alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects potentially suspicious child processes of KeyScrambler.exe
Matching passage: Sigma rule: Detects potentially suspicious child processes of KeyScrambler.exe. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Child Process of KeyScrambler.exe id: ca5583e9-8f80-46ac-ab91-7f314d13b984 related: - id: d2451be2-b582-4e15-8701-4196ac180260 type: similar status: test description: Detects potentially suspicious child processes of KeyScrambler.exe references: - https://twitter.com/DTCERT/status/1712785421845790799 author: Swachchhanda Shrawan Poudel date: 2024-05-13 tags: - attack.persistence - attack.execution - attack.privilege-escalation - attack.stealth - attack.t1203 - attack.t1574.001 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \KeyScrambler.exe selection_binaries: - Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - OriginalFileName: - Cmd.Exe - cscript.exe - mshta.exe - PowerShell.EXE - pwsh.dll - regsvr32.exe - RUNDLL32.EXE - wscript.exe condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via COMPRESS OBFUSCATION. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module id: 7034cbbb-cc55-4dc2-8dad-36c0b942e8f1 related: - id: 20e5497e-331c-4cd5-8d36-935f6e2a9a07 type: derived status: test description: Detects Obfuscated Powershell via COMPRESS OBFUSCATION references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|contains|all: - new-object - text.encoding]::ascii Payload|contains: - system.io.compression.deflatestream - system.io.streamreader Payload|endswith: readtoend condition: selection_4103 falsepositives: - Unknown level: medium
Query: containment actions for Outbound C2 pattern associated with Network Boundary Bridging
Matching passage: Playbook for T1599 Network Boundary Bridging. 1) Validate alert telemetry against T1599. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: defense impairment. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may bridge network boundaries by compromising perimeter network devices or internal devices responsible for network segmentation. Breaching these devices may enable an adversary to bypass restrictions on traffic routing that otherwise separate trusted and untrusted networks. Devices such as routers and firewalls can be used to create boundaries between trusted and untrusted networks. T
Near-miss passage: Playbook for T1599.001 Network Address Translation Traversal. Different response path focused on defense impairment.
Query: vulnerability: XML external entity (XXE) vulnerability in QlikTech Qlikview before 11.20 SR12 allows remote attackers to conduct server-side request forgery (SSRF) attacks and read arbitrary file
Matching passage: CVE-2015-3623. CWE: UNKNOWN. CVSS: 6.400000095367432. XML external entity (XXE) vulnerability in QlikTech Qlikview before 11.20 SR12 allows remote attackers to conduct server-side request forgery (SSRF) attacks and read arbitrary files via crafted XML data in a request to AccessPoint.aspx.
Near-miss passage: CVE-2015-1154. CWE: UNKNOWN. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-1152 and CVE-2015-1153.
Query: EDR alert: possible Bidirectional Communication (T1102.002)
Matching passage: T1102.002 Bidirectional Communication. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Near-miss passage: T1102.003 One-Way Communication. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Query: write Sigma for Detects path traversal exploitation attempts
Matching passage: Sigma rule: Detects path traversal exploitation attempts. Logsource: webserver. Rule: title: Path Traversal Exploitation Attempts id: 7745c2ea-24a5-4290-b680-04359cb84b35 status: test description: Detects path traversal exploitation attempts references: - https://github.com/projectdiscovery/nuclei-templates - https://book.hacktricks.xyz/pentesting-web/file-inclusion author: Subhash Popuri (@pbssubhash), Florian Roth (Nextron Systems), Thurein Oo, Nasreddine Bencherchali (Nextron Systems) date: 2021-09-25 modified: 2023-08-31 tags: - attack.initial-access - attack.t1190 logsource: category: webserver detection: selection: cs-uri-query|contains: - ../../../../../lib/password - ../../../../windows/ - ../../../etc/ - ..%252f..%252f..%252fetc%252f - ..%c0%af..%c0%af..%c0%afetc%c0%af - '%252e%252e%252fetc%252f' condition: selection falsepositives: - Expected to be continuously seen on systems exposed to the Internet - Internal vulnerability scanners level: medium
Near-miss passage: Sigma rule: Detects possible malicious execution of JXA in-memory via OSAScript. Logsource: macos / process_creation. Rule: title: JXA In-memory Execution Via OSAScript id: f1408a58-0e94-4165-b80a-da9f96cf6fc3 related: - id: 1bc2e6c5-0885-472b-bed6-be5ea8eace55 type: derived status: test description: Detects possible malicious execution of JXA in-memory via OSAScript references: - https://redcanary.com/blog/applescript/ author: Sohan G (D4rkCiph3r) date: 2023-01-31 tags: - attack.t1059.002 - attack.t1059.007 - attack.execution logsource: product: macos category: process_creation detection: selection_main: CommandLine|contains|all: - osascript - ' -e ' - eval - NSData.dataWithContentsOfURL selection_js: - CommandLine|contains|all: - ' -l ' - JavaScript - CommandLine|contains: .js condition: all of selection_* falsepositives: - Unknown level: high
Query: risk of Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.
