alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects execution of Windows Problem Steps Recorder (psr.exe), a utility used to record the user screen and clicks.
Matching passage: Sigma rule: Detects execution of Windows Problem Steps Recorder (psr.exe), a utility used to record the user screen and clicks.. Logsource: windows / process_creation. Rule: title: Screen Capture Activity Via Psr.EXE id: 2158f96f-43c2-43cb-952a-ab4580f32382 status: test description: Detects execution of Windows Problem Steps Recorder (psr.exe), a utility used to record the user screen and clicks. references: - https://lolbas-project.github.io/lolbas/Binaries/Psr/ - https://web.archive.org/web/20200229201156/https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1493861893.pdf - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md author: Beyu Denis, oscd.community date: 2019-10-12 modified: 2024-01-04 tags: - attack.collection - attack.t1113 logsource: category: process_creation product: windows detection: selection: Image|endswith: \Psr.exe CommandLine|contains: - /start - -start condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects Crassus, a Windows privilege escalation discovery tool, based on PE metadata characteristics.. Logsource: windows / process_creation. Rule: title: PUA - Crassus Execution id: 2c32b543-1058-4808-91c6-5b31b8bed6c5 status: test description: Detects Crassus, a Windows privilege escalation discovery tool, based on PE metadata characteristics. references: - https://github.com/vu-ls/Crassus author: pH-T (Nextron Systems) date: 2023-04-17 tags: - attack.discovery - attack.reconnaissance - attack.t1590.001 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \Crassus.exe - OriginalFileName: Crassus.exe - Description|contains: Crassus condition: selection falsepositives: - Unlikely level: high
Query: rule covering Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages
Matching passage: Sigma rule: Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages. Logsource: windows / sysmon_error. Rule: title: Sysmon Configuration Error id: 815cd91b-7dbc-4247-841a-d7dd1392b0a8 status: test description: Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://talesfrominfosec.blogspot.com/2017/12/killing-sysmon-silently.html author: frack113 date: 2021-06-04 modified: 2026-07-23 tags: - attack.stealth - attack.t1564 logsource: product: windows category: sysmon_error detection: selection_error: Description|contains: - Failed to open service configuration with error - Failed to connect to the driver to update configuration filter_generic_english: Description|contains|all: - Failed to open service configuration with error - 'Last error: The media is write protected.' filter_generic_french: Description|contains|all: - Failed to open service configuration with error - 'Last error: Média protégé en écriture.' filter_by_errorcode: Description|contains: - Failed to open service configuration with error 19 - Failed to open service configuration with error 93 condition: selection_error and not 1 of filter* falsepositives: - Legitimate administrative action level: high
Near-miss passage: Sigma rule: Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands. Logsource: linux / auditd. Rule: title: Unix Shell Configuration Modification id: a94cdd87-6c54-4678-a6cc-2814ffe5a13d related: - id: e74e15cc-c4b6-4c80-b7eb-dfe49feb7fe9 type: obsolete status: test description: Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands triggered when a new shell is opened. references: - https://objective-see.org/blog/blog_0x68.html - https://web.archive.org/web/20221204161143/https://www.glitch-cat.com/p/green-lambert-and-attack - https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat author: Peter Matkovski, IAI date: 2023-03-06 modified: 2023-03-15 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.004 logsource: product: linux service: auditd detection: selection: type: PATH name: - /etc/shells - /etc/profile - /etc/profile.d/* - /etc/bash.bashrc - /etc/bashrc - /etc/zsh/zprofile - /etc/zsh/zshrc - /etc/zsh/zlogin - /etc/zsh/zlogout - /etc/csh.cshrc - /etc/csh.login - /root/.bashrc - /root/.bash_profile - /root/.profile - /root/.zshrc - /root/.zprofile - /home/*/.bashrc - /home/*/.zshrc - /home/*/.bash_profile - /home/*/.zprofile - /home/*/.profile - /home/*/.bash_login - /home/*/.bash_logout - /home/*/.zlogin - /home/*/.zlogout condition: selection falsepositives: - Admin or User activity are expected to generate some false positives level: medium
Query: risk of In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9655, MSM8909W, SD 2
Matching passage: CVE-2015-9122. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, and SD 835, possible buffer overflow if SIM card sends a response greater than 64KB of data for stream APDU command.
