alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-4135
Matching passage: CVE-2015-4135. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in goto.php in phpwind 8.7 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
Near-miss passage: CVE-2015-10120. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability, which was classified as problematic, was found in WDS Multisite Aggregate Plugin up to 1.0.0 on WordPress. Affected is the function update_options of the file includes/WDS_Multisite_Aggregate_Options.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is 49e0bbcb6ff70e561365d9e0d26426598f63ca12. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-233364.
Query: detection engineering for Stripped Payloads
Matching passage: T1027.008 Stripped Payloads. Tactics: stealth. Description: Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information. Scripts and executables may contain variables names and other strings that help developers document code functionality. Symbols are often created by an operating system’s `linker` when executable payloads are compiled. Reverse engineers use these symbols and strings to analyze code and to identify functionality in payloads.(Citation: Mandiant golang stripped binaries explanation)(Citation: intezer stripped binaries elf files 2018) Adversaries may use stripped payloads in order to make malware analysis more difficult. For example, compilers and other tools may provide features to remove or obfuscate strings and symbols. Adversaries have also used stripped payload formats, such as run-only AppleScripts, a compiled and stripped version of [AppleScript](https://attack.mitre.org/techniques/T1059/002), to evade detection and analysis. The lack of human-readable information may directly hinder detection and analysis of payloads.(Citation: SentinelLabs reversing run-only applescripts 2021)
Near-miss passage: T1027.006 HTML Smuggling. Tactics: stealth. Description: Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. HTML documents can store large binary objects known as JavaScript Blobs (immutable data that represents raw bytes) that can later be constructed into file-like objects. Data may also be stored in Data URLs, which enable embedding media type or MIME files inline of HTML documents. HTML5 also introduced a download attribute that may be used to initiate file downloads.(Citation: HTML Smuggling Menlo Security 2020)(Citation: Outlflank HTML Smuggling 2018) Adversaries may deliver payloads to victims that bypass security controls through HTML Smuggling by abusing JavaScript Blobs and/or HTML5 download attributes. Security controls such as web content filters may not identify smuggled malicious files inside of HTML/JS files, as the content may be based on typically benign MIME types such as <code>text/plain</code> and/or <code>text/html</code>. Malicious files or data can be obfuscated and hidden inside of HTML files through Data URLs and/or JavaScript Blobs and can be deobfuscated when they reach the victim (i.e. [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140)), potentially bypassing content filters. For example, JavaScript Blobs can be abused to dynamically generate malicious files in the victim machine and may be dropped to disk by abusing JavaScript functions such as <code>msSaveBlob</code>.(Citation: HTML Smuggling Menlo Security 2020)(Citation: MSTIC NOBELIUM May 2021)(Citation: Outlflank HTML Smuggling 2018)(Citation: nccgroup Smuggling HTA 2017)
Query: rule covering Detects service installation of different remote access tools software. These software are often abused by threat actors
Matching passage: Sigma rule: Detects service installation of different remote access tools software. These software are often abused by threat actors. Logsource: windows / security. Rule: title: Remote Access Tool Services Have Been Installed - Security id: c8b00925-926c-47e3-beea-298fd563728e related: - id: 1a31b18a-f00c-4061-9900-f735b96c99fc type: similar status: test description: Detects service installation of different remote access tools software. These software are often abused by threat actors to perform references: - https://redcanary.com/blog/misbehaving-rats/ author: Connor Martin, Nasreddine Bencherchali (Nextron Systems) date: 2022-12-23 modified: 2024-12-07 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1543.003 - attack.t1569.002 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceName|contains: - AmmyyAdmin - AnyDesk - Atera - BASupportExpressSrvcUpdater - BASupportExpressStandaloneService - chromoting - GoToAssist - GoToMyPC - jumpcloud - LMIGuardianSvc - LogMeIn - monblanking - Parsec - RManService - RPCPerformanceService - RPCService - SplashtopRemoteService - SSUService - TeamViewer - TightVNC - vncserver - Zoho condition: selection falsepositives: - The rule doesn't look for anything suspicious so false positives are expected. If you use one of the tools mentioned, comment it out level: medium
