alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects the creation of a macro file for Outlook.
Matching passage: Sigma rule: Detects the creation of a macro file for Outlook.. Logsource: windows / file_event. Rule: title: Suspicious Outlook Macro Created id: 117d3d3a-755c-4a61-b23e-9171146d094c related: - id: 8c31f563-f9a7-450c-bfa8-35f8f32f1f61 type: derived status: test description: Detects the creation of a macro file for Outlook. references: - https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/ - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53 - https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-08 tags: - attack.privilege-escalation - attack.persistence - attack.command-and-control - attack.t1137 - attack.t1008 - attack.t1546 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: \Microsoft\Outlook\VbaProject.OTM filter: Image|endswith: \outlook.exe condition: selection and not filter falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects block events for files that are disallowed by code integrity for protected processes. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Disallowed File For Protected Processes Has Been Blocked id: 5daf11c3-022b-4969-adb9-365e6c078c7c status: test description: Detects block events for files that are disallowed by code integrity for protected processes references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-06 tags: - attack.privilege-escalation logsource: product: windows service: codeintegrity-operational detection: selection: EventID: 3104 condition: selection falsepositives: - Unlikely level: high
Query: Sigma YAML for proxy
Matching passage: Sigma rule: Detects suspicious requests to Telegram API without the usual Telegram User-Agent. Logsource: proxy. Rule: title: Telegram API Access id: b494b165-6634-483d-8c47-2026a6c52372 status: test description: Detects suspicious requests to Telegram API without the usual Telegram User-Agent references: - https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/ - https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/ - https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/ author: Florian Roth (Nextron Systems) date: 2018-06-05 modified: 2023-05-18 tags: - attack.command-and-control - attack.t1071.001 - attack.t1102.002 logsource: category: proxy detection: selection: cs-host: api.telegram.org filter: c-useragent|contains: - Telegram - Bot condition: selection and not filter falsepositives: - Legitimate use of Telegram bots in the company level: medium
Near-miss passage: Sigma rule: Detects usage of the "sc.exe" utility adding a new service with special permission seen used by threat actors which make. Logsource: windows / process_creation. Rule: title: Service DACL Abuse To Hide Services Via Sc.EXE id: a537cfc3-4297-4789-92b5-345bfd845ad0 related: - id: 99cf1e02-00fb-4c0d-8375-563f978dfd37 type: similar - id: 98c5aeef-32d5-492f-b174-64a691896d25 type: similar status: test description: Detects usage of the "sc.exe" utility adding a new service with special permission seen used by threat actors which makes the service hidden and unremovable. references: - https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html - https://www.sans.org/blog/red-team-tactics-hiding-windows-services/ - https://twitter.com/Alh4zr3d/status/1580925761996828672 - https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/ author: Andreas Hunkeler (@Karneades) date: 2021-12-20 modified: 2022-08-08 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.011 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \sc.exe - OriginalFileName: sc.exe selection_cli: CommandLine|contains|all: - sdset - DCLCWPDTSD condition: all of selection_* falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-1150
Matching passage: CVE-2015-1150. CWE: CWE-17. CVSS: 5.0. The Firewall component in Apple OS X Server before 4.1 uses an incorrect pathname in configuration files, which allows remote attackers to bypass network-access restrictions by sending packets for which custom-rule blocking was intended.
Near-miss passage: CVE-2015-1841. CWE: CWE-17. CVSS: 3.700000047683716. The Web Admin interface in Red Hat Enterprise Virtualization Manager (RHEV-M) allows local users to bypass the timeout function by selecting a VM in the VM grid view.
Query: describe CVE-2015-3137
Matching passage: CVE-2015-3137. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
Near-miss passage: CVE-2015-6937. CWE: UNKNOWN. CVSS: 4.900000095367432. The __rds_conn_create function in net/rds/connection.c in the Linux kernel through 4.2.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound.
