alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / image_load
Matching passage: Sigma rule: Detects the "iscsicpl.exe" UAC bypass technique that leverages a DLL Search Order hijacking technique to load a custom D. Logsource: windows / image_load. Rule: title: UAC Bypass Using Iscsicpl - ImageLoad id: 9ed5959a-c43c-4c59-84e3-d28628429456 status: test description: Detects the "iscsicpl.exe" UAC bypass technique that leverages a DLL Search Order hijacking technique to load a custom DLL's from temp or a any user controlled location in the users %PATH% references: - https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC - https://twitter.com/wdormann/status/1547583317410607110 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-17 modified: 2022-07-25 tags: - attack.privilege-escalation - attack.t1548.002 logsource: product: windows category: image_load detection: selection: Image: C:\Windows\SysWOW64\iscsicpl.exe ImageLoaded|endswith: \iscsiexe.dll filter: ImageLoaded|contains|all: - C:\Windows\ - iscsiexe.dll condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of the "mount" command with "hidepid" parameter to make invisible processes to other users from the sy. Logsource: linux / process_creation. Rule: title: Mount Execution With Hidepid Parameter id: ec52985a-d024-41e3-8ff6-14169039a0b3 status: test description: Detects execution of the "mount" command with "hidepid" parameter to make invisible processes to other users from the system references: - https://blogs.blackberry.com/ - https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/ - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144 author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-01-12 tags: - attack.credential-access - attack.stealth - attack.t1564 logsource: product: linux category: process_creation detection: selection: Image|endswith: /mount CommandLine|contains|all: - hidepid=2 - ' -o ' condition: selection falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-7882
Matching passage: CVE-2015-7882. CWE: CWE-287. CVSS: 8.100000381469727. Improper handling of LDAP authentication in MongoDB Server versions 3.0.0 to 3.0.6 allows an unauthenticated client to gain unauthorized access.
Near-miss passage: CVE-2015-2033. CWE: CWE-287. CVSS: 10.0. Anyterm Daemon in Infoblox Network Automation NetMRI before NETMRI-23483 allows remote attackers to execute arbitrary commands with root privileges via a crafted terminal/anyterm-module request.
Query: write Sigma for Detects adversary creating screen capture of a desktop with Import Tool. Highly recommended using rule on servers, due t
Matching passage: Sigma rule: Detects adversary creating screen capture of a desktop with Import Tool. Highly recommended using rule on servers, due t. Logsource: linux / auditd. Rule: title: Screen Capture with Import Tool id: dbe4b9c5-c254-4258-9688-d6af0b7967fd status: test description: 'Detects adversary creating screen capture of a desktop with Import Tool. Highly recommended using rule on servers, due to high usage of screenshot utilities on user workstations. ImageMagick must be installed. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md - https://linux.die.net/man/1/import - https://imagemagick.org/ author: Pawel Mazur date: 2021-09-21 modified: 2022-10-09 tags: - attack.collection - attack.t1113 logsource: product: linux service: auditd detection: import: type: EXECVE a0: import import_window_root: a1: -window a2: root a3|endswith: - .png - .jpg - .jpeg import_no_window_root: a1|endswith: - .png - .jpg - .jpeg condition: import and (import_window_root or import_no_window_root) falsepositives: - Legitimate use of screenshot utility level: low
Near-miss passage: Sigma rule: Detects the use of the 'Pubprn.vbs' Microsoft signed script to execute commands.. Logsource: windows / process_creation. Rule: title: Pubprn.vbs Proxy Execution id: 1fb76ab8-fa60-4b01-bddd-71e89bf555da status: test description: Detects the use of the 'Pubprn.vbs' Microsoft signed script to execute commands. references: - https://lolbas-project.github.io/lolbas/Scripts/Pubprn/ author: frack113 date: 2022-05-28 tags: - attack.stealth - attack.t1216.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - \pubprn.vbs - 'script:' condition: selection falsepositives: - Unknown level: medium
Query: exploit Cross-site scripting (XSS) vulnerability in the Client form in the Device Inspector page in SAP Afaria 7 allows remote attackers to inject arbitrary web script or HTML via crafted 
Matching passage: CVE-2015-6663. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Client form in the Device Inspector page in SAP Afaria 7 allows remote attackers to inject arbitrary web script or HTML via crafted client name data, aka SAP Security Note 2152669.
Near-miss passage: CVE-2015-5399. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in PHPVibe before 4.21 allows remote authenticated users to inject arbitrary web script or HTML via a comment.
Query: risk of Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2
Matching passage: CVE-2015-1649. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps Server 2010 SP2 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Component Use After Free Vulnerability."
Near-miss passage: CVE-2015-5428. CWE: UNKNOWN. CVSS: 7.5. HP Matrix Operating Environment before 7.5.0 allows remote attackers to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2015-5427 and CVE-2015-5429.
Query: risk of The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via data[galleryID] to wp-admin/admin-ajax.php.
Matching passage: CVE-2015-9446. CWE: CWE-89. CVSS: 8.800000190734863. The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via data[galleryID] to wp-admin/admin-ajax.php.
Near-miss passage: CVE-2015-7342. CWE: CWE-89. CVSS: 7.199999809265137. JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field.
Query: exploit CoreMedia Playback in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and applicati
Matching passage: CVE-2015-5778. CWE: CWE-119. CVSS: 6.800000190734863. CoreMedia Playback in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-5777.
Near-miss passage: CVE-2015-5156. CWE: CWE-119. CVSS: 6.099999904632568. The virtnet_probe function in drivers/net/virtio_net.c in the Linux kernel before 4.2 attempts to support a FRAGLIST feature without proper memory allocation, which allows guest OS users to cause a denial of service (buffer overflow and memory corruption) via a crafted sequence of fragmented packets.
Query: vulnerability: The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allow local users to write to arbitrary memory l
Matching passage: CVE-2015-5735. CWE: CWE-264. CVSS: 7.199999809265137. The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allow local users to write to arbitrary memory locations via a 0x226108 ioctl call.
Near-miss passage: CVE-2015-8222. CWE: CWE-264. CVSS: 4.599999904632568. The lxd-unix.socket systemd unit file in the Ubuntu lxd package before 0.20-0ubuntu4.1 uses world-readable permissions for /var/lib/lxd/unix.socket, which allows local users to gain privileges via unspecified vectors.
Query: describe CVE-2015-7059
Matching passage: CVE-2015-7059. CWE: CWE-119. CVSS: 6.800000190734863. The ASN.1 decoder in Apple OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate, a different vulnerability than CVE-2015-7060 and CVE-2015-7061.
Near-miss passage: CVE-2015-3703. CWE: CWE-119. CVSS: 6.800000190734863. ImageIO in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted TIFF image.
Query: mitigate Exfiltration over USB
Matching passage: T1052.001 Exfiltration over USB. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
Near-miss passage: T1052 Exfiltration Over Physical Medium. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
Query: alert when Detects WerFault creating a dump file with a name that indicates that the dump file could be an LSASS process memory, wh
Matching passage: Sigma rule: Detects WerFault creating a dump file with a name that indicates that the dump file could be an LSASS process memory, wh. Logsource: windows / file_event. Rule: title: WerFault LSASS Process Memory Dump id: c3e76af5-4ce0-4a14-9c9a-25ceb8fda182 status: test description: Detects WerFault creating a dump file with a name that indicates that the dump file could be an LSASS process memory, which contains user credentials references: - https://github.com/helpsystems/nanodump author: Florian Roth (Nextron Systems) date: 2022-06-27 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: file_event detection: selection: Image: C:\WINDOWS\system32\WerFault.exe TargetFilename|contains: - \lsass - lsass.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when full data export is attempted an unauthorized user.. Logsource: bitbucket / audit. Rule: title: Bitbucket Unauthorized Full Data Export Triggered id: 34d81081-03c9-4a7f-91c9-5e46af625cde status: test description: Detects when full data export is attempted an unauthorized user. references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html - https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.collection - attack.resource-development - attack.t1213.003 - attack.t1586 logsource: product: bitbucket service: audit definition: 'Requirements: "Advance" log level is required to receive these audit events.' detection: selection: auditType.category: Data pipeline auditType.action: Unauthorized full data export triggered condition: selection falsepositives: - Unlikely level: critical
Query: vulnerability: Cisco Unified MeetingPlace 8.6(1.2) does not properly validate session IDs in http URLs, which allows remote attackers to obtain sensitive session information via a crafted URL, ak
Matching passage: CVE-2015-0763. CWE: CWE-200. CVSS: 5.0. Cisco Unified MeetingPlace 8.6(1.2) does not properly validate session IDs in http URLs, which allows remote attackers to obtain sensitive session information via a crafted URL, aka Bug ID CSCuu60338.
Near-miss passage: CVE-2015-4171. CWE: CWE-200. CVSS: 2.5999999046325684. strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.
Query: Sigma rule for Detects potentially suspicious file downloads directly from IP addresses using curl.exe
Matching passage: Sigma rule: Detects potentially suspicious file downloads directly from IP addresses using curl.exe. Logsource: windows / process_creation. Rule: title: Suspicious File Download From IP Via Curl.EXE id: 5cb299fc-5fb1-4d07-b989-0644c68b6043 status: test description: Detects potentially suspicious file downloads directly from IP addresses using curl.exe references: - https://labs.withsecure.com/publications/fin7-target-veeam-servers - https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv - https://github.com/pr0xylife/IcedID/blob/8dd1e218460db4f750d955b4c65b2f918a1db906/icedID_09.28.2023.txt author: Nasreddine Bencherchali (Nextron Systems) date: 2023-07-27 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \curl.exe - OriginalFileName: curl.exe selection_ip: CommandLine|re: ://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3} selection_http: CommandLine|contains: http selection_flag: CommandLine|contains: - ' -O' - --remote-name - --output selection_ext: CommandLine|endswith: - .bat - .bat" - .dat - .dat" - .dll - .dll" - .exe - .exe" - .gif - .gif" - .hta - .hta" - .jpeg - .jpeg" - .log - .log" - .msi - .msi" - .png - .png" - .ps1 - .ps1" - .psm1 - .psm1" - .vbe - .vbe" - .vbs - .vbs" - .bat' - .dat' - .dll' - .exe' - .gif' - .hta' - .jpeg' - .log' - .msi' - .png' - .ps1' - .psm1' - .vbe' - .vbs' condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_download_direct_ip_susp_extensions/info.yml
Near-miss passage: Sigma rule: Detects chromium based browsers starting in headless and debugging mode and pointing to a user profile. This could be a. Logsource: windows / process_creation. Rule: title: Potential Data Stealing Via Chromium Headless Debugging id: 3e8207c5-fcd2-4ea6-9418-15d45b4890e4 related: - id: b3d34dc5-2efd-4ae3-845f-8ec14921f449 type: derived status: test description: Detects chromium based browsers starting in headless and debugging mode and pointing to a user profile. This could be a sign of data stealing or remote control references: - https://github.com/defaultnamehere/cookie_crimes/ - https://mango.pdf.zone/stealing-chrome-cookies-without-a-password - https://embracethered.com/blog/posts/2020/cookie-crimes-on-mirosoft-edge/ - https://embracethered.com/blog/posts/2020/chrome-spy-remote-control/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-23 tags: - attack.credential-access - attack.collection - attack.stealth - attack.t1185 - attack.t1564.003 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - --remote-debugging- - --user-data-dir - --headless condition: selection falsepositives: - Unknown level: high
Query: detect Detects command line parameters used by Bloodhound and Sharphound hack tools in logs
Matching passage: Sigma rule: Detects command line parameters used by Bloodhound and Sharphound hack tools. Logsource: windows / process_creation. Rule: title: HackTool - Bloodhound/Sharphound Execution id: f376c8a7-a2d0-4ddc-aa0c-16c17236d962 status: test description: Detects command line parameters used by Bloodhound and Sharphound hack tools references: - https://github.com/BloodHoundAD/BloodHound - https://github.com/BloodHoundAD/SharpHound author: Florian Roth (Nextron Systems) date: 2019-12-20 modified: 2023-02-04 tags: - attack.discovery - attack.t1087.001 - attack.t1087.002 - attack.t1482 - attack.t1069.001 - attack.t1069.002 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Product|contains: SharpHound - Description|contains: SharpHound - Company|contains: - SpecterOps - evil corp - Image|contains: - \Bloodhound.exe - \SharpHound.exe selection_cli_1: CommandLine|contains: - ' -CollectionMethod All ' - ' --CollectionMethods Session ' - ' --Loop --Loopduration ' - ' --PortScanTimeout ' - '.exe -c All -d ' - Invoke-Bloodhound - Get-BloodHoundData selection_cli_2: CommandLine|contains|all: - ' -JsonFolder ' - ' -ZipFileName ' selection_cli_3: CommandLine|contains|all: - ' DCOnly ' - ' --NoSaveCache ' condition: 1 of selection_* falsepositives: - Other programs that use these command line option and accepts an 'All' parameter level: high
Near-miss passage: Sigma rule: Detects LOLBINs executing from an abnormal or uncommon drive such as a mounted ISO.. Logsource: windows / process_creation. Rule: title: LOLBIN Execution From Abnormal Drive id: d4ca7c59-e9e4-42d8-bf57-91a776efcb87 related: - id: 5b80cf53-3a46-4adc-960b-05ec19348d74 type: similar status: test description: Detects LOLBINs executing from an abnormal or uncommon drive such as a mounted ISO. references: - https://thedfirreport.com/2021/12/13/diavol-ransomware/ - https://www.scythe.io/library/threat-emulation-qakbot - https://sec-consult.com/blog/detail/bumblebee-hunting-with-a-velociraptor/ author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Angelo Violetti - SEC Consult '@angelo_violetti', Aaron Herman date: 2022-01-25 modified: 2023-08-29 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \calc.exe - \certutil.exe - \cmstp.exe - \cscript.exe - \installutil.exe - \mshta.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - OriginalFileName: - CALC.EXE - CertUtil.exe - CMSTP.EXE - cscript.exe - installutil.exe - MSHTA.EXE - REGSVR32.EXE - RUNDLL32.EXE - wscript.exe filter_main_currentdirectory: CurrentDirectory|contains: C:\ filter_main_empty: CurrentDirectory: '' filter_main_null: CurrentDirectory: null condition: selection and not 1 of filter_main_* falsepositives: - Rare false positives could occur on servers with multiple drives. level: medium
Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects the use of the 'setcap' utility to set the 'setuid' capability (cap_setuid) on a binary file. This capability al. Logsource: linux / process_creation. Rule: title: Linux Setuid Capability Set on a Binary via Setcap Utility id: ed447910-bc30-4575-a598-3a2e49516a7a status: experimental description: 'Detects the use of the ''setcap'' utility to set the ''setuid'' capability (cap_setuid) on a binary file. This capability allows a non privileged process to make arbitrary manipulations of user IDs (UIDs), including setting its current UID to a value that would otherwise be restricted (i.e. UID 0, the root user). This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed. ' references: - https://man7.org/linux/man-pages/man8/setcap.8.html - https://dfir.ch/posts/linux_capabilities/ - https://juggernaut-sec.com/capabilities/#cap_setuid author: Luc Génaux date: 2026-01-24 tags: - attack.privilege-escalation - attack.persistence - attack.t1548 - attack.t1554 logsource: product: linux category: process_creation detection: selection: Image|endswith: /setcap CommandLine|contains: cap_setuid condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects files that have extensions commonly seen while SDelete is used to wipe files.. Logsource: windows / security. Rule: title: Potential Secure Deletion with SDelete id: 39a80702-d7ca-4a83-b776-525b1f86a36d status: test description: Detects files that have extensions commonly seen while SDelete is used to wipe files. references: - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/sdelete.htm - https://www.jpcert.or.jp/english/pub/sr/ir_research.html - https://learn.microsoft.com/en-gb/sysinternals/downloads/sdelete author: Thomas Patzke date: 2017-06-14 modified: 2024-12-13 tags: - attack.impact - attack.stealth - attack.defense-impairment - attack.t1070.004 - attack.t1027.005 - attack.t1485 - attack.t1553.002 - attack.s0195 logsource: product: windows service: security detection: selection: EventID: - 4656 - 4663 - 4658 ObjectName|endswith: - .AAA - .ZZZ condition: selection falsepositives: - Legitimate usage of SDelete - Files that are interacted with that have these extensions legitimately level: medium
Query: patch priority for CVE-2015-2292
Matching passage: CVE-2015-2292. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
Near-miss passage: CVE-2015-9352. CWE: CWE-89. CVSS: 9.800000190734863. The wp-polls plugin before 2.72 for WordPress has SQL injection.
Query: patch priority for CVE-2015-2238
Matching passage: CVE-2015-2238. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google V8 before 4.1.0.21, as used in Google Chrome before 41.0.2272.76, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Near-miss passage: CVE-2015-4952. CWE: UNKNOWN. CVSS: 8.800000190734863. The on-demand plugin in IBM Endpoint Manager for Remote Control 9.0.1 and 9.1.0 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors. IBM X-Force ID: 105196.