Near-miss passage: Sigma rule: Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems sin. Logsource: windows / process_creation. Rule: title: Suspicious Kernel Dump Using Dtrace id: 7124aebe-4cd7-4ccb-8df0-6d6b93c96795 status: test description: Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1 references: - https://twitter.com/0gtweet/status/1474899714290208777?s=12 - https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/dtrace author: Florian Roth (Nextron Systems) date: 2021-12-28 tags: - attack.discovery - attack.t1082 logsource: product: windows category: process_creation detection: selection_plain: Image|endswith: \dtrace.exe CommandLine|contains: lkd(0) selection_obfuscated: CommandLine|contains|all: - syscall:::return - lkd( condition: 1 of selection* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_dtrace_kernel_dump/info.yml
Query: patch priority for CVE-2015-0214
Matching passage: CVE-2015-0214. CWE: CWE-264. CVSS: 4.0. message/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to bypass a messaging-disabled setting via a web-services request, as demonstrated by a people-search request.
Near-miss passage: CVE-2015-8279. CWE: CWE-264. CVSS: 8.600000381469727. Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an unspecified PHP script.
Query: detection engineering for External Defacement
Matching passage: T1491.002 External Defacement. Tactics: impact. Description: An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users. [External Defacement](https://attack.mitre.org/techniques/T1491/002) may ultimately cause users to distrust the systems and to question/discredit the system’s integrity. Externally-facing websites are a common victim of defacement; often targeted by adversary and hacktivist groups in order to push a political message or spread propaganda.(Citation: FireEye Cyber Threats to Media Industries)(Citation: Kevin Mandia Statement to US Senate Committee on Intelligence)(Citation: Anonymous Hackers Deface Russian Govt Site) [External Defacement](https://attack.mitre.org/techniques/T1491/002) may be used as a catalyst to trigger events, or as a response to actions taken by an organization or government. Similarly, website defacement may also be used as setup, or a precursor, for future attacks such as [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).(Citation: Trend Micro Deep Dive Into Defacement)
Near-miss passage: T1491.001 Internal Defacement. Tactics: impact. Description: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites or server login messages, or directly to user systems with the replacement of the desktop wallpaper.(Citation: Novetta Blockbuster)(Citation: Varonis) Disturbing or offensive images may be used as a part of [Internal Defacement](https://attack.mitre.org/techniques/T1491/001) in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.(Citation: Novetta Blockbuster Destructive Malware)
Query: rule covering Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts
Matching passage: Sigma rule: Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts. Logsource: windows / ps_script. Rule: title: AMSI Bypass Pattern Assembly GetType id: e0d6c087-2d1c-47fd-8799-3904103c5a98 status: test description: Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts references: - https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/ - https://twitter.com/cyb3rops/status/1588574518057979905?s=20&t=A7hh93ONM7ni1Rj1jO5OaA author: Florian Roth (Nextron Systems) date: 2022-11-09 tags: - attack.defense-impairment - attack.t1685 - attack.execution logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - '[Ref].Assembly.GetType' - SetValue($null,$true) - NonPublic,Static condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55). Logsource: windows / process_creation. Rule: title: UAC Bypass Using MSConfig Token Modification - Process id: ad92e3f9-7eb6-460e-96b1-582b0ccbb980 status: test description: Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 ParentImage|endswith: \AppData\Local\Temp\pkgmgr.exe CommandLine: '"C:\Windows\system32\msconfig.exe" -5' condition: selection falsepositives: - Unknown level: high
Query: risk of Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related 
Matching passage: CVE-2015-0469. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
Near-miss passage: CVE-2015-1276. CWE: UNKNOWN. CVSS: 9.800000190734863. Use-after-free vulnerability in content/browser/indexed_db/indexed_db_backing_store.cc in the IndexedDB implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging an abort action before a certain write operation.
Query: Sigma YAML for windows / openssh
Matching passage: Sigma rule: Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.. Logsource: windows / openssh. Rule: title: OpenSSH Server Listening On Socket id: 3ce8e9a4-bc61-4c9b-8e69-d7e2492a8781 status: test description: Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket. references: - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.004-Remote%20Service%20SSH - https://winaero.com/enable-openssh-server-windows-10/ - https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse - https://virtualizationreview.com/articles/2020/05/21/ssh-server-on-windows-10.aspx - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16 author: mdecrevoisier date: 2022-10-25 tags: - attack.lateral-movement - attack.t1021.004 logsource: product: windows service: openssh detection: selection: EventID: 4 process: sshd payload|startswith: 'Server listening on ' condition: selection falsepositives: - Legitimate administrator activity level: medium
Near-miss passage: Sigma rule: Detects backup catalog deletions. Logsource: windows / application. Rule: title: Backup Catalog Deleted id: 9703792d-fd9a-456d-a672-ff92efe4806a status: test description: Detects backup catalog deletions references: - https://technet.microsoft.com/en-us/library/cc742154(v=ws.11).aspx - https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100 author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection) date: 2017-05-12 modified: 2022-12-25 tags: - attack.stealth - attack.t1070.004 logsource: product: windows service: application detection: selection: EventID: 524 Provider_Name: Microsoft-Windows-Backup condition: selection falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-1383
Matching passage: CVE-2015-1383. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the geo search widget in the Geo Mashup plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the search key.
Near-miss passage: CVE-2015-1404. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: Persistence mechanism resembling Regsvr32
Matching passage: T1218.010 Regsvr32. Tactics: stealth. Description: Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft. (Citation: Microsoft Regsvr32) Malicious usage of Regsvr32.exe may avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of allowlists or false positives from Windows using regsvr32.exe for normal operations. Regsvr32.exe can also be used to specifically bypass application control using functionality to load COM scriptlets to execute DLLs under user permissions. Since Regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation. This method makes no changes to the Registry as the COM object is not actually registered, only executed. (Citation: LOLBAS Regsvr32) This variation of the technique is often referred to as a "Squiblydoo" and has been used in campaigns targeting governments. (Citation: Carbon Black Squiblydoo Apr 2016) (Citation: FireEye Regsvr32 Targeting Mongolian Gov) Regsvr32.exe can also be leveraged to register a COM Object used to establish persistence via [Component Object Model Hijacking](https://attack.mitre.org/techniques/T1546/015). (Citation: Carbon Black Squiblydoo Apr 2016)
Near-miss passage: T1218.009 Regsvcs/Regasm. Tactics: stealth. Description: Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) assemblies. Both are binaries that may be digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm) Both utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: <code>[ComRegisterFunction]</code> or <code>[ComUnregisterFunction]</code> respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute. (Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm)
Query: describe CVE-2015-9116
Matching passage: CVE-2015-9116. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 810, SD 820, and SD 820A, in a QTEE syscall handler, an untrusted pointer dereference can occur.
Near-miss passage: CVE-2015-4646. CWE: CWE-20. CVSS: 7.5. (1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service (application crash) via a crafted input.
Query: rule covering Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.
