alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent in logs
Matching passage: Sigma rule: Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent. Logsource: windows / process_creation. Rule: title: Potential DLL Sideloading Via DeviceEnroller.EXE id: e173ad47-4388-4012-ae62-bd13f71c18a8 related: - id: ee4c5d06-3abc-48cc-8885-77f1c20f4451 type: similar status: test description: 'Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named "ShellChromeAPI.dll". Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter ' references: - https://mobile.twitter.com/0gtweet/status/1564131230941122561 - https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html author: '@gott_cyber' date: 2022-08-29 modified: 2023-02-04 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \deviceenroller.exe - OriginalFileName: deviceenroller.exe selection_cli: CommandLine|contains: /PhoneDeepLink condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of "rundll32" calling "advpack.dll" with potential obfuscated ordinal calls in order to leverage the ". Logsource: windows / process_creation. Rule: title: Suspicious Advpack Call Via Rundll32.EXE id: a1473adb-5338-4a20-b4c3-126763e2d3d3 status: test description: Detects execution of "rundll32" calling "advpack.dll" with potential obfuscated ordinal calls in order to leverage the "RegisterOCX" function references: - https://twitter.com/Hexacorn/status/1224848930795552769 - http://www.hexacorn.com/blog/2020/02/05/stay-positive-lolbins-not/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-05-17 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE - CommandLine|contains: rundll32 selection_cli_dll: CommandLine|contains: advpack selection_cli_ordinal: - CommandLine|contains|all: - '#+' - '12' - CommandLine|contains: '#-' condition: all of selection_* falsepositives: - Unlikely level: high
Query: vulnerability: Buffer overflow in the Telnet service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Window
Matching passage: CVE-2015-0014. CWE: CWE-119. CVSS: 10.0. Buffer overflow in the Telnet service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows Telnet Service Buffer Overflow Vulnerability."
Near-miss passage: CVE-2015-4486. CWE: CWE-119. CVSS: 10.0. The decrease_ref_count function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via malformed WebM video data.
Query: secure coding against Reliance on File Name or Extension of Externally-Supplied File
Matching passage: CWE-646 Reliance on File Name or Extension of Externally-Supplied File. The product allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors. This could be used by attackers to cause the file to be misclassified and processed in a dangerous fashion.
Near-miss passage: CWE-1103 Use of Platform-Dependent Third Party Components. The product relies on third-party components that do not provide equivalent functionality across all desirable platforms.
Query: risk of Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive.
Matching passage: CVE-2015-1191. CWE: CWE-22. CVSS: 5.0. Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive.
Near-miss passage: CVE-2015-2775. CWE: CWE-22. CVSS: 7.599999904632568. Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.
Query: Sigma rule for Identifies when a Firewall Policy is Modified or Deleted.
Matching passage: Sigma rule: Identifies when a Firewall Policy is Modified or Deleted.. Logsource: azure / activitylogs. Rule: title: Azure Network Firewall Policy Modified or Deleted id: 83c17918-746e-4bd9-920b-8e098bf88c23 status: test description: Identifies when a Firewall Policy is Modified or Deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-09-02 modified: 2022-08-23 tags: - attack.impact - attack.defense-impairment - attack.t1686.001 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.NETWORK/FIREWALLPOLICIES/WRITE - MICROSOFT.NETWORK/FIREWALLPOLICIES/JOIN/ACTION - MICROSOFT.NETWORK/FIREWALLPOLICIES/CERTIFICATES/ACTION - MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE condition: selection falsepositives: - Firewall Policy being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Firewall Policy modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects the installation of a well-known TAP driver service. This could be a sign of potential preparation for data exfi. Logsource: windows / security. Rule: title: Tap Driver Installation - Security id: 9c8afa4d-0022-48f0-9456-3712466f9701 related: - id: 8e4cf0e5-aa5d-4dc3-beff-dc26917744a9 type: derived status: test description: 'Detects the installation of a well-known TAP driver service. This could be a sign of potential preparation for data exfiltration using tunnelling techniques. ' references: - https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers author: Daniil Yugoslavskiy, Ian Davis, oscd.community date: 2019-10-24 modified: 2022-11-29 tags: - attack.exfiltration - attack.t1048 logsource: product: windows service: security definition: 'Requirements: The System Security Extension audit subcategory need to be enabled to log the EID 4697' detection: selection: EventID: 4697 ServiceFileName|contains: tap0901 condition: selection falsepositives: - Legitimate OpenVPN TAP installation level: low
