alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected lo in logs
Matching passage: Sigma rule: Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected lo. Logsource: windows / file_event. Rule: title: Files With System DLL Name In Unsuspected Locations id: 13c02350-4177-4e45-ac17-cf7ca628ff5e status: test description: 'Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected locations. (Outisde of "System32", "SysWOW64", etc.). It is highly recommended to perform an initial baseline before using this rule in production. ' references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2024-06-24 tags: - attack.stealth - attack.t1036.005 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - \secur32.dll - \tdh.dll filter_main_generic: TargetFilename|contains: - C:\$WINDOWS.~BT\ - C:\$WinREAgent\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ - C:\Windows\uus\ condition: selection and not 1 of filter_main_* falsepositives: - Third party software might bundle specific versions of system DLLs. level: medium regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_creation_system_dll_files/info.yml
Near-miss passage: Sigma rule: Detects chromium based browsers starting in headless and debugging mode and pointing to a user profile. This could be a. Logsource: windows / process_creation. Rule: title: Potential Data Stealing Via Chromium Headless Debugging id: 3e8207c5-fcd2-4ea6-9418-15d45b4890e4 related: - id: b3d34dc5-2efd-4ae3-845f-8ec14921f449 type: derived status: test description: Detects chromium based browsers starting in headless and debugging mode and pointing to a user profile. This could be a sign of data stealing or remote control references: - https://github.com/defaultnamehere/cookie_crimes/ - https://mango.pdf.zone/stealing-chrome-cookies-without-a-password - https://embracethered.com/blog/posts/2020/cookie-crimes-on-mirosoft-edge/ - https://embracethered.com/blog/posts/2020/chrome-spy-remote-control/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-23 tags: - attack.credential-access - attack.collection - attack.stealth - attack.t1185 - attack.t1564.003 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - --remote-debugging- - --user-data-dir - --headless condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-6658
Matching passage: CVE-2015-6658. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files.
Near-miss passage: CVE-2015-5481. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter in the gdbbpress_attachments page to wp-admin/edit.php.
Query: CVE similar to CVE-2015-1857
Matching passage: CVE-2015-1857. CWE: CWE-200. CVSS: 5.300000190734863. The odl-mdsal-apidocs feature in OpenDaylight Helium allow remote attackers to obtain sensitive information by leveraging missing AAA restrictions.
Near-miss passage: CVE-2015-3391. CWE: CWE-200. CVSS: 5.0. The Path Breadcrumbs module before 7.x-3.2 for Drupal allows remote attackers to bypass intended access restrictions and obtain sensitive node titles by reading a 403 Not Found page.
Query: rule covering Detects a remote thread creation of Ttdinject.exe used as proxy
Matching passage: Sigma rule: Detects a remote thread creation of Ttdinject.exe used as proxy. Logsource: windows / create_remote_thread. Rule: title: Remote Thread Creation Ttdinject.exe Proxy id: c15e99a3-c474-48ab-b9a7-84549a7a9d16 status: test description: Detects a remote thread creation of Ttdinject.exe used as proxy references: - https://lolbas-project.github.io/lolbas/Binaries/Ttdinject/ author: frack113 date: 2022-05-16 modified: 2022-06-02 tags: - attack.execution - attack.stealth - attack.t1127 logsource: product: windows category: create_remote_thread detection: selection: SourceImage|endswith: \ttdinject.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential abuse of the "register_app.vbs" script that is part of the Windows SDK. The script offers the capabili. Logsource: windows / process_creation. Rule: title: Potential Register_App.Vbs LOLScript Abuse id: 28c8f68b-098d-45af-8d43-8089f3e35403 status: test description: Detects potential abuse of the "register_app.vbs" script that is part of the Windows SDK. The script offers the capability to register new VSS/VDS Provider as a COM+ application. Attackers can use this to install malicious DLLs for persistence and execution. references: - https://twitter.com/sblmsrsn/status/1456613494783160325?s=20 - https://github.com/microsoft/Windows-classic-samples/blob/7cbd99ac1d2b4a0beffbaba29ea63d024ceff700/Samples/Win7Samples/winbase/vss/vsssampleprovider/register_app.vbs author: Austin Songer @austinsonger date: 2021-11-05 modified: 2022-07-07 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \cscript.exe - \wscript.exe - OriginalFileName: - cscript.exe - wscript.exe selection_cli: CommandLine|contains: '.vbs -register ' condition: all of selection* falsepositives: - Other VB scripts that leverage the same starting command line flags level: medium
Query: write Sigma for Detects Crassus, a Windows privilege escalation discovery tool, based on PE metadata characteristics.
