alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the networ
Matching passage: Sigma rule: Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the networ. Logsource: windows / security. Rule: title: T1047 Wmiprvse Wbemcomn DLL Hijack id: f6c68d5f-e101-4b86-8c84-7d96851fd65c status: test description: Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario. references: - https://threathunterplaybook.com/hunts/windows/201009-RemoteWMIWbemcomnDLLHijack/notebook.html author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR) date: 2020-10-12 modified: 2022-02-24 tags: - attack.execution - attack.t1047 - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: security detection: selection: EventID: 5145 RelativeTargetName|endswith: \wbem\wbemcomn.dll filter: SubjectUserName|endswith: $ condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).. Logsource: windows / security. Rule: title: SMB Create Remote File Admin Share id: b210394c-ba12-4f89-9117-44a2464b9511 status: test description: Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$). references: - https://github.com/OTRF/ThreatHunter-Playbook/blob/f7a58156dbfc9b019f17f638b8c62d22e557d350/playbooks/WIN-201012004336.yaml - https://securitydatasets.com/notebooks/atomic/windows/lateral_movement/SDWIN-200806015757.html?highlight=create%20file author: Jose Rodriguez (@Cyb3rPandaH), OTR (Open Threat Research) date: 2020-08-06 modified: 2025-10-17 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: security detection: selection: EventID: 5145 ShareName|endswith: C$ AccessMask: '0x2' filter_main_subjectusername: SubjectUserName|endswith: $ filter_optional_local_ip: IpAddress: ::1 condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Query: vulnerability: Multiple SQL injection vulnerabilities in the User Dashboard module 7.x before 7.x-1.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Matching passage: CVE-2015-7877. CWE: CWE-89. CVSS: 9.800000190734863. Multiple SQL injection vulnerabilities in the User Dashboard module 7.x before 7.x-1.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-5078. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the insert function in application/controllers/admin/dataentry.php in LimeSurvey 2.06+ allows remote authenticated users to execute arbitrary SQL commands via the closedate parameter.
Query: how to detect Cloud Account
Matching passage: T1087.004 Cloud Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. With authenticated access there are several tools that can be used to find accounts. The <code>Get-MsolRoleMember</code> PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365.(Citation: Microsoft msolrolemember)(Citation: GitHub Raindance) The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command <code>az ad user list</code> will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018) The AWS command <code>aws iam list-users</code> may be used to obtain a list of users in the current account while <code>aws iam list-roles</code> can obtain IAM roles that have a specified path prefix.(Citation: AWS List Roles)(Citation: AWS List Users) In GCP, <code>gcloud iam service-accounts list</code> and <code>gcloud projects get-iam-policy</code> may be used to obtain a listing of service accounts and users in a project.(Citation: Google Cloud - IAM Servie Accounts List API)
Near-miss passage: T1087 Account Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)). Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment. For examples, cloud environments typically provide easily accessible interfaces to obtain user lists.(Citation: AWS List Users)(Citation: Google Cloud - IAM Servie Accounts List API) On hosts, adversaries can use default [PowerShell](https://attack.mitre.org/techniques/T1059/001) and other command line functionality to identify accounts. Information about email addresses and accounts may also be extracted by searching an infected system’s files.
