alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of clip.exe in order to copy data to the clipboard. Adversaries may collect data stored in the cli. Logsource: windows / process_creation. Rule: title: Data Copied To Clipboard Via Clip.EXE id: ddeff553-5233-4ae9-bbab-d64d2bd634be status: test description: Detects the execution of clip.exe in order to copy data to the clipboard. Adversaries may collect data stored in the clipboard from users copying information within or between applications. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/clip - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1115/T1115.md author: frack113 date: 2021-07-27 modified: 2023-02-21 tags: - attack.collection - attack.t1115 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \clip.exe - OriginalFileName: clip.exe condition: selection falsepositives: - Unknown level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_clip_execution/info.yml simulation: - type: atomic-red-team name: Utilize Clipboard to store or execute commands from technique: T1115 atomic_guid: 0cd14633-58d4-4422-9ede-daa2c9474ae7
Near-miss passage: Sigma rule: Detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell activity. Logsource: linux / process_creation. Rule: title: Potential Perl Reverse Shell Execution id: 259df6bc-003f-4306-9f54-4ff1a08fa38e status: test description: Detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell activity references: - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet - https://www.revshells.com/ author: '@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)' date: 2023-04-07 tags: - attack.execution logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /perl CommandLine|contains: ' -e ' selection_content: - CommandLine|contains|all: - fdopen( - ::Socket::INET - CommandLine|contains|all: - Socket - connect - open - exec condition: all of selection_* falsepositives: - Unlikely level: high
Query: describe CVE-2015-1787
Matching passage: CVE-2015-1787. CWE: CWE-20. CVSS: 2.5999999046325684. The ssl3_get_client_key_exchange function in s3_srvr.c in OpenSSL 1.0.2 before 1.0.2a, when client authentication and an ephemeral Diffie-Hellman ciphersuite are enabled, allows remote attackers to cause a denial of service (daemon crash) via a ClientKeyExchange message with a length of zero.
Near-miss passage: CVE-2015-6248. CWE: CWE-20. CVSS: 4.300000190734863. The ptvcursor_add function in the ptvcursor implementation in epan/proto.c in Wireshark 1.12.x before 1.12.7 does not check whether the expected amount of data is available, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Query: explain CWE-233
Matching passage: CWE-233 Improper Handling of Parameters. The product does not properly handle when the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined.
Near-miss passage: CWE-161 Improper Neutralization of Multiple Leading Special Elements. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple leading special elements that could be interpreted in unexpected ways when they are sent to a downstream component.
Query: CVE similar to CVE-2015-5697
Matching passage: CVE-2015-5697. CWE: CWE-200. CVSS: 2.0999999046325684. The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a certain bitmap data structure, which allows local users to obtain sensitive information from kernel memory via a GET_BITMAP_FILE ioctl call.
Near-miss passage: CVE-2015-3238. CWE: CWE-200. CVSS: 6.5. The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service (hang) via a large password.
Query: alert when The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. Thes
Matching passage: Sigma rule: The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. Thes. Logsource: windows / ps_script. Rule: title: Suspicious Get-ADReplAccount id: 060c3ef1-fd0a-4091-bf46-e7d625f60b73 status: test description: 'The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation. ' references: - https://www.powershellgallery.com/packages/DSInternals - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.006/T1003.006.md#atomic-test-2---run-dsinternals-get-adreplaccount author: frack113 date: 2022-02-06 tags: - attack.credential-access - attack.t1003.006 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Get-ADReplAccount - '-All ' - '-Server ' condition: selection falsepositives: - Legitimate PowerShell scripts level: medium
Near-miss passage: Sigma rule: Detects usage of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages. Logsource: windows / ps_script. Rule: title: Unsigned AppX Installation Attempt Using Add-AppxPackage - PsScript id: 975b2262-9a49-439d-92a6-0709cccdf0b2 related: - id: 37651c2a-42cd-4a69-ae0d-22a4349aa04a type: similar - id: 9a025188-6f2d-42f8-bb2f-d3a83d24a5af type: similar status: test description: Detects usage of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages references: - https://learn.microsoft.com/en-us/windows/msix/package/unsigned-package - https://twitter.com/WindowsDocs/status/1620078135080325122 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-31 tags: - attack.persistence - attack.stealth logsource: product: windows category: ps_script definition: Script Block Logging must be enable detection: selection_cmdlet: ScriptBlockText|contains: - 'Add-AppPackage ' - 'Add-AppxPackage ' selection_flag: ScriptBlockText|contains: ' -AllowUnsigned' condition: all of selection_* falsepositives: - Installation of unsigned packages for testing purposes level: medium
Query: describe CVE-2015-8929
Matching passage: CVE-2015-8929. CWE: CWE-119. CVSS: 5.5. Memory leak in the __archive_read_get_extract function in archive_read_extract2.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service via a tar file.
