alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects PowerShell writing startup shortcuts. This procedure was highlighted in Red Canary Intel Insights Oct. 2021, "We
Matching passage: Sigma rule: Detects PowerShell writing startup shortcuts. This procedure was highlighted in Red Canary Intel Insights Oct. 2021, "We. Logsource: windows / file_event. Rule: title: Potential Startup Shortcut Persistence Via PowerShell.EXE id: 92fa78e7-4d39-45f1-91a3-8b23f3f1088d status: test description: 'Detects PowerShell writing startup shortcuts. This procedure was highlighted in Red Canary Intel Insights Oct. 2021, "We frequently observe adversaries using PowerShell to write malicious .lnk files into the startup directory to establish persistence. Accordingly, this detection opportunity is likely to identify persistence mechanisms in multiple threats. In the context of Yellow Cockatoo, this persistence mechanism eventually launches the command-line script that leads to the installation of a malicious DLL" ' references: - https://redcanary.com/blog/intelligence-insights-october-2021/ - https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1547.001/T1547.001.md#atomic-test-7---add-executable-shortcut-link-to-user-startup-folder author: Christopher Peacock '@securepeacock', SCYTHE date: 2021-10-24 modified: 2023-02-23 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: product: windows category: file_event detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe TargetFilename|contains: \start menu\programs\startup\ TargetFilename|endswith: .lnk condition: selection falsepositives: - Depending on your environment accepted applications may leverage this at times. It is recommended to search for anomalies inidicative of malware. level: high
Near-miss passage: Sigma rule: Detects attempts to remove Windows Defender configuration using the 'MpPreference' cmdlet. Logsource: windows / ps_script. Rule: title: Tamper Windows Defender Remove-MpPreference - ScriptBlockLogging id: ae2bdd58-0681-48ac-be7f-58ab4e593458 related: - id: 07e3cb2c-0608-410d-be4b-1511cb1a0448 type: similar status: test description: Detects attempts to remove Windows Defender configuration using the 'MpPreference' cmdlet references: - https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-controlled-folder-access-event-search/ba-p/2326088 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_remove: ScriptBlockText|contains: Remove-MpPreference selection_tamper: ScriptBlockText|contains: - '-ControlledFolderAccessProtectedFolders ' - '-AttackSurfaceReductionRules_Ids ' - '-AttackSurfaceReductionRules_Actions ' - '-CheckForSignaturesBeforeRunningScan ' condition: all of selection_* falsepositives: - Legitimate PowerShell scripts level: high
Query: CVE similar to CVE-2015-5992
Matching passage: CVE-2015-5992. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in form2WlanSetup.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to inject arbitrary web script or HTML via the ssid parameter.
Near-miss passage: CVE-2015-0714. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Cisco Finesse Server 10.0(1), 10.5(1), 10.6(1), and 11.0(1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCut53595.
Query: campaign using ClickOnce
Matching passage: T1127.002 ClickOnce. Tactics: stealth, execution. Description: Adversaries may use ClickOnce applications (.appref-ms and .application files) to proxy execution of code through a trusted Windows utility.(Citation: Burke/CISA ClickOnce BlackHat) ClickOnce is a deployment that enables a user to create self-updating Windows-based .NET applications (i.e, .XBAP, .EXE, or .DLL) that install and run from a file share or web page with minimal user interaction. The application launches as a child process of DFSVC.EXE, which is responsible for installing, launching, and updating the application.(Citation: SpectorOps Medium ClickOnce) Because ClickOnce applications receive only limited permissions, they do not require administrative permissions to install.(Citation: Microsoft Learn ClickOnce) As such, adversaries may abuse ClickOnce to proxy execution of malicious code without needing to escalate privileges. ClickOnce may be abused in a number of ways. For example, an adversary may rely on [User Execution](https://attack.mitre.org/techniques/T1204). When a user visits a malicious website, the .NET malware is disguised as legitimate software and a ClickOnce popup is displayed for installation.(Citation: NetSPI ClickOnce) Adversaries may also abuse ClickOnce to execute malware via a [Rundll32](https://attack.mitre.org/techniques/T1218/011) script using the command `rundll32.exe dfshim.dll,ShOpenVerbApplication1`.(Citation: LOLBAS /Dfsvc.exe) Additionally, an adversary can move the ClickOnce application file to a remote user’s startup folder for continued malicious code deployment (i.e., [Registry Run Keys / Startup Folder](https://attack.mitre.org/techniques/T1547/001)).(Citation: Burke/CISA ClickOnce BlackHat)(Citation: Burke/CISA ClickOnce Paper)
Near-miss passage: T1127.003 JamPlus. Tactics: stealth, execution. Description: Adversaries may use `JamPlus` to proxy the execution of a malicious script. `JamPlus` is a build utility tool for code and data build systems. It works with several popular compilers and can be used for generating workspaces in code editors such as Visual Studio.(Citation: JamPlus manual) Adversaries may abuse the `JamPlus` build utility to execute malicious scripts via a `.jam` file, which describes the build process and required dependencies. Because the malicious script is executed from a reputable developer tool, it may subvert application control security systems such as Smart App Control.(Citation: Cyble)(Citation: Elastic Security Labs)
Query: risk of Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu.
