alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic
Matching passage: Sigma rule: Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic. Logsource: windows / security. Rule: title: HackTool - EDRSilencer Execution - Filter Added id: 98054878-5eab-434c-85d4-72d4e5a3361b status: test description: 'Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names. ' references: - https://github.com/netero1010/EDRSilencer author: Thodoris Polyzos (@SmoothDeploy) date: 2024-01-29 modified: 2024-01-30 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: security definition: 'Requirements: Audit Filtering Platform Policy Change needs to be enabled' detection: selection: EventID: - 5441 - 5447 FilterName|contains: Custom Outbound Filter condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option. Logsource: macos / process_creation. Rule: title: Hidden User Creation id: b22a5b36-2431-493a-8be1-0bae56c28ef3 status: test description: Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.002/T1564.002.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-10 modified: 2021-11-27 tags: - attack.stealth - attack.t1564.002 logsource: category: process_creation product: macos detection: dscl_create: Image|endswith: /dscl CommandLine|contains: create id_below_500: CommandLine|contains: UniqueID CommandLine|re: ([0-9]|[1-9][0-9]|[1-4][0-9]{2}) ishidden_option_declaration: CommandLine|contains: IsHidden ishidden_option_confirmation: CommandLine|contains: - 'true' - 'yes' - '1' condition: dscl_create and id_below_500 or dscl_create and (ishidden_option_declaration and ishidden_option_confirmation) falsepositives: - Legitimate administration activities level: medium
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of rundll32 with a command line that doesn't contain a common extension. Logsource: windows / process_creation. Rule: title: Rundll32 Execution With Uncommon DLL Extension id: c3a99af4-35a9-4668-879e-c09aeb4f2bdf status: test description: Detects the execution of rundll32 with a command line that doesn't contain a common extension references: - https://twitter.com/mrd0x/status/1481630810495139841?s=12 author: Tim Shelton, Florian Roth (Nextron Systems), Yassine Oukessou date: 2022-01-13 modified: 2024-04-04 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE filter_main_null: CommandLine: null filter_main_empty: CommandLine: '' filter_main_known_extension: - CommandLine|contains: - '.cpl ' - .cpl, - .cpl" - .cpl' - '.dll ' - .dll, - .dll" - .dll' - '.inf ' - .inf, - .inf" - .inf' - CommandLine|endswith: - .cpl - .dll - '.inf' filter_main_localserver: CommandLine|contains: ' -localserver ' filter_main_zzzzInvokeManagedCustomActionOutOfProc: ParentImage|endswith: \msiexec.exe CommandLine|contains|all: - :\Windows\Installer\ - .tmp - zzzzInvokeManagedCustomActionOutOfProc filter_optional_EdgeUpdate: ParentCommandLine|contains|all: - :\Users\ - \AppData\Local\Microsoft\EdgeUpdate\Install\{ - \EDGEMITMP_ - .tmp\setup.exe - --install-archive= - --previous-version= - --msedgewebview --verbose-logging --do-not-launch-msedge --user-level condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects remote RPC calls to create or execute a scheduled task. Logsource: rpc_firewall / application. Rule: title: Remote Schedule Task Lateral Movement via ITaskSchedulerService id: ace3ff54-e7fd-46bd-8ea0-74b49a0aca1d status: test description: Detects remote RPC calls to create or execute a scheduled task references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.lateral-movement - attack.t1053 - attack.t1053.002 logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:86d35949-83c9-4044-b424-db363231fd0c"' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 86d35949-83c9-4044-b424-db363231fd0c OpNum: - 1 - 3 - 4 - 10 - 11 - 12 - 13 - 14 - 15 condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-7863
Matching passage: CVE-2015-7863. CWE: CWE-254. CVSS: 5.0. The default configuration of Persistent Accelerite Radia Client Automation (formerly HP Client Automation) 7.9 through 9.1 before 2015-02-19 enables a remote Notify capability without the Extended Notify Security features, which might allow remote attackers to bypass intended access restrictions via unspecified vectors.
Near-miss passage: CVE-2015-8803. CWE: CWE-254. CVSS: 9.800000190734863. The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8805.