Near-miss passage: CVE-2015-8242. CWE: CWE-119. CVSS: 5.800000190734863. The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (stack-based buffer over-read and application crash) or obtain sensitive information via crafted XML data.
Query: describe CVE-2015-7682
Matching passage: CVE-2015-7682. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allow remote administrators to execute arbitrary SQL commands via the (1) select_invitaion_code_bulk_option or (2) invi_del_id parameter in the pie-invitation-codes page to wp-admin/admin.php.
Near-miss passage: CVE-2015-2866. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability on the Grandstream GXV3611_HD camera with firmware before 1.0.3.9 beta allows remote attackers to execute arbitrary SQL commands by attempting to establish a TELNET session with a crafted username.
Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects execution of shells from a parent process located in a temporary (/tmp) directory. Logsource: linux / process_creation. Rule: title: Shell Execution Of Process Located In Tmp Directory id: 2fade0b6-7423-4835-9d4f-335b39b83867 status: test description: Detects execution of shells from a parent process located in a temporary (/tmp) directory references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.execution logsource: product: linux category: process_creation detection: selection: ParentImage|startswith: /tmp/ Image|endswith: - /bash - /csh - /dash - /fish - /ksh - /sh - /zsh condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of the Notepad++ updater (gup) to launch other commands or executables. Logsource: windows / process_creation. Rule: title: Arbitrary Binary Execution Using GUP Utility id: d65aee4d-2292-4cea-b832-83accd6cfa43 status: test description: Detects execution of the Notepad++ updater (gup) to launch other commands or executables references: - https://twitter.com/nas_bench/status/1535322445439180803 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-10 modified: 2023-03-02 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \gup.exe Image|endswith: \explorer.exe filter: Image|endswith: \explorer.exe CommandLine|contains: \Notepad++\notepad++.exe filter_parent: ParentImage|contains: \Notepad++\updater\ filter_null: CommandLine: null condition: selection and not 1 of filter* falsepositives: - Other parent binaries using GUP not currently identified level: medium
Query: Sigma rule for Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH"
Matching passage: Sigma rule: Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH". Logsource: windows / process_creation. Rule: title: Add Windows Capability Via PowerShell Cmdlet id: b36d01a3-ddaf-4804-be18-18a6247adfcd related: - id: 155c7fd5-47b4-49b2-bbeb-eb4fab335429 type: similar status: test description: Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others. references: - https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=powershell - https://www.virustotal.com/gui/file/af1c82237b6e5a3a7cdbad82cc498d298c67845d92971bada450023d1335e267/content author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-22 modified: 2023-05-09 tags: - attack.execution logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cmdlet: CommandLine|contains: Add-WindowsCapability selection_capa: CommandLine|contains: OpenSSH. condition: all of selection_* falsepositives: - Legitimate usage of the capabilities by administrators or users. Add additional filters accordingly. level: medium
Near-miss passage: Sigma rule: The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by chec. Logsource: windows / security. Rule: title: User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess' id: 6daac7fc-77d1-449a-a71a-e6b4d59a0e54 status: test description: The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by checking that it has the SeTcbPrivilege privilege set. Possible Rubeus tries to get a handle to LSA. references: - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1 author: Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community date: 2019-10-24 modified: 2022-12-25 tags: - attack.credential-access - attack.lateral-movement - attack.privilege-escalation - attack.t1558.003 logsource: product: windows service: security detection: selection: EventID: 4673 Service: LsaRegisterLogonProcess() Keywords: '0x8010000000000000' condition: selection falsepositives: - Unknown level: high