Matching passage: CVE-2015-6661. CWE: CWE-200. CVSS: 5.0. Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu.
Near-miss passage: CVE-2015-7445. CWE: CWE-200. CVSS: 4.300000190734863. IBM Multi-Enterprise Integration Gateway 1.0 through 1.0.0.1 and B2B Advanced Communications 1.x before 1.0.0.4, when guest access is configured, allow remote authenticated users to obtain sensitive information by reading error messages in responses.
Query: exploit Absolute path traversal vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allows remote attackers to read arbitrary files via a full p
Matching passage: CVE-2015-7250. CWE: CWE-22. CVSS: 7.5. Absolute path traversal vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allows remote attackers to read arbitrary files via a full pathname in the getpage parameter.
Near-miss passage: CVE-2015-1429. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in Cybele Software Thinfinity Remote Desktop Workstation 3.0.0.3 32-bit and 64-bit allows remote attackers to download arbitrary files via a .. (dot dot) in an unspecified parameter.
Query: CVE similar to CVE-2015-6775
Matching passage: CVE-2015-6775. CWE: UNKNOWN. CVSS: 7.5. fpdfsdk/src/jsapi/fxjs_v8.cpp in PDFium, as used in Google Chrome before 47.0.2526.73, does not use signatures, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."
Near-miss passage: CVE-2015-2473. CWE: UNKNOWN. CVSS: 9.300000190734863. Untrusted search path vulnerability in the client in Remote Desktop Protocol (RDP) through 8.1 in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .rdp file, aka "Remote Desktop Protocol DLL Planting Remote Code Execution Vulnerability."
Query: common weakness: Improper Handling of Syntactically Invalid Structure
Matching passage: CWE-228 Improper Handling of Syntactically Invalid Structure. The product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the associated specification.
Near-miss passage: CWE-1297 Unprotected Confidential Information on Device is Accessible by OSAT Vendors. The product does not adequately protect confidential information on the device from being accessed by Outsourced Semiconductor Assembly and Test (OSAT) vendors.
Query: rule covering Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace
Matching passage: Sigma rule: Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace. Logsource: windows / process_access. Rule: title: Credential Dumping Attempt Via WerFault id: e5b33f7d-eb93-48b6-9851-09e1e610b6d7 status: test description: Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up. references: - https://github.com/helpsystems/nanodump/commit/578116faea3d278d53d70ea932e2bbfe42569507 author: Florian Roth (Nextron Systems) date: 2012-06-27 modified: 2023-11-29 tags: - attack.credential-access - attack.t1003.001 - attack.s0002 logsource: category: process_access product: windows detection: selection: SourceImage|endswith: \WerFault.exe TargetImage|endswith: \lsass.exe GrantedAccess: '0x1FFFFF' condition: selection falsepositives: - Actual failures in lsass.exe that trigger a crash dump (unlikely) - Unknown cases in which WerFault accesses lsass.exe level: high
Near-miss passage: Sigma rule: Detects changes to "DsrmAdminLogonBehavior" registry value. During a Domain Controller (DC) promotion, administrators cr. Logsource: windows / registry_set. Rule: title: Directory Service Restore Mode(DSRM) Registry Value Tampering id: b61e87c0-50db-4b2e-8986-6a2be94b33b0 related: - id: 53ad8e36-f573-46bf-97e4-15ba5bf4bb51 type: similar status: test description: 'Detects changes to "DsrmAdminLogonBehavior" registry value. During a Domain Controller (DC) promotion, administrators create a Directory Services Restore Mode (DSRM) local administrator account with a password that rarely changes. The DSRM account is an “Administrator” account that logs in with the DSRM mode when the server is booting up to restore AD backups or recover the server from a failure. Attackers could abuse DSRM account to maintain their persistence and access to the organization''s Active Directory. If the "DsrmAdminLogonBehavior" value is set to "0", the administrator account can only be used if the DC starts in DSRM. If the "DsrmAdminLogonBehavior" value is