alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects execution of the Kernel Driver Utility (KDU) tool. KDU can be used to bypass driver signature enforcement and lo
Matching passage: Sigma rule: Detects execution of the Kernel Driver Utility (KDU) tool. KDU can be used to bypass driver signature enforcement and lo. Logsource: windows / process_creation. Rule: title: PUA - Kernel Driver Utility (KDU) Execution id: e76ca062-4de0-4d79-8d90-160a0d335eca status: experimental description: 'Detects execution of the Kernel Driver Utility (KDU) tool. KDU can be used to bypass driver signature enforcement and load unsigned or malicious drivers into the Windows kernel. Potentially allowing for privilege escalation, persistence, or evasion of security controls. ' references: - https://github.com/h4rmy/KDU - https://huntress.com/blog/esxi-vm-escape-exploit author: Matt Anderson, Dray Agha, Anna Pham (Huntress) date: 2026-01-02 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \kdu.exe - \hamakaze.exe - OriginalFileName: hamakaze.exe selection_cli_suspicious: CommandLine|contains: - '-map ' - '-prv ' - '-dse ' - '-ps ' condition: all of selection_* falsepositives: - Legitimate driver development, testing, or administrative troubleshooting (e.g., enabling/disabling hardware) level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_kdu_driver_tool/info.yml
Near-miss passage: Sigma rule: Detects the use of Windows Credential Editor (WCE). Logsource: windows / registry_event. Rule: title: Windows Credential Editor Registry id: a6b33c02-8305-488f-8585-03cb2a7763f2 status: test description: Detects the use of Windows Credential Editor (WCE) references: - https://www.ampliasecurity.com/research/windows-credentials-editor/ author: Florian Roth (Nextron Systems) date: 2019-12-31 modified: 2021-11-27 tags: - attack.credential-access - attack.t1003.001 - attack.s0005 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: Services\WCESERVICE\Start condition: selection falsepositives: - Unknown level: critical
Query: describe CVE-2015-6482
Matching passage: CVE-2015-6482. CWE: UNKNOWN. CVSS: 5.0. Runtime Toolkit before 2.4.7.48 in 3S-Smart CODESYS before 2.3.9.48 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted request.
Near-miss passage: CVE-2015-2113. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in HP Easy Deploy, as distributed standalone and in HP Easy Tools before 3.0.1.1650, on HP Thin Client t5540, t5740, and t5740e devices and HP Flexible Thin Client t510, t520, t610, t620, and t820 devices allows remote attackers to execute arbitrary code via unknown vectors.
Query: detect Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts in logs
Matching passage: Sigma rule: Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts. Logsource: windows / process_creation. Rule: title: Suspicious Child Process Created as System id: 590a5f4c-6c8c-4f10-8307-89afe9453a9d status: test description: Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment - https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/ - https://github.com/antonioCoco/RogueWinRM - https://twitter.com/Cyb3rWard0g/status/1453123054243024897 author: Teymur Kheirkhabarov, Roberto Rodriguez (@Cyb3rWard0g), Open Threat Research (OTR) date: 2019-10-26 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.002 logsource: category: process_creation product: windows definition: 'Requirements: ParentUser field needs sysmon >= 13.30' detection: selection: ParentUser|contains: - AUTHORI - AUTORI ParentUser|endswith: - \NETWORK SERVICE - \LOCAL SERVICE User|contains: - AUTHORI - AUTORI User|endswith: - \SYSTEM - \Système - \СИСТЕМА IntegrityLevel: - System - S-1-16-16384 filter_rundll32: Image|endswith: \rundll32.exe CommandLine|contains: DavSetCookie condition: selection and not 1 of filter_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects changes to the AppInstaller (winget) policy. Specifically the activation of the local manifest installation, whi. Logsource: windows / registry_set. Rule: title: Enable Local Manifest Installation With Winget id: fa277e82-9b78-42dd-b05c-05555c7b6015 status: test description: Detects changes to the AppInstaller (winget) policy. Specifically the activation of the local manifest installation, which allows a user to install new packages via custom manifests. references: - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-17 modified: 2023-08-17 tags: - attack.persistence - attack.stealth logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: \AppInstaller\EnableLocalManifestFiles Details: DWORD (0x00000001) condition: selection falsepositives: - Administrators or developers might enable this for testing purposes or to install custom private packages level: medium
Query: write Sigma for Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may
Matching passage: Sigma rule: Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may. Logsource: windows / process_creation. Rule: title: Changing Existing Service ImagePath Value Via Reg.EXE id: 9b0b7ac3-6223-47aa-a3fd-e8f211e637db status: test description: 'Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-2---service-imagepath-change-with-regexe author: frack113 date: 2021-12-30 modified: 2024-03-13 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.011 logsource: category: process_creation product: windows detection: selection: Image|endswith: \reg.exe CommandLine|contains|all: - 'add ' - SYSTEM\CurrentControlSet\Services\ - ' ImagePath ' selection_value: CommandLine|contains|windash: ' -d ' condition: all of selection* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.. Logsource: windows / image_load. Rule: title: VMGuestLib DLL Sideload id: 70e8e9b4-6a93-4cb7-8cde-da69502e7aff status: test description: Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service. references: - https://decoded.avast.io/martinchlumecky/png-steganography/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-01 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|contains|all: - \VMware\VMware Tools\vmStatsProvider\win32 - \vmGuestLib.dll Image|endswith: \Windows\System32\wbem\WmiApSrv.exe filter: Signed: 'true' condition: selection and not filter falsepositives: - FP could occur if the legitimate version of vmGuestLib already exists on the system level: medium
