alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems sin
Matching passage: Sigma rule: Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems sin. Logsource: windows / process_creation. Rule: title: Suspicious Kernel Dump Using Dtrace id: 7124aebe-4cd7-4ccb-8df0-6d6b93c96795 status: test description: Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1 references: - https://twitter.com/0gtweet/status/1474899714290208777?s=12 - https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/dtrace author: Florian Roth (Nextron Systems) date: 2021-12-28 tags: - attack.discovery - attack.t1082 logsource: product: windows category: process_creation detection: selection_plain: Image|endswith: \dtrace.exe CommandLine|contains: lkd(0) selection_obfuscated: CommandLine|contains|all: - syscall:::return - lkd( condition: 1 of selection* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_dtrace_kernel_dump/info.yml
Near-miss passage: Sigma rule: Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argum. Logsource: windows / image_load. Rule: title: WMIC Loading Scripting Libraries id: 06ce37c2-61ab-4f05-9ff5-b1a96d18ae32 related: - id: 8d63dadf-b91b-4187-87b6-34a1114577ea type: similar - id: 05c36dd6-79d6-4a9a-97da-3db20298ab2d type: similar status: test description: 'Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argument switch to download and execute an XSL file (i.e js, vbs, etc). It could be an indicator of SquiblyTwo technique, which uses Windows Management Instrumentation (WMI) to execute malicious code. ' references: - https://securitydatasets.com/notebooks/atomic/windows/defense_evasion/SDWIN-201017061100.html - https://twitter.com/dez_/status/986614411711442944 - https://lolbas-project.github.io/lolbas/Binaries/Wmic/ author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-17 modified: 2022-10-13 tags: - attack.stealth - attack.t1220 logsource: category: image_load product: windows detection: selection: Image|endswith: \wmic.exe ImageLoaded|endswith: - \jscript.dll - \vbscript.dll condition: selection falsepositives: - The command wmic os get lastbootuptime loads vbscript.dll - The command wmic os get locale loads vbscript.dll - Since the ImageLoad event doesn't have enough information in this case. It's better to look at the recent process creation events that spawned the WMIC process and investigate the command line and parent/child processes to get more insights - The command `wmic ntevent` loads vbscript.dll level: medium
Query: describe CVE-2015-2978
Matching passage: CVE-2015-2978. CWE: CWE-287. CVSS: 5.0. Webservice-DIC yoyaku_v41 allows remote attackers to bypass authentication and complete a conference-room reservation via unspecified vectors, as demonstrated by an "unintentional reservation."
Near-miss passage: CVE-2015-10083. CWE: CWE-287. CVSS: 9.800000190734863. A vulnerability has been found in harrystech Dynosaur-Rails and classified as critical. Affected by this vulnerability is the function basic_auth of the file app/controllers/application_controller.rb. The manipulation leads to improper authentication. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 04b223813f0e336aab50bff140d0f5889c31dbec. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-221503.
Query: weakness EJB Bad Practices: Use of AWT Swing
Matching passage: CWE-575 EJB Bad Practices: Use of AWT Swing. The product violates the Enterprise JavaBeans (EJB) specification by using AWT/Swing.
Near-miss passage: CWE-285 Improper Authorization. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Query: common weakness: Insufficient Encapsulation of Machine-Dependent Functionality
Matching passage: CWE-1105 Insufficient Encapsulation of Machine-Dependent Functionality. The product or code uses machine-dependent functionality, but it does not sufficiently encapsulate or isolate this functionality from the rest of the code.
Near-miss passage: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion'). The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Query: Sigma rule for Detects execution of "VSDiagnostics.exe" with the "start" command in order to launch and proxy arbitrary binaries.
