alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: telemetry for T1547.014
Matching passage: T1547.014 Active Setup. Tactics: persistence, privilege escalation. Description: Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. Active Setup is a Windows mechanism that is used to execute programs when a user logs in. The value stored in the Registry key will be executed after a user logs into the computer.(Citation: Klein Active Setup 2010) These programs will be executed under the context of the user and will have the account's associated permissions level. Adversaries may abuse Active Setup by creating a key under <code> HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\</code> and setting a malicious value for <code>StubPath</code>. This value will serve as the program that will be executed when a user logs into the computer.(Citation: Mandiant Glyer APT 2010)(Citation: Citizenlab Packrat 2015)(Citation: FireEye CFR Watering Hole 2012)(Citation: SECURELIST Bright Star 2015)(Citation: paloalto Tropic Trooper 2016) Adversaries can abuse these components to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.
Near-miss passage: T1547.012 Print Processors. Tactics: persistence, privilege escalation. Description: Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation. Print processors are DLLs that are loaded by the print spooler service, `spoolsv.exe`, during boot.(Citation: Microsoft Intro Print Processors) Adversaries may abuse the print spooler service by adding print processors that load malicious DLLs at startup. A print processor can be installed through the <code>AddPrintProcessor</code> API call with an account that has <code>SeLoadDriverPrivilege</code> enabled. Alternatively, a print processor can be registered to the print spooler service by adding the <code>HKLM\SYSTEM\\[CurrentControlSet or ControlSet001]\Control\Print\Environments\\[Windows architecture: e.g., Windows x64]\Print Processors\\[user defined]\Driver</code> Registry key that points to the DLL. For the malicious print processor to be correctly installed, the payload must be located in the dedicated system print-processor directory, that can be found with the <code>GetPrintProcessorDirectory</code> API call, or referenced via a relative path from this directory.(Citation: Microsoft AddPrintProcessor May 2018) After the print processors are installed, the print spooler service, which starts during boot, must be restarted in order for them to run.(Citation: ESET PipeMon May 2020) The print spooler service runs under SYSTEM level permissions, therefore print processors installed by an adversary may run under elevated privileges.
Query: risk of Stack-based buffer overflow in the Open CAD Format Council SXF common library before 3.30 allows remote attackers to execute arbitrary code via a crafted CAD file.
Matching passage: CVE-2015-2946. CWE: CWE-119. CVSS: 6.800000190734863. Stack-based buffer overflow in the Open CAD Format Council SXF common library before 3.30 allows remote attackers to execute arbitrary code via a crafted CAD file.
Near-miss passage: CVE-2015-0979. CWE: CWE-119. CVSS: 9.0. Heap-based buffer overflow in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via a crafted packet.
Query: risk of The Client/Server Run-time Subsystem (CSRSS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and
Matching passage: CVE-2015-2453. CWE: CWE-200. CVSS: 4.699999809265137. The Client/Server Run-time Subsystem (CSRSS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to obtain sensitive information via a crafted application that continues to execute during a subsequent user's login session, aka "Windows CSRSS Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-3293. CWE: CWE-200. CVSS: 4.0. FortiMail 5.0.3 through 5.2.3 allows remote administrators to obtain credentials via the "diag debug application httpd" command.
Query: write Sigma for Detects uses of the createdump.exe LOLOBIN utility to dump process memory
Matching passage: Sigma rule: Detects uses of the createdump.exe LOLOBIN utility to dump process memory. Logsource: windows / process_creation. Rule: title: CreateDump Process Dump id: 515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48 related: - id: 1a1ed54a-2ba4-4221-94d5-01dee560d71e type: similar status: test description: Detects uses of the createdump.exe LOLOBIN utility to dump process memory references: - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/ - https://twitter.com/bopin2020/status/1366400799199272960 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-01-04 modified: 2022-08-19 tags: - attack.stealth - attack.t1036 - attack.t1003.001 - attack.credential-access logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \createdump.exe - OriginalFileName: FX_VER_INTERNALNAME_STR selection_cli: CommandLine|contains: - ' -u ' - ' --full ' - ' -f ' - ' --name ' - '.dmp ' condition: all of selection_* falsepositives: - Command lines that use the same flags level: high
Near-miss passage: Sigma rule: Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation. Logsource: windows / process_creation. Rule: title: Powershell Token Obfuscation - Process Creation id: deb9b646-a508-44ee-b7c9-d8965921c6b6 related: - id: f3a98ce4-6164-4dd4-867c-4d83de7eca51 type: similar status: test description: Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation references: - https://github.com/danielbohannon/Invoke-Obfuscation author: frack113 date: 2022-12-27 modified: 2026-03-16 tags: - attack.stealth - attack.t1027.009 logsource: category: process_creation product: windows detection: selection: - CommandLine|re: \w+`(?:\w+|-|.)`[\w+|\s] - CommandLine|re: '"(?:\{\d\})+"\s*-f' - CommandLine|re: (?i)\$\{`?e`?n`?v`?:`?p`?a`?t`?h`?\} filter_main_envpath: CommandLine|contains: ${env:path} condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: describe CVE-2015-8880
Matching passage: CVE-2015-8880. CWE: CWE-415. CVSS: 9.800000190734863. Double free vulnerability in the format printer in PHP 7.x before 7.0.1 allows remote attackers to have an unspecified impact by triggering an error.