Query: Sigma YAML for windows / system
Matching passage: Sigma rule: This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded. Logsource: windows / system. Rule: title: DHCP Server Loaded the CallOut DLL id: 13fc89a9-971e-4ca6-b9dc-aa53a445bf40 status: test description: This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded references: - https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html - https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx - https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx author: Dimitrios Slamaris date: 2017-05-15 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows service: system detection: selection: EventID: 1033 Provider_Name: Microsoft-Windows-DHCP-Server condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change m. Logsource: windows / registry_set. Rule: title: New Netsh Helper DLL Registered From A Suspicious Location id: e7b18879-676e-4a0e-ae18-27039185a8e7 related: - id: 56321594-9087-49d9-bf10-524fe8479452 type: similar - id: c90362e0-2df3-4e61-94fe-b37615814cb1 type: similar status: test description: 'Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper ' references: - https://www.ired.team/offensive-security/persistence/t1128-netsh-helper-dll - https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-11-28 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.007 logsource: category: registry_set product: windows detection: selection_target: TargetObject|contains: \SOFTWARE\Microsoft\NetSh selection_folders_1: Details|contains: - :\Perflogs\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\Local\Temp\ - \Temporary Internet selection_folders_2: - Details|contains|all: - :\Users\ - \Favorites\ - Details|contains|all: - :\Users\ - \Favourites\ - Details|contains|all: - :\Users\ - \Contacts\ - Details|contains|all: - :\Users\ - \Pictures\ condition: selection_target and 1 of selection_folders_* falsepositives: - Unknown level: high
Query: threat report mentioning Compiled HTML File
Matching passage: T1218.001 Compiled HTML File. Tactics: stealth. Description: Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program) A custom CHM file containing embedded payloads could be delivered to a victim then triggered by [User Execution](https://attack.mitre.org/techniques/T1204). CHM execution may also bypass application application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe. (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017)
Near-miss passage: T1218.003 CMSTP. Tactics: stealth. Description: Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections. Adversaries may supply CMSTP.exe with INF files infected with malicious commands. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010) / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs (Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets (SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate binary that may be signed by Microsoft. CMSTP.exe can also be abused to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018)
Query: Persistence mechanism resembling Screen Capture
Matching passage: T1113 Screen Capture. Tactics: collection. Description: Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.(Citation: CopyFromScreen .NET)(Citation: Antiquated Mac Malware)
Near-miss passage: T1119 Automated Collection. Tactics: collection. Description: Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals. In cloud-based environments, adversaries may also use cloud APIs, data pipelines, command line interfaces, or extract, transform, and load (ETL) services to automatically collect data.(Citation: Mandiant UNC3944 SMS Phishing 2023) This functionality could also be built into remote access tools. This technique may incorporate use of other techniques such as [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) and [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570) to identify and move files, as well as [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538) and [Cloud Storage Object Discovery](https://attack.mitre.org/techniques/T1619) to identify resources in cloud environments.
Query: resource development using Malware
Matching passage: T1588.001 Malware. Tactics: resource development. Description: Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols. Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors. In addition to downloading free malware from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware development, criminal marketplaces (including Malware-as-a-Service, or MaaS), or from individuals. In addition to purchasing malware, adversaries may steal and repurpose malware from third-party entities (including other adversaries).
Near-miss passage: T1588.003 Code Signing Certificates. Tactics: resource development. Description: Adversaries may buy and/or steal code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is. Prior to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may purchase or steal code signing certificates for use in operations. The purchase of code signing certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal code signing materials directly from a compromised third-party.
