alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfus
Matching passage: Sigma rule: Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfus. Logsource: windows / process_creation. Rule: title: HackTool - HandleKatz LSASS Dumper Execution id: ca621ba5-54ab-4035-9942-d378e6fcde3c status: test description: Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same references: - https://github.com/codewhitesec/HandleKatz author: Florian Roth (Nextron Systems) date: 2022-08-18 modified: 2024-11-23 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection_loader_img: Image|endswith: \loader.exe CommandLine|contains: '--pid:' selection_loader_imphash: Hashes|contains: - IMPHASH=38D9E015591BBFD4929E0D0F47FA0055 - IMPHASH=0E2216679CA6E1094D63322E3412D650 selection_flags: CommandLine|contains|all: - '--pid:' - '--outfile:' CommandLine|contains: - .dmp - lsass - .obf - dump condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege. Logsource: windows / driver_load. Rule: title: Vulnerable WinRing0 Driver Load id: 1a42dfa6-6cb2-4df9-9b48-295be477e835 status: test description: Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege escalation references: - https://github.com/xmrig/xmrig/tree/master/bin/WinRing0 - https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/ author: Florian Roth (Nextron Systems) date: 2022-07-26 modified: 2024-11-23 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: product: windows category: driver_load detection: selection: - Hashes|contains: IMPHASH=D41FA95D4642DC981F10DE36F4DC8CD7 - ImageLoaded|endswith: - \WinRing0x64.sys - \WinRing0.sys - \WinRing0.dll - \WinRing0x64.dll - \winring00x64.sys condition: selection falsepositives: - Unknown level: high
Query: risk of The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain se
Matching passage: CVE-2015-3153. CWE: CWE-200. CVSS: 5.0. The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.
Near-miss passage: CVE-2015-1680. CWE: CWE-200. CVSS: 2.0999999046325684. The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to bypass the ASLR protection mechanism via a crafted function call, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability," a different vulnerability than CVE-2015-1676, CVE-2015-1677, CVE-2015-1678, and CVE-2015-1679.
Query: mitigate Identify Roles
Matching passage: T1591.004 Identify Roles. Tactics: reconnaissance. Description: Adversaries may gather information about identities and roles within the victim organization that can be used during targeting. Information about business roles may reveal a variety of targetable details, including identifiable information for key personnel as well as what data/resources they have access to. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about business roles may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).
Near-miss passage: T1591 Gather Victim Org Information. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's organization that can be used during targeting. Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about an organization may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak)(Citation: SEC EDGAR Search) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Query: rule covering Detects activity when a security-enabled global group is deleted
Matching passage: Sigma rule: Detects activity when a security-enabled global group is deleted. Logsource: windows / security. Rule: title: A Security-Enabled Global Group Was Deleted id: b237c54b-0f15-4612-a819-44b735e0de27 related: - id: 9cf01b6c-e723-4841-a868-6d7f8245ca6e type: obsolete status: stable description: Detects activity when a security-enabled global group is deleted references: - https://www.cisecurity.org/controls/cis-controls-list/ - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4730 - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=634 author: Alexandr Yampolskyi, SOC Prime date: 2023-04-26 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: windows service: security detection: selection: EventID: - 4730 - 634 condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. W. Logsource: windows / dns_query. Rule: title: DNS Query Request To OneLaunch Update Service id: df68f791-ad95-447f-a271-640a0dab9cf8 status: test description: 'Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. When the OneLaunch application is installed it will attempt to get updates from this domain. ' references: - https://www.malwarebytes.com/blog/detections/pup-optional-onelaunch-silentcf - https://www.myantispyware.com/2020/12/14/how-to-uninstall-onelaunch-browser-removal-guide/ - https://malware.guide/browser-hijacker/remove-onelaunch-virus/ author: Josh Nickels date: 2024-02-26 tags: - attack.credential-access - attack.collection - attack.t1056 logsource: category: dns_query product: windows detection: selection: QueryName: update.onelaunch.com Image|endswith: \OneLaunch.exe condition: selection falsepositives: - Unlikely level: low
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.. Logsource: windows / process_creation. Rule: title: Suspicious Child Process Of SQL Server id: 869b9ca7-9ea2-4a5a-8325-e80e62f75445 related: - id: 344482e4-a477-436c-aa70-7536d18a48c7 type: obsolete status: test description: Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection. references: - Internal Research author: FPT.EagleEye Team, wagga date: 2020-12-11 modified: 2023-05-04 tags: - attack.t1505.003 - attack.t1190 - attack.initial-access - attack.persistence - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \sqlservr.exe Image|endswith: - \bash.exe - \bitsadmin.exe - \cmd.exe - \netstat.exe - \nltest.exe - \ping.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \sh.exe - \systeminfo.exe - \tasklist.exe - \wsl.exe filter_optional_datev: ParentImage|startswith: C:\Program Files\Microsoft SQL Server\ ParentImage|endswith: DATEV_DBENGINE\MSSQL\Binn\sqlservr.exe Image: C:\Windows\System32\cmd.exe CommandLine|startswith: '"C:\Windows\system32\cmd.exe" ' condition: selection and not 1 of filter_optional_* level: high