set to "1", the administrator account can only be used if the local AD DS service is stopped. If the "DsrmAdminLogonBehavior" value is set to "2", the administrator account can always be used. ' references: - https://adsecurity.org/?p=1785 - https://www.sentinelone.com/blog/detecting-dsrm-account-misconfigurations/ - https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/dsrm-credentials author: Nischal Khadgi date: 2024-07-11 tags: - attack.credential-access - attack.persistence - attack.defense-impairment - attack.t1556 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Control\Lsa\DsrmAdminLogonBehavior filter_main_default_value: Details: DWORD (0x00000000) condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: rule covering Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy dat
Matching passage: Sigma rule: Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy dat. Logsource: windows / process_creation. Rule: title: Deleted Data Overwritten Via Cipher.EXE id: 4b046706-5789-4673-b111-66f25fe99534 status: test description: 'Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md#atomic-test-3---overwrite-deleted-data-on-c-drive author: frack113 date: 2021-12-26 modified: 2023-02-21 tags: - attack.impact - attack.t1485 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: CIPHER.EXE - Image|endswith: \cipher.exe selection_cli: CommandLine|contains: ' /w:' condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data/info.yml simulation: - type: atomic-red-team name: Overwrite deleted data on C drive technique: T1485 atomic_guid: 321fd25e-0007-417f-adec-33232252be19
Near-miss passage: Sigma rule: Detects the use of the 'setcap' utility to set the 'setuid' capability (cap_setuid) on a binary file. This capability al. Logsource: linux / process_creation. Rule: title: Linux Setuid Capability Set on a Binary via Setcap Utility id: ed447910-bc30-4575-a598-3a2e49516a7a status: experimental description: 'Detects the use of the ''setcap'' utility to set the ''setuid'' capability (cap_setuid) on a binary file. This capability allows a non privileged process to make arbitrary manipulations of user IDs (UIDs), including setting its current UID to a value that would otherwise be restricted (i.e. UID 0, the root user). This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed. ' references: - https://man7.org/linux/man-pages/man8/setcap.8.html - https://dfir.ch/posts/linux_capabilities/ - https://juggernaut-sec.com/capabilities/#cap_setuid author: Luc Génaux date: 2026-01-24 tags: - attack.privilege-escalation - attack.persistence - attack.t1548 - attack.t1554 logsource: product: linux category: process_creation detection: selection: Image|endswith: /setcap CommandLine|contains: cap_setuid condition: selection falsepositives: - Unknown level: low
Query: risk of The Network Location Awareness (NLA) service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and
Matching passage: CVE-2015-0006. CWE: CWE-264. CVSS: 6.099999904632568. The Network Location Awareness (NLA) service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not perform mutual authentication to determine a domain connection, which allows remote attackers to trigger an unintended permissive configuration by spoofing DNS and LDAP responses on a local network, aka "NLA Security Feature Bypass Vulnerability."
Near-miss passage: CVE-2015-1341. CWE: CWE-264. CVSS: 7.800000190734863. Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport before 2.19.2 function _python_module_path.
Query: exploit Multiple directory traversal vulnerabilities in pax 1:20140703 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive.
Matching passage: CVE-2015-1193. CWE: CWE-22. CVSS: 5.0. Multiple directory traversal vulnerabilities in pax 1:20140703 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive.
Near-miss passage: CVE-2015-4988. CWE: CWE-22. CVSS: 8.600000381469727. Directory traversal vulnerability in the replay server in IBM Tealeaf Customer Experience before 8.7.1.8818, 8.8 before 8.8.0.9026, 9.0.0, 9.0.0A, 9.0.1 before 9.0.1.1083, 9.0.1A before 9.0.1.5073, 9.0.2 before 9.0.2.1095, and 9.0.2A before 9.0.2.5144 allows remote attackers to read arbitrary files via unspecified vectors.