Query: CVE similar to CVE-2015-8704
Matching passage: CVE-2015-8704. CWE: CWE-20. CVSS: 6.5. apl_42.c in ISC BIND 9.x before 9.9.8-P3, 9.9.x, and 9.10.x before 9.10.3-P3 allows remote authenticated users to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed Address Prefix List (APL) record.
Near-miss passage: CVE-2015-4951. CWE: CWE-20. CVSS: 5.300000190734863. Client Acceptor Daemon (CAD) in the client in IBM Spectrum Protect (formerly Tivoli Storage Manager) 5.5 and 6.x before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before 7.1.3 allows remote attackers to cause a denial of service (daemon crash) via a crafted Web client URL.
Query: patch priority for CVE-2015-4074
Matching passage: CVE-2015-4074. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter in a ticket.download_attachment task.
Near-miss passage: CVE-2015-1198. CWE: CWE-22. CVSS: 7.5. Multiple directory traversal vulnerabilities in ha 0.999p+dfsg-5.
Query: risk of Heap-based buffer overflow in Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary cod
Matching passage: CVE-2015-6097. CWE: CWE-119. CVSS: 9.300000190734863. Heap-based buffer overflow in Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted Journal (.jnt) file, aka "Windows Journal Heap Overflow Vulnerability."
Near-miss passage: CVE-2015-9161. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, and SD 810, TOCTOU condition could lead to a buffer overflow in function playready_reader_bind().
Query: EDR alert: possible Modify Cloud Resource Hierarchy (T1666)
Matching passage: T1666 Modify Cloud Resource Hierarchy. Tactics: defense impairment. Description: Adversaries may attempt to modify hierarchical structures in infrastructure-as-a-service (IaaS) environments in order to evade defenses. IaaS environments often group resources into a hierarchy, enabling improved resource management and application of policies to relevant groups. Hierarchical structures differ among cloud providers. For example, in AWS environments, multiple accounts can be grouped under a single organization, while in Azure environments, multiple subscriptions can be grouped under a single management group.(Citation: AWS Organizations)(Citation: Microsoft Azure Resources) Adversaries may add, delete, or otherwise modify resource groups within an IaaS hierarchy. For example, in Azure environments, an adversary who has gained access to a Global Administrator account may create new subscriptions in which to deploy resources. They may also engage in subscription hijacking by transferring an existing pay-as-you-go subscription from a victim tenant to an adversary-controlled tenant. This will allow the adversary to use the victim’s compute resources without generating logs on the victim tenant.(Citation: Microsoft Peach Sandstorm 2023)(Citation: Microsoft Subscription Hijacking 2022) In AWS environments, adversaries with appropriate permissions in a given account may call the `LeaveOrganization` API, causing the account to be severed from the AWS Organization to which it was tied and removing any Service Control Policies, guardrails, or restrictions imposed upon it by its former Organization. Alternatively, adversaries may call the `CreateAccount` API in order to create a new account within an AWS Organization. This account will use the same payment methods registered to the payment account but may not be subject to existing detections or Service Control Policies.(Citation: AWS re Inforce Trust Mod)
Near-miss passage: T1553.002 Code Signing. Tactics: defense impairment. Description: Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. (Citation: Wikipedia Code Signing) The certificates used during an operation may be created, acquired, or stolen by the adversary. (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates) Unlike [Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001), this activity will result in a valid signature. Code signing to verify software on first run can be used on modern Windows and macOS systems. It is not used on Linux due to the decentralized nature of the platform. (Citation: Wikipedia Code Signing)(Citation: EclecticLightChecksonEXECodeSigning) Code signing certificates may be used to bypass security policies that require signed code to execute on a system.
Query: CVE similar to CVE-2015-7208
Matching passage: CVE-2015-7208. CWE: CWE-200. CVSS: 5.0. Mozilla Firefox before 43.0 stores cookies containing vertical tab characters, which allows remote attackers to obtain sensitive information by reading HTTP Cookie headers.