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility. Logsource: windows / process_creation. Rule: title: Potential Suspicious Registry File Imported Via Reg.EXE id: 62e0298b-e994-4189-bc87-bc699aa62d97 related: - id: 73bba97f-a82d-42ce-b315-9182e76c57b1 type: derived status: test description: Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/reg-import author: frack113, Nasreddine Bencherchali date: 2022-08-01 modified: 2023-02-05 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_cli: CommandLine|contains: ' import ' selection_paths: CommandLine|contains: - C:\Users\ - '%temp%' - '%tmp%' - '%appdata%' - \AppData\Local\Temp\ - C:\Windows\Temp\ - C:\ProgramData\ condition: all of selection_* falsepositives: - Legitimate import of keys level: medium
Near-miss passage: Sigma rule: Detects the execution of a renamed MegaSync.exe as seen used by ransomware families like Nefilim, Sodinokibi, Pysa, and. Logsource: windows / process_creation. Rule: title: Renamed MegaSync Execution id: 643bdcac-8b82-49f4-9fd9-25a90b929f3b status: test description: Detects the execution of a renamed MegaSync.exe as seen used by ransomware families like Nefilim, Sodinokibi, Pysa, and Conti. references: - https://redcanary.com/blog/rclone-mega-extortion/ author: Sittikorn S date: 2021-06-22 modified: 2023-02-03 tags: - attack.stealth - attack.t1218 logsource: product: windows category: process_creation detection: selection: OriginalFileName: megasync.exe filter: Image|endswith: \megasync.exe condition: selection and not filter falsepositives: - Software that illegally integrates MegaSync in a renamed form - Administrators that have renamed MegaSync level: high
Query: detect Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse in logs
Matching passage: Sigma rule: Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse. Logsource: windows / network_connection. Rule: title: Network Connection Initiated To Visual Studio Code Tunnels Domain id: 4b657234-038e-4ad5-997c-4be42340bce4 related: - id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4 type: similar - id: b3e6418f-7c7a-4fad-993a-93b65027a9f1 type: similar - id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b type: similar status: test description: 'Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. ' references: - https://ipfyx.fr/post/visual-studio-code-tunnel/ - https://badoption.eu/blog/2023/01/31/code_c2.html - https://cydefops.com/vscode-data-exfiltration author: Kamran Saifullah date: 2023-11-20 tags: - attack.exfiltration - attack.command-and-control - attack.t1567 - attack.t1572 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationHostname|endswith: .tunnels.api.visualstudio.com condition: selection falsepositives: - Legitimate use of Visual Studio Code tunnel will also trigger this. level: medium
Near-miss passage: Sigma rule: Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE id: d2451be2-b582-4e15-8701-4196ac180260 related: - id: ca5583e9-8f80-46ac-ab91-7f314d13b984 type: similar status: test description: 'Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe". ' references: - https://thehackernews.com/2024/03/two-chinese-apt-groups-ramp-up-cyber.html - https://csirt-cti.net/2024/02/01/stately-taurus-continued-new-information-on-cyberespionage-attacks-against-myanmar-military-junta/ - https://bazaar.abuse.ch/sample/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831/ - https://twitter.com/Max_Mal_/status/1775222576639291859 - https://twitter.com/DTCERT/status/1712785426895839339 author: Swachchhanda Shrawan Poudel date: 2024-04-15 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: Image|endswith: - \KeyScrambler.exe - \KeyScramblerLogon.exe ImageLoaded|endswith: \KeyScramblerIE.dll filter_main_legitimate_path: Image|contains: - C:\Program Files (x86)\KeyScrambler\ - C:\Program Files\KeyScrambler\ ImageLoaded|contains: - C:\Program Files (x86)\KeyScrambler\ - C:\Program Files\KeyScrambler\ filter_main_signature: Signature: QFX Software Corporation SignatureStatus: Valid condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: describe CVE-2015-4001
Matching passage: CVE-2015-4001. CWE: CWE-189. CVSS: 9.0. Integer signedness error in the oz_hcd_get_desc_cnf function in drivers/staging/ozwpan/ozhcd.c in the OZWPAN driver in the Linux kernel through 4.0.5 allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted packet.
Near-miss passage: CVE-2015-3809. CWE: CWE-189. CVSS: 7.800000190734863. The dissect_lbmr_pser function in epan/dissectors/packet-lbmr.c in the LBMR dissector in Wireshark 1.12.x before 1.12.5 does not properly track the current offset, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
Query: patch priority for CVE-2015-7683
Matching passage: CVE-2015-7683. CWE: CWE-22. CVSS: 4.0. Absolute path traversal vulnerability in Font.php in the Font plugin before 7.5.1 for WordPress allows remote administrators to read arbitrary files via a full pathname in the url parameter to AjaxProxy.php.
Near-miss passage: CVE-2015-8358. CWE: CWE-22. CVSS: 9.0. Directory traversal vulnerability in the bitrix.mpbuilder module before 1.0.12 for Bitrix allows remote administrators to include and execute arbitrary local files via a .. (dot dot) in the element name of the "work" array parameter to admin/bitrix.mpbuilder_step2.php.
Query: CVE similar to CVE-2015-9114
Matching passage: CVE-2015-9114. CWE: CWE-476. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, lack of address argument validation in qsee_query_counter syscall could lead to untrusted pointer dereference.
Near-miss passage: CVE-2015-9072. CWE: CWE-476. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall.
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects the creation of recent element file that points to an .ISO, .IMG, .VHD or .VHDX file as often used in phishing a. Logsource: windows / file_event. Rule: title: ISO or Image Mount Indicator in Recent Files id: 4358e5a5-7542-4dcb-b9f3-87667371839b status: test description: 'Detects the creation of recent element file that points to an .ISO, .IMG, .VHD or .VHDX file as often used in phishing attacks. This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files. ' references: - https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ - https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/malicious-spam-campaign-uses-iso-image-files-to-deliver-lokibot-and-nanocore - https://blog.emsisoft.com/en/32373/beware-new-wave-of-malware-spreads-via-iso-file-email-attachments/ - https://insights.sei.cmu.edu/blog/the-dangers-of-vhd-and-vhdx-files/ author: Florian Roth (Nextron Systems) date: 2022-02-11 tags: - attack.initial-access - attack.t1566.001 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - .iso.lnk - .img.lnk - .vhd.lnk - .vhdx.lnk TargetFilename|contains: \Microsoft\Windows\Recent\ condition: selection falsepositives: - Cases in which a user mounts an image file for legitimate reasons level: medium
Near-miss passage: Sigma rule: Detects creation of the Process Explorer drivers by processes other than Process Explorer (procexp) itself. Hack tools o. Logsource: windows / file_event. Rule: title: Process Explorer Driver Creation By Non-Sysinternals Binary id: de46c52b-0bf8-4936-a327-aace94f94ac6 status: test description: 'Detects creation of the Process Explorer drivers by processes other than Process Explorer (procexp) itself. Hack tools or malware may use the Process Explorer driver to elevate privileges, drops it to disk for a few moments, runs a service using that driver and removes it afterwards. ' references: - https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer - https://github.com/Yaxser/Backstab - https://www.elastic.co/security-labs/stopping-vulnerable-driver-attacks - https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/ author: Florian Roth (Nextron Systems) date: 2023-05-05 modified: 2026-06-29 tags: - attack.persistence - attack.privilege-escalation - attack.t1068 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \PROCEXP TargetFilename|endswith: .sys filter_main_process_explorer: Image|endswith: - \procexp.exe - \procexp64.exe - \procexp64a.exe condition: selection and not 1 of filter_main_* falsepositives: - Some false positives may occur with legitimate renamed process explorer binaries level: high
Query: vulnerability: Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited 
Matching passage: CVE-2015-8562. CWE: CWE-20. CVSS: 7.5. Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015.
Near-miss passage: CVE-2015-2053. CWE: CWE-20. CVSS: 4.300000190734863. The log viewer in McAfee Agent (MA) before 4.8.0 Patch 3 and 5.0.0, when the "Accept connections only from the ePO server" option is disabled, allows remote attackers to conduct clickjacking attacks via a crafted web page, aka an "http-generic-click-jacking" vulnerability.
Query: detection rule: Detects the execution of "whoami.exe" with the "/FO" flag to choose CSV as output format or with redirection options to
Matching passage: Sigma rule: Detects the execution of "whoami.exe" with the "/FO" flag to choose CSV as output format or with redirection options to. Logsource: windows / process_creation. Rule: title: Whoami.EXE Execution With Output Option id: c30fb093-1109-4dc8-88a8-b30d11c95a5d status: test description: Detects the execution of "whoami.exe" with the "/FO" flag to choose CSV as output format or with redirection options to export the results to a file for later use. references: - https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/ - https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/ - https://www.youtube.com/watch?v=DsJ9ByX84o4&t=6s author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-02-28 modified: 2023-12-04 tags: - attack.discovery - attack.t1033 - car.2016-03-001 logsource: category: process_creation product: windows detection: selection_main_img: - Image|endswith: \whoami.exe - OriginalFileName: whoami.exe selection_main_cli: CommandLine|contains: - ' /FO CSV' - ' -FO CSV' selection_special: CommandLine|contains: whoami*> condition: all of selection_main_* or selection_special falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when changes are made to PIM roles. Logsource: azure / auditlogs. Rule: title: Changes To PIM Settings id: db6c06c4-bf3b-421c-aa88-15672b88c743 status: test description: Detects when changes are made to PIM roles references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H' date: 2022-08-09 tags: - attack.initial-access - attack.privilege-escalation - attack.persistence - attack.stealth - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: properties.message: Update role setting in PIM condition: selection falsepositives: - Legit administrative PIM setting configuration changes level: high
Query: CVE similar to CVE-2015-1875
Matching passage: CVE-2015-1875. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in a2billing/customer/iridium_threed.php in Elastix 2.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the transactionID parameter.
Near-miss passage: CVE-2015-10100. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability, which was classified as critical, has been found in Dynamic Widgets Plugin up to 1.5.10 on WordPress. This issue affects some unknown processing of the file classes/dynwid_class.php. The manipulation leads to sql injection. The attack may be initiated remotely. Upgrading to version 1.5.11 is able to address this issue. The identifier of the patch is d0a19c6efcdc86d7093b369bc9e29a0629e57795. It is recommended to upgrade the affected component. The identifier VDB-225353 was assigned to this vulnerability.
Query: patch priority for CVE-2015-7317
Matching passage: CVE-2015-7317. CWE: CWE-264. CVSS: 6.800000190734863. Kupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7 allows remote authenticated users to edit Kupu settings.
Near-miss passage: CVE-2015-0002. CWE: CWE-264. CVSS: 7.199999809265137. The AhcVerifyAdminContext function in ahcache.sys in the Application Compatibility component in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not verify that an impersonation token is associated with an administrative account, which allows local users to gain privileges by running AppCompatCache.exe with a crafted DLL file, aka MSRC ID 20544 or "Microsoft Application Compatibility Infrastructure Elevation of Privilege Vulnerability."
Query: detect Exfiltration Over Unencrypted Non-C2 Protocol
Matching passage: T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.(Citation: copy_cmd_cisco) Adversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted (such as HTTP, FTP, or DNS). This may include custom or publicly available encoding/compression algorithms (such as base64) as well as embedding data within protocol headers and fields.
Near-miss passage: T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Symmetric encryption algorithms are those that use shared or the same keys/secrets on each end of the channel. This requires an exchange or pre-arranged agreement/possession of the value used to encrypt and decrypt data. Network protocols that use asymmetric encryption often utilize symmetric encryption once keys are exchanged, but adversaries may opt to manually share keys and implement symmetric cryptographic algorithms (ex: RC4, AES) vice using mechanisms that are baked into a protocol. This may result in multiple layers of encryption (in protocols that are natively encrypted such as HTTPS) or encryption in protocols that not typically encrypted (such as HTTP or FTP).