alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / registry_event
Matching passage: Sigma rule: Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellS. Logsource: windows / registry_event. Rule: title: Run Once Task Configuration in Registry id: c74d7efc-8826-45d9-b8bb-f04fac9e4eff status: test description: Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellStartup references: - https://twitter.com/pabraeken/status/990717080805789697 - https://lolbas-project.github.io/lolbas/Binaries/Runonce/ author: Avneet Singh @v3t0_, oscd.community date: 2020-11-15 modified: 2024-03-25 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_event detection: selection: TargetObject|contains: \Microsoft\Active Setup\Installed Components TargetObject|endswith: \StubPath filter_optional_chrome: Details|contains|all: - C:\Program Files\Google\Chrome\Application\ - \Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level filter_optional_edge: Details|contains: - C:\Program Files (x86)\Microsoft\Edge\Application\ - C:\Program Files\Microsoft\Edge\Application\ Details|endswith: \Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable condition: selection and not 1 of filter_optional_* falsepositives: - Legitimate modification of the registry key by legitimate program level: medium
Near-miss passage: Sigma rule: Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2. Logsource: windows / process_creation. Rule: title: PUA - Netcat Suspicious Execution id: e31033fc-33f0-4020-9a16-faf9b31cbf08 status: test description: Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network references: - https://nmap.org/ncat/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1095/T1095.md - https://www.revshells.com/ author: frack113, Florian Roth (Nextron Systems) date: 2021-07-21 modified: 2023-02-08 tags: - attack.command-and-control - attack.t1095 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: - \nc.exe - \ncat.exe - \netcat.exe selection_cmdline: CommandLine|contains: - ' -lvp ' - ' -lvnp' - ' -l -v -p ' - ' -lv -p ' - ' -l --proxy-type http ' - ' -vnl --exec ' - ' -vnl -e ' - ' --lua-exec ' - ' --sh-exec ' condition: 1 of selection_* falsepositives: - Legitimate ncat use level: high
Query: describe CVE-2015-1132
Matching passage: CVE-2015-1132. CWE: CWE-20. CVSS: 10.0. fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1131, CVE-2015-1133, CVE-2015-1134, and CVE-2015-1135.
Near-miss passage: CVE-2015-8722. CWE: CWE-20. CVSS: 5.5. epan/dissectors/packet-sctp.c in the SCTP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the frame pointer, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet.
Query: describe CVE-2015-6565
Matching passage: CVE-2015-6565. CWE: CWE-264. CVSS: 7.199999809265137. sshd in OpenSSH 6.8 and 6.9 uses world-writable permissions for TTY devices, which allows local users to cause a denial of service (terminal disruption) or possibly have unspecified other impact by writing to a device, as demonstrated by writing an escape sequence.
Near-miss passage: CVE-2015-4927. CWE: CWE-264. CVSS: 7.199999809265137. The Reporting and Monitoring component in Tivoli Monitoring in IBM Tivoli Storage Manager 6.3 before 6.3.6 and 7.1 before 7.1.3 on Linux and AIX uses world-writable permissions for unspecified files, which allows local users to gain privileges by writing to a file.
Query: rule covering An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users. This may take
Matching passage: Sigma rule: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users. This may take. Logsource: windows / ps_script. Rule: title: Replace Desktop Wallpaper by Powershell id: c5ac6a1e-9407-45f5-a0ce-ca9a0806a287 status: test description: 'An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users. This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1491.001/T1491.001.md author: frack113 date: 2021-12-26 tags: - attack.impact - attack.t1491.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_1: ScriptBlockText|contains|all: - Get-ItemProperty - 'Registry::' - HKEY_CURRENT_USER\Control Panel\Desktop\ - WallPaper selection_2: ScriptBlockText|contains: SystemParametersInfo(20,0,*,3) condition: 1 of selection_* falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects the use of CleanWipe a tool usually used to delete Symantec antivirus.. Logsource: windows / process_creation. Rule: title: PUA - CleanWipe Execution id: f44800ac-38ec-471f-936e-3fa7d9c53100 status: test description: Detects the use of CleanWipe a tool usually used to delete Symantec antivirus. references: - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/CleanWipe author: Nasreddine Bencherchali (Nextron Systems) date: 2021-12-18 modified: 2023-02-14 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection1: Image|endswith: \SepRemovalToolNative_x64.exe selection2: Image|endswith: \CATClean.exe CommandLine|contains: --uninstall selection3: Image|endswith: \NetInstaller.exe CommandLine|contains: -r selection4: Image|endswith: \WFPUnins.exe CommandLine|contains|all: - /uninstall - /enterprise condition: 1 of selection* falsepositives: - Legitimate administrative use (Should be investigated either way) level: high
Query: describe CVE-2015-5739
Matching passage: CVE-2015-5739. CWE: CWE-444. CVSS: 9.800000190734863. The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks via a space instead of a hyphen, as demonstrated by "Content Length" instead of "Content-Length."
Near-miss passage: CVE-2015-5741. CWE: CWE-444. CVSS: 9.800000190734863. The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request that contains Content-Length and Transfer-Encoding header fields.
Query: describe CVE-2015-0800
Matching passage: CVE-2015-0800. CWE: CWE-200. CVSS: 5.0. The PRNG implementation in the DNS resolver in Mozilla Firefox (aka Fennec) before 37.0 on Android does not properly generate random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a related issue to CVE-2012-2808.
Near-miss passage: CVE-2015-6557. CWE: CWE-200. CVSS: 2.0999999046325684. IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 5.5 before 5.5.6.1, 6.3 before 6.3.1.5, 6.4 before 6.4.1.7, and 7.1 before 7.1.2; Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 5.5 before 5.5.1.1, 6.1 before 6.1.3.7, 6.3 before 6.3.1.5, 6.4 before 6.4.1.7, and 7.1 before 7.1.2; and Tivoli Storage FlashCopy Manager 3.1 before 3.1.1.5, 3.2 before 3.2.1.7, and 4.1 before 4.1.2, when application tracing is used, place cleartext passwords in exception messages, which allows physically proximate attackers to obtain sensitive information by reading trace output, a different vulnerability than CVE-2015-4949.
Query: Sigma rule for Find local accounts being created or modified as well as remote authentication configurations
Matching passage: Sigma rule: Find local accounts being created or modified as well as remote authentication configurations. Logsource: cisco / aaa. Rule: title: Cisco Local Accounts id: 6d844f0f-1c18-41af-8f19-33e7654edfc3 status: test description: Find local accounts being created or modified as well as remote authentication configurations author: Austin Clark date: 2019-08-12 modified: 2023-01-04 tags: - attack.privilege-escalation - attack.persistence - attack.t1136.001 - attack.t1098 logsource: product: cisco service: aaa detection: keywords: - username - aaa condition: keywords falsepositives: - When remote authentication is in place, this should not change often level: high
Near-miss passage: Sigma rule: Detects the execution of certutil with certain flags that allow the utility to download files.. Logsource: windows / process_creation. Rule: title: Suspicious Download Via Certutil.EXE id: 19b08b1c-861d-4e75-a1ef-ea0c1baf202b related: - id: 13e6fe51-d478-4c7e-b0f2-6da9b400a829 type: similar status: test description: Detects the execution of certutil with certain flags that allow the utility to download files. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil - https://forensicitguy.github.io/agenttesla-vba-certutil-download/ - https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/ - https://twitter.com/egre55/status/1087685529016193025 - https://lolbas-project.github.io/lolbas/Binaries/Certutil/ - https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2023-02-15 modified: 2025-12-01 tags: - attack.stealth - attack.t1027 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certutil.exe - OriginalFileName: CertUtil.exe selection_flags: CommandLine|contains: - 'urlcache ' - 'verifyctl ' - 'URL ' selection_http: CommandLine|contains: http condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_download/info.yml
Query: alert when Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS
Matching passage: Sigma rule: Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS. Logsource: windows / process_creation. Rule: title: IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI id: 10344bb3-7f65-46c2-b915-2d00d47be5b0 related: - id: 3fd4c8d7-8362-4557-a8e6-83b29cc0d724 type: similar status: test description: 'Detects changes to Internet Explorer''s (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally. ' references: - https://twitter.com/M_haggis/status/1699056847154725107 - https://twitter.com/JAMESWT_MHT/status/1699042827261391247 - https://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries - https://www.virustotal.com/gui/file/339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5/content author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-05 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - \Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults - http - ' 0' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by. Logsource: windows / process_creation. Rule: title: Suspicious Rundll32 Invoking Inline VBScript id: 1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd status: test description: Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452 references: - https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ author: Florian Roth (Nextron Systems) date: 2021-03-05 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - rundll32.exe - Execute - RegRead - window.close condition: selection falsepositives: - Unknown level: high
Query: Suspicious Local Storage Discovery execution detected on endpoint
