alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Suspicious Input Injection execution detected on endpoint
Matching passage: T1674 Input Injection. Tactics: execution. Description: Adversaries may simulate keystrokes on a victim’s computer by various means to perform any type of action on behalf of the user, such as launching the command interpreter using keyboard shortcuts, typing an inline script to be executed, or interacting directly with a GUI-based application. These actions can be preprogrammed into adversary tooling or executed through physical devices such as Human Interface Devices (HIDs). For example, adversaries have used tooling that monitors the Windows message loop to detect when a user visits bank-specific URLs. If detected, the tool then simulates keystrokes to open the developer console or select the address bar, pastes malicious JavaScript from the clipboard, and executes it - enabling manipulation of content within the browser, such as replacing bank account numbers during transactions.(Citation: BleepingComputer BackSwap)(Citation: welivesecurity BackSwap) Adversaries have also used malicious USB devices to emulate keystrokes that launch PowerShell, leading to the download and execution of malware from adversary-controlled servers.(Citation: BleepingComputer USB)
Near-miss passage: T1059.005 Visual Basic. Tactics: execution. Description: Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and the [Native API](https://attack.mitre.org/techniques/T1106) through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.(Citation: VB .NET Mar 2020)(Citation: VB Microsoft) Derivative languages based on VB have also been created, such as Visual Basic for Applications (VBA) and VBScript. VBA is an event-driven programming language built into Microsoft Office, as well as several third-party applications.(Citation: Microsoft VBA)(Citation: Wikipedia VBA) VBA enables documents to contain macros used to automate the execution of tasks and other functionality on the host. VBScript is a default scripting language on Windows hosts and can also be used in place of [JavaScript](https://attack.mitre.org/techniques/T1059/007) on HTML Application (HTA) webpages served to Internet Explorer (though most modern browsers do not come with VBScript support).(Citation: Microsoft VBScript) Adversaries may use VB payloads to execute malicious commands. Common malicious usage includes automating execution of behaviors with VBScript or embedding VBA content into [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) payloads (which may also involve [Mark-of-the-Web Bypass](https://attack.mitre.org/techniques/T1553/005) to enable execution).(Citation: Default VBS macros Blocking )
Query: risk of The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not prevent display of Unicode LOCK characters in the omnibox, whi
Matching passage: CVE-2015-1296. CWE: CWE-254. CVSS: 5.0. The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not prevent display of Unicode LOCK characters in the omnibox, which makes it easier for remote attackers to spoof the SSL lock icon by placing one of these characters at the end of a URL, as demonstrated by the omnibox in localizations for right-to-left languages.
Near-miss passage: CVE-2015-5759. CWE: CWE-254. CVSS: 5.0. WebKit in Apple iOS before 8.4.1 allows remote attackers to spoof clicks via a crafted web site that leverages tap events.
Query: exploit The SavedStacks class in the JavaScript implementation in Mozilla Firefox before 41.0, when the Debugger API is enabled, allows remote attackers to cause a denial of service (getSl
Matching passage: CVE-2015-4507. CWE: UNKNOWN. CVSS: 5.099999904632568. The SavedStacks class in the JavaScript implementation in Mozilla Firefox before 41.0, when the Debugger API is enabled, allows remote attackers to cause a denial of service (getSlotRef assertion failure and application exit) or possibly execute arbitrary code via a crafted web site.
Near-miss passage: CVE-2015-6479. CWE: UNKNOWN. CVSS: 4.300000190734863. ACEmanager in Sierra Wireless ALEOS 4.4.2 and earlier on ES440, ES450, GX400, GX440, GX450, and LS300 devices allows remote attackers to read the filteredlogs.txt file, and consequently discover potentially sensitive boot-sequence information, via unspecified vectors.
Query: risk of The Navigate module for Drupal does not properly check permissions, which allows remote authenticated users to modify custom widgets and create widget database records by leveragin
Matching passage: CVE-2015-5499. CWE: CWE-264. CVSS: 4.0. The Navigate module for Drupal does not properly check permissions, which allows remote authenticated users to modify custom widgets and create widget database records by leveraging the "navigate view" permission.
