alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / file_delete
Matching passage: Sigma rule: Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic ev. Logsource: windows / file_delete. Rule: title: Exchange PowerShell Cmdlet History Deleted id: a55349d8-9588-4c5a-8e3b-1925fe2a4ffe status: test description: Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence references: - https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-26 modified: 2022-12-30 tags: - attack.stealth - attack.t1070 logsource: category: file_delete product: windows detection: selection: TargetFilename|startswith: \Logging\CmdletInfra\LocalPowerShell\Cmdlet\ TargetFilename|contains: _Cmdlet_ condition: selection falsepositives: - Possible FP during log rotation level: high
Near-miss passage: Sigma rule: Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs. Logsource: windows / image_load. Rule: title: HackTool - SharpEvtMute DLL Load id: 49329257-089d-46e6-af37-4afce4290685 related: - id: bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c type: similar status: test description: Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs references: - https://github.com/bats3c/EvtMute author: Florian Roth (Nextron Systems) date: 2022-09-07 modified: 2024-11-23 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: image_load product: windows detection: selection: Hashes|contains: IMPHASH=330768A4F172E10ACB6287B87289D83B condition: selection falsepositives: - Other DLLs with the same Imphash level: high
Query: SIEM correlation: persistence activity consistent with Logon Script (Windows)
Matching passage: T1037.001 Logon Script (Windows). Tactics: persistence, privilege escalation. Description: Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.(Citation: TechNet Logon Scripts) This is done via adding a path to a script to the <code>HKCU\Environment\UserInitMprLogonScript</code> Registry key.(Citation: Hexacorn Logon Scripts) Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
Near-miss passage: T1037.002 Login Hook. Tactics: persistence, privilege escalation. Description: Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that points to a specific script to execute with root privileges upon user logon. The plist file is located in the <code>/Library/Preferences/com.apple.loginwindow.plist</code> file and can be modified using the <code>defaults</code> command-line utility. This behavior is the same for logout hooks where a script can be executed upon user logout. All hooks require administrator permissions to modify or create hooks.(Citation: Login Scripts Apple Dev)(Citation: LoginWindowScripts Apple Dev) Adversaries can add or insert a path to a malicious script in the <code>com.apple.loginwindow.plist</code> file, using the <code>LoginHook</code> or <code>LogoutHook</code> key-value pair. The malicious script is executed upon the next user login. If a login hook already exists, adversaries can add additional commands to an existing login hook. There can be only one login and logout hook on a system at a time.(Citation: S1 macOs Persistence)(Citation: Wardle Persistence Chapter) **Note:** Login hooks were deprecated in 10.11 version of macOS in favor of [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001)
Query: vulnerability: The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.
Matching passage: CVE-2015-9322. CWE: CWE-352. CVSS: 8.800000190734863. The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.
Near-miss passage: CVE-2015-1568. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the GD Infinite Scroll module before 7.x-1.4 for Drupal allows remote attackers to hijack the authentication of users with the "edit gd infinite scroll settings" permission for requests that delete settings via unspecified vectors.
Query: vulnerability: SAP Content Server allows remote attackers to cause a denial of service (service termination) via unspecified vectors, aka SAP Security Note 2127995.
Matching passage: CVE-2015-4157. CWE: UNKNOWN. CVSS: 5.0. SAP Content Server allows remote attackers to cause a denial of service (service termination) via unspecified vectors, aka SAP Security Note 2127995.
Near-miss passage: CVE-2015-4769. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Firewall, a different vulnerability than CVE-2015-4767.
