alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: explain T1546.007 Netsh Helper DLL
Matching passage: T1546.007 Netsh Helper DLL. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility.(Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at <code>HKLM\SOFTWARE\Microsoft\Netsh</code>. Adversaries can use netsh.exe helper DLLs to trigger execution of arbitrary code in a persistent manner. This execution would take place anytime netsh.exe is executed, which could happen automatically, with another persistence technique, or if other software (ex: VPN) is present on the system that executes netsh.exe as part of its normal functionality.(Citation: Github Netsh Helper CS Beacon)(Citation: Demaske Netsh Persistence)
Near-miss passage: T1546.011 Application Shimming. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10. (Citation: Elastic Process Injection July 2017) Within the framework, shims are created to act as a buffer between the program (or more specifically, the Import Address Table) and the Windows OS. When a program is executed, the shim cache is referenced to determine if the program requires the use of the shim database (.sdb). If so, the shim database uses hooking to redirect the code as necessary in order to communicate with the OS. A list of all shims currently installed by the default Windows installer (sdbinst.exe) is kept in: * <code>%WINDIR%\AppPatch\sysmain.sdb</code> and * <code>hklm\software\microsoft\windows nt\currentversion\appcompatflags\installedsdb</code> Custom databases are stored in: * <code>%WINDIR%\AppPatch\custom & %WINDIR%\AppPatch\AppPatch64\Custom</code> and * <code>hklm\software\microsoft\windows nt\currentversion\appcompatflags\custom</code> To keep shims secure, Windows designed them to run in user mode so they cannot modify the kernel and you must have administrator privileges to install a shim. However, certain shims can be used to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) (UAC and RedirectEXE), inject DLLs into processes (InjectDLL), disable Data Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH), and intercept memory addresses (GetProcAddress). Utilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdo
Query: describe CVE-2015-1180
Matching passage: CVE-2015-1180. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Web Reports in EventSentry 3.1.0 allows remote attackers to inject arbitrary web script or HTML via the pageId parameter to networktile/bullet.
Near-miss passage: CVE-2015-9104. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerabilities in Synology Audio Station 5.1 before 5.1-2550 and 5.4 before 5.4-2857 allows remote authenticated attackers to inject arbitrary web script or HTML via the album title.
Query: incident response steps for Multiple failed authentications followed by Pre-OS Boot
Matching passage: Playbook for T1542 Pre-OS Boot. 1) Validate alert telemetry against T1542. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth, persistence. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting) Adversaries may overwrite data in boot drivers or firmware such as BIOS (Ba
Near-miss passage: Playbook for T1542.004 ROMMONkit. Different response path focused on stealth, persistence.
Query: detection rule: Detects suspicious DNS queries known from Cobalt Strike beacons
Matching passage: Sigma rule: Detects suspicious DNS queries known from Cobalt Strike beacons. Logsource: dns. Rule: title: Cobalt Strike DNS Beaconing id: 2975af79-28c4-4d2f-a951-9095f229df29 status: test description: Detects suspicious DNS queries known from Cobalt Strike beacons references: - https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns - https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/ author: Florian Roth (Nextron Systems) date: 2018-05-10 modified: 2022-10-09 tags: - attack.command-and-control - attack.t1071.004 logsource: category: dns detection: selection1: query|startswith: - aaa.stage. - post.1 selection2: query|contains: .stage.123456. condition: 1 of selection* falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects attempts of decoding encoded Gzip archives via PowerShell.. Logsource: windows / process_creation. Rule: title: Gzip Archive Decode Via PowerShell id: 98767d61-b2e8-4d71-b661-e36783ee24c1 status: test description: Detects attempts of decoding encoded Gzip archives via PowerShell. references: - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution author: Hieu Tran date: 2023-03-13 tags: - attack.command-and-control - attack.t1132.001 logsource: product: windows category: process_creation detection: selection: CommandLine|contains|all: - GZipStream - ::Decompress condition: selection falsepositives: - Legitimate administrative scripts may use this functionality. Use "ParentImage" in combination with the script names and allowed users and applications to filter legitimate executions level: medium
