alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects a ping command that uses a hex encoded IP address
Matching passage: Sigma rule: Detects a ping command that uses a hex encoded IP address. Logsource: windows / process_creation. Rule: title: Ping Hex IP id: 1a0d4aba-7668-4365-9ce4-6d79ab088dfd status: test description: Detects a ping command that uses a hex encoded IP address references: - https://github.com/vysecurity/Aggressor-VYSEC/blob/0d61c80387b9432dab64b8b8a9fb52d20cfef80e/ping.cna - https://twitter.com/vysecurity/status/977198418354491392 author: Florian Roth (Nextron Systems) date: 2018-03-23 modified: 2025-10-17 tags: - attack.stealth - attack.t1140 - attack.t1027 logsource: category: process_creation product: windows detection: selection: Image|endswith: \ping.exe CommandLine|re: 0x[a-fA-F0-9]{8} condition: selection falsepositives: - Unlikely, because no sane admin pings IP addresses in a hexadecimal form level: high
Near-miss passage: Sigma rule: Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.. Logsource: windows / process_creation. Rule: title: Renamed PingCastle Binary Execution id: 2433a154-bb3d-42e4-86c3-a26bdac91c45 status: test description: Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields. references: - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/ - https://www.pingcastle.com/documentation/scanner/ author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) date: 2024-01-11 tags: - attack.execution - attack.stealth - attack.t1059 - attack.t1202 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: - PingCastleReporting.exe - PingCastleCloud.exe - PingCastle.exe - CommandLine|contains: - --scanner aclcheck - --scanner antivirus - --scanner computerversion - --scanner foreignusers - --scanner laps_bitlocker - --scanner localadmin - --scanner nullsession - --scanner nullsession-trust - --scanner oxidbindings - --scanner remote - --scanner share - --scanner smb - --scanner smb3querynetwork - --scanner spooler - --scanner startup - --scanner zerologon - CommandLine|contains: --no-enum-limit - CommandLine|contains|all: - --healthcheck - --level Full - CommandLine|contains|all: - --healthcheck - '--server ' filter_main_img: Image|endswith: - \PingCastleReporting.exe - \PingCastleCloud.exe - \PingCastle.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: how to detect Domain Groups
Matching passage: T1069.002 Domain Groups. Tactics: discovery. Description: Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators. Commands such as <code>net group /domain</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscacheutil -q group</code> on macOS, and <code>ldapsearch</code> on Linux can list domain-level groups.
Near-miss passage: T1069 Permission Groups Discovery. Tactics: discovery. Description: Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions. Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.(Citation: CrowdStrike BloodHound April 2018)
Query: stealth using COR_PROFILER
Matching passage: T1574.012 COR_PROFILER. Tactics: stealth, execution. Description: Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profilers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR.(Citation: Microsoft Profiling Mar 2017)(Citation: Microsoft COR_PROFILER Feb 2013) The COR_PROFILER environment variable can be set at various scopes (system, user, or process) resulting in different levels of influence. System and user-wide environment variable scopes are specified in the Registry, where a [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) object can be registered as a profiler DLL. A process scope COR_PROFILER can also be created in-memory without modifying the Registry. Starting with .NET Framework 4, the profiling DLL does not need to be registered as long as the location of the DLL is specified in the COR_PROFILER_PATH environment variable.(Citation: Microsoft COR_PROFILER Feb 2013) Adversaries may abuse COR_PROFILER to establish persistence that executes a malicious DLL in the context of all .NET processes every time the CLR is invoked. The COR_PROFILER can also be used to elevate privileges (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)) if the victim .NET process executes at a higher permission level, as well as to hook and impair defenses provided by .NET processes.(Citation: RedCanary Mockingbird May 2020)(Citation: Red Canary COR_PROFILER May 2020)(Citation: Almond COR_PROFILER Apr 2019)(Citation: GitHub OmerYa Invisi-Shell)(Citation: subTee .NET Profilers May 2017)
Near-miss passage: T1574 Hijack Execution Flow. Tactics: stealth, execution. Description: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.
Query: vulnerability: The png_convert_to_rfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before 1.2.54, and 1.4.x before 1.4.17 allows remote attackers to obtain sensitive process memory 
Matching passage: CVE-2015-7981. CWE: CWE-200. CVSS: 5.0. The png_convert_to_rfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before 1.2.54, and 1.4.x before 1.4.17 allows remote attackers to obtain sensitive process memory information via crafted tIME chunk data in an image file, which triggers an out-of-bounds read.