Matching passage: Sigma rule: Detects Crassus, a Windows privilege escalation discovery tool, based on PE metadata characteristics.. Logsource: windows / process_creation. Rule: title: PUA - Crassus Execution id: 2c32b543-1058-4808-91c6-5b31b8bed6c5 status: test description: Detects Crassus, a Windows privilege escalation discovery tool, based on PE metadata characteristics. references: - https://github.com/vu-ls/Crassus author: pH-T (Nextron Systems) date: 2023-04-17 tags: - attack.discovery - attack.reconnaissance - attack.t1590.001 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \Crassus.exe - OriginalFileName: Crassus.exe - Description|contains: Crassus condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.. Logsource: windows / process_creation. Rule: title: Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe) id: a58353df-af43-4753-bad0-cd83ef35eef5 related: - id: 2afafd61-6aae-4df4-baed-139fa1f4c345 type: derived status: test description: Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731620(v=ws.11) - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-14 tags: - attack.credential-access - attack.t1003.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \ntdsutil.exe - OriginalFileName: ntdsutil.exe selection_cli: - CommandLine|contains|all: - snapshot - 'mount ' - CommandLine|contains|all: - ac - ' i' - ' ntds' condition: all of selection_* falsepositives: - Legitimate usage to restore snapshots - Legitimate admin activity level: medium
Query: vulnerability: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Small Cell SoC FSM9055, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD
Matching passage: CVE-2015-9132. CWE: CWE-476. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Small Cell SoC FSM9055, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 800, and SD 810, possible arbitrary memory read due to untrusted pointer dereference when handling HLOS controlled values passed to the QSEE syscall helper.
Near-miss passage: CVE-2015-4047. CWE: CWE-476. CVSS: 7.800000190734863. racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests.
Query: detect Detects when a request has been made to transfer a Route 53 domain to another AWS account. in logs
Matching passage: Sigma rule: Detects when a request has been made to transfer a Route 53 domain to another AWS account.. Logsource: aws / cloudtrail. Rule: title: AWS Route 53 Domain Transferred to Another Account id: b056de1a-6e6e-4e40-a67e-97c9808cf41b status: test description: Detects when a request has been made to transfer a Route 53 domain to another AWS account. references: - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/integrations/aws/persistence_route_53_domain_transferred_to_another_account.toml author: Elastic, Austin Songer @austinsonger date: 2021-07-22 modified: 2022-10-09 tags: - attack.persistence - attack.credential-access - attack.privilege-escalation - attack.t1098 logsource: product: aws service: cloudtrail detection: selection: eventSource: route53.amazonaws.com eventName: TransferDomainToAnotherAwsAccount condition: selection falsepositives: - A domain may be transferred to another AWS account by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Domain transfers from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Near-miss passage: Sigma rule: Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands. Logsource: windows / system. Rule: title: Sliver C2 Default Service Installation id: 31c51af6-e7aa-4da7-84d4-8f32cc580af2 status: test description: Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands references: - https://github.com/BishopFox/sliver/blob/79f2d48fcdfc2bee4713b78d431ea4b27f733f30/client/command/commands.go#L1231 - https://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-08-25 tags: - attack.persistence - attack.execution - attack.privilege-escalation - attack.t1543.003 - attack.t1569.002 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7045 selection_service_1: ImagePath|re: ^[a-zA-Z]:\\windows\\temp\\[a-zA-Z0-9]{10}\.exe selection_service_2: ServiceName: - Sliver - Sliver implant condition: selection_eid and 1 of selection_service_* falsepositives: - Unknown level: high
Query: write Sigma for Detects Access to LSASS Process
Matching passage: Sigma rule: Detects Access to LSASS Process. Logsource: windows / windefend. Rule: title: LSASS Access Detected via Attack Surface Reduction id: a0a278fe-2c0e-4de2-ac3c-c68b08a9ba98 status: test description: Detects Access to LSASS Process references: - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction author: Markus Neis date: 2018-08-26 modified: 2022-08-13 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows service: windefend definition: 'Requirements:Enabled Block credential stealing from the Windows local security authority subsystem (lsass.exe) from Attack Surface Reduction (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2)' detection: selection: EventID: 1121 Path|endswith: \lsass.exe filter_thor: ProcessName|startswith: C:\Windows\Temp\asgard2-agent\ ProcessName|endswith: - \thor64.exe - \thor.exe filter_exact: ProcessName: - C:\Windows\System32\atiesrxx.exe - C:\Windows\System32\CompatTelRunner.exe - C:\Windows\System32\msiexec.exe - C:\Windows\System32\nvwmi64.exe - C:\Windows\System32\svchost.exe - C:\Windows\System32\Taskmgr.exe - C:\Windows\System32\wbem\WmiPrvSE.exe - C:\Windows\SysWOW64\msiexec.exe filter_begins: ProcessName|startswith: - C:\Windows\System32\DriverStore\ - C:\WINDOWS\Installer\ - C:\Program Files\ - C:\Program Files (x86)\ condition: selection and not 1 of filter_* falsepositives: - Google Chrome GoogleUpdate.exe - Some Taskmgr.exe related activity level: high
Near-miss passage: Sigma rule: Identifies when a service account is modified in Google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud Service Account Modified id: 6b67c12e-5e40-47c6-b3b0-1e6b571184cc status: test description: Identifies when a service account is modified in Google Cloud. references: - https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts author: Austin Songer @austinsonger date: 2021-08-14 modified: 2022-10-09 tags: - attack.impact logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name|endswith: - .serviceAccounts.patch - .serviceAccounts.create - .serviceAccounts.update - .serviceAccounts.enable - .serviceAccounts.undelete condition: selection falsepositives: - Service Account being modified may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Service Account modified from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: describe CVE-2015-1805
Matching passage: CVE-2015-1805. CWE: CWE-17. CVSS: 7.199999809265137. The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun."
Near-miss passage: CVE-2015-1452. CWE: CWE-17. CVSS: 7.800000190734863. The Control and Provisioning of Wireless Access Points (CAPWAP) daemon in Fortinet FortiOS 5.0 Patch 7 build 4457 allows remote attackers to cause a denial of service (locked CAPWAP Access Controller) via a large number of ClientHello DTLS messages.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects MsiExec loading a DLL and calling its DllUnregisterServer function. Logsource: windows / process_creation. Rule: title: DllUnregisterServer Function Call Via Msiexec.EXE id: 84f52741-8834-4a8c-a413-2eb2269aa6c8 status: test description: Detects MsiExec loading a DLL and calling its DllUnregisterServer function references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md - https://lolbas-project.github.io/lolbas/Binaries/Msiexec/ - https://twitter.com/_st0pp3r_/status/1583914515996897281 author: frack113 date: 2022-04-24 modified: 2024-03-13 tags: - attack.stealth - attack.t1218.007 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \msiexec.exe - OriginalFileName: \msiexec.exe selection_flag: CommandLine|contains|windash: ' -z ' selection_dll: CommandLine|contains: .dll condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of MemProcFS a memory forensics tool with the '-device' parameter. MemProcFS mounts physical memory as. Logsource: windows / process_creation. Rule: title: PUA - Memory Dump Mount Via MemProcFS id: 8a1b2c3d-4e5f-6789-abcd-ef1234567890 status: experimental description: 'Detects execution of MemProcFS a memory forensics tool with the ''-device'' parameter. MemProcFS mounts physical memory as a virtual file system, allowing direct access to process memory and system structures. Threat actors were seen abusing this utility to mount memory dumps and then extract sensitive information from processes like LSASS or extract registry hives to obtain credentials, LSA secrets, SAM data, and cached domain credentials. MemProcFS usage that is not part of authorized forensic analysis should be treated as suspicious and warrants further investigation. ' references: - https://github.com/ufrisk/MemProcFS - https://0xdf.gitlab.io/2024/10/05/htb-freelancer.html# - https://www.huntress.com/blog/curling-for-data-a-dive-into-a-threat-actors-malicious-ttps author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-04-27 tags: - attack.credential-access - attack.t1003 - attack.t1003.001 - attack.t1003.004 - attack.t1003.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \MemProcFS.exe - OriginalFileName: MemProcFS.exe - Description: MemProcFS selection_cli: CommandLine|contains: -device condition: all of selection_* falsepositives: - Legitimate use during memory forensics; if not part of authorized analysis, warrants urgent investigation level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_memprocfs/info.yml
Query: detection engineering for Match Legitimate Resource Name or Location
Matching passage: T1036.005 Match Legitimate Resource Name or Location. Tactics: stealth. Description: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: `svchost.exe`). Alternatively, a Windows Registry key may be given a close approximation to a key used by a legitimate program. In containerized environments, a threat actor may create a resource in a trusted namespace or one that matches the naming convention of a container pod or cluster.(Citation: Aquasec Kubernetes Backdoor 2023)
Near-miss passage: T1036.006 Space after Filename. Tactics: stealth. Description: Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system. For example, if there is a Mach-O executable file called <code>evil.bin</code>, when it is double clicked by a user, it will launch Terminal.app and execute. If this file is renamed to <code>evil.txt</code>, then when double clicked by a user, it will launch with the default text editing application (not executing the binary). However, if the file is renamed to <code>evil.txt </code> (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed (Citation: Mac Backdoors are back). Adversaries can use this feature to trick users into double clicking benign-looking files of any format and ultimately executing something malicious.
Query: weakness Hardware Child Block Incorrectly Connected to Parent System
Matching passage: CWE-1276 Hardware Child Block Incorrectly Connected to Parent System. Signals between a hardware IP and the parent system design are incorrectly connected causing security risks.
Near-miss passage: CWE-1314 Missing Write Protection for Parametric Data Values. The device does not write-protect the parametric data values for sensors that scale the sensor value, allowing untrusted software to manipulate the apparent result and potentially damage hardware or cause operational failure.
Query: rule covering Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by
Matching passage: Sigma rule: Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by. Logsource: windows / process_creation. Rule: title: Suspicious Rundll32 Invoking Inline VBScript id: 1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd status: test description: Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452 references: - https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ author: Florian Roth (Nextron Systems) date: 2021-03-05 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - rundll32.exe - Execute - RegRead - window.close condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line. Logsource: windows / process_creation. Rule: title: PowerShell Base64 Encoded FromBase64String Cmdlet id: fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c status: test description: Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line references: - Internal Research author: Florian Roth (Nextron Systems) date: 2019-08-24 modified: 2023-04-06 tags: - attack.stealth - attack.t1140 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: - CommandLine|base64offset|contains: ::FromBase64String - CommandLine|contains: - OgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcA - oAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnA - 6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZw condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-5674
Matching passage: CVE-2015-5674. CWE: CWE-20. CVSS: 6.5. The routed daemon in FreeBSD 9.3 before 9.3-RELEASE-p22, 10.2-RC2 before 10.2-RC2-p1, 10.2-RC1 before 10.2-RC1-p2, 10.2 before 10.2-BETA2-p3, and 10.1 before 10.1-RELEASE-p17 allows remote authenticated users to cause a denial of service (assertion failure and daemon exit) via a query from a network that is not directly connected.
Near-miss passage: CVE-2015-2514. CWE: CWE-20. CVSS: 9.300000190734863. Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted .jnt file, aka "Windows Journal RCE Vulnerability," a different vulnerability than CVE-2015-2513 and CVE-2015-2530.