Near-miss passage: CVE-2015-8962. CWE: CWE-415. CVSS: 7.300000190734863. Double free vulnerability in the sg_common_write function in drivers/scsi/sg.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (memory corruption and system crash) by detaching a device during an SG_IO ioctl call.
Query: describe CVE-2015-1322
Matching passage: CVE-2015-1322. CWE: CWE-22. CVSS: 4.599999904632568. Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu (vivid) before 0.9.10.0-4ubuntu15.1, Ubuntu 14.10 before 0.9.8.8-0ubuntu28.1, and Ubuntu 14.04 LTS before 0.9.8.8-0ubuntu7.1 allows local users to change the modem device configuration or read arbitrary files via a .. (dot dot) in the file name in a request to read modem device contexts (com.canonical.NMOfono.ReadImsiContexts).
Near-miss passage: CVE-2015-5353. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the tab parameter to admin/.
Query: write Sigma for Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly"
Matching passage: Sigma rule: Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly". Logsource: windows / process_creation. Rule: title: Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call id: 9c0295ce-d60d-40bd-bd74-84673b7592b1 related: - id: 62b7ccc9-23b4-471e-aa15-6da3663c4d59 type: similar status: test description: Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly" references: - https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/mal_revil.yar - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/ - https://learn.microsoft.com/en-us/dotnet/api/system.appdomain.load?view=net-7.0 author: pH-T (Nextron Systems) date: 2022-03-01 modified: 2023-04-06 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1027 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - OgA6ACgAIgBMACIAKwAiAG8AYQBkACIAKQ - oAOgAoACIATAAiACsAIgBvAGEAZAAiACkA - 6ADoAKAAiAEwAIgArACIAbwBhAGQAIgApA - OgA6ACgAIgBMAG8AIgArACIAYQBkACIAKQ - oAOgAoACIATABvACIAKwAiAGEAZAAiACkA - 6ADoAKAAiAEwAbwAiACsAIgBhAGQAIgApA - OgA6ACgAIgBMAG8AYQAiACsAIgBkACIAKQ - oAOgAoACIATABvAGEAIgArACIAZAAiACkA - 6ADoAKAAiAEwAbwBhACIAKwAiAGQAIgApA - OgA6ACgAJwBMACcAKwAnAG8AYQBkACcAKQ - oAOgAoACcATAAnACsAJwBvAGEAZAAnACkA - 6ADoAKAAnAEwAJwArACcAbwBhAGQAJwApA - OgA6ACgAJwBMAG8AJwArACcAYQBkACcAKQ - oAOgAoACcATABvACcAKwAnAGEAZAAnACkA - 6ADoAKAAnAEwAbwAnACsAJwBhAGQAJwApA - OgA6ACgAJwBMAG8AYQAnACsAJwBkACcAKQ - oAOgAoACcATABvAGEAJwArACcAZAAnACkA - 6ADoAKAAnAEwAbwBhACcAKwAnAGQAJwApA condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects when an Okta user session starts where the user is behind an anonymising proxy service.. Logsource: okta / okta. Rule: title: Okta User Session Start Via An Anonymising Proxy Service id: bde30855-5c53-4c18-ae90-1ff79ebc9578 status: test description: Detects when an Okta user session starts where the user is behind an anonymising proxy service. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection author: kelnage date: 2023-09-07 modified: 2026-04-27 tags: - attack.defense-impairment - attack.t1685 logsource: product: okta service: okta detection: selection: eventType: user.session.start securityContext.isProxy: 'true' condition: selection falsepositives: - If a user requires an anonymising proxy due to valid justifications. level: high
Query: CVE similar to CVE-2015-1566
Matching passage: CVE-2015-1566. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-5481. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter in the gdbbpress_attachments page to wp-admin/edit.php.
Query: patch priority for CVE-2015-0467
Matching passage: CVE-2015-0467. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the PeopleSoft Enterprise HCM Talent Acquisition Manager component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote attackers to affect integrity via unknown vectors related to Security.
Near-miss passage: CVE-2015-4492. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in the XMLHttpRequest::Open implementation in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 might allow remote attackers to execute arbitrary code via a SharedWorker object that makes recursive calls to the open method of an XMLHttpRequest object.
Query: Sigma rule for Detection of unusual child processes by different system processes
Matching passage: Sigma rule: Detection of unusual child processes by different system processes. Logsource: windows / process_creation. Rule: title: Abused Debug Privilege by Arbitrary Parent Processes id: d522eca2-2973-4391-a3e0-ef0374321dae status: test description: Detection of unusual child processes by different system processes references: - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-74-638.jpg author: Semanur Guneysu @semanurtg, oscd.community date: 2020-10-28 modified: 2022-11-11 tags: - attack.privilege-escalation - attack.t1548 logsource: product: windows category: process_creation detection: selection_parent: ParentImage|endswith: - \winlogon.exe - \services.exe - \lsass.exe - \csrss.exe - \smss.exe - \wininit.exe - \spoolsv.exe - \searchindexer.exe User|contains: - AUTHORI - AUTORI selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \cmd.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll - Cmd.Exe filter: CommandLine|contains|all: - ' route ' - ' ADD ' condition: all of selection_* and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is tr. Logsource: windows / application. Rule: title: Audit CVE Event id: 48d91a3a-2363-43ba-a456-ca71ac3da5c2 status: test description: 'Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log. ' references: - https://twitter.com/VM_vivisector/status/1217190929330655232 - https://twitter.com/DidierStevens/status/1217533958096924676 - https://twitter.com/FlemmingRiis/status/1217147415482060800 - https://www.youtube.com/watch?v=ebmW42YYveI - https://nullsec.us/windows-event-log-audit-cve/ author: Florian Roth (Nextron Systems), Zach Mathis date: 2020-01-15 modified: 2022-10-22 tags: - attack.execution - attack.stealth - attack.t1203 - attack.privilege-escalation - attack.t1068 - attack.t1211 - attack.credential-access - attack.t1212 - attack.lateral-movement - attack.t1210 - attack.impact - attack.t1499.004 logsource: product: windows service: application detection: selection: Provider_Name: - Microsoft-Windows-Audit-CVE - Audit-CVE EventID: 1 condition: selection falsepositives: - Unknown level: critical
Query: detection rule: Detects Obfuscated use of stdin to execute PowerShell
Matching passage: Sigma rule: Detects Obfuscated use of stdin to execute PowerShell. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation STDIN+ Launcher - Powershell id: 779c8c12-0eb1-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of stdin to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|re: cmd.{0,5}(?:/c|/r).+powershell.+(?:\$?\{?input\}?|noexit).+" condition: selection_4104 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Identifies the deletion of Azure Kubernetes Pods.. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes Pods Deleted id: b02f9591-12c3-4965-986a-88028629b2e1 status: test description: Identifies the deletion of Azure Kubernetes Pods. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://github.com/elastic/detection-rules/blob/065bf48a9987cd8bd826c098a30ce36e6868ee46/rules/integrations/azure/impact_kubernetes_pod_deleted.toml author: Austin Songer @austinsonger date: 2021-07-24 modified: 2022-08-23 tags: - attack.impact logsource: product: azure service: activitylogs detection: selection: operationName: MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/PODS/DELETE condition: selection falsepositives: - Pods may be deleted by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Pods deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: patch priority for CVE-2015-1709
Matching passage: CVE-2015-1709. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-7201. CWE: CWE-119. CVSS: 10.0. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Query: describe CVE-2015-1062
Matching passage: CVE-2015-1062. CWE: CWE-19. CVSS: 5.0. MobileStorageMounter in Apple iOS before 8.2 and Apple TV before 7.1 does not delete invalid disk-image folders, which allows attackers to create folders in arbitrary filesystem locations via a crafted app.
