alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH"
Matching passage: Sigma rule: Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH". Logsource: windows / ps_script. Rule: title: Add Windows Capability Via PowerShell Script id: 155c7fd5-47b4-49b2-bbeb-eb4fab335429 related: - id: b36d01a3-ddaf-4804-be18-18a6247adfcd type: similar status: test description: Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others. references: - https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=powershell - https://www.virustotal.com/gui/file/af1c82237b6e5a3a7cdbad82cc498d298c67845d92971bada450023d1335e267/content author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-22 modified: 2023-05-09 tags: - attack.execution logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmdlet: ScriptBlockText|contains: 'Add-WindowsCapability ' selection_capa: ScriptBlockText|contains: -Name OpenSSH. condition: all of selection_* falsepositives: - Legitimate usage of the capabilities by administrators or users. Add additional filters accordingly. level: medium
Near-miss passage: Sigma rule: Detects linux package removal using builtin tools such as "yum", "apt", "apt-get" or "dpkg".. Logsource: linux / process_creation. Rule: title: Linux Package Uninstall id: 95d61234-7f56-465c-6f2d-b562c6fedbc4 status: test description: Detects linux package removal using builtin tools such as "yum", "apt", "apt-get" or "dpkg". references: - https://sysdig.com/blog/mitre-defense-evasion-falco - https://www.tutorialspoint.com/how-to-install-a-software-on-linux-using-yum-command - https://linuxhint.com/uninstall_yum_package/ - https://linuxhint.com/uninstall-debian-packages/ author: Tuan Le (NCSGroup), Nasreddine Bencherchali (Nextron Systems) date: 2023-03-09 tags: - attack.stealth - attack.t1070 logsource: product: linux category: process_creation detection: selection_yum: Image|endswith: /yum CommandLine|contains: - erase - remove selection_apt: Image|endswith: - /apt - /apt-get CommandLine|contains: - remove - purge selection_dpkg: Image|endswith: /dpkg CommandLine|contains: - '--remove ' - ' -r ' selection_rpm: Image|endswith: /rpm CommandLine|contains: ' -e ' condition: 1 of selection_* falsepositives: - Administrator or administrator scripts might delete packages for several reasons (debugging, troubleshooting). level: low
Query: Sigma rule for Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an c
Matching passage: Sigma rule: Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an c. Logsource: windows / security. Rule: title: Suspicious Windows ANONYMOUS LOGON Local Account Created id: 1bbf25b9-8038-4154-a50b-118f2a32be27 status: test description: Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts. references: - https://twitter.com/SBousseaden/status/1189469425482829824 author: James Pemberton / @4A616D6573 date: 2019-10-31 modified: 2022-10-09 tags: - attack.persistence - attack.t1136.001 - attack.t1136.002 logsource: product: windows service: security detection: selection: EventID: 4720 SamAccountName|contains|all: - ANONYMOUS - LOGON condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when there is a interruption in the authentication process.. Logsource: azure / signinlogs. Rule: title: Azure Unusual Authentication Interruption id: 8366030e-7216-476b-9927-271d79f13cf3 status: test description: Detects when there is a interruption in the authentication process. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts author: Austin Songer @austinsonger date: 2021-11-26 modified: 2022-12-18 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 logsource: product: azure service: signinlogs detection: selection_50097: ResultType: 50097 ResultDescription: Device authentication is required selection_50155: ResultType: 50155 ResultDescription: DeviceAuthenticationFailed selection_50158: ResultType: 50158 ResultDescription: ExternalSecurityChallenge - External security challenge was not satisfied condition: 1 of selection_* falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-4376
Matching passage: CVE-2015-4376. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Profile2 Privacy module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with the "Administer Profile2 Privacy Levels" permission to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-9426. CWE: CWE-79. CVSS: 4.599999904632568. The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=mic_editor_window postId parameter.