Query: Suspicious Keychain execution detected on endpoint
Matching passage: T1555.001 Keychain. Tactics: credential access. Description: Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The System Keychain stores items accessed by the operating system, such as items shared among users on a host. The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service. Keychains can be viewed and edited through the Keychain Access application or using the command-line utility <code>security</code>. Keychain files are located in <code>~/Library/Keychains/</code>, <code>/Library/Keychains/</code>, and <code>/Network/Library/Keychains/</code>.(Citation: Keychain Services Apple)(Citation: Keychain Decryption Passware)(Citation: OSX Keychain Schaumann) Adversaries may gather user credentials from Keychain storage/memory. For example, the command <code>security dump-keychain –d</code> will dump all Login Keychain credentials from <code>~/Library/Keychains/login.keychain-db</code>. Adversaries may also directly read Login Keychain credentials from the <code>~/Library/Keychains/login.keychain</code> file. Both methods require a password, where the default password for the Login Keychain is the current user’s password to login to the macOS host.(Citation: External to DA, the OS X Way)(Citation: Empire Keychain Decrypt)
Near-miss passage: T1555.005 Password Managers. Tactics: credential access. Description: Adversaries may acquire user credentials from third-party password managers.(Citation: ise Password Manager February 2019) Password managers are applications designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied to memory. These databases can be stored as files on disk.(Citation: ise Password Manager February 2019) Adversaries may acquire user credentials from password managers by extracting the master password and/or plain-text credentials from memory.(Citation: FoxIT Wocao December 2019)(Citation: Github KeeThief) Adversaries may extract credentials from memory via [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212).(Citation: NVD CVE-2019-3610) Adversaries may also try brute forcing via [Password Guessing](https://attack.mitre.org/techniques/T1110/001) to obtain the master password of a password manager.(Citation: Cyberreason Anchor December 2019)
Query: exploit Stack-based buffer overflow in Hospira LifeCare PCA Infusion System 5.0 and earlier, and possibly other versions, allows remote attackers to execute arbitrary code via unspecified 
Matching passage: CVE-2015-3955. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in Hospira LifeCare PCA Infusion System 5.0 and earlier, and possibly other versions, allows remote attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-5822. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Query: Sigma rule for Detects Windows shells and scripting applications that write files to suspicious folders
Matching passage: Sigma rule: Detects Windows shells and scripting applications that write files to suspicious folders. Logsource: windows / file_event. Rule: title: Windows Shell/Scripting Application File Write to Suspicious Folder id: 1277f594-a7d1-4f28-a2d3-73af5cbeab43 status: test description: Detects Windows shells and scripting applications that write files to suspicious folders references: - Internal Research author: Florian Roth (Nextron Systems) date: 2021-11-20 modified: 2023-03-29 tags: - attack.execution - attack.t1059 logsource: category: file_event product: windows detection: selection_1: Image|endswith: - \bash.exe - \cmd.exe - \cscript.exe - \msbuild.exe - \powershell.exe - \pwsh.exe - \sh.exe - \wscript.exe TargetFilename|startswith: - C:\PerfLogs\ - C:\Users\Public\ selection_2: Image|endswith: - \certutil.exe - \forfiles.exe - \mshta.exe - \schtasks.exe - \scriptrunner.exe - \wmic.exe TargetFilename|contains: - C:\PerfLogs\ - C:\Users\Public\ - C:\Windows\Temp\ condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious network connections made by a well-known Windows binary run with no command line parameters. Logsource: windows / network_connection. Rule: title: Suspicious Network Connection Binary No CommandLine id: 20384606-a124-4fec-acbb-8bd373728613 status: test description: Detects suspicious network connections made by a well-known Windows binary run with no command line parameters references: - https://redcanary.com/blog/raspberry-robin/ author: Florian Roth (Nextron Systems) date: 2022-07-03 tags: - attack.stealth logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: - \regsvr32.exe - \rundll32.exe - \dllhost.exe CommandLine|endswith: - \regsvr32.exe - \rundll32.exe - \dllhost.exe filter_no_cmdline: CommandLine: '' filter_null: CommandLine: null condition: selection and not 1 of filter* falsepositives: - Unknown level: high
Query: exploit Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors.
Matching passage: CVE-2015-3250. CWE: CWE-200. CVSS: 7.5. Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors.