Matching passage: CVE-2015-5563. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5564, and CVE-2015-5565.
Near-miss passage: CVE-2015-2652. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle Marketing component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.1, 12.1.2, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect integrity via unknown vectors related to Web Management.
Query: common weakness: EJB Bad Practices: Use of AWT Swing
Matching passage: CWE-575 EJB Bad Practices: Use of AWT Swing. The product violates the Enterprise JavaBeans (EJB) specification by using AWT/Swing.
Near-miss passage: CWE-87 Improper Neutralization of Alternate XSS Syntax. The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.
Query: detection rule: Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.
Matching passage: Sigma rule: Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.. Logsource: windows / file_event. Rule: title: Advanced IP Scanner - File Event id: fed85bf9-e075-4280-9159-fbe8a023d6fa related: - id: bef37fa2-f205-4a7b-b484-0759bfd5f86f type: derived status: test description: Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups. references: - https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/ - https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html - https://labs.f-secure.com/blog/prelude-to-ransomware-systembc - https://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf - https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer author: '@ROxPinTeddy' date: 2020-05-12 modified: 2022-11-29 tags: - attack.discovery - attack.t1046 logsource: category: file_event product: windows detection: selection: TargetFilename|contains: \AppData\Local\Temp\Advanced IP Scanner 2 condition: selection falsepositives: - Legitimate administrative use level: medium regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_advanced_ip_scanner/info.yml
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus. Logsource: windows / image_load. Rule: title: Potential SmadHook.DLL Sideloading id: 24b6cf51-6122-469e-861a-22974e9c1e5b status: test description: Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus references: - https://research.checkpoint.com/2023/malware-spotlight-camaro-dragons-tinynote-backdoor/ - https://www.qurium.org/alerts/targeted-malware-against-crph/ author: X__Junior (Nextron Systems) date: 2023-06-01 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: - \SmadHook32c.dll - \SmadHook64c.dll filter_main_legit_path: Image: - C:\Program Files (x86)\SMADAV\SmadavProtect32.exe - C:\Program Files (x86)\SMADAV\SmadavProtect64.exe - C:\Program Files\SMADAV\SmadavProtect32.exe - C:\Program Files\SMADAV\SmadavProtect64.exe ImageLoaded|startswith: - C:\Program Files (x86)\SMADAV\ - C:\Program Files\SMADAV\ condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Query: risk of Directory traversal vulnerability in core/ViewDataTable/Factory.php in Piwik before 2.15.0 allows remote attackers to include and execute arbitrary local files via the viewDataTabl
Matching passage: CVE-2015-7815. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in core/ViewDataTable/Factory.php in Piwik before 2.15.0 allows remote attackers to include and execute arbitrary local files via the viewDataTable parameter.
Near-miss passage: CVE-2015-9287. CWE: CWE-22. CVSS: 9.800000190734863. Directory Traversal was discovered in University of Cambridge mod_ucam_webauth before 2.0.2. The key identification field ("kid") of the IdP's HTTP response message ("WLS-Response") can be manipulated by an attacker. The "kid" field is not signed like the rest of the message, and manipulation is therefore trivial. The "kid" field should only ever represent an integer. However, it is possible to provide any string value. An attacker could use this to their advantage to force the application agent to load the RSA public key required for message integrity checking from an unintended location.
Query: vulnerability: Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote authenticated users to affect integrity via unknown 
Matching passage: CVE-2015-4739. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote authenticated users to affect integrity via unknown vectors related to Help screens.
Near-miss passage: CVE-2015-3175. CWE: UNKNOWN. CVSS: 5.800000190734863. Multiple open redirect vulnerabilities in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving an error page that links to a URL from an HTTP Referer header.
Query: patch priority for CVE-2015-7691
Matching passage: CVE-2015-7691. CWE: CWE-20. CVSS: 7.5. The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted packets containing particular autokey operations. NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.
Near-miss passage: CVE-2015-7282. CWE: CWE-20. CVSS: 5.800000190734863. ReadyNet WRT300N-DD devices with firmware 1.0.26 use the same source port number for every DNS query, which makes it easier for remote attackers to spoof responses by selecting that number for the destination port.
Query: patch priority for CVE-2015-3280
Matching passage: CVE-2015-3280. CWE: CWE-399. CVSS: 6.800000190734863. OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service (disk consumption) by deleting instances while in the resize state.
Near-miss passage: CVE-2015-2222. CWE: CWE-399. CVSS: 5.0. ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted petite packed file.
Query: CVE similar to CVE-2015-0519
Matching passage: CVE-2015-0519. CWE: CWE-200. CVSS: 2.0999999046325684. The InputAccel Database (IADB) installation process in EMC Captiva Capture 7.0 before patch 25 and 7.1 before patch 13 places a cleartext InputAccel (IA) SQL password in a DAL log file, which allows local users to obtain sensitive information by reading a file.