Near-miss passage: CVE-2015-8967. CWE: CWE-264. CVSS: 7.800000190734863. arch/arm64/kernel/sys.c in the Linux kernel before 4.0 allows local users to bypass the "strict page permissions" protection mechanism and modify the system-call table, and consequently gain privileges, by leveraging write access.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspici. Logsource: windows / process_creation. Rule: title: Suspicious Git Clone id: aef9d1f1-7396-4e92-a927-4567c7a495c1 status: test description: Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious references: - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-03 modified: 2023-01-10 tags: - attack.reconnaissance - attack.t1593.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \git.exe - \git-remote-https.exe - OriginalFileName: git.exe selection_cli: CommandLine|contains: - ' clone ' - 'git-remote-https ' selection_keyword: CommandLine|contains: - exploit - Vulns - vulnerability - RemoteCodeExecution - Invoke- - CVE- - poc- - ProofOfConcept - proxyshell - log4shell - eternalblue - eternal-blue - MS17- condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the. Logsource: windows / process_creation. Rule: title: Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths id: c74c0390-3e20-41fd-a69a-128f0275a5ea related: - id: 59b39960-5f9d-4a49-9cef-1e4d2c1d0cb9 type: derived status: test description: 'Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the "/extract" argument from potentially suspicious paths. ' references: - https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html - https://www.echotrail.io/insights/search/wusa.exe/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 modified: 2023-11-28 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_root: Image|endswith: \wusa.exe CommandLine|contains: '/extract:' selection_paths: CommandLine|contains: - :\PerfLogs\ - :\Users\Public\ - :\Windows\Temp\ - \Appdata\Local\Temp\ condition: all of selection_* falsepositives: - Unknown level: high
Query: vulnerability: The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in FFmpeg before 2.8.2 does not validate the Chroma Format Indicator, which allows remote attackers to cause a denial of serv
Matching passage: CVE-2015-8217. CWE: CWE-20. CVSS: 7.5. The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in FFmpeg before 2.8.2 does not validate the Chroma Format Indicator, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted High Efficiency Video Coding (HEVC) data.
Near-miss passage: CVE-2015-6602. CWE: CWE-20. CVSS: 9.300000190734863. libutils in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file, as demonstrated by an attack against use of libutils by libstagefright in Android 5.x.
Query: detect Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and in logs
Matching passage: Sigma rule: Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and. Logsource: windows / process_creation. Rule: title: Suspicious Process Masquerading As SvcHost.EXE id: be58d2e2-06c8-4f58-b666-b99f6dc3b6cd related: - id: 01d2e2a1-5f09-44f7-9fc1-24faa7479b6d type: similar - id: e4a6b256-3e47-40fc-89d2-7a477edd6915 type: similar status: test description: 'Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and executing from an uncommon location. Adversaries often disguise their malicious binaries by naming them after legitimate system processes like "svchost.exe" to evade detection. ' references: - https://tria.ge/240731-jh4crsycnb/behavioral2 - https://redcanary.com/blog/threat-detection/process-masquerading/ author: Swachchhanda Shrawan Poudel date: 2024-08-07 tags: - attack.stealth - attack.t1036.005 logsource: category: process_creation product: windows detection: selection: Image|endswith: \svchost.exe filter_main_img_location: Image: - C:\Windows\System32\svchost.exe - C:\Windows\SysWOW64\svchost.exe filter_main_ofn: OriginalFileName: svchost.exe condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_svchost_masqueraded_execution/info.yml
Near-miss passage: Sigma rule: Detects suspicious ways to use the "DumpMinitool.exe" binary. Logsource: windows / process_creation. Rule: title: Suspicious DumpMinitool Execution id: eb1c4225-1c23-4241-8dd4-051389fde4ce status: test description: Detects suspicious ways to use the "DumpMinitool.exe" binary references: - https://twitter.com/mrd0x/status/1511415432888131586 - https://twitter.com/mrd0x/status/1511489821247684615 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/DumpMinitool/ author: Florian Roth (Nextron Systems) date: 2022-04-06 modified: 2023-04-12 tags: - attack.credential-access - attack.stealth - attack.t1036 - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \DumpMinitool.exe - \DumpMinitool.x86.exe - \DumpMinitool.arm64.exe - OriginalFileName: - DumpMinitool.exe - DumpMinitool.x86.exe - DumpMinitool.arm64.exe filter_folder: Image|contains: - \Microsoft Visual Studio\ - \Extensions\ susp_flags: CommandLine|contains: .txt cmd_has_flags: CommandLine|contains: - ' Full' - ' Mini' - ' WithHeap' filter_cmd_misses_flags: CommandLine|contains: --dumpType condition: selection and ( ( not filter_folder ) or susp_flags or ( cmd_has_flags and not filter_cmd_misses_flags ) ) falsepositives: - Unknown level: high