Query: write Sigma for Detects when an Google Workspace user is granted admin privileges.
Matching passage: Sigma rule: Detects when an Google Workspace user is granted admin privileges.. Logsource: gcp / google_workspace.admin. Rule: title: Google Workspace User Granted Admin Privileges id: 2d1b83e4-17c6-4896-a37b-29140b40a788 status: test description: Detects when an Google Workspace user is granted admin privileges. references: - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3 - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-user-settings#GRANT_ADMIN_PRIVILEGE author: Austin Songer date: 2021-08-23 modified: 2023-10-11 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: gcp service: google_workspace.admin detection: selection: eventService: admin.googleapis.com eventName: - GRANT_DELEGATED_ADMIN_PRIVILEGES - GRANT_ADMIN_PRIVILEGE condition: selection falsepositives: - Google Workspace admin role privileges, may be modified by system administrators. level: medium
Near-miss passage: Sigma rule: Detects execution of "curl.exe" with the "insecure" flag over proxy or DOH.. Logsource: windows / process_creation. Rule: title: Insecure Proxy/DOH Transfer Via Curl.EXE id: 2c1486f5-02e8-4f86-9099-b97f2da4ed77 status: test description: Detects execution of "curl.exe" with the "insecure" flag over proxy or DOH. references: - https://curl.se/docs/manpage.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-07-27 tags: - attack.execution logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \curl.exe - OriginalFileName: curl.exe selection_cli: CommandLine|contains: - --doh-insecure - --proxy-insecure condition: all of selection_* falsepositives: - Access to badly maintained internal or development systems level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_insecure_proxy_or_doh/info.yml
Query: rule covering Detects usage of "Reflection.Assembly" load functions to dynamically load assemblies in memory
Matching passage: Sigma rule: Detects usage of "Reflection.Assembly" load functions to dynamically load assemblies in memory. Logsource: windows / ps_script. Rule: title: Potential In-Memory Execution Using Reflection.Assembly id: ddcd88cb-7f62-4ce5-86f9-1704190feb0a status: test description: Detects usage of "Reflection.Assembly" load functions to dynamically load assemblies in memory references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=50 author: frack113 date: 2022-12-25 tags: - attack.stealth - attack.t1620 logsource: product: windows category: ps_script definition: Script Block Logging must be enable detection: selection: ScriptBlockText|contains: '[Reflection.Assembly]::load' condition: selection falsepositives: - Legitimate use of the library level: medium
Near-miss passage: Sigma rule: Detects a potentially suspicious empty user agent strings in proxy log. Could potentially indicate an uncommon request m. Logsource: proxy. Rule: title: HTTP Request With Empty User Agent id: 21e44d78-95e7-421b-a464-ffd8395659c4 status: test description: 'Detects a potentially suspicious empty user agent strings in proxy log. Could potentially indicate an uncommon request method. ' references: - https://twitter.com/Carlos_Perez/status/883455096645931008 author: Florian Roth (Nextron Systems) date: 2017-07-08 modified: 2021-11-27 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent: '' condition: selection falsepositives: - Unknown level: medium
Query: describe CVE-2015-3784
Matching passage: CVE-2015-3784. CWE: CWE-200. CVSS: 5.0. Office Viewer in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Near-miss passage: CVE-2015-3912. CWE: CWE-200. CVSS: 5.0. Huawei E355s Mobile WiFi with firmware before 22.158.45.02.625 and WEBUI before 13.100.04.01.625 allows remote attackers to obtain sensitive configuration information by sniffing the network or sending unspecified commands.
Query: vulnerability: EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3 and RSA BSAFE SSL-C 2.8.9 and earlier, when client authentication and an ephemeral Diffie-Hellman 
Matching passage: CVE-2015-0536. CWE: UNKNOWN. CVSS: 7.5. EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3 and RSA BSAFE SSL-C 2.8.9 and earlier, when client authentication and an ephemeral Diffie-Hellman ciphersuite are enabled, allow remote attackers to cause a denial of service (daemon crash) via a ClientKeyExchange message with a length of zero, a similar issue to CVE-2015-1787.
Near-miss passage: CVE-2015-0356. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion."