alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects LOLBINs and applications that should not legitimately drop executable or executable-equivalent files to disk. Th in logs
Matching passage: Sigma rule: Detects LOLBINs and applications that should not legitimately drop executable or executable-equivalent files to disk. Th. Logsource: windows / file_event. Rule: title: Legitimate Application Dropped Executable id: f0540f7e-2db3-4432-b9e0-3965486744bc status: test description: 'Detects LOLBINs and applications that should not legitimately drop executable or executable-equivalent files to disk. This may indicate malware staging, process injection, or abuse of a trusted binary for payload delivery. ' references: - https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326 - https://dmpdump.github.io/posts/TelegramRat/ - https://www.virustotal.com/gui/file/a0d5b30578acd1df9139e7a8a4bfc659dc2cf48f4dc0c5804b70890adeb9fa21/behavior author: frack113, Florian Roth (Nextron Systems) date: 2022-08-21 modified: 2026-05-11 tags: - attack.stealth - attack.t1218 logsource: product: windows category: file_event detection: selection: Image|endswith: - \eqnedt32.exe - \wordpad.exe - \wordview.exe - \certutil.exe - \certoc.exe - \CertReq.exe - \Desktopimgdownldr.exe - \esentutl.exe - \mshta.exe - \AcroRd32.exe - \RdrCEF.exe - \hh.exe - \finger.exe TargetFilename|endswith: - .com - .dll - .exe - .jar - .ocx - .pyc condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_exe/info.yml
Near-miss passage: Sigma rule: Detects attempts to create and/or add an account to the admin group, thus granting admin privileges.. Logsource: macos / process_creation. Rule: title: User Added To Admin Group Via DseditGroup id: 5d0fdb62-f225-42fb-8402-3dfe64da468a status: test description: Detects attempts to create and/or add an account to the admin group, thus granting admin privileges. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-5---add-a-newexisting-user-to-the-admin-group-using-dseditgroup-utility---macos - https://ss64.com/osx/dseditgroup.html author: Sohan G (D4rkCiph3r) date: 2023-08-22 tags: - attack.persistence - attack.initial-access - attack.privilege-escalation - attack.stealth - attack.t1078.003 logsource: category: process_creation product: macos detection: selection: Image|endswith: /dseditgroup CommandLine|contains|all: - ' -o edit ' - ' -a ' - ' -t user' - admin condition: selection falsepositives: - Legitimate administration activities level: medium
Query: risk of Unspecified vulnerability in Oracle Java SE 6u101, 7u85 and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to JGSS.
Matching passage: CVE-2015-4734. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 6u101, 7u85 and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to JGSS.
Near-miss passage: CVE-2015-1153. CWE: UNKNOWN. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-1152 and CVE-2015-1154.
Query: rule covering Detects the execution traces of the WizardUpdate malware. WizardUpdate is a macOS trojan that attempts to infiltrate mac
Matching passage: Sigma rule: Detects the execution traces of the WizardUpdate malware. WizardUpdate is a macOS trojan that attempts to infiltrate mac. Logsource: macos / process_creation. Rule: title: Potential WizardUpdate Malware Infection id: f68c4a4f-19ef-4817-952c-50dce331f4b0 status: test description: Detects the execution traces of the WizardUpdate malware. WizardUpdate is a macOS trojan that attempts to infiltrate macOS machines to steal data and it is associated with other types of malicious payloads, increasing the chances of multiple infections on a device. references: - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-c68a1fcbf7a3f80c87225d7fdc031f691e9f3b6a14a36754be00762bfe6eae97 - https://malpedia.caad.fkie.fraunhofer.de/details/osx.xcsset - https://www.microsoft.com/security/blog/2022/02/02/the-evolution-of-a-mac-trojan-updateagents-progression/ author: Tim Rauch (rule), Elastic (idea) date: 2022-10-17 tags: - attack.command-and-control logsource: category: process_creation product: macos detection: selection_1: Image|endswith: /sh CommandLine|contains|all: - '=$(curl ' - eval selection_2: Image|endswith: /curl CommandLine|contains: _intermediate_agent_ condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of msiexec.exe from an uncommon directory. Logsource: windows / process_creation. Rule: title: Potential MsiExec Masquerading id: e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144 status: test description: Detects the execution of msiexec.exe from an uncommon directory references: - https://twitter.com/200_okay_/status/1194765831911215104 author: Florian Roth (Nextron Systems) date: 2019-11-14 modified: 2023-02-21 tags: - attack.stealth - attack.t1036.005 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \msiexec.exe - OriginalFileName: \msiexec.exe filter: Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ condition: selection and not filter falsepositives: - Unknown level: high