Query: detection rule: Detects PDQDeploy service installation on the target system. When a package is deployed via PDQDeploy it installs a remo
Matching passage: Sigma rule: Detects PDQDeploy service installation on the target system. When a package is deployed via PDQDeploy it installs a remo. Logsource: windows / system. Rule: title: New PDQDeploy Service - Client Side id: b98a10af-1e1e-44a7-bab2-4cc026917648 status: test description: 'Detects PDQDeploy service installation on the target system. When a package is deployed via PDQDeploy it installs a remote service on the target machine with the name "PDQDeployRunner-X" where "X" is an integer starting from 1 ' references: - https://documentation.pdq.com/PDQDeploy/13.0.3.0/index.html?windows-services.htm author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-22 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: product: windows service: system detection: selection_root: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ImagePath|contains: PDQDeployRunner- - ServiceName|startswith: PDQDeployRunner- condition: all of selection_* falsepositives: - Legitimate use of the tool level: medium
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via use MSHTA in Scripts. Logsource: windows / security. Rule: title: Invoke-Obfuscation Via Use MSHTA - Security id: 9b8d9203-4e0f-4cd9-bb06-4cc4ea6d0e9a related: - id: 7e9c7999-0f9b-4d4a-a6ed-af6d553d4af4 type: derived status: test description: Detects Obfuscated Powershell via use MSHTA in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-09 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceFileName|contains|all: - mshta - vbscript:createobject - .run - window.close condition: selection falsepositives: - Unknown level: high
Query: detect Detects registry changes to Microsoft Office "AccessVBOM" to a value of "1" which disables trust access for VBA on the v in logs
Matching passage: Sigma rule: Detects registry changes to Microsoft Office "AccessVBOM" to a value of "1" which disables trust access for VBA on the v. Logsource: windows / registry_set. Rule: title: Trust Access Disable For VBApplications id: 1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf related: - id: 9b894e57-033f-46cf-b7fa-a52804181973 type: obsolete status: test description: Detects registry changes to Microsoft Office "AccessVBOM" to a value of "1" which disables trust access for VBA on the victim machine and lets attackers execute malicious macros without any Microsoft Office warnings. references: - https://twitter.com/inversecos/status/1494174785621819397 - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/zloader-with-a-new-infection-technique/ - https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/ author: Trent Liffick (@tliffick), Nasreddine Bencherchali (Nextron Systems) date: 2020-05-22 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Security\AccessVBOM Details: DWORD (0x00000001) condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects potentially suspicious child processes of "aspnet_compiler.exe".. Logsource: windows / process_creation. Rule: title: Suspicious Child Process of AspNetCompiler id: 9ccba514-7cb6-4c5c-b377-700758f2f120 related: - id: 4c7f49ee-2638-43bb-b85b-ce676c30b260 type: similar - id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622 type: similar - id: a01b8329-5953-4f73-ae2d-aa01e1f35f00 type: similar status: test description: Detects potentially suspicious child processes of "aspnet_compiler.exe". references: - https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/ - https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-14 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \aspnet_compiler.exe selection_child: - Image|endswith: - \calc.exe - \notepad.exe - Image|contains: - \Users\Public\ - \AppData\Local\Temp\ - \AppData\Local\Roaming\ - :\Temp\ - :\Windows\Temp\ - :\Windows\System32\Tasks\ - :\Windows\Tasks\ condition: all of selection_* falsepositives: - Unknown level: high
Query: vulnerability: The SQL interface in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to execute arbitrary code via unspecified vectors related to "SQL Login," aka SAP Security
Matching passage: CVE-2015-7994. CWE: CWE-20. CVSS: 7.5. The SQL interface in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to execute arbitrary code via unspecified vectors related to "SQL Login," aka SAP Security Note 2197428.
Near-miss passage: CVE-2015-0578. CWE: CWE-20. CVSS: 5.699999809265137. Cisco Adaptive Security Appliance (ASA) Software, when a DHCPv6 relay is configured, allows remote attackers to cause a denial of service (device reload) via crafted DHCP packets on the local network, aka Bug ID CSCur45455.
Query: exploit drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c in the Qualcomm components in Android before 2016-08-05 on Nexus 6 devices does not validate the stream state, which allows
Matching passage: CVE-2015-8942. CWE: CWE-264. CVSS: 7.800000190734863. drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c in the Qualcomm components in Android before 2016-08-05 on Nexus 6 devices does not validate the stream state, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28814652 and Qualcomm internal bug CR803246.