Query: alert when Detects a highly relevant Antivirus alert that reports password dumpers and stealers. This event must not be ignored jus
Matching passage: Sigma rule: Detects a highly relevant Antivirus alert that reports password dumpers and stealers. This event must not be ignored jus. Logsource: antivirus. Rule: title: Antivirus - Password Dumper Signature id: 78cc2dd2-7d20-4d32-93ff-057084c38b93 status: stable description: 'Detects a highly relevant Antivirus alert that reports password dumpers and stealers. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset. ' references: - https://www.nextron-systems.com/?s=antivirus - https://www.virustotal.com/gui/file/5fcda49ee7f202559a6cbbb34edb65c33c9a1e0bde9fa2af06a6f11b55ded619 - https://www.virustotal.com/gui/file/a4edfbd42595d5bddb442c82a02cf0aaa10893c1bf79ea08b9ce576f82749448 author: Florian Roth (Nextron Systems), Arnim Rupp date: 2018-09-09 modified: 2026-06-15 tags: - attack.credential-access - attack.t1003 - attack.t1558 - attack.t1003.001 - attack.t1003.002 logsource: category: antivirus detection: selection: - Signature|startswith: PWS - Signature|contains: - Certify - DCSync - Creddump - DumpCreds - DumpLsass - DumpPert - FormBook - HTool/WCE - Kekeo - Lazagne - LsassDump - Lummast - Mimikatz - MultiDump - Multiverze - Nanodump - NativeDump - Outflank - PShlSpy - PSWTool - PWCrack - PWDump - PWS. - PWSX - pypykatz - Rubeus - SafetyKatz - SecurityTool - SharpChrome - SharpDPAPI - SharpDump - SharpKatz - SharpS. - ShpKatz - Steal - TrickDump - wsass condition: selection falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: Detects when a Security Compliance Center reported a user who exceeded sending limits of the service policies and becaus. Logsource: m365 / threat_management. Rule: title: Microsoft 365 - User Restricted from Sending Email id: ff246f56-7f24-402a-baca-b86540e3925c status: test description: Detects when a Security Compliance Center reported a user who exceeded sending limits of the service policies and because of this has been restricted from sending email. references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: austinsonger date: 2021-08-19 modified: 2022-10-09 tags: - attack.initial-access - attack.t1199 logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: User restricted from sending email status: success condition: selection falsepositives: - Unknown level: medium
Query: exploit mediaserver in Android before 5.1.1 LMY48X allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors
Matching passage: CVE-2015-8074. CWE: CWE-200. CVSS: 5.0. mediaserver in Android before 5.1.1 LMY48X allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, aka internal bugs 23540907 and 23515142, a different vulnerability than CVE-2015-6611.
Near-miss passage: CVE-2015-7032. CWE: CWE-200. CVSS: 4.300000190734863. The Apple iWork application before 2.6 for iOS, Apple Keynote before 6.6, Apple Pages before 5.6, and Apple Numbers before 3.6 allow remote attackers to obtain sensitive information via a crafted document.
Query: patch priority for CVE-2015-4190
Matching passage: CVE-2015-4190. CWE: UNKNOWN. CVSS: 4.300000190734863. Cisco Cloud Portal in Cisco Prime Service Catalog 9.4.1_vortex on Cloud Portal appliances allows man-in-the-middle attackers to modify data via unspecified vectors, aka Bug ID CSCuh19683.
Near-miss passage: CVE-2015-0470. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in Oracle Java SE 8u40 allows remote attackers to affect integrity via unknown vectors related to Hotspot.
Query: patch priority for CVE-2015-1009
Matching passage: CVE-2015-1009. CWE: CWE-200. CVSS: 1.7000000476837158. Schneider Electric InduSoft Web Studio before 7.1.3.5 Patch 5 and Wonderware InTouch Machine Edition through 7.1 SP3 Patch 4 use cleartext for project-window password storage, which allows local users to obtain sensitive information by reading a file.
Near-miss passage: CVE-2015-5860. CWE: CWE-200. CVSS: 5.0. The CFNetwork HTTPProtocol component in Apple iOS before 9 mishandles HSTS state, which allows remote attackers to bypass the Safari private-browsing protection mechanism and track users via a crafted web site.
Query: vulnerability: Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier does not properly implement access control for IPC messages, which allows local users to write to arbitrary files vi
Matching passage: CVE-2015-0663. CWE: CWE-264. CVSS: 6.599999904632568. Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier does not properly implement access control for IPC messages, which allows local users to write to arbitrary files via crafted messages, aka Bug ID CSCus79392.
Near-miss passage: CVE-2015-0223. CWE: CWE-264. CVSS: 5.0. Unspecified vulnerability in Apache Qpid 0.30 and earlier allows remote attackers to bypass access restrictions on qpidd via unknown vectors, related to 0-10 connection handling.