Matching passage: Sigma rule: Detects execution of "VSDiagnostics.exe" with the "start" command in order to launch and proxy arbitrary binaries.. Logsource: windows / process_creation. Rule: title: Potential Binary Proxy Execution Via VSDiagnostics.EXE id: ac1c92b4-ac81-405a-9978-4604d78cc47e status: test description: Detects execution of "VSDiagnostics.exe" with the "start" command in order to launch and proxy arbitrary binaries. references: - https://twitter.com/0xBoku/status/1679200664013135872 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-03 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \VSDiagnostics.exe - OriginalFileName: VSDiagnostics.exe selection_cli_start: CommandLine|contains: start selection_cli_launch: CommandLine|contains: - ' /launch:' - ' -launch:' condition: all of selection_* falsepositives: - Legitimate usage for tracing and diagnostics purposes level: medium
Near-miss passage: Sigma rule: Detects a "regsvr32" execution where the DLL doesn't contain a common file extension.. Logsource: windows / process_creation. Rule: title: Regsvr32 DLL Execution With Uncommon Extension id: 50919691-7302-437f-8e10-1fe088afa145 status: test description: Detects a "regsvr32" execution where the DLL doesn't contain a common file extension. references: - https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/ author: Florian Roth (Nextron Systems) date: 2019-07-17 modified: 2023-05-24 tags: - attack.privilege-escalation - attack.persistence - attack.stealth - attack.t1574 - attack.execution logsource: category: process_creation product: windows detection: selection: - Image|endswith: \regsvr32.exe - OriginalFileName: REGSVR32.EXE filter_main_legit_ext: CommandLine|contains: - .ax - .cpl - .dll - .ocx filter_optional_pascal: CommandLine|contains: .ppl filter_optional_avg: CommandLine|contains: .bav filter_main_null_4688: CommandLine: null filter_main_empty_4688: CommandLine: '' condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Other legitimate extensions currently not in the list either from third party or specific Windows components. level: medium
Query: write Sigma for Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-d
Matching passage: Sigma rule: Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-d. Logsource: windows / image_load. Rule: title: Potential Mpclient.DLL Sideloading id: 418dc89a-9808-4b87-b1d7-e5ae0cb6effc related: - id: 7002aa10-b8d4-47ae-b5ba-51ab07e228b9 type: similar status: test description: Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory. references: - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool author: Bhabesh Raj date: 2022-08-02 modified: 2023-08-04 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: image_load detection: selection: ImageLoaded|endswith: \mpclient.dll Image|endswith: - \MpCmdRun.exe - \NisSrv.exe filter_main_known_locations: Image|startswith: - C:\Program Files (x86)\Windows Defender\ - C:\Program Files\Microsoft Security Client\ - C:\Program Files\Windows Defender\ - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects programs on a Windows system that should not write an archive to disk. Logsource: windows / file_event. Rule: title: Legitimate Application Dropped Archive id: 654fcc6d-840d-4844-9b07-2c3300e54a26 status: test description: Detects programs on a Windows system that should not write an archive to disk references: - https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326 author: frack113, Florian Roth date: 2022-08-21 tags: - attack.stealth - attack.t1218 logsource: product: windows category: file_event detection: selection: Image|endswith: - \winword.exe - \excel.exe - \powerpnt.exe - \msaccess.exe - \mspub.exe - \eqnedt32.exe - \visio.exe - \wordpad.exe - \wordview.exe - \certutil.exe - \certoc.exe - \CertReq.exe - \Desktopimgdownldr.exe - \esentutl.exe - \finger.exe - \notepad.exe - \AcroRd32.exe - \RdrCEF.exe - \mshta.exe - \hh.exe TargetFilename|endswith: - .zip - .rar - .7z - .diagcab - .appx condition: selection falsepositives: - Unknown level: high
Query: threat report mentioning Application Layer Protocol
Matching passage: T1071 Application Layer Protocol. Tactics: command and control. Description: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.(Citation: Mandiant APT29 Eye Spy Email Nov 22)
Near-miss passage: T1071.002 File Transfer Protocols. Tactics: command and control. Description: Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as SMB(Citation: US-CERT TA18-074A), FTP(Citation: ESET Machete July 2019), FTPS, and TFTP that transfer files may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the transferred files. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) label value of an item 
Matching passage: CVE-2015-7562. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) label value of an item or (2) name of a role.