Query: alert when Detects instances where an email, identified as malicious or suspicious by the Microsoft Defender for Office 365 (former
Matching passage: Sigma rule: Detects instances where an email, identified as malicious or suspicious by the Microsoft Defender for Office 365 (former. Logsource: m365 / audit. Rule: title: Suspicious Email Delivered In Microsoft 365 id: 3569aefd-e535-4391-8c18-24bd01a21eaf status: experimental description: 'Detects instances where an email, identified as malicious or suspicious by the Microsoft Defender for Office 365 (formerly ATP) engine, was delivered to a user''s Inbox or Junk folder. It might indicate that a potential threat, such as a spearphishing attachment or links, has bypassed initial blocking mechanisms and reached an end-user, requiring further investigation and potential remediation. ' references: - https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about - https://research.splunk.com/cloud/605cc93a-70e4-4ee3-9a3d-1a62e8c9b6c2/ - https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules/blob/e7250648cb16d4a497ae8737943bf010ea96d2e6/Defender%20For%20Cloud%20Apps/MaliciousEmailDeliveredInMailbox.md author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2026-01-27 tags: - attack.initial-access - attack.t1566.001 - attack.t1566.002 logsource: service: audit product: m365 detection: selection: Workload: ThreatIntelligence Operation: TIMailData Directionality: Inbound filter_main_blocked: DeliveryAction: Blocked condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Detects potential suspicious applet or osascript executing "osacompile".. Logsource: macos / process_creation. Rule: title: Osacompile Execution By Potentially Suspicious Applet/Osascript id: a753a6af-3126-426d-8bd0-26ebbcb92254 status: test description: Detects potential suspicious applet or osascript executing "osacompile". references: - https://redcanary.com/blog/mac-application-bundles/ author: Sohan G (D4rkCiph3r), Red Canary (Idea) date: 2023-04-03 tags: - attack.execution - attack.t1059.002 logsource: category: process_creation product: macos detection: selection: ParentImage|endswith: - /applet - /osascript CommandLine|contains: osacompile condition: selection falsepositives: - Unknown level: medium
Query: detect Detects the malicious use of a control panel item in logs
Matching passage: Sigma rule: Detects the malicious use of a control panel item. Logsource: windows / process_creation. Rule: title: Control Panel Items id: 0ba863e6-def5-4e50-9cea-4dd8c7dc46a4 status: test description: Detects the malicious use of a control panel item references: - https://ired.team/offensive-security/code-execution/code-execution-through-control-panel-add-ins author: Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_) date: 2020-06-22 modified: 2023-10-11 tags: - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1218.002 - attack.persistence - attack.t1546 logsource: product: windows category: process_creation detection: selection_reg_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_reg_cli: CommandLine|contains|all: - add - CurrentVersion\Control Panel\CPLs selection_cpl: CommandLine|endswith: .cpl filter_cpl_sys: CommandLine|contains: - \System32\ - '%System%' - '|C:\Windows\system32|' filter_cpl_igfx: CommandLine|contains|all: - 'regsvr32 ' - ' /s ' - igfxCPL.cpl condition: all of selection_reg_* or (selection_cpl and not 1 of filter_cpl_*) falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of NSudo tool for command execution. Logsource: windows / process_creation. Rule: title: PUA - NSudo Execution id: 771d1eb5-9587-4568-95fb-9ec44153a012 status: test description: Detects the use of NSudo tool for command execution references: - https://web.archive.org/web/20221019044836/https://nsudo.m2team.org/en-us/ - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali date: 2022-01-24 modified: 2023-02-13 tags: - attack.execution - attack.t1569.002 - attack.s0029 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \NSudo.exe - \NSudoLC.exe - \NSudoLG.exe - OriginalFileName: - NSudo.exe - NSudoLC.exe - NSudoLG.exe selection_cli: CommandLine|contains: - '-U:S ' - '-U:T ' - '-U:E ' - '-P:E ' - '-M:S ' - '-M:H ' - '-U=S ' - '-U=T ' - '-U=E ' - '-P=E ' - '-M=S ' - '-M=H ' - -ShowWindowMode:Hide condition: all of selection_* falsepositives: - Legitimate use by administrators level: high
Query: vulnerability: bootp in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to obtain potentially sensitive information about MAC addresses seen in previous Wi-Fi sessions by s
Matching passage: CVE-2015-3778. CWE: CWE-200. CVSS: 3.299999952316284. bootp in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to obtain potentially sensitive information about MAC addresses seen in previous Wi-Fi sessions by sniffing an 802.11 network for DNAv4 broadcast traffic.