Query: alert when Detects potential DLL sideloading of "dbghelp.dll"
Matching passage: Sigma rule: Detects potential DLL sideloading of "dbghelp.dll". Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of DBGHELP.DLL id: 6414b5cd-b19d-447e-bb5e-9f03940b5784 status: test description: Detects potential DLL sideloading of "dbghelp.dll" references: - https://hijacklibs.net/ author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) date: 2022-10-25 modified: 2025-10-07 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \dbghelp.dll filter_main_generic: ImageLoaded|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SystemTemp\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_optional_anaconda: ImageLoaded|endswith: - \Anaconda3\Lib\site-packages\vtrace\platforms\windll\amd64\dbghelp.dll - \Anaconda3\Lib\site-packages\vtrace\platforms\windll\i386\dbghelp.dll filter_optional_epicgames: ImageLoaded|endswith: - \Epic Games\Launcher\Engine\Binaries\ThirdParty\DbgHelp\dbghelp.dll - \Epic Games\MagicLegends\x86\dbghelp.dll filter_optional_opera: ImageLoaded|contains: opera\Opera Installer Temp\opera_package ImageLoaded|endswith: \assistant\dbghelp.dll condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate applications loading their own versions of the DLL mentioned in this rule level: medium
Near-miss passage: Sigma rule: Detects blocking of process creations originating from PSExec and WMI commands. Logsource: windows / windefend. Rule: title: PSExec and WMI Process Creations Block id: 97b9ce1e-c5ab-11ea-87d0-0242ac130003 status: test description: Detects blocking of process creations originating from PSExec and WMI commands references: - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#block-process-creations-originating-from-psexec-and-wmi-commands - https://twitter.com/duff22b/status/1280166329660497920 author: Bhabesh Raj date: 2020-07-14 modified: 2022-12-25 tags: - attack.execution - attack.lateral-movement - attack.t1047 - attack.t1569.002 logsource: product: windows service: windefend definition: 'Requirements:Enabled Block process creations originating from PSExec and WMI commands from Attack Surface Reduction (GUID: d1e49aac-8f56-4280-b9ba-993a6d77406c)' detection: selection: EventID: 1121 ProcessName|endswith: - \wmiprvse.exe - \psexesvc.exe condition: selection falsepositives: - Unknown level: high
Query: exploit The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted "KOD" messages.
Matching passage: CVE-2015-7704. CWE: CWE-20. CVSS: 7.5. The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted "KOD" messages.
Near-miss passage: CVE-2015-2081. CWE: CWE-20. CVSS: 9.800000190734863. Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts.
Query: alert when Detects disabling of the "Automatic Sample Submission" feature of Windows Defender.
Matching passage: Sigma rule: Detects disabling of the "Automatic Sample Submission" feature of Windows Defender.. Logsource: windows / windefend. Rule: title: Windows Defender Submit Sample Feature Disabled id: 91903aba-1088-42ee-b680-d6d94fe002b0 related: - id: 1321dc4e-a1fe-481d-a016-52c45f0c8b4f type: similar - id: a3ab73f1-bd46-4319-8f06-4b20d0617886 type: similar - id: 801bd44f-ceed-4eb6-887c-11544633c0aa type: similar status: stable description: Detects disabling of the "Automatic Sample Submission" feature of Windows Defender. references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide - https://bidouillesecurity.com/disable-windows-defender-in-powershell/#DisableAntiSpyware author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-06 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: 5007 NewValue|contains: \Real-Time Protection\SubmitSamplesConsent = 0x0 condition: selection falsepositives: - Administrator activity (must be investigated) level: low
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer). Logsource: windows / image_load. Rule: title: Potential Iviewers.DLL Sideloading id: 4c21b805-4dd7-469f-b47d-7383a8fcb437 status: test description: Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer) references: - https://www.secureworks.com/research/shadowpad-malware-analysis author: X__Junior (Nextron Systems) date: 2023-03-21 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \iviewers.dll filter: ImageLoaded|startswith: - C:\Program Files (x86)\Windows Kits\ - C:\Program Files\Windows Kits\ condition: selection and not filter falsepositives: - Unknown level: high
Query: exploit updater.exe in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows allows local users to write to arbitrary files by conducting a junction attack and waiting fo
Matching passage: CVE-2015-4505. CWE: CWE-264. CVSS: 6.599999904632568. updater.exe in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows allows local users to write to arbitrary files by conducting a junction attack and waiting for an update operation by the Mozilla Maintenance Service.