Near-miss passage: CVE-2015-0089. CWE: CWE-200. CVSS: 5.0. Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to obtain sensitive information from kernel memory, and possibly bypass the KASLR protection mechanism, via a crafted font, aka "Adobe Font Driver Information Disclosure Vulnerability," a different vulnerability than CVE-2015-0087.
Query: risk of The hub_activate function in drivers/usb/core/hub.c in the Linux kernel before 4.3.5 does not properly maintain a hub-interface data structure, which allows physically proximate at
Matching passage: CVE-2015-8816. CWE: UNKNOWN. CVSS: 6.800000190734863. The hub_activate function in drivers/usb/core/hub.c in the Linux kernel before 4.3.5 does not properly maintain a hub-interface data structure, which allows physically proximate attackers to cause a denial of service (invalid memory access and system crash) or possibly have unspecified other impact by unplugging a USB hub device.
Near-miss passage: CVE-2015-4824. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
Query: Sigma rule for Detects process creation events where the Image field lacks an absolute path, which occurs when the backing file no long
Matching passage: Sigma rule: Detects process creation events where the Image field lacks an absolute path, which occurs when the backing file no long. Logsource: windows / process_creation. Rule: title: Execution Of Non-Existing File id: 71158e3f-df67-472b-930e-7d287acaa3e1 status: test description: 'Detects process creation events where the Image field lacks an absolute path, which occurs when the backing file no longer exists on disk at the time of logging - commonly caused by Process Ghosting or other unorthodox process creation techniques. ' references: - https://pentestlaboratories.com/2021/12/08/process-ghosting/ - https://www.elastic.co/blog/process-ghosting-a-new-executable-image-tampering-attack author: Max Altgelt (Nextron Systems) date: 2021-12-09 modified: 2026-07-05 tags: - attack.stealth - attack.privilege-escalation - attack.t1055 logsource: category: process_creation product: windows detection: filter_main_image_absolute_path: Image|contains: \ filter_optional_null: Image: null filter_optional_empty: Image: - '-' - '' filter_optional_4688: - Image: - MemCompression - Registry - System - vmmem - vmmemWSL - CommandLine: - MemCompression - Registry - vmmem - vmmemWSL condition: not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of the "Write-EventLog" cmdlet with 'RawData' flag. The cmdlet can be levreage to write malicious payloads. Logsource: windows / ps_script. Rule: title: PowerShell Write-EventLog Usage id: 35f41cd7-c98e-469f-8a02-ec4ba0cc7a7e status: test description: Detects usage of the "Write-EventLog" cmdlet with 'RawData' flag. The cmdlet can be levreage to write malicious payloads to the EventLog and then retrieve them later for later use references: - https://www.blackhillsinfosec.com/windows-event-logs-for-red-teams/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-16 tags: - attack.defense-impairment logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Write-EventLog - '-RawData ' condition: selection falsepositives: - Legitimate applications writing events via this cmdlet. Investigate alerts to determine if the action is benign level: medium
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for. Logsource: windows / process_creation. Rule: title: Msiexec Quiet Installation id: 79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5 status: test description: 'Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi) ' references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md - https://twitter.com/_st0pp3r_/status/1583914244344799235 author: frack113 date: 2022-01-16 modified: 2026-07-28 tags: - attack.stealth - attack.t1218.007 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \msiexec.exe - OriginalFileName: msiexec.exe selection_cli: CommandLine|contains|windash: - -i - -package - -a - -j selection_quiet: CommandLine|contains|windash: -q filter_main_system_temp: ParentImage|startswith: C:\Windows\Temp\ filter_main_ccm: ParentImage: C:\Windows\CCM\Ccm32BitLauncher.exe IntegrityLevel: - System - S-1-16-16384 filter_optional_user_temp: ParentImage|startswith: C:\Users\ ParentImage|contains: \AppData\Local\Temp\ filter_optional_wsl: ParentImage|endswith: C:\Windows\System32\wsl.exe Image|endswith: C:\Windows\System32\msiexec.exe condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - WindowsApps installing updates via the quiet flag level: medium
Near-miss passage: Sigma rule: Detects PowerShell execution to set the ACL of a file or a folder. Logsource: windows / process_creation. Rule: title: PowerShell Script Change Permission Via Set-Acl id: bdeb2cff-af74-4094-8426-724dc937f20a related: - id: cae80281-ef23-44c5-873b-fd48d2666f49 type: derived - id: 0944e002-e3f6-4eb5-bf69-3a3067b53d73 type: derived - id: 3bf1d859-3a7e-44cb-8809-a99e066d3478 type: derived status: test description: Detects PowerShell execution to set the ACL of a file or a folder references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-acl?view=powershell-5.1 - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1505.005/T1505.005.md author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-18 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: - PowerShell.EXE - pwsh.dll - Image|endswith: - \powershell.exe - \pwsh.exe selection_cmdlet: CommandLine|contains|all: - 'Set-Acl ' - '-AclObject ' - '-Path ' condition: all of selection_* falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-2780
Matching passage: CVE-2015-2780. CWE: CWE-434. CVSS: 9.800000190734863. Unrestricted file upload vulnerability in Berta CMS allows remote attackers to execute arbitrary code by uploading a crafted image file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.