Near-miss passage: CVE-2015-5051. CWE: CWE-264. CVSS: 4.300000190734863. IBM Maximo Asset Management 7.5 before 7.5.0.8 IF6 and 7.6 before 7.6.0.2 IF1 and Maximo Asset Management 7.5 before 7.5.0.8 IF6, 7.5.1, and 7.6 before 7.6.0.2 IF1 for SmartCloud Control Desk allow remote authenticated users to bypass intended access restrictions on query results via unspecified vectors.
Query: risk of Directory traversal vulnerability in Konica Minolta FTP Utility 1.0 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in a RETR command.
Matching passage: CVE-2015-7603. CWE: CWE-22. CVSS: 7.800000190734863. Directory traversal vulnerability in Konica Minolta FTP Utility 1.0 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in a RETR command.
Near-miss passage: CVE-2015-1490. CWE: CWE-22. CVSS: 5.5. Directory traversal vulnerability in the management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticated users to read arbitrary files via a relative pathname in a client installation package.
Query: patch priority for CVE-2015-7711
Matching passage: CVE-2015-7711. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in popuphelp.php in ATutor 2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the h parameter.
Near-miss passage: CVE-2015-3360. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Term Merge module before 7.x-1.2 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Query: Sigma rule for Identifies when a service principal is created in Azure.
Matching passage: Sigma rule: Identifies when a service principal is created in Azure.. Logsource: azure / auditlogs. Rule: title: Azure Service Principal Created id: 0ddcff6d-d262-40b0-804b-80eb592de8e3 status: test description: Identifies when a service principal is created in Azure. references: - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory - https://analyticsrules.exchange/analyticrules/79566f41-df67-4e10-a703-c38a6213afd8/ author: Austin Songer @austinsonger date: 2021-09-02 modified: 2026-04-30 tags: - attack.stealth logsource: product: azure service: auditlogs detection: selection: operationName: Add service principal condition: selection falsepositives: - Service principal being created may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Service principal created from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process usin. Logsource: windows / image_load. Rule: title: Aruba Network Service Potential DLL Sideloading id: 90ae0469-0cee-4509-b67f-e5efcef040f7 status: test description: Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process using DLL Search Order Hijacking references: - https://twitter.com/wdormann/status/1616581559892545537?t=XLCBO9BziGzD7Bmbt8oMEQ&s=09 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-22 modified: 2023-03-15 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: Image|endswith: \arubanetsvc.exe ImageLoaded|endswith: - \wtsapi32.dll - \msvcr100.dll - \msvcp100.dll - \dbghelp.dll - \dbgcore.dll - \wininet.dll - \iphlpapi.dll - \version.dll - \cryptsp.dll - \cryptbase.dll - \wldp.dll - \profapi.dll - \sspicli.dll - \winsta.dll - \dpapi.dll filter: ImageLoaded|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ condition: selection and not filter falsepositives: - Unknown level: high
Query: risk of The BestWebSoft Google Captcha (aka reCAPTCHA) plugin before 1.13 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access 
Matching passage: CVE-2015-0890. CWE: UNKNOWN. CVSS: 5.0. The BestWebSoft Google Captcha (aka reCAPTCHA) plugin before 1.13 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.
Near-miss passage: CVE-2015-7393. CWE: UNKNOWN. CVSS: 7.400000095367432. dcoep in BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.0 through 11.6.0 and 12.0.0 before 12.0.0 HF1, BIG-IP AAM 11.4.0 through 11.6.0 and 12.0.0 before 12.0.0 HF1, BIG-IP AFM and PEM 11.3.0 through 11.6.0 and 12.0.0 before 12.0.0 HF1, BIG-IP DNS 12.0.0 before 12.0.0 HF1, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.2.0 through 11.3.0, BIG-IP GTM 11.2.0 through 11.6.0, BIG-IP PSM 11.2.0 through 11.4.1, Enterprise Manager 3.0.0 through 3.1.1, BIG-IQ Cloud 4.0.0 through 4.5.0, BIG-IQ Device 4.2.0 through 4.5.0, BIG-IQ Security 4.0.0 through 4.5.0, BIG-IQ ADC 4.5.0, BIG-IQ Centralized Management 4.6.0, and BIG-IQ Cloud and Orchestration 1.0.0 allows local users with advanced shell (bash) access to gain privileges via unspecified vectors.
Query: describe CVE-2015-6671
Matching passage: CVE-2015-6671. CWE: CWE-200. CVSS: 5.900000095367432. Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup.
Near-miss passage: CVE-2015-5341. CWE: CWE-200. CVSS: 4.300000190734863. mod_scorm in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 mishandles availability dates, which allows remote authenticated users to bypass intended access restrictions and read SCORM contents via unspecified vectors.
Query: write Sigma for Detects access to clipboard content via osascript, which may be used for data collection but also occurs in legitimate c
Matching passage: Sigma rule: Detects access to clipboard content via osascript, which may be used for data collection but also occurs in legitimate c. Logsource: macos / process_creation. Rule: title: Clipboard Access Via OSAScript id: 7794fa3c-edea-4cff-bec7-267dd4770fd7 related: - id: 1bc2e6c5-0885-472b-bed6-be5ea8eace55 type: derived status: test description: Detects access to clipboard content via osascript, which may be used for data collection but also occurs in legitimate clipboard utilities and automation scripts references: - https://www.sentinelone.com/blog/how-offensive-actors-use-applescript-for-attacking-macos/ author: Sohan G (D4rkCiph3r) date: 2023-01-31 modified: 2026-05-22 tags: - attack.collection - attack.execution - attack.t1115 - attack.t1059.002 logsource: product: macos category: process_creation detection: selection: Image|endswith: /osascript CommandLine|contains|all: - ' -e ' - clipboard filter_optional_opencode: ParentImage|endswith: opencode CommandLine|contains|all: - osascript - ' -e ' - set imageData to the clipboard - set fileRef condition: selection and not 1 of filter_optional_* falsepositives: - Legitimate clipboard utilities and automation scripts that read or write clipboard content - Developer tools and IDEs that use osascript for clipboard integration level: medium
Near-miss passage: Sigma rule: Detects the use of the "flock" command to execute a shell. Such behavior may be associated with privilege escalation, un. Logsource: linux / process_creation. Rule: title: Shell Execution via Flock - Linux id: 4b09c71e-4269-4111-9cdd-107d8867f0cc status: test description: 'Detects the use of the "flock" command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. ' references: - https://gtfobins.github.io/gtfobins/flock/#shell - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-09-02 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /flock CommandLine|contains: ' -u ' selection_cli: CommandLine|contains: - /bin/bash - /bin/dash - /bin/fish - /bin/sh - /bin/zsh condition: all of selection_* falsepositives: - Unknown level: high
Query: exploit Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous befo
Matching passage: CVE-2015-7624. CWE: CWE-200. CVSS: 5.0. Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2015-5583, CVE-2015-6705, and CVE-2015-6706.
Near-miss passage: CVE-2015-7493. CWE: CWE-200. CVSS: 4.699999809265137. IBM InfoSphere Information Server could allow a local user under special circumstances to execute commands during installation processes that could expose sensitive information.
Query: Outbound C2 pattern associated with SMB/Windows Admin Shares
Matching passage: T1021.002 SMB/Windows Admin Shares. Tactics: lateral movement. Description: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user. SMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain. Adversaries may use SMB to interact with file shares, allowing them to move laterally throughout a network. Linux and macOS implementations of SMB typically use Samba. Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include `C$`, `ADMIN$`, and `IPC$`. Adversaries may use this technique in conjunction with administrator-level [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely access a networked system over SMB,(Citation: Wikipedia Server Message Block) to interact with systems using remote procedure calls (RPCs),(Citation: TechNet RPC) transfer files, and run transferred binaries through remote Execution. Example execution techniques that rely on authenticated sessions over SMB/RPC are [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), [Service Execution](https://attack.mitre.org/techniques/T1569/002), and [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047). Adversaries can also use NTLM hashes to access administrator shares on systems with [Pass the Hash](https://attack.mitre.org/techniques/T1550/002) and certain configuration and patch levels.(Citation: Microsoft Admin Shares)
Near-miss passage: T1021.001 Remote Desktop Protocol. Tactics: lateral movement. Description: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services) Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. Adversaries may also use RDP in conjunction with the [Accessibility Features](https://attack.mitre.org/techniques/T1546/008) or [Terminal Services DLL](https://attack.mitre.org/techniques/T1505/005) for Persistence.(Citation: Alperovitch Malware)