Matching passage: Sigma rule: Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.. Logsource: windows / security. Rule: title: Suspicious Teams Application Related ObjectAcess Event id: 25cde13e-8e20-4c29-b949-4e795b76f16f status: test description: Detects an access to authentication tokens and accounts of Microsoft Teams desktop application. references: - https://www.bleepingcomputer.com/news/security/microsoft-teams-stores-auth-tokens-as-cleartext-in-windows-linux-macs/ - https://www.vectra.ai/blogpost/undermining-microsoft-teams-security-by-mining-tokens author: '@SerkinValery' date: 2022-09-16 tags: - attack.credential-access - attack.t1528 logsource: product: windows service: security detection: selection: EventID: 4663 ObjectName|contains: - \Microsoft\Teams\Cookies - \Microsoft\Teams\Local Storage\leveldb filter: ProcessName|contains: \Microsoft\Teams\current\Teams.exe condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when the a stored procedure is set or cleared for automatic execution in MSSQL. A stored procedure that is set t. Logsource: windows / application. Rule: title: MSSQL SPProcoption Set id: b3d57a5c-c92e-4b48-9a79-5f124b7cf964 status: test description: Detects when the a stored procedure is set or cleared for automatic execution in MSSQL. A stored procedure that is set to automatic execution runs every time an instance of SQL Server is started references: - https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/ - https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-procoption-transact-sql?view=sql-server-ver16 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-13 modified: 2024-06-26 tags: - attack.persistence logsource: product: windows service: application definition: 'Requirements: MSSQL audit policy to monitor for "sp_procoption" must be enabled in order to receive this event in the application log' detection: selection: Provider_Name|contains: MSSQL EventID: 33205 Data|contains|all: - object_name:sp_procoption - statement:EXEC condition: selection falsepositives: - Legitimate use of the feature by administrators (rare) level: high
Query: alert when Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image based detection
Matching passage: Sigma rule: Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image based detection. Logsource: windows / process_creation. Rule: title: Use NTFS Short Name in Image id: 3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b related: - id: dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795 type: similar status: test description: Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image based detection references: - https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/ - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10) - https://twitter.com/jonasLyk/status/1555914501802921984 author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-08-06 modified: 2023-07-20 tags: - attack.stealth - attack.t1564.004 logsource: category: process_creation product: windows detection: selection: Image|contains: - ~1.bat - ~1.dll - ~1.exe - ~1.hta - ~1.js - ~1.msi - ~1.ps1 - ~1.tmp - ~1.vbe - ~1.vbs - ~2.bat - ~2.dll - ~2.exe - ~2.hta - ~2.js - ~2.msi - ~2.ps1 - ~2.tmp - ~2.vbe - ~2.vbs filter_main_generic_parent: ParentImage: C:\Windows\explorer.exe filter_optional_webex: ParentImage|endswith: \WebEx\WebexHost.exe filter_optional_thor: ParentImage|endswith: \thor\thor64.exe filter_optional_winzip: Image: C:\PROGRA~1\WinZip\WZPREL~1.EXE filter_optional_vcred: Image|endswith: \VCREDI~1.EXE condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Software Installers level: medium
Near-miss passage: Sigma rule: Detects potentially suspicious child processes of WinRAR.exe.. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Child Process Of WinRAR.EXE id: 146aace8-9bd6-42ba-be7a-0070d8027b76 related: - id: ec3a3c2f-9bb0-4a9b-8f4b-5ec386544343 type: similar status: test description: Detects potentially suspicious child processes of WinRAR.exe. references: - https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ - https://github.com/knight0x07/WinRAR-Code-Execution-Vulnerability-CVE-2023-38831/blob/26ab6c40b6d2c09bb4fc60feaa4a3a90cfd20c23/Part-1-Overview.md author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-31 tags: - attack.execution - attack.t1203 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \WinRAR.exe selection_binaries: - Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - OriginalFileName: - Cmd.Exe - cscript.exe - mshta.exe - PowerShell.EXE - pwsh.dll - regsvr32.exe - RUNDLL32.EXE - wscript.exe condition: all of selection_* falsepositives: - Unknown level: medium
Query: describe CVE-2015-2230
Matching passage: CVE-2015-2230. CWE: CWE-79. CVSS: 6.099999904632568. Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console.
Near-miss passage: CVE-2015-6176. CWE: CWE-79. CVSS: 4.300000190734863. Microsoft Edge mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting (XSS) protection mechanism via unspecified vectors, aka "Microsoft Edge XSS Filter Bypass Vulnerability."