Query: alert when Detects suspicious encoded character syntax often used for defense evasion
Matching passage: Sigma rule: Detects suspicious encoded character syntax often used for defense evasion. Logsource: windows / process_creation. Rule: title: Potential PowerShell Obfuscation Via WCHAR/CHAR id: e312efd0-35a1-407f-8439-b8d434b438a6 status: test description: Detects suspicious encoded character syntax often used for defense evasion references: - https://twitter.com/0gtweet/status/1281103918693482496 author: Florian Roth (Nextron Systems) date: 2020-07-09 modified: 2025-03-03 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1027 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - '[char]0x' - (WCHAR)0x condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects launch of the PSEXESVC service, which means that this system was the target of a psexec remote execution. Logsource: windows / process_creation. Rule: title: PsExec Service Execution id: fdfcbd78-48f1-4a4b-90ac-d82241e368c5 related: - id: fa91cc36-24c9-41ce-b3c8-3bbc3f2f67ba type: obsolete status: test description: Detects launch of the PSEXESVC service, which means that this system was the target of a psexec remote execution references: - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec - https://www.youtube.com/watch?v=ro2QuZTIMBM author: Thomas Patzke, Romaissa Adjailia, Florian Roth (Nextron Systems) date: 2017-06-12 modified: 2023-02-28 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: - Image: C:\Windows\PSEXESVC.exe - OriginalFileName: psexesvc.exe condition: selection falsepositives: - Legitimate administrative tasks level: medium
Query: CVE similar to CVE-2015-1077
Matching passage: CVE-2015-1077. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Near-miss passage: CVE-2015-0099. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Query: how to detect Match Legitimate Resource Name or Location
Matching passage: T1036.005 Match Legitimate Resource Name or Location. Tactics: stealth. Description: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: `svchost.exe`). Alternatively, a Windows Registry key may be given a close approximation to a key used by a legitimate program. In containerized environments, a threat actor may create a resource in a trusted namespace or one that matches the naming convention of a container pod or cluster.(Citation: Aquasec Kubernetes Backdoor 2023)
Near-miss passage: T1036.012 Browser Fingerprint. Tactics: stealth. Description: Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc. The HTTP User-Agent request header is a string that lets servers and network peers identify the application, operating system, vendor, and/or version of the requesting user agent.(Citation: Mozilla User Agent) Adversaries may gather this information through [System Information Discovery](https://attack.mitre.org/techniques/T1082) or by users navigating to adversary-controlled websites, and then use that information to craft their web traffic to evade defenses.(Citation: Gummy Browsers Targeted Browser Spoofing against State-of-the-Art Fingerprinting Techniques)
Query: CVE similar to CVE-2015-1723
Matching passage: CVE-2015-1723. CWE: CWE-416. CVSS: 7.199999809265137. Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Microsoft Windows Station Use After Free Vulnerability."
Near-miss passage: CVE-2015-0313. CWE: CWE-416. CVSS: 9.800000190734863. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2015, a different vulnerability than CVE-2015-0315, CVE-2015-0320, and CVE-2015-0322.
Query: exploit The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold
Matching passage: CVE-2015-1676. CWE: CWE-200. CVSS: 2.0999999046325684. The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to bypass the ASLR protection mechanism via a crafted function call, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability," a different vulnerability than CVE-2015-1677, CVE-2015-1678, CVE-2015-1679, and CVE-2015-1680.
Near-miss passage: CVE-2015-8253. CWE: CWE-200. CVSS: 3.700000047683716. The Frontel protocol before 3 on RSI Video Technologies Videofied devices sets up AES encryption but sends all traffic in cleartext, which allows remote attackers to obtain sensitive (1) message or (2) MJPEG video data by sniffing the network.
Query: patch priority for CVE-2015-2556
Matching passage: CVE-2015-2556. CWE: CWE-200. CVSS: 4.300000190734863. The InfoPath Forms Services component in Microsoft SharePoint Server 2007 SP3 and 2010 SP2 misparses DTDs, which allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka "Microsoft SharePoint Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-2774. CWE: CWE-200. CVSS: 5.900000095367432. Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).
Query: how to detect Subvert Trust Controls
Matching passage: T1553 Subvert Trust Controls. Tactics: defense impairment. Description: Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site. Adversaries may attempt to subvert these trust mechanisms. The method adversaries use will depend on the specific mechanism they seek to subvert. Adversaries may conduct [File and Directory Permissions Modification](https://attack.mitre.org/techniques/T1222) or [Modify Registry](https://attack.mitre.org/techniques/T1112) in support of subverting these controls.(Citation: SpectorOps Subverting Trust Sept 2017) Adversaries may also create or steal code signing certificates to acquire trust on target systems.(Citation: Securelist Digital Certificates)(Citation: Symantec Digital Certificates)
Near-miss passage: T1553.005 Mark-of-the-Web Bypass. Tactics: defense impairment. Description: Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, when files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named <code>Zone.Identifier</code> with a specific value known as the MOTW.(Citation: Microsoft Zone.Identifier 2020) Files that are tagged with MOTW are protected and cannot perform certain actions. For example, starting in MS Office 10, if a MS Office file has the MOTW, it will open in Protected View. Executables tagged with the MOTW will be processed by Windows Defender SmartScreen that compares files with an allowlist of well-known executables. If the file is not known/trusted, SmartScreen will prevent the execution and warn the user not to run it.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)(Citation: Intezer Russian APT Dec 2020) Adversaries may abuse container files such as compressed/archive (.arj, .gzip) and/or disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW. Container files downloaded from the Internet will be marked with MOTW but the files within may not inherit the MOTW after the container files are extracted and/or mounted. MOTW is a NTFS feature and many container files do not support NTFS alternative data streams. After a container file is extracted and/or mounted, the files contained within them may be treated as local files on disk and run without protections.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)
Query: vulnerability: CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 do not require authentication from Alarm Receiving Center (ARC) servers, which allows man-in-the-middle attackers 
Matching passage: CVE-2015-7285. CWE: CWE-287. CVSS: 5.800000190734863. CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 do not require authentication from Alarm Receiving Center (ARC) servers, which allows man-in-the-middle attackers to bypass intended access restrictions via a spoofed HSxx response.
Near-miss passage: CVE-2015-5998. CWE: CWE-287. CVSS: 10.0. Impero Education Pro before 5105 relies on the -1|AUTHENTICATE\x02PASSWORD string for authentication, which allows remote attackers to execute arbitrary programs via an encrypted command.
Query: vulnerability: The Colorbox module 7.x-2.x before 7.x-2.10 for Drupal allows remote authenticated users with certain permissions to bypass intended access restrictions and "add unexpected content
Matching passage: CVE-2015-7881. CWE: CWE-284. CVSS: 3.5. The Colorbox module 7.x-2.x before 7.x-2.10 for Drupal allows remote authenticated users with certain permissions to bypass intended access restrictions and "add unexpected content to a Colorbox" via unspecified vectors, possibly related to a link in a comment.
Near-miss passage: CVE-2015-0660. CWE: CWE-284. CVSS: 7.199999809265137. Cisco Virtual TelePresence Server Software does not properly restrict use of the serial port, which allows local users to execute arbitrary OS commands as root by leveraging vSphere controller administrative privileges, aka Bug ID CSCus61123.
Query: Sigma rule for Detects suspicious use of XORDump process memory dumping utility
Matching passage: Sigma rule: Detects suspicious use of XORDump process memory dumping utility. Logsource: windows / process_creation. Rule: title: HackTool - XORDump Execution id: 66e563f9-1cbd-4a22-a957-d8b7c0f44372 status: test description: Detects suspicious use of XORDump process memory dumping utility references: - https://github.com/audibleblink/xordump author: Florian Roth (Nextron Systems) date: 2022-01-28 modified: 2023-02-08 tags: - attack.stealth - attack.t1036 - attack.t1003.001 - attack.credential-access logsource: category: process_creation product: windows detection: selection: - Image|endswith: \xordump.exe - CommandLine|contains: - ' -process lsass.exe ' - ' -m comsvcs ' - ' -m dbghelp ' - ' -m dbgcore ' condition: selection falsepositives: - Another tool that uses the command line switches of XORdump level: high
Near-miss passage: Sigma rule: Detects creation of a file named "ErrorHandler.cmd" in the "C:\WINDOWS\Setup\Scripts\" directory which could be used as. Logsource: windows / file_event. Rule: title: Potential Persistence Attempt Via ErrorHandler.Cmd id: 15904280-565c-4b73-9303-3291f964e7f9 status: test description: 'Detects creation of a file named "ErrorHandler.cmd" in the "C:\WINDOWS\Setup\Scripts\" directory which could be used as a method of persistence The content of C:\WINDOWS\Setup\Scripts\ErrorHandler.cmd is read whenever some tools under C:\WINDOWS\System32\oobe\ (e.g. Setup.exe) fail to run for any reason. ' references: - https://www.hexacorn.com/blog/2022/01/16/beyond-good-ol-run-key-part-135/ - https://github.com/last-byte/PersistenceSniper author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-09 modified: 2022-12-19 tags: - attack.persistence logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: \WINDOWS\Setup\Scripts\ErrorHandler.cmd condition: selection falsepositives: - Unknown level: medium
Query: EDR alert: possible Abuse Elevation Control Mechanism (T1548)
Matching passage: T1548 Abuse Elevation Control Mechanism. Tactics: privilege escalation. Description: Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.(Citation: TechNet How UAC Works)(Citation: sudo man page 2018) An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.(Citation: OSX Keydnap malware)(Citation: Fortinet Fareit)
Near-miss passage: T1548.006 TCC Manipulation. Tactics: privilege escalation. Description: Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database to grant malicious executables elevated permissions. TCC is a Privacy & Security macOS control mechanism used to determine if the running process has permission to access the data or services protected by TCC, such as screen sharing, camera, microphone, or Full Disk Access (FDA). When an application requests to access data or a service protected by TCC, the TCC daemon (`tccd`) checks the TCC database, located at `/Library/Application Support/com.apple.TCC/TCC.db` (and `~/` equivalent), and an overwrites file (if connected to an MDM) for existing permissions. If permissions do not exist, then the user is prompted to grant permission. Once permissions are granted, the database stores the application's permissions and will not prompt the user again unless reset. For example, when a web browser requests permissions to the user's webcam, once granted the web browser may not explicitly prompt the user again.(Citation: welivesecurity TCC) Adversaries may access restricted data or services protected by TCC through abusing applications previously granted permissions through [Process Injection](https://attack.mitre.org/techniques/T1055) or executing a malicious binary using another application. For example, adversaries can use Finder, a macOS native app with FDA permissions, to execute a malicious [AppleScript](https://attack.mitre.org/techniques/T1059/002). When executing under the Finder App, the malicious [AppleScript](https://attack.mitre.org/techniques/T1059/002) inherits access to all files on the system without requiring a user prompt. When System Integrity Protection (SIP) is disabled, TCC protections are also disabled. For a system without SIP enabled, adversaries can manipulate the TCC database to add permissions to their malicious executable through loading an adversary controlled TCC database using environment variables and [Launchctl](https://attack.mitre.org/techni
Query: risk of Out-of-bounds memory read in the x509_decode_time function in x509_cert_parser.c in Linux kernels 4.3-rc1 and after.
Matching passage: CVE-2015-5327. CWE: CWE-125. CVSS: 6.5. Out-of-bounds memory read in the x509_decode_time function in x509_cert_parser.c in Linux kernels 4.3-rc1 and after.
Near-miss passage: CVE-2015-8743. CWE: CWE-125. CVSS: 7.099999904632568. QEMU (aka Quick Emulator) built with the NE2000 device emulation support is vulnerable to an OOB r/w access issue. It could occur while performing 'ioport' r/w operations. A privileged (CAP_SYS_RAWIO) user/process could use this flaw to leak or corrupt QEMU memory bytes.
Query: CVE similar to CVE-2015-3845
Matching passage: CVE-2015-3845. CWE: CWE-264. CVSS: 6.800000190734863. The Parcel::appendFrom function in libs/binder/Parcel.cpp in Binder in Android before 5.1.1 LMY48M does not consider parcel boundaries during identification of binder objects in an append operation, which allows attackers to obtain a different application's privileges via a crafted application, aka internal bug 17312693.
Near-miss passage: CVE-2015-8222. CWE: CWE-264. CVSS: 4.599999904632568. The lxd-unix.socket systemd unit file in the Ubuntu lxd package before 0.20-0ubuntu4.1 uses world-readable permissions for /var/lib/lxd/unix.socket, which allows local users to gain privileges via unspecified vectors.