Near-miss passage: CVE-2015-4929. CWE: CWE-200. CVSS: 4.0. IBM License Metric Tool 9 before 9.2.1.0 and Endpoint Manager for Software Use Analysis 9 before 9.2.1.0 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information via a REST API request.
Query: rule covering Detects WmiPrvSE spawning a process
Matching passage: Sigma rule: Detects WmiPrvSE spawning a process. Logsource: windows / process_creation. Rule: title: WmiPrvSE Spawned A Process id: d21374ff-f574-44a7-9998-4a8c8bf33d7d related: - id: 8a582fe2-0882-4b89-a82a-da6b2dc32937 type: similar - id: 692f0bec-83ba-4d04-af7e-e884a96059b6 type: similar status: stable description: Detects WmiPrvSE spawning a process references: - https://threathunterplaybook.com/hunts/windows/190815-RemoteServiceInstallation/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-08-15 modified: 2023-03-23 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \WmiPrvSe.exe filter_logonid: LogonId: - '0x3e7' - 'null' filter_system_user: User|contains: - AUTHORI - AUTORI filter_wmiprvse: Image|endswith: \WmiPrvSE.exe filter_werfault: Image|endswith: \WerFault.exe filter_null: LogonId: null condition: selection and not 1 of filter_* falsepositives: - False positives are expected (e.g. in environments where WinRM is used legitimately) level: medium
Near-miss passage: Sigma rule: Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attacke. Logsource: windows / process_creation. Rule: title: Insensitive Subfolder Search Via Findstr.EXE id: 04936b66-3915-43ad-a8e5-809eadfd1141 related: - id: bf6c39fc-e203-45b9-9538-05397c1b4f3f type: obsolete status: test description: 'Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Findstr/ - https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/ - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) date: 2020-10-05 modified: 2024-03-05 tags: - attack.credential-access - attack.command-and-control - attack.stealth - attack.t1218 - attack.t1564.004 - attack.t1552.001 - attack.t1105 logsource: category: process_creation product: windows detection: selection_findstr: - CommandLine|contains: findstr - Image|endswith: findstr.exe - OriginalFileName: FINDSTR.EXE selection_cli_search_subfolder: CommandLine|contains|windash: ' -s ' selection_cli_search_insensitive: CommandLine|contains|windash: ' -i ' condition: selection_findstr and all of selection_cli_search_* falsepositives: - Administrative or software activity level: low
Query: Sigma rule for Detects Obfuscated use of stdin to execute PowerShell
Matching passage: Sigma rule: Detects Obfuscated use of stdin to execute PowerShell. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation STDIN+ Launcher - PowerShell Module id: 9ac8b09b-45de-4a07-9da1-0de8c09304a3 related: - id: 779c8c12-0eb1-11eb-adc1-0242ac120002 type: derived status: test description: Detects Obfuscated use of stdin to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|re: cmd.{0,5}(?:/c|/r).+powershell.+(?:\$\{?input\}?|noexit).+" condition: selection_4103 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detect set DisallowRun to 1 to prevent user running specific computer program. Logsource: windows / registry_set. Rule: title: Add DisallowRun Execution to Registry id: 275641a5-a492-45e2-a817-7c81e9d9d3e9 status: test description: Detect set DisallowRun to 1 to prevent user running specific computer program references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md author: frack113 date: 2022-08-19 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: medium
Query: vulnerability: Cross-site request forgery (CSRF) vulnerability in the OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Import module is enabled, allows remote attackers to hijack the au
Matching passage: CVE-2015-7233. CWE: CWE-352. CVSS: 5.099999904632568. Cross-site request forgery (CSRF) vulnerability in the OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Import module is enabled, allows remote attackers to hijack the authentication of administrators for requests that create new OSF datasets via unspecified vectors.
Near-miss passage: CVE-2015-2089. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the CrossSlide jQuery (crossslide-jquery-plugin-for-wordpress) plugin 2.0.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2) csj_width, (3) csj_height, (4) csj_sleep, (5) csj_fade, or (6) upload_image parameter in the thisismyurl_csj.php page to wp-admin/options-general.php.
Query: patch priority for CVE-2015-4224
Matching passage: CVE-2015-4224. CWE: CWE-78. CVSS: 7.199999809265137. Cisco Wireless LAN Controller (WLC) devices with software 7.0(240.0) allow local users to execute arbitrary OS commands in a privileged context via crafted CLI commands, aka Bug ID CSCuj39474.
Near-miss passage: CVE-2015-5690. CWE: CWE-78. CVSS: 8.5. The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands by leveraging a "redirect."
Query: vulnerability: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, A
Matching passage: CVE-2015-7635. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.
Near-miss passage: CVE-2015-0331. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0313, CVE-2015-0315, CVE-2015-0320, and CVE-2015-0322.
Query: adversary uses Private Keys
Matching passage: T1552.004 Private Keys. Tactics: credential access. Description: Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures.(Citation: Wikipedia Public Key Crypto) Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc. Adversaries may also look in common key directories, such as <code>~/.ssh</code> for SSH keys on * nix-based systems or <code>C:&#92;Users&#92;(username)&#92;.ssh&#92;</code> on Windows. Adversary tools may also search compromised systems for file extensions relating to cryptographic keys and certificates.(Citation: Kaspersky Careto)(Citation: Palo Alto Prince of Persia) When a device is registered to Entra ID, a device key and a transport key are generated and used to verify the device’s identity.(Citation: Microsoft Primary Refresh Token) An adversary with access to the device may be able to export the keys in order to impersonate the device.(Citation: AADInternals Azure AD Device Identities) On network devices, private keys may be exported via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `crypto pki export`.(Citation: cisco_deploy_rsa_keys) Some private keys require a password or passphrase for operation, so an adversary may also use [Input Capture](https://attack.mitre.org/techniques/T1056) for keylogging or attempt to [Brute Force](https://attack.mitre.org/techniques/T1110) the passphrase off-line. These private keys can be used to authenticate to [Remote Services](https://attack.mitre.org/techniques/T1021) like SSH or for use in decrypting other collected files such as email.
Near-miss passage: T1552.007 Container API. Tactics: credential access. Description: Adversaries may gather credentials via APIs within a containers environment. APIs in these environments, such as the Docker API and Kubernetes APIs, allow a user to remotely manage their container resources and cluster components.(Citation: Docker API)(Citation: Kubernetes API) An adversary may access the Docker API to collect logs that contain credentials to cloud, container, and various other resources in the environment.(Citation: Unit 42 Unsecured Docker Daemons) An adversary with sufficient permissions, such as via a pod's service account, may also use the Kubernetes API to retrieve credentials from the Kubernetes API server. These credentials may include those needed for Docker API authentication or secrets from Kubernetes cluster components.
Query: risk of Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014, when transactional replication is configured, does not prevent use of uninitialized memory i
Matching passage: CVE-2015-1762. CWE: CWE-74. CVSS: 7.099999904632568. Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014, when transactional replication is configured, does not prevent use of uninitialized memory in unspecified function calls, which allows remote authenticated users to execute arbitrary code by leveraging certain permissions and making a crafted query, as demonstrated by the VIEW SERVER STATE permission, aka "SQL Server Remote Code Execution Vulnerability."
Near-miss passage: CVE-2015-5841. CWE: CWE-74. CVSS: 5.0. The CFNetwork Proxies component in Apple iOS before 9 does not properly handle a Set-Cookie header within a response to an HTTP CONNECT request, which allows remote proxy servers to conduct cookie-injection attacks via a crafted response.
Query: vulnerability: SQL injection vulnerability in cygnux.org sysPass 1.0.9 and earlier allows remote authenticated users to execute arbitrary SQL commands via the search parameter to ajax/ajax_search
Matching passage: CVE-2015-6516. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in cygnux.org sysPass 1.0.9 and earlier allows remote authenticated users to execute arbitrary SQL commands via the search parameter to ajax/ajax_search.php.
Near-miss passage: CVE-2015-4222. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in Cisco Unified Communications Manager IM and Presence Service 9.1(1) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuq46325.
Query: detection rule: Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitra
Matching passage: Sigma rule: Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitra. Logsource: windows / image_load. Rule: title: Potential Mfdetours.DLL Sideloading id: d2605a99-2218-4894-8fd3-2afb7946514d status: test description: Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution. references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-03 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \mfdetours.dll filter_main_legit_path: ImageLoaded|contains: :\Program Files (x86)\Windows Kits\10\bin\ condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin". Logsource: windows / process_creation. Rule: title: Sensitive File Recovery From Backup Via Wbadmin.EXE id: 84972c80-251c-4c3a-9079-4f00aad93938 related: - id: 6fe4aa1e-0531-4510-8be2-782154b73b48 type: derived status: test description: 'Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information. ' references: - https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml - https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/ - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2024-05-10 tags: - attack.credential-access - attack.t1003.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wbadmin.exe - OriginalFileName: WBADMIN.EXE selection_backup: CommandLine|contains|all: - ' recovery' - recoveryTarget - itemtype:File CommandLine|contains: - \config\SAM - \config\SECURITY - \config\SYSTEM - \Windows\NTDS\NTDS.dit condition: all of selection_* falsepositives: - Unknown level: high