Near-miss passage: CVE-2015-2286. CWE: CWE-200. CVSS: 6.5. lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assisted remote attackers to discover password-reset tokens by reading a referer log after a victim navigates from this page to a social-sharing site.
Query: detect Internal Proxy
Matching passage: T1090.001 Internal Proxy. Tactics: command and control. Description: Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment. By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.
Near-miss passage: T1090 Proxy. Tactics: command and control. Description: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.
Query: CVE similar to CVE-2015-1910
Matching passage: CVE-2015-1910. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Reference Data Management component in the server in IBM InfoSphere Master Data Management (MDM) 10.1 before IF1, 11.0 before FP3, and 11.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-1179. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in data_point_details.shtm in Mango Automation 2.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dpid, (2) dpxid, or (3) pid parameter.
Query: hunt for Silver Ticket activity
Matching passage: T1558.002 Silver Ticket. Tactics: credential access. Description: Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets.(Citation: ADSecurity Silver Tickets) Silver tickets are more limited in scope in than golden tickets in that they only enable adversaries to access a particular resource (e.g. MSSQL) and the system that hosts the resource; however, unlike golden tickets, adversaries with the ability to forge silver tickets are able to create TGS tickets without interacting with the Key Distribution Center (KDC), potentially making detection more difficult.(Citation: ADSecurity Detecting Forged Tickets) Password hashes for target services may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).
Near-miss passage: T1558.005 Ccache Files. Tactics: credential access. Description: Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having to re-enter credentials. The <code>/etc/krb5.conf</code> configuration file and the <code>KRB5CCNAME</code> environment variable are used to set the storage location for ccache entries. On Linux, credentials are typically stored in the `/tmp` directory with a naming format of `krb5cc_%UID%` or `krb5.ccache`. On macOS, ccache entries are stored by default in memory with an `API:{uuid}` naming scheme. Typically, users interact with ticket storage using <code>kinit</code>, which obtains a Ticket-Granting-Ticket (TGT) for the principal; <code>klist</code>, which lists obtained tickets currently held in the credentials cache; and other built-in binaries.(Citation: Kerberos GNU/Linux)(Citation: Binary Defense Kerberos Linux) Adversaries can collect tickets from ccache files stored on disk and authenticate as the current user without their password to perform [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003) attacks. Adversaries can also use these tickets to impersonate legitimate users with elevated privileges to perform [Privilege Escalation](https://attack.mitre.org/tactics/TA0004). Tools like Kekeo can also be used by adversaries to convert ccache files to Windows format for further [Lateral Movement](https://attack.mitre.org/tactics/TA0008). On macOS, adversaries may use open-source tools or the Kerberos framework to interact with ccache files and extract TGTs or Service Tickets via lower-level APIs.(Citation: SpectorOps Bifrost Kerberos macOS 2019)(Citation: Linux Kerberos Tickets)(Citation: Brining MimiKatz to Unix)(Citation: Kekeo)