Query: detect Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters in logs
Matching passage: Sigma rule: Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters. Logsource: windows / process_creation. Rule: title: PUA - Seatbelt Execution id: 38646daa-e78f-4ace-9de0-55547b2d30da status: test description: Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters references: - https://github.com/GhostPack/Seatbelt - https://www.bluetangle.dev/2022/08/fastening-seatbelt-on-threat-hunting.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-18 modified: 2023-02-04 tags: - attack.discovery - attack.t1526 - attack.t1087 - attack.t1083 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \Seatbelt.exe - OriginalFileName: Seatbelt.exe - Description: Seatbelt - CommandLine|contains: - ' DpapiMasterKeys' - ' InterestingProcesses' - ' InterestingFiles' - ' CertificateThumbprints' - ' ChromiumBookmarks' - ' ChromiumHistory' - ' ChromiumPresence' - ' CloudCredentials' - ' CredEnum' - ' CredGuard' - ' FirefoxHistory' - ' ProcessCreationEvents' selection_group_list: CommandLine|contains: - ' -group=misc' - ' -group=remote' - ' -group=chromium' - ' -group=slack' - ' -group=system' - ' -group=user' - ' -group=all' selection_group_output: CommandLine|contains: ' -outputfile=' condition: selection_img or all of selection_group_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only availab. Logsource: windows / process_creation. Rule: title: Suspicious Service DACL Modification Via Set-Service Cmdlet id: a95b9b42-1308-4735-a1af-abb1c5e6f5ac related: - id: 99cf1e02-00fb-4c0d-8375-563f978dfd37 type: derived status: test description: Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only available with PowerShell 7) that can be used to hide services or make them unstopable references: - https://www.sans.org/blog/red-team-tactics-hiding-windows-services/ - https://learn.microsoft.com/pt-br/windows/win32/secauthz/sid-strings author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-18 tags: - attack.privilege-escalation - attack.persistence - attack.t1543.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \pwsh.exe - OriginalFileName: pwsh.dll selection_sddl_flag: CommandLine|contains: - '-SecurityDescriptorSddl ' - '-sd ' selection_set_service: CommandLine|contains|all: - 'Set-Service ' - D;; CommandLine|contains: - ;;;IU - ;;;SU - ;;;BA - ;;;SY - ;;;WD condition: all of selection_* falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-6908
Matching passage: CVE-2015-6908. CWE: CWE-20. CVSS: 5.0. The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd.
Near-miss passage: CVE-2015-9046. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached due to an improper bound on the size of a frequency list.
Query: risk of PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1
Matching passage: CVE-2015-1399. CWE: CWE-94. CVSS: 6.5. PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary PHP code via a URL in unspecified vectors involving the setScriptPath function. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files.
Near-miss passage: CVE-2015-1675. CWE: CWE-94. CVSS: 9.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1695, CVE-2015-1696, CVE-2015-1697, CVE-2015-1698, and CVE-2015-1699.
Query: write Sigma for Detects the "IDiagnosticProfileUAC" UAC bypass technique
Matching passage: Sigma rule: Detects the "IDiagnosticProfileUAC" UAC bypass technique. Logsource: windows / process_creation. Rule: title: UAC Bypass Using IDiagnostic Profile id: 4cbef972-f347-4170-b62a-8253f6168e6d status: test description: Detects the "IDiagnosticProfileUAC" UAC bypass technique references: - https://github.com/Wh04m1001/IDiagnosticProfileUAC author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-03 modified: 2024-12-01 tags: - attack.execution - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \DllHost.exe ParentCommandLine|contains: ' /Processid:{12C21EA7-2EB8-4B55-9249-AC243DA8C666}' IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.. Logsource: windows / registry_set. Rule: title: Potential SentinelOne Shell Context Menu Scan Command Tampering id: 6c304b02-06e6-402d-8be4-d5833cdf8198 status: test description: Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne. references: - https://mrd0x.com/sentinelone-persistence-via-menu-context/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-03-06 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \shell\SentinelOneScan\command\ filter_main_sentinelone_default_scan_binary: Details|startswith: - C:\Program Files\SentinelOne\Sentinel Agent - C:\Program Files (x86)\SentinelOne\Sentinel Agent Details|contains: \SentinelScanFromContextMenu.exe filter_main_sentinelone_binary: Image|endswith: - C:\Program Files\SentinelOne\ - C:\Program Files (x86)\SentinelOne\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium