alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from t
Matching passage: Sigma rule: Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from t. Logsource: windows / process_creation. Rule: title: Forfiles.EXE Child Process Masquerading id: f53714ec-5077-420e-ad20-907ff9bb2958 status: test description: 'Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory. ' references: - https://www.hexacorn.com/blog/2023/12/31/1-little-known-secret-of-forfiles-exe/ author: Nasreddine Bencherchali (Nextron Systems), Anish Bogati date: 2024-01-05 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: ParentCommandLine|endswith: - .exe - .exe" Image|endswith: \cmd.exe CommandLine|startswith: /c echo " filter_main_parent_not_sys: ParentImage|contains: - :\Windows\System32\ - :\Windows\SysWOW64\ ParentImage|endswith: \forfiles.exe Image|contains: - :\Windows\System32\ - :\Windows\SysWOW64\ Image|endswith: \cmd.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute. Logsource: windows / process_creation. Rule: title: Potential Arbitrary Code Execution Via Node.EXE id: 6640f31c-01ad-49b5-beb5-83498a5cd8bd status: test description: Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc references: - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html - https://www.sprocketsecurity.com/resources/crossing-the-log4j-horizon-a-vulnerability-with-no-return - https://www.rapid7.com/blog/post/2022/01/18/active-exploitation-of-vmware-horizon-servers/ - https://nodejs.org/api/cli.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-09 modified: 2023-02-03 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection_main: Image|endswith: \node.exe CommandLine|contains: - ' -e ' - ' --eval ' selection_action_reverse_shell: CommandLine|contains|all: - .exec( - net.socket - .connect - child_process condition: selection_main and 1 of selection_action_* falsepositives: - Unlikely level: high
Query: detect Customer Relationship Management Software
Matching passage: T1213.004 Customer Relationship Management Software. Tactics: collection. Description: Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable information. CRM software is used to assist organizations in tracking and managing customer interactions, as well as storing customer data. Once adversaries gain access to a victim organization, they may mine CRM software for customer data. This may include personally identifiable information (PII) such as full names, emails, phone numbers, and addresses, as well as additional details such as purchase histories and IT support interactions. By collecting this data, an adversary may be able to send personalized [Phishing](https://attack.mitre.org/techniques/T1566) emails, engage in SIM swapping, or otherwise target the organization’s customers in ways that enable financial gain or the compromise of additional organizations.(Citation: Bleeping Computer US Cellular Hack 2022)(Citation: Bleeping Computer Mint Mobile Hack 2021)(Citation: Bleeping Computer Bank Hack 2020) CRM software may be hosted on-premises or in the cloud. Information stored in these solutions may vary based on the specific instance or environment. Examples of CRM software include Microsoft Dynamics 365, Salesforce, Zoho, Zendesk, and HubSpot.
Near-miss passage: T1213.003 Code Repositories. Tactics: collection. Description: Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git. Once adversaries gain access to a victim network or a private code repository, they may collect sensitive information such as proprietary source code or [Unsecured Credentials](https://attack.mitre.org/techniques/T1552) contained within software's source code. Having access to software's source code may allow adversaries to develop [Exploits](https://attack.mitre.org/techniques/T1587/004), while credentials may provide access to additional resources using [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: Wired Uber Breach)(Citation: Krebs Adobe) **Note:** This is distinct from [Code Repositories](https://attack.mitre.org/techniques/T1593/003), which focuses on conducting [Reconnaissance](https://attack.mitre.org/tactics/TA0043) via public code repositories.
Query: risk of Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, modify passwords, or r
Matching passage: CVE-2015-2959. CWE: CWE-284. CVSS: 7.5. Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, modify passwords, or remove accounts by leveraging the guest role.
Near-miss passage: CVE-2015-3114. CWE: CWE-284. CVSS: 5.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors.
Query: patch priority for CVE-2015-2687
Matching passage: CVE-2015-2687. CWE: CWE-284. CVSS: 4.699999809265137. OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local users to access VM volumes that they would normally not have permissions for.