Near-miss passage: Sigma rule: Detects svchost hosting RDP termsvcs communicating with the loopback address. Logsource: windows / security. Rule: title: RDP over Reverse SSH Tunnel WFP id: 5bed80b6-b3e8-428e-a3ae-d3c757589e41 status: test description: Detects svchost hosting RDP termsvcs communicating with the loopback address references: - https://twitter.com/SBousseaden/status/1096148422984384514 - https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/44fbe85f72ee91582876b49678f9a26292a155fb/Command%20and%20Control/DE_RDP_Tunnel_5156.evtx author: Samir Bousseaden date: 2019-02-16 modified: 2022-09-02 tags: - attack.command-and-control - attack.lateral-movement - attack.t1090.001 - attack.t1090.002 - attack.t1021.001 - car.2013-07-002 logsource: product: windows service: security detection: selection: EventID: 5156 sourceRDP: SourcePort: 3389 DestAddress: - 127.* - ::1 destinationRDP: DestPort: 3389 SourceAddress: - 127.* - ::1 filter_app_container: FilterOrigin: AppContainer Loopback filter_thor: Application|endswith: - \thor.exe - \thor64.exe condition: selection and ( sourceRDP or destinationRDP ) and not 1 of filter* falsepositives: - Programs that connect locally to the RDP port level: high
Query: write Sigma for Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mappin
Matching passage: Sigma rule: Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mappin. Logsource: windows / system. Rule: title: Certificate Use With No Strong Mapping id: 993c2665-e6ef-40e3-a62a-e1a97686af79 status: test description: 'Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID) This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping. Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing. ' references: - https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16 author: '@br4dy5' date: 2023-10-09 modified: 2025-09-22 tags: - attack.privilege-escalation logsource: product: windows service: system detection: selection: Provider_Name: - Kerberos-Key-Distribution-Center - Microsoft-Windows-Kerberos-Key-Distribution-Center EventID: - 39 - 41 condition: selection falsepositives: - If prevalent in the environment, filter on events where the AccountName and CN of the Subject do not reference the same user - If prevalent in the environment, filter on CNs that end in a dollar sign indicating it is a machine name level: medium
Near-miss passage: Sigma rule: Detects the import of the specified file to the registry with regedit.exe.. Logsource: windows / process_creation. Rule: title: Imports Registry Key From a File id: 73bba97f-a82d-42ce-b315-9182e76c57b1 related: - id: 0b80ade5-6997-4b1d-99a1-71701778ea61 type: similar status: test description: Detects the import of the specified file to the registry with regedit.exe. references: - https://lolbas-project.github.io/lolbas/Binaries/Regedit/ - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f author: Oddvar Moe, Sander Wiebing, oscd.community date: 2020-10-07 modified: 2024-03-13 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regedit.exe - OriginalFileName: REGEDIT.EXE selection_cli: CommandLine|contains: - ' /i ' - ' /s ' - .reg filter_1: CommandLine|contains|windash: - ' -e ' - ' -a ' - ' -c ' filter_2: CommandLine|re: :[^ \\] condition: all of selection_* and not all of filter_* falsepositives: - Legitimate import of keys - Evernote level: medium
Query: exploit The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, related 
Matching passage: CVE-2015-5727. CWE: CWE-399. CVSS: 7.5. The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, related to a length field.
Near-miss passage: CVE-2015-0044. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-8967 and CVE-2015-0050.
Query: describe CVE-2015-4253
Matching passage: CVE-2015-4253. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence Serial Gateway devices with software 1.0(1.42) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu90728.
Near-miss passage: CVE-2015-9428. CWE: CWE-352. CVSS: 6.5. The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address, or lp-niche parameters.
Query: exploit Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2730B router (rev C1) with firmware GE_1.01 allow remote authenticated users to inject arbitrary web script or HTM
Matching passage: CVE-2015-1028. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2730B router (rev C1) with firmware GE_1.01 allow remote authenticated users to inject arbitrary web script or HTML via the (1) domainname parameter to dnsProxy.cmd (DNS Proxy Configuration Panel); the (2) brName parameter to lancfg2get.cgi (Lan Configuration Panel); the (3) wlAuthMode, (4) wl_wsc_reg, or (5) wl_wsc_mode parameter to wlsecrefresh.wl (Wireless Security Panel); or the (6) wlWpaPsk parameter to wlsecurity.wl (Wireless Password Viewer).
Near-miss passage: CVE-2015-1180. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Web Reports in EventSentry 3.1.0 allows remote attackers to inject arbitrary web script or HTML via the pageId parameter to networktile/bullet.
