alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: secure coding against Improper Neutralization of Leading Special Elements
Matching passage: CWE-160 Improper Neutralization of Leading Special Elements. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes leading special elements that could be interpreted in unexpected ways when they are sent to a downstream component.
Near-miss passage: CWE-657 Violation of Secure Design Principles. The product violates well-established principles for secure design.
Query: write Sigma for Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.
Matching passage: Sigma rule: Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.. Logsource: windows / process_creation. Rule: title: Dumping of Sensitive Hives Via Reg.EXE id: fd877b94-9bb5-4191-bb25-d79cbd93c167 related: - id: 038cd51c-3ad8-41c5-ba8f-5d1c92f3cc1e type: obsolete - id: 4d6c9da1-318b-4edf-bcea-b6c93fa98fd0 type: obsolete status: test description: Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives. references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment - https://eqllib.readthedocs.io/en/latest/analytics/aed95fc6-5e3f-49dc-8b35-06508613f979.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003/T1003.md - https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets author: Teymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community, frack113 date: 2019-10-22 modified: 2023-12-13 tags: - attack.credential-access - attack.t1003.002 - attack.t1003.004 - attack.t1003.005 - car.2013-07-001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_cli_flag: CommandLine|contains: - ' save ' - ' export ' - ' ˢave ' - ' eˣport ' selection_cli_hklm: CommandLine|contains: - hklm - hk˪m - hkey_local_machine - hkey_˪ocal_machine - hkey_loca˪_machine - hkey_˪oca˪_machine selection_cli_hive: CommandLine|contains: - \system - \sam - \security - \ˢystem - \syˢtem - \ˢyˢtem - \ˢam - \ˢecurity condition: all of selection_* falsepositives: - Dumping hives for legitimate purpouse i.e. backup or forensic investigation level: high
Near-miss passage: Sigma rule: Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\. Logsource: windows / file_event. Rule: title: Suspicious Creation with Colorcpl id: e15b518d-b4ce-4410-a9cd-501f23ce4a18 status: test description: Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\ references: - https://twitter.com/eral4m/status/1480468728324231172?s=20 author: frack113 date: 2022-01-21 modified: 2023-01-05 tags: - attack.stealth - attack.t1564 logsource: product: windows category: file_event detection: selection: Image|endswith: \colorcpl.exe filter_ext: TargetFilename|endswith: - .icm - .gmmp - .cdmp - .camp condition: selection and not 1 of filter_* falsepositives: - Unknown level: high
Query: rule covering Detects an appx package deployment / installation with the error code "0x80073cff" which indicates that the package didn
Matching passage: Sigma rule: Detects an appx package deployment / installation with the error code "0x80073cff" which indicates that the package didn. Logsource: windows / appxdeployment-server. Rule: title: AppX Package Deployment Failed Due to Signing Requirements id: 898d5fc9-fbc3-43de-93ad-38e97237c344 status: test description: 'Detects an appx package deployment / installation with the error code "0x80073cff" which indicates that the package didn''t meet the signing requirements. ' references: - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/ - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-11 modified: 2025-12-03 tags: - attack.stealth logsource: product: windows service: appxdeployment-server detection: selection: EventID: 401 ErrorCode: '0x80073cff' condition: selection falsepositives: - Legitimate AppX packages not signed by MS used part of an enterprise. level: medium
Near-miss passage: Sigma rule: Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.. Logsource: windows / process_creation. Rule: title: PUA - Advanced IP Scanner Execution id: bef37fa2-f205-4a7b-b484-0759bfd5f86f status: test description: Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups. references: - https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/ - https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html - https://labs.f-secure.com/blog/prelude-to-ransomware-systembc - https://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf - https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/Advanced%20IP%20Scanner author: Nasreddine Bencherchali (Nextron Systems), @ROxPinTeddy date: 2020-05-12 modified: 2023-02-07 tags: - attack.discovery - attack.t1046 - attack.t1135 logsource: category: process_creation product: windows detection: selection_img: - Image|contains: \advanced_ip_scanner - OriginalFileName|contains: advanced_ip_scanner - Description|contains: Advanced IP Scanner selection_cli: CommandLine|contains|all: - /portable - /lng condition: 1 of selection_* falsepositives: - Legitimate administrative use level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advanced_ip_scanner/info.yml
Query: risk of Cross-site request forgery (CSRF) vulnerability in Cisco Headend Digital Broadband Delivery System allows remote attackers to hijack the authentication of arbitrary users.
Matching passage: CVE-2015-0759. CWE: CWE-20. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco Headend Digital Broadband Delivery System allows remote attackers to hijack the authentication of arbitrary users.
Near-miss passage: CVE-2015-1302. CWE: CWE-20. CVSS: 7.5. The PDF viewer in Google Chrome before 46.0.2490.86 does not properly restrict scripting messages and API exposure, which allows remote attackers to bypass the Same Origin Policy via an unintended embedder or unintended plugin loading, related to pdf.js and out_of_process_instance.cc.
Query: CVE similar to CVE-2015-9137
Matching passage: CVE-2015-9137. CWE: CWE-19. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, several EFS2 DIAG command handlers are not calling fs_diag_access_check().