Query: what is T1547.013
Matching passage: T1547.013 XDG Autostart Entries. Tactics: persistence, privilege escalation. Description: Adversaries may add or modify XDG Autostart Entries to execute malicious programs or commands when a user’s desktop environment is loaded at login. XDG Autostart entries are available for any XDG-compliant Linux system. XDG Autostart entries use Desktop Entry files (`.desktop`) to configure the user’s desktop environment upon user login. These configuration files determine what applications launch upon user login, define associated applications to open specific file types, and define applications used to open removable media.(Citation: Free Desktop Application Autostart Feb 2006)(Citation: Free Desktop Entry Keys) Adversaries may abuse this feature to establish persistence by adding a path to a malicious binary or command to the `Exec` directive in the `.desktop` configuration file. When the user’s desktop environment is loaded at user login, the `.desktop` files located in the XDG Autostart directories are automatically executed. System-wide Autostart entries are located in the `/etc/xdg/autostart` directory while the user entries are located in the `~/.config/autostart` directory. Adversaries may combine this technique with [Masquerading](https://attack.mitre.org/techniques/T1036) to blend malicious Autostart entries with legitimate programs.(Citation: Red Canary Netwire Linux 2022)
Near-miss passage: T1547.014 Active Setup. Tactics: persistence, privilege escalation. Description: Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. Active Setup is a Windows mechanism that is used to execute programs when a user logs in. The value stored in the Registry key will be executed after a user logs into the computer.(Citation: Klein Active Setup 2010) These programs will be executed under the context of the user and will have the account's associated permissions level. Adversaries may abuse Active Setup by creating a key under <code> HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\</code> and setting a malicious value for <code>StubPath</code>. This value will serve as the program that will be executed when a user logs into the computer.(Citation: Mandiant Glyer APT 2010)(Citation: Citizenlab Packrat 2015)(Citation: FireEye CFR Watering Hole 2012)(Citation: SECURELIST Bright Star 2015)(Citation: paloalto Tropic Trooper 2016) Adversaries can abuse these components to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.
Query: secure coding against Unauthorized Error Injection Can Degrade Hardware Redundancy
Matching passage: CWE-1334 Unauthorized Error Injection Can Degrade Hardware Redundancy. An unauthorized agent can inject errors into a redundant block to deprive the system of redundancy or put the system in a degraded operating mode.
Near-miss passage: CWE-283 Unverified Ownership. The product does not properly verify that a critical resource is owned by the proper entity.
Query: risk of http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which 
Matching passage: CVE-2015-5262. CWE: CWE-399. CVSS: 4.300000190734863. http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.
Near-miss passage: CVE-2015-0743. CWE: CWE-399. CVSS: 5.0. Cisco Headend System Release allows remote attackers to cause a denial of service (DHCP and TFTP outage) via a flood of crafted UDP traffic, aka Bug ID CSCus04097.
Query: common weakness: Excessive Use of Self-Modifying Code
Matching passage: CWE-1123 Excessive Use of Self-Modifying Code. The product uses too much self-modifying code.