Near-miss passage: CVE-2015-7875. CWE: CWE-264. CVSS: 7.5. ctools 6.x-1.x before 6.x-1.14 and 7.x-1.x before 7.x-1.8 in Drupal does not verify the "edit" permission for the "content type" plugins that are used on Panels and similar systems to place content and functionality on a page.
Query: mitigate Remote Desktop Software
Matching passage: T1219.002 Remote Desktop Software. Tactics: command and control. Description: An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) Remote access modules/features may also exist as part of otherwise existing software such as Zoom or Google Chrome’s Remote Desktop.(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)
Near-miss passage: T1219.001 IDE Tunneling. Tactics: command and control. Description: Adversaries may abuse Integrated Development Environment (IDE) software with remote development features to establish an interactive command and control channel on target systems within a network. IDE tunneling combines SSH, port forwarding, file sharing, and debugging into a single secure connection, letting developers work on remote systems as if they were local. Unlike SSH and port forwarding, IDE tunneling encapsulates an entire session and may use proprietary tunneling protocols alongside SSH, allowing adversaries to blend in with legitimate development workflows. Some IDEs, like Visual Studio Code, also provide CLI tools (e.g., `code tunnel`) that adversaries may use to programmatically establish tunnels and generate web-accessible URLs for remote access. These tunnels can be authenticated through accounts such as GitHub, enabling the adversary to control the compromised system via a legitimate developer portal.(Citation: sentinelone operationDigitalEye Dec 2024)(Citation: Unit42 Chinese VSCode 06 September 2024)(Citation: Thornton tutorial VSCode shell September 2023) Additionally, adversaries may use IDE tunneling for persistence. Some IDEs, such as Visual Studio Code and JetBrains, support automatic reconnection. Adversaries may configure the IDE to auto-launch at startup, re-establishing the tunnel upon execution. Compromised developer machines may also be exploited as jump hosts to move further into the network. IDE tunneling tools may be built-in or installed as [IDE Extensions](https://attack.mitre.org/techniques/T1176/002).
Query: describe CVE-2015-0814
Matching passage: CVE-2015-0814. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Near-miss passage: CVE-2015-4880. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 allows remote attackers to affect integrity via unknown vectors related to Content Server, a different vulnerability than CVE-2015-4867.
Query: write Sigma for Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be
Matching passage: Sigma rule: Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be. Logsource: windows / registry_set. Rule: title: Potential Persistence Via MyComputer Registry Keys id: 8fbe98a8-8f9d-44f8-aa71-8c572e29ef06 status: test description: Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example) references: - https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-09 modified: 2024-01-11 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Windows\CurrentVersion\Explorer\MyComputer TargetObject|endswith: (Default) condition: selection falsepositives: - Unlikely but if you experience FPs add specific processes and locations you would like to monitor for level: high
Near-miss passage: Sigma rule: Detects execution of msdt.exe using the "cab" flag which could indicates suspicious diagcab files with embedded answer f. Logsource: windows / process_creation. Rule: title: Suspicious Cabinet File Execution Via Msdt.EXE id: dc4576d4-7467-424f-9eee-fd2b02855fe0 related: - id: 6545ce61-a1bd-4119-b9be-fcbee42c0cf3 type: obsolete status: test description: Detects execution of msdt.exe using the "cab" flag which could indicates suspicious diagcab files with embedded answer files leveraging CVE-2022-30190 references: - https://twitter.com/nas_bench/status/1537896324837781506 - https://github.com/GossiTheDog/ThreatHunting/blob/e85884abbf05d5b41efc809ea6532b10b45bd05c/AdvancedHuntingQueries/DogWalk-DiagCab - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-9015912909545e72ed42cbac4d1e96295e8964579c406d23fd9c47a8091576a0 - https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd author: Nasreddine Bencherchali (Nextron Systems), GossiTheDog, frack113 date: 2022-06-21 modified: 2024-03-13 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \msdt.exe - OriginalFileName: msdt.exe selection_cmd: CommandLine|contains|windash: ' -cab ' condition: all of selection_* falsepositives: - Legitimate usage of ".diagcab" files level: medium
Query: risk of Soreco Xpert.Line 3.0 allows local users to spoof users and consequently gain privileges by intercepting a Windows API call.