Matching passage: T1680 Local Storage Discovery. Tactics: discovery. Description: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number. This can be done to prepare for ransomware-related encryption, to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0109), or as a precursor to [Direct Volume Access](https://attack.mitre.org/techniques/T1006). On ESXi systems, adversaries may use [Hypervisor CLI](https://attack.mitre.org/techniques/T1059/012) commands such as `esxcli` to list storage connected to the host as well as `.vmdk` files.(Citation: TrendMicro)(Citation: TrendMicro ESXI Ransomware) On Windows systems, adversaries can use `wmic logicaldisk get` to find information about local network drives. They can also use `Get-PSDrive` in PowerShell to retrieve drives and may additionally use Windows API functions such as `GetDriveType`.(Citation: Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024)(Citation: Volexity) Linux has commands such as `parted`, `lsblk`, `fdisk`, `lshw`, and `df` that can list information about disk partitions such as size, type, file system types, and free space. The command `diskutil` on MacOS can be used to list disks while `system_profiler SPStorageDataType` can additionally show information such as a volume’s mount path, file system, and the type of drive in the system. Infrastructure as a Service (IaaS) cloud providers also have commands for storage discovery such as `describe volume` in AWS, `gcloud compute disks list` in GCP, and `az disk list` in Azure.(Citation: AWS docs describe volumes)(Citation: GCP gcloud compute disks list)(Citation: azure az disk)
Near-miss passage: T1135 Network Share Discovery. Tactics: discovery. Description: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. File sharing over a Windows network occurs over the SMB protocol. (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder) [Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the <code>net view \\\\remotesystem</code> command. It can also be used to query shared drives on the local system using <code>net share</code>. For macOS, the <code>sharing -l</code> command lists all shared points used for smb services.
Query: risk of Multiple cross-site request forgery (CSRF) vulnerabilities in Ipswitch MOVEit Mobile 1.2.0.962 and earlier allow remote attackers to hijack the authentication of unspecified victim
Matching passage: CVE-2015-7678. CWE: CWE-352. CVSS: 8.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Ipswitch MOVEit Mobile 1.2.0.962 and earlier allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Near-miss passage: CVE-2015-5999. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DIR-816L Wireless Router with firmware before 2.06.B09_BETA allow remote attackers to hijack the authentication of administrators for requests that (1) change the admin password, (2) change the network policy, or (3) possibly have other unspecified impact via crafted requests to hedwig.cgi and pigwidgeon.cgi.
Query: exploit Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier, and 5.6.25 and earlier, allows local users to affect confidentiality, integrity, and availability via unknown v
Matching passage: CVE-2015-4819. CWE: UNKNOWN. CVSS: 7.199999809265137. Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier, and 5.6.25 and earlier, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client programs.
Near-miss passage: CVE-2015-0462. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, and 6.3.6 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
Query: vulnerability: Clustered Data ONTAP versions 8.0, 8.3.1, and 8.3.2 contain a default privileged account which under certain conditions can be used for unauthorized information disclosure.
Matching passage: CVE-2015-8020. CWE: CWE-200. CVSS: 3.700000047683716. Clustered Data ONTAP versions 8.0, 8.3.1, and 8.3.2 contain a default privileged account which under certain conditions can be used for unauthorized information disclosure.
Near-miss passage: CVE-2015-1933. CWE: CWE-200. CVSS: 2.0999999046325684. IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX001, and 7.6.0 before 7.6.0.1 IFIX001; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX001 and 7.6.0 before 7.6.0.1 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products do not have an off autocomplete attribute for the password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
Query: explain T1114.003 Email Forwarding Rule
Matching passage: T1114.003 Email Forwarding Rule. Tactics: collection. Description: Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.(Citation: Pfammatter - Hidden Inbox Rules) Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient. These rules may be created through a local email application, a web interface, or by command-line interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2)(Citation: Mac Forwarding Rules) Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more. Adversaries may also hide the rule by making use of the Microsoft Messaging API (MAPI) to modify the rule properties, making it hidden and not visible from Outlook, OWA or most Exchange Administration tools.(Citation: Pfammatter - Hidden Inbox Rules) In some environments, administrators may be able to enable email forwarding rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.(Citation: Microsof
Near-miss passage: T1114.002 Remote Email Collection. Tactics: collection. Description: Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords.
Query: risk of Cross-site scripting (XSS) vulnerability in the Ubercart Webform Checkout Pane module 6.x-3.x before 6.x-3.10 and 7.x-3.x before 7.x-3.11 for Drupal allows remote authenticated use
Matching passage: CVE-2015-4384. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Ubercart Webform Checkout Pane module 6.x-3.x before 6.x-3.10 and 7.x-3.x before 7.x-3.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-6521. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in ATutor LMS version 2.2.