Near-miss passage: CVE-2015-2692. CWE: CWE-284. CVSS: 10.0. AdBlock before 2.21 allows remote attackers to block arbitrary resources on arbitrary websites and to disable arbitrary blocking filters.
Query: vulnerability: The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safe when "html" are th
Matching passage: CVE-2015-9272. CWE: CWE-94. CVSS: 9.800000190734863. The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code.
Near-miss passage: CVE-2015-0093. CWE: CWE-94. CVSS: 9.300000190734863. Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0088, CVE-2015-0090, CVE-2015-0091, and CVE-2015-0092.
Query: alert when Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and ma
Matching passage: Sigma rule: Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and ma. Logsource: velocity / application. Rule: title: Potential Server Side Template Injection In Velocity id: 16c86189-b556-4ee8-b4c7-7e350a195a4f status: test description: Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE. references: - https://antgarsil.github.io/posts/velocity/ - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs author: Moti Harmats date: 2023-02-11 tags: - attack.initial-access - attack.t1190 logsource: category: application product: velocity definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)' detection: keywords: - ParseErrorException - VelocityException - TemplateInitException condition: keywords falsepositives: - Application bugs - Missing .vm files level: high
Near-miss passage: Sigma rule: Detects loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary which can be abused as a method of DLL side. Logsource: windows / image_load. Rule: title: Potential RjvPlatform.DLL Sideloading From Default Location id: 259dda31-b7a3-444f-b7d8-17f96e8a7d0d status: test description: Detects loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary which can be abused as a method of DLL side loading since the "$SysReset" directory isn't created by default. references: - https://twitter.com/0gtweet/status/1666716511988330499 author: X__Junior (Nextron Systems) date: 2023-06-09 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: Image: C:\Windows\System32\SystemResetPlatform\SystemResetPlatform.exe ImageLoaded: C:\$SysReset\Framework\Stack\RjvPlatform.dll condition: selection falsepositives: - Unknown level: medium
Query: write Sigma for Detects well-known credential dumping tools execution via specific named pipe creation
Matching passage: Sigma rule: Detects well-known credential dumping tools execution via specific named pipe creation. Logsource: windows / pipe_created. Rule: title: HackTool - Credential Dumping Tools Named Pipe Created id: 961d0ba2-3eea-4303-a930-2cf78bbfcc5e status: test description: Detects well-known credential dumping tools execution via specific named pipe creation references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment - https://image.slidesharecdn.com/zeronights2017kheirkhabarov-171118103000/75/hunting-for-credentials-dumping-in-windows-environment-57-2048.jpg?cb=1666035799 author: Teymur Kheirkhabarov, oscd.community date: 2019-11-01 modified: 2023-08-07 tags: - attack.credential-access - attack.t1003.001 - attack.t1003.002 - attack.t1003.004 - attack.t1003.005 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName|contains: - \cachedump - \lsadump - \wceservicepipe condition: selection falsepositives: - Legitimate Administrator using tool for password recovery level: critical
Near-miss passage: Sigma rule: Detects execution of msdt.exe using the "cab" flag which could indicates suspicious diagcab files with embedded answer f. Logsource: windows / process_creation. Rule: title: Suspicious Cabinet File Execution Via Msdt.EXE id: dc4576d4-7467-424f-9eee-fd2b02855fe0 related: - id: 6545ce61-a1bd-4119-b9be-fcbee42c0cf3 type: obsolete status: test description: Detects execution of msdt.exe using the "cab" flag which could indicates suspicious diagcab files with embedded answer files leveraging CVE-2022-30190 references: - https://twitter.com/nas_bench/status/1537896324837781506 - https://github.com/GossiTheDog/ThreatHunting/blob/e85884abbf05d5b41efc809ea6532b10b45bd05c/AdvancedHuntingQueries/DogWalk-DiagCab - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-9015912909545e72ed42cbac4d1e96295e8964579c406d23fd9c47a8091576a0 - https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd author: Nasreddine Bencherchali (Nextron Systems), GossiTheDog, frack113 date: 2022-06-21 modified: 2024-03-13 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \msdt.exe - OriginalFileName: msdt.exe selection_cmd: CommandLine|contains|windash: ' -cab ' condition: all of selection_* falsepositives: - Legitimate usage of ".diagcab" files level: medium
Query: risk of The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows re
Matching passage: CVE-2015-2317. CWE: CWE-79. CVSS: 4.300000190734863. The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL.