Matching passage: CVE-2015-3442. CWE: CWE-287. CVSS: 9.800000190734863. Soreco Xpert.Line 3.0 allows local users to spoof users and consequently gain privileges by intercepting a Windows API call.
Near-miss passage: CVE-2015-2117. CWE: CWE-287. CVSS: 7.5. HP TippingPoint Security Management System (SMS) and TippingPoint Virtual Security Management System (vSMS) before 4.1 patch 3 and 4.2 before patch 1 do not require authentication for JBoss RMI requests, which allows remote attackers to execute arbitrary code by (1) uploading this code within an archive or (2) instantiating a class.
Query: mitigate Windows Remote Management
Matching passage: T1021.006 Windows Remote Management. Tactics: lateral movement. Description: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services).(Citation: Microsoft WinRM) It may be called with the `winrm` command or by any number of programs such as PowerShell.(Citation: Jacobsen 2014) WinRM can be used as a method of remotely interacting with [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).(Citation: MSDN WMI)
Near-miss passage: T1021.005 VNC. Tactics: lateral movement. Description: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely control machines using Virtual Network Computing (VNC). VNC is a platform-independent desktop sharing system that uses the RFB (“remote framebuffer”) protocol to enable users to remotely control another computer’s display by relaying the screen, mouse, and keyboard inputs over the network.(Citation: The Remote Framebuffer Protocol) VNC differs from [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) as VNC is screen-sharing software rather than resource-sharing software. By default, VNC uses the system's authentication, but it can be configured to use credentials specific to VNC.(Citation: MacOS VNC software for Remote Desktop)(Citation: VNC Authentication) Adversaries may abuse VNC to perform malicious actions as the logged-on user such as opening documents, downloading files, and running arbitrary commands. An adversary could use VNC to remotely control and monitor a system to collect data and information to pivot to other systems within the network. Specific VNC libraries/implementations have also been susceptible to brute force attacks and memory usage exploitation.(Citation: Hijacking VNC)(Citation: macOS root VNC login without authentication)(Citation: VNC Vulnerabilities)(Citation: Offensive Security VNC Authentication Check)(Citation: Attacking VNC Servers PentestLab)(Citation: Havana authentication bug)
Query: risk of Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Ex
Matching passage: CVE-2015-2406. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2385, CVE-2015-2390, CVE-2015-2397, CVE-2015-2404, and CVE-2015-2422.
Near-miss passage: CVE-2015-3667. CWE: CWE-119. CVSS: 6.800000190734863. QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3661, CVE-2015-3662, CVE-2015-3663, CVE-2015-3666, and CVE-2015-3668.
Query: risk of Cross-site scripting (XSS) vulnerability in the Shibboleth authentication module 6.x-4.x before 6.x-4.2 and 7.x-4.x before 7.x-4.2 for Drupal allows remote authenticated users with
Matching passage: CVE-2015-5513. CWE: CWE-79. CVSS: 2.0999999046325684. Cross-site scripting (XSS) vulnerability in the Shibboleth authentication module 6.x-4.x before 6.x-4.2 and 7.x-4.x before 7.x-4.2 for Drupal allows remote authenticated users with the "Administer blocks" permission to inject arbitrary web script or HTML via unspecified vectors related to a login link.
Near-miss passage: CVE-2015-2347. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote attackers to inject arbitrary web script or HTML via the command XML element in the req parameter to flexdata.action in (1) common/, (2) monitor/, or (3) psnpm/ or the (4) module XML element in the req parameter to flexdata.action in monitor/.
Query: containment actions for Persistence mechanism resembling Traffic Signaling
Matching passage: Playbook for T1205 Traffic Signaling. 1) Validate alert telemetry against T1205. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth, persistence, command and control. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control. Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task. This may take the form of sending a series of packets with certain characterist
Near-miss passage: Playbook for T1205.001 Port Knocking. Different response path focused on stealth, persistence, command and control.