Near-miss passage: CVE-2015-3092. CWE: CWE-200. CVSS: 5.0. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2015-3091.
Query: patch priority for CVE-2015-8779
Matching passage: CVE-2015-8779. CWE: CWE-119. CVSS: 9.800000190734863. Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long catalog name.
Near-miss passage: CVE-2015-5868. CWE: CWE-119. CVSS: 7.199999809265137. The kernel in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5896 and CVE-2015-5903.
Query: detect Detects the creation of a new office macro files on the systems in logs
Matching passage: Sigma rule: Detects the creation of a new office macro files on the systems. Logsource: windows / file_event. Rule: title: Office Macro File Creation id: 91174a41-dc8f-401b-be89-7bfc140612a0 related: - id: 0e29e3a7-1ad8-40aa-b691-9f82ecd33d66 type: similar status: test description: Detects the creation of a new office macro files on the systems references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference author: Nasreddine Bencherchali (Nextron Systems) date: 2022-01-23 modified: 2026-01-09 tags: - attack.initial-access - attack.t1566.001 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - .docm - .dotm - .xlsm - .xltm - .potm - .pptm filter_main_office: Image|startswith: - C:\Program Files\Microsoft Office\ - C:\Program Files (x86)\Microsoft Office\ Image|endswith: - \WINWORD.EXE - \EXCEL.EXE - \POWERPNT.EXE TargetFilename|contains: \~$ condition: selection and not 1 of filter_main_* falsepositives: - Very common in environments that rely heavily on macro documents level: low
Near-miss passage: Sigma rule: Detect the creation of a service with a service binary located in a suspicious directory. Logsource: windows / registry_set. Rule: title: Service Binary in Suspicious Folder id: a07f0359-4c90-4dc4-a681-8ffea40b4f47 related: - id: c0abc838-36b0-47c9-b3b3-a90c39455382 type: obsolete status: test description: Detect the creation of a service with a service binary located in a suspicious directory references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md author: Florian Roth (Nextron Systems), frack113 date: 2022-05-02 modified: 2025-10-07 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection_service_start: TargetObject|startswith: HKLM\System\CurrentControlSet\Services\ TargetObject|endswith: \Start Image|contains: - \Users\Public\ - \Perflogs\ - \ADMIN$\ - \Temp\ Details: - DWORD (0x00000000) - DWORD (0x00000001) - DWORD (0x00000002) selection_service_imagepath: TargetObject|startswith: HKLM\System\CurrentControlSet\Services\ TargetObject|endswith: \ImagePath Details|contains: - \Users\Public\ - \Perflogs\ - \ADMIN$\ - \Temp\ filter_optional_avast: Image|contains|all: - \Common Files\ - \Temp\ filter_optional_mbamservice: TargetObject|endswith: \CurrentControlSet\Services\MBAMInstallerService\ImagePath Details|endswith: \AppData\Local\Temp\MBAMInstallerService.exe" Image: C:\Windows\system32\services.exe condition: 1 of selection_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Query: explain CWE-126
Matching passage: CWE-126 Buffer Over-read. The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
Near-miss passage: CWE-473 PHP External Variable Modification. A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise.