Query: detect Detects usage of system utilities to discover system network connections in logs
Matching passage: Sigma rule: Detects usage of system utilities to discover system network connections. Logsource: macos / process_creation. Rule: title: System Network Connections Discovery - MacOs id: 9a7a0393-2144-4626-9bf1-7c2f5a7321db status: test description: Detects usage of system utilities to discover system network connections references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2022-12-28 tags: - attack.discovery - attack.t1049 logsource: category: process_creation product: macos detection: selection: Image|endswith: - /who - /w - /last - /lsof - /netstat condition: selection falsepositives: - Legitimate activities level: informational
Near-miss passage: Sigma rule: Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidum. Logsource: windows / process_creation. Rule: title: Process Memory Dump Via Comsvcs.DLL id: 646ea171-dded-4578-8a4d-65e9822892e3 related: - id: 09e6d5c0-05b8-4ff8-9eeb-043046ec774c type: obsolete status: test description: Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.) references: - https://twitter.com/shantanukhande/status/1229348874298388484 - https://twitter.com/pythonresponder/status/1385064506049630211?s=21 - https://twitter.com/Hexacorn/status/1224848930795552769 - https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/ - https://twitter.com/SBousseaden/status/1167417096374050817 - https://twitter.com/Wietze/status/1542107456507203586 - https://github.com/Hackndo/lsassy/blob/14d8f8ae596ecf22b449bfe919829173b8a07635/lsassy/dumpmethod/comsvcs.py - https://www.youtube.com/watch?v=52tAmVLg1KM&t=2070s author: Florian Roth (Nextron Systems), Modexp, Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2020-02-18 modified: 2025-02-23 tags: - attack.credential-access - attack.stealth - attack.t1036 - attack.t1003.001 - car.2013-05-009 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE - CommandLine|contains: rundll32 selection_cli_1: CommandLine|contains|all: - comsvcs - full CommandLine|contains: - '#-' - '#+' - '#24' - '24 ' - MiniDump - '#65560' selection_generic: CommandLine|contains|all: - '24' - comsvcs - full CommandLine|contains: - ' #' - ',#' - ', #' - '"#' condition: (selection_img and 1 of selection_cli_*) or selection_generic falsepositives: - Unlikely level: high
Query: detect Detects Executables in the Downloads folder without FileVersion,Description,Product,Company likely created with py2exe in logs
Matching passage: Sigma rule: Detects Executables in the Downloads folder without FileVersion,Description,Product,Company likely created with py2exe. Logsource: windows / process_creation. Rule: title: Suspicious File Characteristics Due to Missing Fields id: 9637e8a5-7131-4f7f-bdc7-2b05d8670c43 status: test description: Detects Executables in the Downloads folder without FileVersion,Description,Product,Company likely created with py2exe references: - https://securelist.com/muddywater/88059/ - https://www.virustotal.com/#/file/276a765a10f98cda1a38d3a31e7483585ca3722ecad19d784441293acf1b7beb/detection author: Markus Neis, Sander Wiebing date: 2018-11-22 modified: 2022-10-09 tags: - attack.execution - attack.t1059.006 logsource: product: windows category: process_creation detection: selection1: Description: \? FileVersion: \? selection2: Description: \? Product: \? selection3: Description: \? Company: \? folder: Image|contains: \Downloads\ condition: (selection1 or selection2 or selection3) and folder falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of a renamed "ftp.exe" binary based on the PE metadata fields. Logsource: windows / process_creation. Rule: title: Renamed FTP.EXE Execution id: 277a4393-446c-449a-b0ed-7fdc7795244c status: test description: Detects the execution of a renamed "ftp.exe" binary based on the PE metadata fields references: - https://lolbas-project.github.io/lolbas/Binaries/Ftp/ author: Victor Sergeev, oscd.community date: 2020-10-09 modified: 2023-02-03 tags: - attack.execution - attack.stealth - attack.t1059 - attack.t1202 logsource: category: process_creation product: windows detection: selection_original: OriginalFileName: ftp.exe filter_img: Image|endswith: \ftp.exe condition: selection_original and not filter_img falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_ftp/info.yml
Query: Sigma rule for Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a netw