Near-miss passage: CVE-2015-2521. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: Persistence mechanism resembling VBA Stomping
Matching passage: T1564.007 VBA Stomping. Tactics: stealth. Description: Adversaries may hide malicious Visual Basic for Applications (VBA) payloads embedded within MS Office documents by replacing the VBA source code with benign data.(Citation: FireEye VBA stomp Feb 2020) MS Office documents with embedded VBA content store source code inside of module streams. Each module stream has a <code>PerformanceCache</code> that stores a separate compiled version of the VBA source code known as p-code. The p-code is executed when the MS Office version specified in the <code>_VBA_PROJECT</code> stream (which contains the version-dependent description of the VBA project) matches the version of the host MS Office application.(Citation: Evil Clippy May 2019)(Citation: Microsoft _VBA_PROJECT Stream) An adversary may hide malicious VBA code by overwriting the VBA source code location with zero’s, benign code, or random bytes while leaving the previously compiled malicious p-code. Tools that scan for malicious VBA source code may be bypassed as the unwanted code is hidden in the compiled p-code. If the VBA source code is removed, some tools might even think that there are no macros present. If there is a version match between the <code>_VBA_PROJECT</code> stream and host MS Office application, the p-code will be executed, otherwise the benign VBA source code will be decompressed and recompiled to p-code, thus removing malicious p-code and potentially bypassing dynamic analysis.(Citation: Walmart Roberts Oct 2018)(Citation: FireEye VBA stomp Feb 2020)(Citation: pcodedmp Bontchev)
Near-miss passage: T1564.004 NTFS File Attributes. Tactics: stealth. Description: Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. (Citation: SpectorOps Host-Based Jul 2017) Within MFT entries are file attributes, (Citation: Microsoft NTFS File Attributes Aug 2010) such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files). (Citation: SpectorOps Host-Based Jul 2017) (Citation: Microsoft File Streams) (Citation: MalwareBytes ADS July 2015) (Citation: Microsoft ADS Mar 2014) Adversaries may store malicious data or binaries in file attribute metadata instead of directly in files. This may be done to evade some defenses, such as static indicator scanning tools and anti-virus. (Citation: Journey into IR ZeroAccess NTFS EA) (Citation: MalwareBytes ADS July 2015)
Query: patch priority for CVE-2015-9012
Matching passage: CVE-2015-9012. CWE: CWE-264. CVSS: 9.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384691.
Near-miss passage: CVE-2015-7788. CWE: CWE-264. CVSS: 7.300000190734863. ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to execute arbitrary commands via unspecified vectors.
Query: exploit Cross-site request forgery in the REST API in IPython 2 and 3.
Matching passage: CVE-2015-5607. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery in the REST API in IPython 2 and 3.
Near-miss passage: CVE-2015-0145. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Query: patch priority for CVE-2015-9109
Matching passage: CVE-2015-9109. CWE: CWE-476. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, lack of address argument validation inqsee_fuse_write could lead to untrusted pointer dereference.
Near-miss passage: CVE-2015-3194. CWE: CWE-476. CVSS: 7.5. crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an RSA PSS ASN.1 signature that lacks a mask generation function parameter.
Query: patch priority for CVE-2015-4282
Matching passage: CVE-2015-4282. CWE: CWE-264. CVSS: 6.900000095367432. Cisco Mobility Services Engine (MSE) through 8.0.120.7 uses weak permissions for unspecified binary files, which allows local users to obtain root privileges by writing to a file, aka Bug ID CSCuv40504.
Near-miss passage: CVE-2015-9012. CWE: CWE-264. CVSS: 9.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384691.
Query: common weakness: Improper Handling of Incomplete Structural Elements
Matching passage: CWE-238 Improper Handling of Incomplete Structural Elements. The product does not handle or incorrectly handles when a particular structural element is not completely specified.
Near-miss passage: CWE-185 Incorrect Regular Expression. The product specifies a regular expression in a way that causes data to be improperly matched or compared.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the "Create download task via URL" feature in Synology Download Station before 3.5-2967 allows remote attackers to inject arbitrary web 
Matching passage: CVE-2015-6913. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the "Create download task via URL" feature in Synology Download Station before 3.5-2967 allows remote attackers to inject arbitrary web script or HTML via the urls parameter in an add_url_task action to dlm/downloadman.cgi.