Query: SIEM correlation: defense impairment activity consistent with Subvert Trust Controls
Matching passage: T1553 Subvert Trust Controls. Tactics: defense impairment. Description: Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site. Adversaries may attempt to subvert these trust mechanisms. The method adversaries use will depend on the specific mechanism they seek to subvert. Adversaries may conduct [File and Directory Permissions Modification](https://attack.mitre.org/techniques/T1222) or [Modify Registry](https://attack.mitre.org/techniques/T1112) in support of subverting these controls.(Citation: SpectorOps Subverting Trust Sept 2017) Adversaries may also create or steal code signing certificates to acquire trust on target systems.(Citation: Securelist Digital Certificates)(Citation: Symantec Digital Certificates)
Near-miss passage: T1553.005 Mark-of-the-Web Bypass. Tactics: defense impairment. Description: Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, when files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named <code>Zone.Identifier</code> with a specific value known as the MOTW.(Citation: Microsoft Zone.Identifier 2020) Files that are tagged with MOTW are protected and cannot perform certain actions. For example, starting in MS Office 10, if a MS Office file has the MOTW, it will open in Protected View. Executables tagged with the MOTW will be processed by Windows Defender SmartScreen that compares files with an allowlist of well-known executables. If the file is not known/trusted, SmartScreen will prevent the execution and warn the user not to run it.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)(Citation: Intezer Russian APT Dec 2020) Adversaries may abuse container files such as compressed/archive (.arj, .gzip) and/or disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW. Container files downloaded from the Internet will be marked with MOTW but the files within may not inherit the MOTW after the container files are extracted and/or mounted. MOTW is a NTFS feature and many container files do not support NTFS alternative data streams. After a container file is extracted and/or mounted, the files contained within them may be treated as local files on disk and run without protections.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)
Query: risk of Heap-based buffer overflow in the mozilla::gfx::CopyRect function in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers 
Matching passage: CVE-2015-0827. CWE: CWE-119. CVSS: 4.300000190734863. Heap-based buffer overflow in the mozilla::gfx::CopyRect function in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers to obtain sensitive information from uninitialized process memory via a malformed SVG graphic.
Near-miss passage: CVE-2015-2716. CWE: CWE-119. CVSS: 7.5. Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283.
Query: secure coding against Path Equivalence: 'file name' (Internal Whitespace)
Matching passage: CWE-48 Path Equivalence: 'file name' (Internal Whitespace). The product accepts path input in the form of internal space ('file(SPACE)name') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Near-miss passage: CWE-1069 Empty Exception Block. An invokable code block contains an exception handling block that does not contain any code, i.e. is empty.
Query: detection rule: Detects execution of "certmgr" with the "add" flag in order to install a new certificate on the system. Adversaries may
Matching passage: Sigma rule: Detects execution of "certmgr" with the "add" flag in order to install a new certificate on the system. Adversaries may. Logsource: windows / process_creation. Rule: title: New Root Certificate Installed Via CertMgr.EXE id: ff992eac-6449-4c60-8c1d-91c9722a1d48 related: - id: 42821614-9264-4761-acfc-5772c3286f76 type: derived - id: 46591fae-7a4c-46ea-aec3-dff5e6d785dc type: obsolete status: test description: 'Detects execution of "certmgr" with the "add" flag in order to install a new certificate on the system. Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md - https://securelist.com/to-crypt-or-to-mine-that-is-the-question/86307/ author: oscd.community, @redcanary, Zach Stanford @svch0st date: 2023-03-05 tags: - attack.defense-impairment - attack.t1553.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \CertMgr.exe - OriginalFileName: CERTMGT.EXE selection_cli: CommandLine|contains|all: - /add - root condition: all of selection_* falsepositives: - Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to test if GPO push doesn't trigger FP level: medium
Near-miss passage: Sigma rule: Detects a suspicious process spawning from an Outlook process.. Logsource: windows / process_creation. Rule: title: Suspicious Outlook Child Process id: 208748f7-881d-47ac-a29c-07ea84bf691d related: - id: 438025f9-5856-4663-83f7-52f878a70a50 type: derived - id: e212d415-0e93-435f-9e1a-f29005bb4723 type: derived status: test description: Detects a suspicious process spawning from an Outlook process. references: - https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100 - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html author: Michael Haag, Florian Roth (Nextron Systems), Markus Neis, Elastic, FPT.EagleEye Team date: 2022-02-28 modified: 2023-02-04 tags: - attack.execution - attack.t1204.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \OUTLOOK.EXE Image|endswith: - \AppVLP.exe - \bash.exe - \cmd.exe - \cscript.exe - \forfiles.exe - \hh.exe - \mftrace.exe - \msbuild.exe - \msdt.exe - \mshta.exe - \msiexec.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \schtasks.exe - \scrcons.exe - \scriptrunner.exe - \sh.exe - \svchost.exe - \wmic.exe - \wscript.exe condition: selection falsepositives: - Unknown level: high