Query: write Sigma for Detects the use of NSudo tool for command execution
Matching passage: Sigma rule: Detects the use of NSudo tool for command execution. Logsource: windows / process_creation. Rule: title: PUA - NSudo Execution id: 771d1eb5-9587-4568-95fb-9ec44153a012 status: test description: Detects the use of NSudo tool for command execution references: - https://web.archive.org/web/20221019044836/https://nsudo.m2team.org/en-us/ - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali date: 2022-01-24 modified: 2023-02-13 tags: - attack.execution - attack.t1569.002 - attack.s0029 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \NSudo.exe - \NSudoLC.exe - \NSudoLG.exe - OriginalFileName: - NSudo.exe - NSudoLC.exe - NSudoLG.exe selection_cli: CommandLine|contains: - '-U:S ' - '-U:T ' - '-U:E ' - '-P:E ' - '-M:S ' - '-M:H ' - '-U=S ' - '-U=T ' - '-U=E ' - '-P=E ' - '-M=S ' - '-M=H ' - -ShowWindowMode:Hide condition: all of selection_* falsepositives: - Legitimate use by administrators level: high
Near-miss passage: Sigma rule: Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. It can. Logsource: windows / process_creation. Rule: title: Suspicious Csi.exe Usage id: 40b95d31-1afc-469e-8d34-9a3a667d058e status: test description: Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. It can be used to run C# code from a file passed as a parameter in command line. Early version of this utility provided with Microsoft “Roslyn” Community Technology Preview was named 'rcsi.exe' references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Csi/ - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Rcsi/ - https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/ - https://twitter.com/Z3Jpa29z/status/1317545798981324801 author: Konstantin Grishchenko, oscd.community date: 2020-10-17 modified: 2022-07-11 tags: - attack.lateral-movement - attack.execution - attack.stealth - attack.t1072 - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \csi.exe - \rcsi.exe - OriginalFileName: - csi.exe - rcsi.exe selection_cli: Company: Microsoft Corporation condition: all of selection* falsepositives: - Legitimate usage by software developers level: medium
Query: exploit Unspecified vulnerability in in Oracle Java SE 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to De
Matching passage: CVE-2015-0458. CWE: UNKNOWN. CVSS: 7.599999904632568. Unspecified vulnerability in in Oracle Java SE 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.
Near-miss passage: CVE-2015-9067. CWE: UNKNOWN. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a potential compiler optimization of memset() is addressed.
Query: ATT&CK technique for Parent PID Spoofing
Matching passage: T1134.004 Parent PID Spoofing. Tactics: stealth, privilege escalation. Description: Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified. One way of explicitly assigning the PPID of a new process is via the <code>CreateProcess</code> API call, which supports a parameter that defines the PPID to use.(Citation: DidierStevens SelectMyParent Nov 2009) This functionality is used by Windows features such as User Account Control (UAC) to correctly set the PPID after a requested elevated process is spawned by SYSTEM (typically via <code>svchost.exe</code> or <code>consent.exe</code>) rather than the current user context.(Citation: Microsoft UAC Nov 2018) Adversaries may abuse these mechanisms to evade defenses, such as those blocking processes spawning directly from Office documents, and analysis targeting unusual/potentially malicious parent-child process relationships, such as spoofing the PPID of [PowerShell](https://attack.mitre.org/techniques/T1059/001)/[Rundll32](https://attack.mitre.org/techniques/T1218/011) to be <code>explorer.exe</code> rather than an Office document delivered as part of [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001).(Citation: CounterCept PPID Spoofing Dec 2018) This spoofing could be executed via [Visual Basic](https://attack.mitre.org/techniques/T1059/005) within a malicious Office document or any code that can perform [Native API](https://attack.mitre.org/techniques/T1106).(Citation: CTD PPID Spoofing Macro Mar 2019)(Citation: CounterCept PPID Spoofing Dec 2018) Explicitly assigning the PPID may also enable elevated privileges given appropriate access rights to the parent process. For example, an adversary in a privileged user context (i.e. administrator) may spawn a new process and assign the parent as a process running as SYSTEM (such as <code>lsass.exe</code>), causing the new process to be elevated vi
Near-miss passage: T1134.003 Make and Impersonate Token. Tactics: stealth, privilege escalation. Description: Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function.(Citation: LogonUserW function) The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread. This behavior is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) in that this refers to creating a new user token instead of stealing or duplicating an existing one.
Query: exploit vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 6 through 11 and other products, allows remote attackers to execute arbitrary code or cause a den
Matching passage: CVE-2015-2372. CWE: CWE-119. CVSS: 9.300000190734863. vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 6 through 11 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "VBScript Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-3804. CWE: CWE-119. CVSS: 7.5. FontParser in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted font file, a different vulnerability than CVE-2015-5756 and CVE-2015-5775.
Query: exploit WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corrupt
Matching passage: CVE-2015-1081. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Near-miss passage: CVE-2015-6287. CWE: CWE-399. CVSS: 5.0. Cisco Web Security Appliance (WSA) 8.0.6-078 and 8.0.6-115 allows remote attackers to cause a denial of service (service outage) via a flood of TCP traffic that leads to DNS resolution delays, aka Bug IDs CSCur32005 and CSCur07907.