Near-miss passage: CVE-2015-5035. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-5036.
Query: patch priority for CVE-2015-3795
Matching passage: CVE-2015-3795. CWE: CWE-119. CVSS: 9.300000190734863. libxpc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app that sends a malformed XPC message.
Near-miss passage: CVE-2015-3873. CWE: CWE-119. CVSS: 10.0. libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 23016072, 23248776, 23247055, 22845824, 22008959, 21814993, 21048776, 20718524, 20674674, 22388975, 20674086, 21443020, and 22077698, a different vulnerability than CVE-2015-7716.
Query: rule covering Detects installation of NalDrv or PROCEXP152 services via registry-keys to non-system32 folders. Both services are used
Matching passage: Sigma rule: Detects installation of NalDrv or PROCEXP152 services via registry-keys to non-system32 folders. Both services are used. Logsource: windows / registry_set. Rule: title: Suspicious Service Installed id: f2485272-a156-4773-82d7-1d178bc4905b status: test description: 'Detects installation of NalDrv or PROCEXP152 services via registry-keys to non-system32 folders. Both services are used in the tool Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU (https://github.com/hfiref0x/KDU) ' references: - https://web.archive.org/web/20200419024230/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/ author: xknow (@xknow_infosec), xorxes (@xor_xes) date: 2019-04-08 modified: 2026-06-29 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject: - HKLM\System\CurrentControlSet\Services\NalDrv\ImagePath - HKLM\System\CurrentControlSet\Services\PROCEXP152\ImagePath filter: Image|endswith: - \procexp64.exe - \procexp64a.exe - \procexp.exe - \procmon64.exe - \procmon64a.exe - \procmon.exe - \handle.exe - \handle64.exe - \handle64a.exe Details|contains: \WINDOWS\system32\Drivers\PROCEXP152.SYS condition: selection and not filter falsepositives: - Other legimate tools using this service names and drivers. Note - clever attackers may easily bypass this detection by just renaming the services. Therefore just Medium-level and don't rely on it. level: medium
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via use Clip.exe in Scripts. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation Via Use Clip - Powershell id: db92dd33-a3ad-49cf-8c2c-608c3e30ace0 status: test description: Detects Obfuscated Powershell via use Clip.exe in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-09 modified: 2024-04-15 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|re: (?i)echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?e`?) condition: selection_4104 falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-0937
Matching passage: CVE-2015-0937. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in search.php on the Blue Coat Malware Analysis appliance with software before 4.2.4.20150312-RELEASE allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-9412. CWE: CWE-79. CVSS: 6.099999904632568. The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter.
Query: describe CVE-2015-3965
Matching passage: CVE-2015-3965. CWE: CWE-264. CVSS: 8.800000190734863. Hospira Symbiq Infusion System 3.13 and earlier allows remote authenticated users to trigger "unanticipated operations" by leveraging "elevated privileges" for an unspecified call to an incorrectly exposed function.
Near-miss passage: CVE-2015-3617. CWE: CWE-264. CVSS: 7.800000190734863. Fortinet FortiManager 5.0 before 5.0.11 and 5.2 before 5.2.2 allow local users to gain privileges via crafted CLI commands.