Near-miss passage: CVE-2015-6414. CWE: CWE-200. CVSS: 2.0999999046325684. Cisco TelePresence Video Communication Server (VCS) X8.6 uses the same encryption key across different customers' installations, which makes it easier for local users to defeat cryptographic protection mechanisms by leveraging knowledge of a key from another installation, aka Bug ID CSCuw64516.
Query: detect Detects Obfuscated use of Clip.exe to execute PowerShell in logs
Matching passage: Sigma rule: Detects Obfuscated use of Clip.exe to execute PowerShell. Logsource: windows / security. Rule: title: Invoke-Obfuscation CLIP+ Launcher - Security id: 4edf51e1-cb83-4e1a-bc39-800e396068e3 related: - id: f7385ee2-0e0c-11eb-adc1-0242ac120002 type: derived status: test description: Detects Obfuscated use of Clip.exe to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-13 modified: 2022-11-27 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceFileName|contains|all: - cmd - '&&' - 'clipboard]::' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when an Google Workspace user is granted admin privileges.. Logsource: gcp / google_workspace.admin. Rule: title: Google Workspace User Granted Admin Privileges id: 2d1b83e4-17c6-4896-a37b-29140b40a788 status: test description: Detects when an Google Workspace user is granted admin privileges. references: - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3 - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-user-settings#GRANT_ADMIN_PRIVILEGE author: Austin Songer date: 2021-08-23 modified: 2023-10-11 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: gcp service: google_workspace.admin detection: selection: eventService: admin.googleapis.com eventName: - GRANT_DELEGATED_ADMIN_PRIVILEGES - GRANT_ADMIN_PRIVILEGE condition: selection falsepositives: - Google Workspace admin role privileges, may be modified by system administrators. level: medium
Query: exploit Multiple integer overflows in the GraphicBuffer::unflatten function in platform/frameworks/native/libs/ui/GraphicBuffer.cpp in Android through 5.0 allow attackers to gain privilege
Matching passage: CVE-2015-1474. CWE: CWE-189. CVSS: 10.0. Multiple integer overflows in the GraphicBuffer::unflatten function in platform/frameworks/native/libs/ui/GraphicBuffer.cpp in Android through 5.0 allow attackers to gain privileges or cause a denial of service (memory corruption) via vectors that trigger a large number of (1) file descriptors or (2) integer values.
Near-miss passage: CVE-2015-4472. CWE: CWE-189. CVSS: 6.800000190734863. Off-by-one error in the READ_ENCINT macro in chmd.c in libmspack before 0.5 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CHM file.
Query: detect Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn't contain any command in logs
Matching passage: Sigma rule: Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn't contain any command. Logsource: windows / process_creation. Rule: title: Suspicious Windows Update Agent Empty Cmdline id: 52d097e2-063e-4c9c-8fbb-855c8948d135 status: test description: 'Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn''t contain any command line flags ' references: - https://redcanary.com/blog/blackbyte-ransomware/ author: Florian Roth (Nextron Systems) date: 2022-02-26 modified: 2023-11-11 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \Wuauclt.exe - OriginalFileName: Wuauclt.exe selection_cli: CommandLine|endswith: - Wuauclt - Wuauclt.exe condition: all of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190). Logsource: windows / process_creation. Rule: title: Sdiagnhost Calling Suspicious Child Process id: f3d39c45-de1a-4486-a687-ab126124f744 status: test description: Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190) references: - https://twitter.com/nao_sec/status/1530196847679401984 - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ - https://app.any.run/tasks/f420d295-0457-4e9b-9b9e-6732be227583/ - https://app.any.run/tasks/c4117d9a-f463-461a-b90f-4cd258746798/ author: Nextron Systems, @Kostastsale date: 2022-06-01 modified: 2024-08-23 tags: - attack.stealth - attack.t1036 - attack.t1218 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \sdiagnhost.exe Image|endswith: - \powershell.exe - \pwsh.exe - \cmd.exe - \mshta.exe - \cscript.exe - \wscript.exe - \taskkill.exe - \regsvr32.exe - \rundll32.exe - \calc.exe filter_main_cmd_bits: Image|endswith: \cmd.exe CommandLine|contains: bits filter_main_powershell_noprofile: Image|endswith: \powershell.exe CommandLine|endswith: - -noprofile - - -noprofile condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-10093
Matching passage: CVE-2015-10093. CWE: CWE-79. CVSS: 5.400000095367432. A vulnerability was found in Mark User as Spammer Plugin 1.0.0/1.0.1 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function user_row_actions of the file plugin/plugin.php. The manipulation of the argument url leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is e7059727274d2767c240c55c02c163eaa4ba6c62. It is recommended to upgrade the affected component. The identifier VDB-222325 was assigned to this vulnerability.
Near-miss passage: CVE-2015-2015. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in pubnames.ntf (aka the Directory template) in the web server in IBM Domino before 9.0.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka SPR KLYH8WBPRN.