Near-miss passage: CVE-2015-0854. CWE: CWE-19. CVSS: 7.800000190734863. App/HelperFunctions.pm in Shutter through 0.93.1 allows user-assisted remote attackers to execute arbitrary commands via a crafted image name that is mishandled during a "Show in Folder" action.
Query: exploit Heap-based buffer overflow in the ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving a command 
Matching passage: CVE-2015-5522. CWE: CWE-119. CVSS: 6.800000190734863. Heap-based buffer overflow in the ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving a command character in an href.
Near-miss passage: CVE-2015-4143. CWE: CWE-119. CVSS: 5.0. The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload.
Query: detect Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE- in logs
Matching passage: Sigma rule: Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-. Logsource: windows / process_creation. Rule: title: Terminal Service Process Spawn id: 1012f107-b8f1-4271-af30-5aed2de89b39 status: test description: Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708) references: - https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708/ author: Florian Roth (Nextron Systems) date: 2019-05-22 modified: 2023-01-25 tags: - attack.initial-access - attack.t1190 - attack.lateral-movement - attack.t1210 - car.2013-07-002 logsource: product: windows category: process_creation detection: selection: ParentCommandLine|contains|all: - \svchost.exe - termsvcs filter_img: Image|endswith: - \rdpclip.exe - :\Windows\System32\csrss.exe - :\Windows\System32\wininit.exe - :\Windows\System32\winlogon.exe filter_null: Image: null condition: selection and not 1 of filter_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects default PsExec service filename which indicates PsExec service installation and execution. Logsource: windows / file_event. Rule: title: PsExec Service File Creation id: 259e5a6a-b8d2-4c38-86e2-26c5e651361d related: - id: 42c575ea-e41e-41f1-b248-8093c3e82a28 type: derived status: test description: Detects default PsExec service filename which indicates PsExec service installation and execution references: - https://www.jpcert.or.jp/english/pub/sr/ir_research.html - https://jpcertcc.github.io/ToolAnalysisResultSheet author: Thomas Patzke date: 2017-06-12 modified: 2022-10-26 tags: - attack.execution - attack.t1569.002 - attack.s0029 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: \PSEXESVC.exe condition: selection falsepositives: - Unknown level: low
Query: rule covering Detects possible Sysmon filter driver unloaded via fltmc.exe
Matching passage: Sigma rule: Detects possible Sysmon filter driver unloaded via fltmc.exe. Logsource: windows / process_creation. Rule: title: Sysmon Driver Unloaded Via Fltmc.EXE id: 4d7cda18-1b12-4e52-b45c-d28653210df8 related: - id: 4931188c-178e-4ee7-a348-39e8a7a56821 type: similar status: test description: Detects possible Sysmon filter driver unloaded via fltmc.exe references: - https://www.darkoperator.com/blog/2018/10/5/operating-offensively-against-sysmon author: Kirill Kiryanov, oscd.community date: 2019-10-23 modified: 2023-02-13 tags: - attack.stealth - attack.defense-impairment - attack.t1070 - attack.t1685 - attack.t1685.001 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \fltMC.exe - OriginalFileName: fltMC.exe selection_cli: CommandLine|contains|all: - unload - sysmon condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's locat. Logsource: windows / process_creation. Rule: title: Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script id: 236d8e89-ed95-4789-a982-36f4643738ba related: - id: 7aa4e81a-a65c-4e10-9f81-b200eb229d7d type: derived status: test description: Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state references: - https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-14 tags: - attack.execution - attack.persistence - attack.t1059 logsource: category: process_creation product: windows detection: selection_bin_img: - Image|endswith: \VMwareToolBoxCmd.exe - OriginalFileName: toolbox-cmd.exe selection_bin_cli: CommandLine|contains|all: - ' script ' - ' set ' selection_susp_paths: CommandLine|contains: - :\PerfLogs\ - :\Temp\ - :\Windows\System32\Tasks\ - :\Windows\Tasks\ - :\Windows\Temp\ - \AppData\Local\Temp condition: all of selection_* falsepositives: - Unknown level: high
Query: vulnerability: phpMyBackupPro 2.5 and earlier does not properly sanitize input strings, which allows remote authenticated users to execute arbitrary PHP code by storing a crafted string in a user
Matching passage: CVE-2015-3639. CWE: CWE-20. CVSS: 8.800000190734863. phpMyBackupPro 2.5 and earlier does not properly sanitize input strings, which allows remote authenticated users to execute arbitrary PHP code by storing a crafted string in a user configuration file.
Near-miss passage: CVE-2015-8727. CWE: CWE-20. CVSS: 5.5. The dissect_rsvp_common function in epan/dissectors/packet-rsvp.c in the RSVP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not properly maintain request-key data, which allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted packet.