Query: rule covering Detects creation of a local user via PowerShell
Matching passage: Sigma rule: Detects creation of a local user via PowerShell. Logsource: windows / ps_script. Rule: title: PowerShell Create Local User id: 243de76f-4725-4f2e-8225-a8a69b15ad61 status: test description: Detects creation of a local user via PowerShell references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.001/T1136.001.md author: '@ROxPinTeddy' date: 2020-04-11 modified: 2022-12-25 tags: - attack.execution - attack.t1059.001 - attack.persistence - attack.t1136.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: New-LocalUser condition: selection falsepositives: - Legitimate user creation level: medium
Near-miss passage: Sigma rule: Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace. Logsource: windows / process_access. Rule: title: Credential Dumping Attempt Via WerFault id: e5b33f7d-eb93-48b6-9851-09e1e610b6d7 status: test description: Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up. references: - https://github.com/helpsystems/nanodump/commit/578116faea3d278d53d70ea932e2bbfe42569507 author: Florian Roth (Nextron Systems) date: 2012-06-27 modified: 2023-11-29 tags: - attack.credential-access - attack.t1003.001 - attack.s0002 logsource: category: process_access product: windows detection: selection: SourceImage|endswith: \WerFault.exe TargetImage|endswith: \lsass.exe GrantedAccess: '0x1FFFFF' condition: selection falsepositives: - Actual failures in lsass.exe that trigger a crash dump (unlikely) - Unknown cases in which WerFault accesses lsass.exe level: high
Query: describe CVE-2015-4688
Matching passage: CVE-2015-4688. CWE: CWE-200. CVSS: 5.300000190734863. Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allow remote attackers to enumerate user accounts via a series of requests.
Near-miss passage: CVE-2015-3373. CWE: CWE-200. CVSS: 5.0. The Amazon AWS module before 7.x-1.3 for Drupal uses the base URL and AWS access key to generate the access token, which makes it easier for remote attackers to guess the token value and create backups via a crafted URL.
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in Visualware MyConnection Server 8.2b allow remote attackers to inject arbitrary web script or HTML via the (1) bt, (2) variabl
Matching passage: CVE-2015-2043. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Visualware MyConnection Server 8.2b allow remote attackers to inject arbitrary web script or HTML via the (1) bt, (2) variable, or (3) et parameter to myspeed/db/historyitem.
Near-miss passage: CVE-2015-2031. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: exploit Multiple open redirect vulnerabilities in the Tadaa! module before 7.x-1.4 for Drupal allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks v
Matching passage: CVE-2015-3358. CWE: UNKNOWN. CVSS: 5.800000190734863. Multiple open redirect vulnerabilities in the Tadaa! module before 7.x-1.4 for Drupal allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a destination parameter, related to callbacks that (1) enable and disable modules or (2) change variables.
Near-miss passage: CVE-2015-4760. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
Query: detection engineering for Employee Names
Matching passage: T1589.003 Employee Names. Tactics: reconnaissance. Description: Adversaries may gather employee names that can be used during targeting. Employee names be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures. Adversaries may easily gather employee names, since they may be readily available and exposed via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
Near-miss passage: T1589.002 Email Addresses. Tactics: reconnaissance. Description: Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees. Adversaries may easily gather email addresses, since they may be readily available and exposed via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: HackersArise Email)(Citation: CNET Leaks) Email addresses could also be enumerated via more active means (i.e. [Active Scanning](https://attack.mitre.org/techniques/T1595)), such as probing and analyzing responses from authentication services that may reveal valid usernames in a system.(Citation: GrimBlog UsernameEnum) For example, adversaries may be able to enumerate email addresses in Office 365 environments by querying a variety of publicly available API endpoints, such as autodiscover and GetCredentialType.(Citation: GitHub Office 365 User Enumeration)(Citation: Azure Active Directory Reconnaisance) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Email Accounts](https://attack.mitre.org/techniques/T1586/002)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Brute Force](https://attack.mitre.org/techniques/T1110) via [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Query: patch priority for CVE-2015-2819
Matching passage: CVE-2015-2819. CWE: CWE-20. CVSS: 5.0. SAP Sybase SQL Anywhere 11 and 16 allows remote attackers to cause a denial of service (crash) via a crafted request, aka SAP Security Note 2108161.
Near-miss passage: CVE-2015-7551. CWE: CWE-20. CVSS: 8.399999618530273. The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2 before 2.2.4, as distributed in Apple OS X before 10.11.4 and other products, mishandles tainting, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string, related to the DL module and the libffi library. NOTE: this vulnerability exists because of a CVE-2009-5147 regression.