Near-miss passage: CVE-2015-0621. CWE: CWE-19. CVSS: 7.800000190734863. Cisco TelePresence MCU devices with software 4.5(1.45) allow remote attackers to cause a denial of service (device reload) via an unspecified series of TCP packets, aka Bug ID CSCur50347.
Query: patch priority for CVE-2015-9359
Matching passage: CVE-2015-9359. CWE: CWE-79. CVSS: 6.099999904632568. The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg().
Near-miss passage: CVE-2015-8006. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the PageTriage toolbar in the PageTriage extension for MediWiki allows remote attackers to inject arbitrary web script or HTML via the page title.
Query: exploit Active Directory in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allows remote authenticated users to cause a denial of service (service outage) by crea
Matching passage: CVE-2015-2535. CWE: CWE-17. CVSS: 4.0. Active Directory in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allows remote authenticated users to cause a denial of service (service outage) by creating multiple machine accounts, aka "Active Directory Denial of Service Vulnerability."
Near-miss passage: CVE-2015-1361. CWE: CWE-17. CVSS: 6.800000190734863. platform/image-decoders/ImageFrame.h in Blink, as used in Google Chrome before 40.0.2214.91, does not initialize a variable that is used in calls to the Skia SkBitmap::setAlphaType function, which might allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted HTML document, a different vulnerability than CVE-2015-1205.
Query: patch priority for CVE-2015-5287
Matching passage: CVE-2015-5287. CWE: CWE-59. CVSS: 6.900000095367432. The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.
Near-miss passage: CVE-2015-1377. CWE: CWE-59. CVSS: 4.900000095367432. The Read Mail module in Webmin 1.720 allows local users to read arbitrary files via a symlink attack on an unspecified file.
Query: playbook for alert: Suspicious Windows Service execution detected on endpoint
Matching passage: Playbook for T1543.003 Windows Service. 1) Validate alert telemetry against T1543.003. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: persistence, privilege escalation. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.(Citation: TechNet Services) Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in th
Near-miss passage: Playbook for T1543.001 Launch Agent. Different response path focused on persistence, privilege escalation.
Query: vulnerability: Blue Coat Unified Agent before 4.6.2 does not prevent modification of its configuration files when running in local enforcement mode, which allows local administrators to unblock c
Matching passage: CVE-2015-8482. CWE: CWE-264. CVSS: 2.0999999046325684. Blue Coat Unified Agent before 4.6.2 does not prevent modification of its configuration files when running in local enforcement mode, which allows local administrators to unblock categories or disable the agent via unspecified vectors.
Near-miss passage: CVE-2015-5897. CWE: CWE-264. CVSS: 4.599999904632568. The Address Book framework in Apple OS X before 10.11 allows local users to gain privileges by using an environment variable to inject code into processes that rely on this framework.
Query: Sigma rule for Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory
Matching passage: Sigma rule: Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory. Logsource: windows / process_creation. Rule: title: HackTool - Dumpert Process Dumper Execution id: 2704ab9e-afe2-4854-a3b1-0c0706d03578 status: test description: Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory references: - https://github.com/outflanknl/Dumpert - https://unit42.paloaltonetworks.com/actors-still-exploiting-sharepoint-vulnerability/ author: Florian Roth (Nextron Systems) date: 2020-02-04 modified: 2025-01-22 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: - Hashes|contains: MD5=09D278F9DE118EF09163C6140255C690 - CommandLine|contains: Dumpert.dll condition: selection falsepositives: - Very unlikely level: critical
Near-miss passage: Sigma rule: Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauth. Logsource: aws / cloudtrail. Rule: title: Modification or Deletion of an AWS RDS Cluster id: 457cc9ac-d8e6-4d1d-8c0e-251d0f11a74c status: experimental description: Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information. references: - https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBCluster.html - https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBCluster.html - https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc#rds-modifydbinstance author: Ivan Saakov date: 2024-12-06 tags: - attack.exfiltration - attack.t1020 logsource: product: aws service: cloudtrail detection: selection: eventSource: rds.amazonaws.com eventName: - ModifyDBCluster - DeleteDBCluster condition: selection falsepositives: - Verify if the modification or deletion was performed by an authorized administrator. - Confirm if the modification or deletion was part of a planned change or maintenance activity. level: high