Near-miss passage: CWE-193 Off-by-one Error. A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Query: detect Detects usage of bitsadmin downloading a file in logs
Matching passage: Sigma rule: Detects usage of bitsadmin downloading a file. Logsource: windows / process_creation. Rule: title: File Download Via Bitsadmin id: d059842b-6b9d-4ed1-b5c3-5b89143c6ede status: test description: Detects usage of bitsadmin downloading a file references: - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin - https://isc.sans.edu/diary/22264 - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ author: Michael Haag, FPT.EagleEye date: 2017-03-09 modified: 2023-02-15 tags: - attack.persistence - attack.execution - attack.stealth - attack.t1197 - attack.s0190 - attack.t1036.003 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \bitsadmin.exe - OriginalFileName: bitsadmin.exe selection_cmd: CommandLine|contains: ' /transfer ' selection_cli_1: CommandLine|contains: - ' /create ' - ' /addfile ' selection_cli_2: CommandLine|contains: http condition: selection_img and (selection_cmd or all of selection_cli_*) falsepositives: - Some legitimate apps use this, but limited. level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download/info.yml simulation: - type: atomic-red-team name: Windows - BITSAdmin BITS Download technique: T1105 atomic_guid: a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b
Near-miss passage: Sigma rule: Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by. Logsource: windows / process_creation. Rule: title: Boot Configuration Tampering Via Bcdedit.EXE id: 1444443e-6757-43e4-9ea4-c8fc705f79a2 status: stable description: Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md - https://eqllib.readthedocs.io/en/latest/analytics/c4732632-9c1d-4980-9fa8-1d98c93f918e.html author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community date: 2019-10-24 modified: 2023-02-15 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \bcdedit.exe - OriginalFileName: bcdedit.exe selection_set: CommandLine|contains: set selection_cli: - CommandLine|contains|all: - bootstatuspolicy - ignoreallfailures - CommandLine|contains|all: - recoveryenabled - 'no' condition: all of selection_* falsepositives: - Unlikely level: high simulation: - type: atomic-red-team name: Windows - Disable Windows Recovery Console Repair technique: T1490 atomic_guid: cf21060a-80b3-4238-a595-22525de4ab81
Query: explain CWE-1080
Matching passage: CWE-1080 Source Code File with Excessive Number of Lines of Code. A source code file has too many lines of code.
Near-miss passage: CWE-13 ASP.NET Misconfiguration: Password in Configuration File. Storing a plaintext password in a configuration file allows anyone who can read the file access to the password-protected resource making them an easy target for attackers.
Query: detection rule: Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from t
Matching passage: Sigma rule: Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from t. Logsource: windows / process_creation. Rule: title: Forfiles.EXE Child Process Masquerading id: f53714ec-5077-420e-ad20-907ff9bb2958 status: test description: 'Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory. ' references: - https://www.hexacorn.com/blog/2023/12/31/1-little-known-secret-of-forfiles-exe/ author: Nasreddine Bencherchali (Nextron Systems), Anish Bogati date: 2024-01-05 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: ParentCommandLine|endswith: - .exe - .exe" Image|endswith: \cmd.exe CommandLine|startswith: /c echo " filter_main_parent_not_sys: ParentImage|contains: - :\Windows\System32\ - :\Windows\SysWOW64\ ParentImage|endswith: \forfiles.exe Image|contains: - :\Windows\System32\ - :\Windows\SysWOW64\ Image|endswith: \cmd.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Sysmon registry detection of a local hidden user account.. Logsource: windows / registry_event. Rule: title: Creation of a Local Hidden User Account by Registry id: 460479f3-80b7-42da-9c43-2cc1d54dbccd status: test description: Sysmon registry detection of a local hidden user account. references: - https://twitter.com/SBousseaden/status/1387530414185664538 author: Christian Burkard (Nextron Systems) date: 2021-05-03 modified: 2025-10-31 tags: - attack.persistence - attack.t1136.001 logsource: product: windows category: registry_event detection: selection: TargetObject|contains: \SAM\SAM\Domains\Account\Users\Names\ TargetObject|endswith: $\(Default) Image|endswith: \lsass.exe condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_event/registry_event_add_local_hidden_user/info.yml simulation: - type: atomic-red-team name: Create Hidden User in Registry technique: T1564.002 atomic_guid: 173126b7-afe4-45eb-8680-fa9f6400431c
Query: describe CVE-2015-1877
Matching passage: CVE-2015-1877. CWE: CWE-77. CVSS: 8.800000190734863. The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables, which allows remote attackers to execute arbitrary commands via a crafted file.
Near-miss passage: CVE-2015-5080. CWE: CWE-77. CVSS: 9.0. The Management Interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.1 before 10.1.132.8, 10.5 before Build 56.15, and 10.5.e before Build 56.1505.e allows remote authenticated users to execute arbitrary shell commands via shell metacharacters in the filter parameter to rapi/ipsec_logs.