Near-miss passage: CVE-2015-6509. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) proxypass parameter to system_advanced_misc.php; (2) adaptiveend, (3) adaptivestart, (4) maximumstates, (5) maximumtableentries, or (6) aliasesresolveinterval parameter to system_advanced_firewall.php; (7) proxyurl, (8) proxyuser, or (9) proxyport parameter to system_advanced_misc.php; or (10) name, (11) notification_name, (12) ipaddress, (13) password, (14) smtpipaddress, (15) smtpport, (16) smtpfromaddress, (17) smtpnotifyemailaddress, (18) smtpusername, or (19) smtppassword parameter to system_advanced_notifications.php.
Query: detection rule: Detects the use of Replace.exe which can be used to replace file with another file
Matching passage: Sigma rule: Detects the use of Replace.exe which can be used to replace file with another file. Logsource: windows / process_creation. Rule: title: Replace.exe Usage id: 9292293b-8496-4715-9db6-37028dcda4b3 status: test description: Detects the use of Replace.exe which can be used to replace file with another file references: - https://lolbas-project.github.io/lolbas/Binaries/Replace/ - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/replace author: frack113 date: 2022-03-06 modified: 2024-03-13 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection: Image|endswith: \replace.exe argument: CommandLine|contains|windash: -a condition: selection and argument falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious Plink tunnel port forwarding to a local port. Logsource: windows / process_creation. Rule: title: Suspicious Plink Port Forwarding id: 48a61b29-389f-4032-b317-b30de6b95314 status: test description: Detects suspicious Plink tunnel port forwarding to a local port references: - https://www.real-sec.com/2019/04/bypassing-network-restrictions-through-rdp-tunneling/ - https://medium.com/@informationsecurity/remote-ssh-tunneling-with-plink-exe-7831072b3d7d author: Florian Roth (Nextron Systems) date: 2021-01-19 modified: 2022-10-09 tags: - attack.command-and-control - attack.t1572 - attack.lateral-movement - attack.t1021.001 logsource: category: process_creation product: windows detection: selection: Description: Command-line SSH, Telnet, and Rlogin client CommandLine|contains: ' -R ' condition: selection falsepositives: - Administrative activity using a remote port forwarding to a local port level: high
Query: describe CVE-2015-5086
Matching passage: CVE-2015-5086. CWE: UNKNOWN. CVSS: 6.800000190734863. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-4435, CVE-2015-4438, CVE-2015-4441, CVE-2015-4445, CVE-2015-4447, CVE-2015-4451, CVE-2015-4452, and CVE-2015-5085.
Near-miss passage: CVE-2015-5932. CWE: UNKNOWN. CVSS: 7.199999809265137. The kernel in Apple OS X before 10.11.1 allows local users to gain privileges by leveraging an unspecified "type confusion" during Mach task processing.
Query: detect Detects the addition of a new Federated Domain. in logs
Matching passage: Sigma rule: Detects the addition of a new Federated Domain.. Logsource: m365 / exchange. Rule: title: New Federated Domain Added - Exchange id: 42127bdd-9133-474f-a6f1-97b6c08a4339 related: - id: 58f88172-a73d-442b-94c9-95eaed3cbb36 type: similar status: test description: Detects the addition of a new Federated Domain. references: - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf - https://us-cert.cisa.gov/ncas/alerts/aa21-008a - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html - https://www.sygnia.co/golden-saml-advisory - https://o365blog.com/post/aadbackdoor/ author: Splunk Threat Research Team (original rule), '@ionsor (rule)' date: 2022-02-08 tags: - attack.persistence - attack.t1136.003 logsource: service: exchange product: m365 detection: selection: eventSource: Exchange eventName: Add-FederatedDomain status: success condition: selection falsepositives: - The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider. level: medium
Near-miss passage: Sigma rule: Detects when the password policy is enumerated.. Logsource: windows / security. Rule: title: Password Policy Enumerated id: 12ba6a38-adb3-4d6b-91ba-a7fb248e3199 status: test description: Detects when the password policy is enumerated. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4661 - https://github.com/jpalanco/alienvault-ossim/blob/f74359c0c027e42560924b5cff25cdf121e5505a/os-sim/agent/src/ParserUtil.py#L951 author: Zach Mathis date: 2023-05-19 tags: - attack.discovery - attack.t1201 logsource: product: windows service: security definition: dfd8c0f4-e6ad-4e07-b91b-f2fca0ddef64 detection: selection: EventID: 4661 AccessList|contains: '%%5392' ObjectServer: Security Account Manager condition: selection level: medium
Query: vulnerability: net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel before 4.0 does not validate attempted changes to the MTU value, which allows context-dependent attackers to cause a denia
Matching passage: CVE-2015-8215. CWE: CWE-20. CVSS: 5.0. net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel before 4.0 does not validate attempted changes to the MTU value, which allows context-dependent attackers to cause a denial of service (packet loss) via a value that is (1) smaller than the minimum compliant value or (2) larger than the MTU of an interface, as demonstrated by a Router Advertisement (RA) message that is not validated by a daemon, a different vulnerability than CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is limited to the NetworkManager product.
Near-miss passage: CVE-2015-7740. CWE: CWE-20. CVSS: 5.5. Huawei P7 before P7-L00C17B851, P7-L05C00B851, and P7-L09C92B851 and P8 ALE-UL00 before ALE-UL00B211 allows local users to cause a denial of service (OS crash) via vectors involving an application that passes crafted input to the GPU driver.
Query: CVE similar to CVE-2015-8489
Matching passage: CVE-2015-8489. CWE: CWE-20. CVSS: 6.5. customapp in Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to cause a denial of service (excessive database locking) via a crafted CSV file, a different vulnerability than CVE-2016-1153.
Near-miss passage: CVE-2015-5074. CWE: CWE-20. CVSS: 7.5. Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM before 5.0.9 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a .pht extension.
Query: exploit Cross-site scripting (XSS) vulnerability in Vindula 1.9.
Matching passage: CVE-2015-6959. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Vindula 1.9.
Near-miss passage: CVE-2015-7790. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability on ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: hunt for Boot or Logon Initialization Scripts activity
Matching passage: T1037 Boot or Logon Initialization Scripts. Tactics: persistence, privilege escalation. Description: Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke March 2019) Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely. Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.
Near-miss passage: T1037.005 Startup Items. Tactics: persistence, privilege escalation. Description: Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.(Citation: Startup Items) This is technically a deprecated technology (superseded by [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)), and thus the appropriate folder, <code>/Library/StartupItems</code> isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. A startup item is a directory whose executable and configuration property list (plist), <code>StartupParameters.plist</code>, reside in the top-level directory. An adversary can create the appropriate folders/files in the StartupItems directory to register their own persistence mechanism.(Citation: Methods of Mac Malware Persistence) Additionally, since StartupItems run during the bootup phase of macOS, they will run as the elevated root user.
Query: exploit ntpq in NTP before 4.2.8p7 allows remote attackers to obtain origin timestamps and then impersonate peers via unspecified vectors.
Matching passage: CVE-2015-8139. CWE: CWE-284. CVSS: 5.300000190734863. ntpq in NTP before 4.2.8p7 allows remote attackers to obtain origin timestamps and then impersonate peers via unspecified vectors.
Near-miss passage: CVE-2015-0755. CWE: CWE-284. CVSS: 6.800000190734863. The Posture module for Cisco Identity Services Engine (ISE), as distributed in Cisco AnyConnect Secure Mobility Client 4.0(64), allows local users to gain privileges via unspecified commands, aka Bug ID CSCut05797.