Query: indicators of Search Closed Sources
Matching passage: T1597 Search Closed Sources. Tactics: reconnaissance. Description: Adversaries may search and gather information about victims from closed (e.g., paid, private, or otherwise not freely available) sources that can be used during targeting. Information about victims may be available for purchase from reputable private sources and databases, such as paid subscriptions to feeds of technical/threat intelligence data. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets.(Citation: ZDNET Selling Data) Adversaries may search in different closed databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
Near-miss passage: T1597.002 Purchase Technical Data. Tactics: reconnaissance. Description: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure.(Citation: ZDNET Selling Data) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
Query: alert when Uses PowerShell to install/copy a file into a system directory such as "System32" or "SysWOW64"
Matching passage: Sigma rule: Uses PowerShell to install/copy a file into a system directory such as "System32" or "SysWOW64". Logsource: windows / ps_script. Rule: title: Powershell Install a DLL in System Directory id: 63bf8794-9917-45bc-88dd-e1b5abc0ecfd status: test description: Uses PowerShell to install/copy a file into a system directory such as "System32" or "SysWOW64" references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1556.002/T1556.002.md#atomic-test-1---install-and-register-password-filter-dll author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-12-27 modified: 2024-01-22 tags: - attack.persistence - attack.credential-access - attack.defense-impairment - attack.t1556.002 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|re: (Copy-Item|cpi) .{2,128} -Destination .{1,32}\\Windows\\(System32|SysWOW64) condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh. Logsource: linux / process_creation. Rule: title: Execution Of Script Located In Potentially Suspicious Directory id: 30bcce26-51c5-49f2-99c8-7b59e3af36c7 status: test description: Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh", etc. references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.execution logsource: product: linux category: process_creation detection: selection_img: Image|endswith: - /bash - /csh - /dash - /fish - /ksh - /sh - /zsh selection_flag: CommandLine|contains: ' -c ' selection_paths: CommandLine|contains: /tmp/ condition: all of selection_* falsepositives: - Unknown level: medium
Query: detect Detects usage of base64 utility to decode arbitrary base64-encoded text in logs
Matching passage: Sigma rule: Detects usage of base64 utility to decode arbitrary base64-encoded text. Logsource: macos / process_creation. Rule: title: Decode Base64 Encoded Text -MacOs id: 719c22d7-c11a-4f2c-93a6-2cfdd5412f68 status: test description: Detects usage of base64 utility to decode arbitrary base64-encoded text references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2022-11-26 tags: - attack.stealth - attack.t1027 logsource: category: process_creation product: macos detection: selection: Image: /usr/bin/base64 CommandLine|contains: -d condition: selection falsepositives: - Legitimate activities level: low
Near-miss passage: Sigma rule: Detects suspicious powershell command line parameters used in Empire. Logsource: windows / process_creation. Rule: title: HackTool - Empire PowerShell Launch Parameters id: 79f4ede3-402e-41c8-bc3e-ebbf5f162581 status: test description: Detects suspicious powershell command line parameters used in Empire references: - https://github.com/EmpireProject/Empire/blob/c2ba61ca8d2031dad0cfc1d5770ba723e8b710db/lib/common/helpers.py#L165 - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/lib/modules/powershell/persistence/powerbreach/deaduser.py#L191 - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/lib/modules/powershell/persistence/powerbreach/resolver.py#L178 - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-EventVwrBypass.ps1#L64 author: Florian Roth (Nextron Systems) date: 2019-04-20 modified: 2023-02-21 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - ' -NoP -sta -NonI -W Hidden -Enc ' - ' -noP -sta -w 1 -enc ' - ' -NoP -NonI -W Hidden -enc ' - ' -noP -sta -w 1 -enc' - ' -enc SQB' - ' -nop -exec bypass -EncodedCommand ' condition: selection falsepositives: - Other tools that incidentally use the same command line parameters level: high
Query: CWE for Improperly Implemented Security Check for Standard
Matching passage: CWE-358 Improperly Implemented Security Check for Standard. The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.
Near-miss passage: CWE-1024 Comparison of Incompatible Types. The product performs a comparison between two entities, but the entities are of different, incompatible types that cannot be guaranteed to provide correct results when they are directly compared.
Query: risk of The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs.
Matching passage: CVE-2015-0266. CWE: CWE-264. CVSS: 7.099999904632568. The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs.
Near-miss passage: CVE-2015-6335. CWE: CWE-264. CVSS: 9.0. The policy implementation in Cisco FireSIGHT Management Center 5.3.1.7, 5.4.0.4, and 6.0.0 for VMware allows remote authenticated administrators to bypass intended policy restrictions and execute Linux commands as root via unspecified vectors, aka Bug ID CSCuw12839.
Query: Lateral movement indicators for Service Execution
Matching passage: T1569.002 Service Execution. Tactics: execution. Description: Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and [Net](https://attack.mitre.org/software/S0039). [PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals) Tools such as [PsExec](https://attack.mitre.org/software/S0029) and <code>sc.exe</code> can accept remote servers as arguments and may be used to conduct remote execution. Adversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.
Near-miss passage: T1569 System Services. Tactics: execution. Description: Adversaries may abuse system services or daemons to execute commands or programs. Adversaries can execute malicious content by interacting with or creating services either locally or remotely. Many services are set to run at boot, which can aid in achieving persistence ([Create or Modify System Process](https://attack.mitre.org/techniques/T1543)), but adversaries can also abuse services for one-time or temporary execution.