Query: detection rule: Detects execution of "certutil" with the "addstore" flag in order to install a new certificate on the system. Adversarie
Matching passage: Sigma rule: Detects execution of "certutil" with the "addstore" flag in order to install a new certificate on the system. Adversarie. Logsource: windows / process_creation. Rule: title: New Root Certificate Installed Via Certutil.EXE id: d2125259-ddea-4c1c-9c22-977eb5b29cf0 related: - id: 42821614-9264-4761-acfc-5772c3286f76 type: derived - id: 46591fae-7a4c-46ea-aec3-dff5e6d785dc type: obsolete status: test description: 'Detects execution of "certutil" with the "addstore" flag in order to install a new certificate on the system. Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md author: oscd.community, @redcanary, Zach Stanford @svch0st date: 2023-03-05 modified: 2024-03-05 tags: - attack.defense-impairment - attack.t1553.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certutil.exe - OriginalFileName: CertUtil.exe selection_cli_add: CommandLine|contains|windash: -addstore selection_cli_store: CommandLine|contains: root condition: all of selection_* falsepositives: - Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to test if GPO push doesn't trigger FP level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_certificate_installation/info.yml
Near-miss passage: Sigma rule: Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child p. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Execution From Parent Process In Public Folder id: 69bd9b97-2be2-41b6-9816-fb08757a4d1a status: test description: 'Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines. ' references: - https://redcanary.com/blog/blackbyte-ransomware/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-02-25 modified: 2024-07-12 tags: - attack.execution - attack.stealth - attack.t1564 - attack.t1059 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|contains: :\Users\Public\ selection_child: - Image|endswith: - \bitsadmin.exe - \certutil.exe - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - CommandLine|contains: - bitsadmin - certutil - cscript - mshta - powershell - regsvr32 - rundll32 - wscript condition: all of selection_* falsepositives: - Unknown level: high
Query: rule covering Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several
Matching passage: Sigma rule: Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several. Logsource: windows / ps_script. Rule: title: Dump Credentials from Windows Credential Manager With PowerShell id: 99c49d9c-34ea-45f7-84a7-4751ae6b2cbc status: test description: 'Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555/T1555.md author: frack113 date: 2021-12-20 modified: 2022-12-25 tags: - attack.credential-access - attack.t1555 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_kiddie: ScriptBlockText|contains: - Get-PasswordVaultCredentials - Get-CredManCreds selection_rename_Password: ScriptBlockText|contains|all: - New-Object - Windows.Security.Credentials.PasswordVault selection_rename_credman: ScriptBlockText|contains|all: - New-Object - Microsoft.CSharp.CSharpCodeProvider - '[System.Runtime.InteropServices.RuntimeEnvironment]::GetRuntimeDirectory())' - Collections.ArrayList - System.CodeDom.Compiler.CompilerParameters condition: 1 of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects instances where an SMB service on an OpenCanary node has had a file open request.. Logsource: opencanary / application. Rule: title: OpenCanary - SMB File Open Request id: 22777c9e-873a-4b49-855f-6072ab861a52 status: test description: Detects instances where an SMB service on an OpenCanary node has had a file open request. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.lateral-movement - attack.collection - attack.t1021 - attack.t1005 logsource: category: application product: opencanary detection: selection: logtype: 5000 condition: selection falsepositives: - Unlikely level: high
Query: patch priority for CVE-2015-3921
Matching passage: CVE-2015-3921. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in contact.php in Coppermine Photo Gallery before 1.5.36 allows remote authenticated users to inject arbitrary web script or HTML via the referer parameter.
Near-miss passage: CVE-2015-2195. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the WP Media Cleaner plugin 2.2.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) view, (2) paged, or (3) s parameter in the wp-media-cleaner page to wp-admin/upload.php.
Query: describe CVE-2015-1942
Matching passage: CVE-2015-1942. CWE: CWE-20. CVSS: 9.300000190734863. The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to write to arbitrary files, and subsequently execute these files, via a crafted TCP packet to an unspecified port.