Near-miss passage: CVE-2015-1910. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Reference Data Management component in the server in IBM InfoSphere Master Data Management (MDM) 10.1 before IF1, 11.0 before FP3, and 11.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: patch priority for CVE-2015-2854
Matching passage: CVE-2015-2854. CWE: CWE-20. CVSS: 4.300000190734863. The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to conduct clickjacking attacks via vectors involving an IFRAME element.
Near-miss passage: CVE-2015-1371. CWE: CWE-20. CVSS: 7.5. Unrestricted file upload vulnerability in ferretCMS 1.0.4-alpha allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in custom/uploads/.
Query: detection rule: Detects relevant ClamAV messages
Matching passage: Sigma rule: Detects relevant ClamAV messages. Logsource: linux / clamav. Rule: title: Relevant ClamAV Message id: 36aa86ca-fd9d-4456-814e-d3b1b8e1e0bb status: stable description: Detects relevant ClamAV messages references: - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/clam_av_rules.xml author: Florian Roth (Nextron Systems) date: 2017-03-01 tags: - attack.resource-development - attack.t1588.001 logsource: product: linux service: clamav detection: keywords: - Trojan*FOUND - VirTool*FOUND - Webshell*FOUND - Rootkit*FOUND - Htran*FOUND condition: keywords falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations. Logsource: windows / image_load. Rule: title: Abusable DLL Potential Sideloading From Suspicious Location id: 799a5f48-0ac1-4e0f-9152-71d137d48c2a status: test description: Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations references: - https://www.trendmicro.com/en_us/research/23/f/behind-the-scenes-unveiling-the-hidden-workings-of-earth-preta.html - https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/ author: X__Junior (Nextron Systems) date: 2023-07-11 tags: - attack.execution - attack.t1059 logsource: category: image_load product: windows detection: selection_dll: ImageLoaded|endswith: - \coreclr.dll - \facesdk.dll - \HPCustPartUI.dll - \libcef.dll - \ZIPDLL.dll selection_folders_1: ImageLoaded|contains: - :\Perflogs\ - :\Users\Public\ - \Temporary Internet - \Windows\Temp\ selection_folders_2: - ImageLoaded|contains|all: - :\Users\ - \Favorites\ - ImageLoaded|contains|all: - :\Users\ - \Favourites\ - ImageLoaded|contains|all: - :\Users\ - \Contacts\ - ImageLoaded|contains|all: - :\Users\ - \Pictures\ condition: selection_dll and 1 of selection_folders_* falsepositives: - Unknown level: high
Query: exploit The Telephony component in Apple OS X before 10.11, when the Continuity feature is enabled, allows local users to bypass intended telephone-call restrictions via unspecified vector
Matching passage: CVE-2015-3785. CWE: UNKNOWN. CVSS: 1.899999976158142. The Telephony component in Apple OS X before 10.11, when the Continuity feature is enabled, allows local users to bypass intended telephone-call restrictions via unspecified vectors.
Near-miss passage: CVE-2015-5581. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5570, CVE-2015-5574, CVE-2015-5584, and CVE-2015-6682.
Query: risk of The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by
Matching passage: CVE-2015-9097. CWE: CWE-93. CVSS: 6.099999904632568. The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.
Near-miss passage: CVE-2015-9096. CWE: CWE-93. CVSS: 6.099999904632568. Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.
Query: CVE similar to CVE-2015-0618
Matching passage: CVE-2015-0618. CWE: CWE-19. CVSS: 7.099999904632568. Cisco IOS XR 5.0.1 and 5.2.1 on Network Convergence System (NCS) 6000 devices and 5.1.3 and 5.1.4 on Carrier Routing System X (CRS-X) devices allows remote attackers to cause a denial of service (line-card reload) via malformed IPv6 packets with extension headers, aka Bug ID CSCuq95241.
Near-miss passage: CVE-2015-5374. CWE: CWE-19. CVSS: 7.800000190734863. A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02. Specially crafted packets sent to port 50000/UDP could cause a denial-of-service of the affected device. A manual reboot may be required to recover the service of the device.
Query: CVE similar to CVE-2015-5609
Matching passage: CVE-2015-5609. CWE: CWE-22. CVSS: 9.100000381469727. Absolute path traversal vulnerability in the Image Export plugin 1.1 for WordPress allows remote attackers to read and delete arbitrary files via a full pathname in the file parameter to download.php.
Near-miss passage: CVE-2015-0016. CWE: CWE-22. CVSS: 7.800000190734863. Directory traversal vulnerability in the TS WebProxy (aka TSWbPrxy) component in Microsoft Windows Vista SP2, Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to gain privileges via a crafted pathname in an executable file, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Directory Traversal Elevation of Privilege Vulnerability."
Query: campaign using Embedded Payloads
Matching passage: T1027.009 Embedded Payloads. Tactics: stealth. Description: Adversaries may embed payloads within other files to conceal malicious content from defenses. Otherwise seemingly benign files (such as scripts and executables) may be abused to carry and obfuscate malicious payloads and content. In some cases, embedded payloads may also enable adversaries to [Subvert Trust Controls](https://attack.mitre.org/techniques/T1553) by not impacting execution controls such as digital signatures and notarization tickets.(Citation: Sentinel Labs) Adversaries may embed payloads in various file formats to hide payloads.(Citation: Microsoft Learn) This is similar to [Steganography](https://attack.mitre.org/techniques/T1027/003), though does not involve weaving malicious content into specific bytes and patterns related to legitimate digital media formats.(Citation: GitHub PSImage) For example, adversaries have been observed embedding payloads within or as an overlay of an otherwise benign binary.(Citation: Securelist Dtrack2) Adversaries have also been observed nesting payloads (such as executables and run-only scripts) inside a file of the same format.(Citation: SentinelLabs reversing run-only applescripts 2021) Embedded content may also be used as [Process Injection](https://attack.mitre.org/techniques/T1055) payloads used to infect benign system processes.(Citation: Trend Micro) These embedded then injected payloads may be used as part of the modules of malware designed to provide specific features such as encrypting C2 communications in support of an orchestrator module. For example, an embedded module may be injected into default browsers, allowing adversaries to then communicate via the network.(Citation: Malware Analysis Report ComRAT)
Near-miss passage: T1027.008 Stripped Payloads. Tactics: stealth. Description: Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information. Scripts and executables may contain variables names and other strings that help developers document code functionality. Symbols are often created by an operating system’s `linker` when executable payloads are compiled. Reverse engineers use these symbols and strings to analyze code and to identify functionality in payloads.(Citation: Mandiant golang stripped binaries explanation)(Citation: intezer stripped binaries elf files 2018) Adversaries may use stripped payloads in order to make malware analysis more difficult. For example, compilers and other tools may provide features to remove or obfuscate strings and symbols. Adversaries have also used stripped payload formats, such as run-only AppleScripts, a compiled and stripped version of [AppleScript](https://attack.mitre.org/techniques/T1059/002), to evade detection and analysis. The lack of human-readable information may directly hinder detection and analysis of payloads.(Citation: SentinelLabs reversing run-only applescripts 2021)
Query: Sigma rule for Detects the execution of Xwizard tool with the "RunWizard" flag and a GUID like argument. This utility can be abused in
Matching passage: Sigma rule: Detects the execution of Xwizard tool with the "RunWizard" flag and a GUID like argument. This utility can be abused in. Logsource: windows / process_creation. Rule: title: COM Object Execution via Xwizard.EXE id: 53d4bb30-3f36-4e8a-b078-69d36c4a79ff status: test description: 'Detects the execution of Xwizard tool with the "RunWizard" flag and a GUID like argument. This utility can be abused in order to run custom COM object created in the registry. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Xwizard/ - https://www.elastic.co/guide/en/security/current/execution-of-com-object-via-xwizard.html - https://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/ author: Ensar Şamil, @sblmsrsn, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) date: 2020-10-07 modified: 2024-08-15 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: CommandLine: RunWizard CommandLine|re: \{[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}\} condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used. Logsource: windows / process_creation. Rule: title: Suspicious PowerShell Mailbox Export to Share id: 889719ef-dd62-43df-86c3-768fb08dc7c0 status: test description: Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations references: - https://youtu.be/5mqid-7zp8k?t=2481 - https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html - https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1 - https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/ author: Florian Roth (Nextron Systems) date: 2021-08-07 modified: 2022-10-26 tags: - attack.exfiltration logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - New-MailboxExportRequest - ' -Mailbox ' - ' -FilePath \\\\' condition: selection falsepositives: - Unknown level: critical