Near-miss passage: CVE-2015-7571. CWE: CWE-434. CVSS: 7.800000190734863. Unrestricted file upload vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
Query: patch priority for CVE-2015-3766
Matching passage: CVE-2015-3766. CWE: CWE-200. CVSS: 4.300000190734863. The kernel in Apple iOS before 8.4.1 and OS X before 10.10.5 does not properly restrict the mach_port_space_info interface, which allows attackers to obtain sensitive memory-layout information via a crafted app.
Near-miss passage: CVE-2015-8252. CWE: CWE-200. CVSS: 5.900000095367432. The Frontel protocol before 3 on RSI Video Technologies Videofied devices sends a cleartext serial number, which allows remote attackers to determine a hardcoded key by sniffing the network and performing a "jumbled up" calculation with this number.
Query: alert when Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line i
Matching passage: Sigma rule: Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line i. Logsource: windows / ps_script. Rule: title: Powershell MsXml COM Object id: 78aa1347-1517-4454-9982-b338d6df8343 status: test description: 'Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-7---powershell-msxml-com-object---with-prompt - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ms766431(v=vs.85) - https://www.trendmicro.com/en_id/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html author: frack113, MatilJ date: 2022-01-19 modified: 2022-05-19 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - New-Object - -ComObject - MsXml2. - XmlHttp condition: selection falsepositives: - Legitimate administrative script level: medium
Near-miss passage: Sigma rule: Detects Windows services that got terminated for whatever reason. Logsource: windows / system. Rule: title: Windows Service Terminated With Error id: acfa2210-0d71-4eeb-b477-afab494d596c related: - id: d6b5520d-3934-48b4-928c-2aa3f92d6963 type: similar status: test description: Detects Windows services that got terminated for whatever reason references: - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-14 tags: - attack.stealth logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7023 condition: selection falsepositives: - False positives could occur since service termination could happen due to multiple reasons level: low
Query: CVE similar to CVE-2015-5848
Matching passage: CVE-2015-5848. CWE: CWE-119. CVSS: 7.199999809265137. IOAcceleratorFamily in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
Near-miss passage: CVE-2015-1473. CWE: CWE-119. CVSS: 6.400000095367432. The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service (segmentation violation) or overwrite memory locations beyond the stack boundary via a long line containing wide characters that are improperly handled in a wscanf call.
Query: exploit Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.
Matching passage: CVE-2015-4816. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.
Near-miss passage: CVE-2015-4827. CWE: UNKNOWN. CVSS: 6.400000095367432. Unspecified vulnerability in the Oracle Retail Open Commerce Platform component in Oracle Retail Applications 3.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Framework.
Query: describe CVE-2015-6128
Matching passage: CVE-2015-6128. CWE: CWE-20. CVSS: 7.199999809265137. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Windows Library Loading Remote Code Execution Vulnerability."
Near-miss passage: CVE-2015-7872. CWE: CWE-20. CVSS: 2.0999999046325684. The key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 4.2.6 allows local users to cause a denial of service (OOPS) via crafted keyctl commands.