Near-miss passage: CVE-2015-0597. CWE: CWE-20. CVSS: 5.0. The Forgot Password feature in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to enumerate administrative accounts via crafted packets, aka Bug IDs CSCuj67166 and CSCuj67159.
Query: CVE similar to CVE-2015-5284
Matching passage: CVE-2015-5284. CWE: CWE-200. CVSS: 9.800000190734863. ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable.
Near-miss passage: CVE-2015-5383. CWE: CWE-200. CVSS: 7.5. Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.
Query: describe CVE-2015-7336
Matching passage: CVE-2015-7336. CWE: CWE-347. CVSS: 7.5. MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior that could allow the signature check of an update to be bypassed.
Near-miss passage: CVE-2015-3298. CWE: CWE-347. CVSS: 8.800000190734863. Yubico ykneo-openpgp before 1.0.10 has a typo in which an invalid PIN can be used. When first powered up, a signature will be issued even though the PIN has not been validated.
Query: detect Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-d in logs
Matching passage: Sigma rule: Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-d. Logsource: windows / process_creation. Rule: title: Potential Mpclient.DLL Sideloading Via Defender Binaries id: 7002aa10-b8d4-47ae-b5ba-51ab07e228b9 related: - id: 418dc89a-9808-4b87-b1d7-e5ae0cb6effc type: similar status: test description: Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory. references: - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool author: Bhabesh Raj date: 2022-08-01 modified: 2023-08-04 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: process_creation detection: selection: Image|endswith: - \MpCmdRun.exe - \NisSrv.exe filter_main_known_locations: Image|startswith: - C:\Program Files (x86)\Windows Defender\ - C:\Program Files\Microsoft Security Client\ - C:\Program Files\Windows Defender\ - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for. Logsource: windows / process_creation. Rule: title: Msiexec Quiet Installation id: 79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5 status: test description: 'Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi) ' references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md - https://twitter.com/_st0pp3r_/status/1583914244344799235 author: frack113 date: 2022-01-16 modified: 2026-07-28 tags: - attack.stealth - attack.t1218.007 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \msiexec.exe - OriginalFileName: msiexec.exe selection_cli: CommandLine|contains|windash: - -i - -package - -a - -j selection_quiet: CommandLine|contains|windash: -q filter_main_system_temp: ParentImage|startswith: C:\Windows\Temp\ filter_main_ccm: ParentImage: C:\Windows\CCM\Ccm32BitLauncher.exe IntegrityLevel: - System - S-1-16-16384 filter_optional_user_temp: ParentImage|startswith: C:\Users\ ParentImage|contains: \AppData\Local\Temp\ filter_optional_wsl: ParentImage|endswith: C:\Windows\System32\wsl.exe Image|endswith: C:\Windows\System32\msiexec.exe condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - WindowsApps installing updates via the quiet flag level: medium
Query: weakness Observable Behavioral Discrepancy With Equivalent Products
Matching passage: CWE-207 Observable Behavioral Discrepancy With Equivalent Products. The product operates in an environment in which its existence or specific identity should not be known, but it behaves differently than other products with equivalent functionality, in a way that is observable to an attacker.
Near-miss passage: CWE-683 Function Call With Incorrect Order of Arguments. The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order, leading to resultant weaknesses.
Query: risk of The Render cache system in Drupal 7.x before 7.38, when used to cache content by user role, allows remote authenticated users to obtain private content viewed by user 1 by reading 
Matching passage: CVE-2015-3231. CWE: CWE-200. CVSS: 4.0. The Render cache system in Drupal 7.x before 7.38, when used to cache content by user role, allows remote authenticated users to obtain private content viewed by user 1 by reading the cache.
Near-miss passage: CVE-2015-8079. CWE: CWE-200. CVSS: 5.300000190734863. qt5-qtwebkit before 5.4 records private browsing URLs to its favicon database, WebpageIcons.db.