Matching passage: Sigma rule: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a netw. Logsource: windows / process_creation. Rule: title: Suspicious Scan Loop Network id: f8ad2e2c-40b6-4117-84d7-20b89896ab23 status: test description: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md - https://ss64.com/nt/for.html - https://ss64.com/ps/foreach-object.html author: frack113 date: 2022-03-12 tags: - attack.execution - attack.t1059 - attack.discovery - attack.t1018 logsource: category: process_creation product: windows detection: selection_loop: CommandLine|contains: - 'for ' - 'foreach ' selection_tools: CommandLine|contains: - nslookup - ping condition: all of selection_* falsepositives: - Legitimate script level: medium
Near-miss passage: Sigma rule: Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common. Logsource: windows / file_event. Rule: title: Suspicious Startup Folder Persistence id: 28208707-fe31-437f-9a7f-4b1108b94d2e related: - id: 2aa0a6b4-a865-495b-ab51-c28249537b75 type: similar status: test description: 'Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common persistence technique used by threat actors. These files (.ps1, .vbs, .js, .bat, etc.) are automatically executed when a user logs in, making the Startup folder an attractive target for attackers. This technique is frequently observed in malvertising campaigns and malware distribution where attackers attempt to maintain long-term access to compromised systems. ' references: - https://github.com/last-byte/PersistenceSniper - https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/ - https://github.com/redcanaryco/atomic-red-team/blob/5ede8f21e42ebe37e0a6eff757dba60bcfa85859/atomics/T1547.001/T1547.001.md author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2022-08-10 modified: 2025-10-12 tags: - attack.privilege-escalation - attack.execution - attack.t1204.002 - attack.persistence - attack.t1547.001 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \Windows\Start Menu\Programs\Startup\ TargetFilename|endswith: - .bat - .cmd - .dll - .hta - .jar - .js - .jse - .msi - .ps1 - .psd1 - .psm1 - .scr - .url - .vba - .vbe - .vbs - .wsf condition: selection falsepositives: - Rare legitimate usage of some of the extensions mentioned in the rule level: high
Query: Lateral movement indicators for Compromise Software Dependencies and Development Tools
Matching passage: T1195.001 Compromise Software Dependencies and Development Tools. Tactics: initial access. Description: Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise)(Citation: Bitdefender NPM Repositories Compromised 2021)(Citation: MANDVI Malicious npm and PyPI Packages Disguised) This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by adversaries.(Citation: The Hacker News PyPi Revival Hijack 2024) Adversaries may also employ "typosquatting" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user.(Citation: Ahmed Backdoors in Python and NPM Packages)(Citation: Meyer PyPI Supply Chain Attack Uncovered)(Citation: Checkmarx-oss-seo) Additionally, CI/CD pipeline components, such as GitHub Actions, may be targeted in order to gain access to the building, testing, and deployment cycles of an application.(Citation: Unit 42 Palo Alto GitHub Actions Supply Chain Attack 2025) By adding malicious code into a GitHub action, a threat actor may be able to collect runtime credentials (e.g., via [Proc Filesystem](https://attack.mitre.org/techniques/T1003/007)) or insert further malicious components into the build pipelines for a second-order supply chain compromise.(Citation: OWASP CICD-SEC-4) As GitHub Actions are often dependent on other GitHub Actions, threat actors may be able to infect a large number of repositories via the compromise of a single Action.(Citation: Palo Alto Networks GitHub Actions Worm 2023) Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.
Near-miss passage: T1195.003 Compromise Hardware Supply Chain. Tactics: initial access. Description: Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system. Hardware backdoors may be inserted into various devices, such as servers, workstations, network infrastructure, or peripherals.
Query: risk of The jpeg2000_read_main_headers function in libavcodec/jpeg2000dec.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not enforce uniqueness of the SIZ marke
Matching passage: CVE-2015-8363. CWE: CWE-119. CVSS: 6.800000190734863. The jpeg2000_read_main_headers function in libavcodec/jpeg2000dec.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not enforce uniqueness of the SIZ marker in a JPEG 2000 image, which allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via a crafted image with two or more of these markers.
Near-miss passage: CVE-2015-9128. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, and SD 835, lack of validation of the buffer size could lead to a buffer overread.
Query: vulnerability: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Ex
Matching passage: CVE-2015-1705. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1689.
Near-miss passage: CVE-2015-7116. CWE: CWE-119. CVSS: 4.300000190734863. libxml2 in Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 allows remote attackers to obtain sensitive information or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2015-7115.
Query: CVE similar to CVE-2015-6964
Matching passage: CVE-2015-6964. CWE: CWE-697. CVSS: 5.300000190734863. MultiBit HD before 0.1.2 allows attackers to conduct bit-flipping attacks that insert unspendable Bitcoin addresses into the list that MultiBit uses to send fees to the developers. (Attackers cannot realistically steal these fees for themselves.) This occurs because there is no message authentication code (MAC).
Near-miss passage: CVE-2015-9238. CWE: CWE-697. CVSS: 5.300000190734863. secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.
Query: patch priority for CVE-2015-7297
Matching passage: CVE-2015-7297. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2015-7858.
Near-miss passage: CVE-2015-10055. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in PictureThisWebServer and classified as critical. This issue affects the function router.post of the file routes/user.js. The manipulation of the argument username/password leads to sql injection. The patch is named 68b9dc346e88b494df00d88c7d058e96820e1479. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218399.
Query: exploit The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection.
Matching passage: CVE-2015-9324. CWE: CWE-89. CVSS: 9.800000190734863. The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection.
Near-miss passage: CVE-2015-1605. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in Dell ScriptLogic Asset Manager (aka Quest Workspace Asset Manager) before 9.5 allow remote attackers to execute arbitrary SQL commands via unspecified vectors to (1) GetClientPackage.aspx or (2) GetProcessedPackage.aspx.
Query: detect Detects the creation of a file with the ".dmp"/".hdmp" extension by a shell or scripting application such as "cmd", "pow in logs
Matching passage: Sigma rule: Detects the creation of a file with the ".dmp"/".hdmp" extension by a shell or scripting application such as "cmd", "pow. Logsource: windows / file_event. Rule: title: Potentially Suspicious DMP/HDMP File Creation id: aba15bdd-657f-422a-bab3-ac2d2a0d6f1c related: - id: 3a525307-d100-48ae-b3b9-0964699d7f97 type: similar status: test description: Detects the creation of a file with the ".dmp"/".hdmp" extension by a shell or scripting application such as "cmd", "powershell", etc. Often created by software during a crash. Memory dumps can sometimes contain sensitive information such as credentials. It's best to determine the source of the crash. references: - https://learn.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-07 tags: - attack.stealth logsource: category: file_event product: windows detection: selection: Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \wscript.exe TargetFilename|endswith: - .dmp - .dump - .hdmp condition: selection falsepositives: - Some administrative PowerShell or VB scripts might have the ability to collect dumps and move them to other folders which might trigger a false positive. level: medium regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_dump_file_susp_creation/info.yml
Near-miss passage: Sigma rule: Detects the presence of default Cobalt Strike certificate in the HTTPS traffic. Logsource: zeek / x509. Rule: title: Default Cobalt Strike Certificate id: 7100f7e3-92ce-4584-b7b7-01b40d3d4118 status: test description: Detects the presence of default Cobalt Strike certificate in the HTTPS traffic references: - https://sergiusechel.medium.com/improving-the-network-based-detection-of-cobalt-strike-c2-servers-in-the-wild-while-reducing-the-6964205f6468 author: Bhabesh Raj date: 2021-06-23 modified: 2022-10-09 tags: - attack.command-and-control - attack.s0154 logsource: product: zeek service: x509 detection: selection: certificate.serial: 8BB00EE condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-5289
Matching passage: CVE-2015-5289. CWE: CWE-119. CVSS: 6.400000095367432. Multiple stack-based buffer overflows in json parsing in PostgreSQL before 9.3.x before 9.3.10 and 9.4.x before 9.4.5 allow attackers to cause a denial of service (server crash) via unspecified vectors, which are not properly handled in (1) json or (2) jsonb values.
Near-miss passage: CVE-2015-3674. CWE: CWE-119. CVSS: 7.5. afpserver in Apple OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.