alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects suspicious start of rundll32.exe without any parameters as found in CobaltStrike beacon activity
Matching passage: Sigma rule: Detects suspicious start of rundll32.exe without any parameters as found in CobaltStrike beacon activity. Logsource: windows / process_creation. Rule: title: Rundll32 Execution Without CommandLine Parameters id: 1775e15e-b61b-4d14-a1a3-80981298085a status: test description: Detects suspicious start of rundll32.exe without any parameters as found in CobaltStrike beacon activity references: - https://www.cobaltstrike.com/help-opsec - https://twitter.com/ber_m1ng/status/1397948048135778309 author: Florian Roth (Nextron Systems) date: 2021-05-27 modified: 2023-08-31 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection: CommandLine|endswith: - \rundll32.exe - \rundll32.exe" - \rundll32 filter: ParentImage|contains: - \AppData\Local\ - \Microsoft\Edge\ condition: selection and not filter falsepositives: - Possible but rare level: high
Near-miss passage: Sigma rule: Monitor and alert for users added to device admin roles.. Logsource: azure / auditlogs. Rule: title: Users Added to Global or Device Admin Roles id: 11c767ae-500b-423b-bae3-b234450736ed status: test description: Monitor and alert for users added to device admin roles. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#device-administrator-roles author: Michael Epping, '@mepples21' date: 2022-06-28 tags: - attack.persistence - attack.initial-access - attack.privilege-escalation - attack.stealth - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: Category: RoleManagement OperationName|contains|all: - Add - member to role TargetResources|contains: - 7698a772-787b-4ac8-901f-60d6b08affd2 - 62e90394-69f5-4237-9190-012177145e10 condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-5800
Matching passage: CVE-2015-5800. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-5120. CWE: CWE-119. CVSS: 10.0. Adobe Shockwave Player before 12.1.9.159 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5121.
Query: detection rule: Download and compress a remote file and store it in a cab file on local machine.
Matching passage: Sigma rule: Download and compress a remote file and store it in a cab file on local machine.. Logsource: windows / process_creation. Rule: title: Suspicious Diantz Download and Compress Into a CAB File id: 185d7418-f250-42d0-b72e-0c8b70661e93 status: test description: Download and compress a remote file and store it in a cab file on local machine. references: - https://lolbas-project.github.io/lolbas/Binaries/Diantz/ author: frack113 date: 2021-11-26 modified: 2022-08-13 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - diantz.exe - ' \\\\' - .cab condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of Chromium based browser in headless mode. Logsource: windows / process_creation. Rule: title: Browser Execution In Headless Mode id: ef9dcfed-690c-4c5d-a9d1-482cd422225c related: - id: 0e8cfe08-02c9-4815-a2f8-0d157b7ed33e type: derived status: test description: Detects execution of Chromium based browser in headless mode references: - https://twitter.com/mrd0x/status/1478234484881436672?s=12 - https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-12 tags: - attack.command-and-control - attack.stealth - attack.t1105 - attack.t1564.003 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \brave.exe - \chrome.exe - \msedge.exe - \opera.exe - \vivaldi.exe CommandLine|contains: --headless condition: selection falsepositives: - Unknown level: low
Query: risk of eClinicalWorks Population Health (CCMR) suffers from an SQL injection vulnerability in portalUserService.jsp which allows remote authenticated users to inject arbitrary malicious d
Matching passage: CVE-2015-4592. CWE: CWE-89. CVSS: 8.800000190734863. eClinicalWorks Population Health (CCMR) suffers from an SQL injection vulnerability in portalUserService.jsp which allows remote authenticated users to inject arbitrary malicious database commands as part of user input.
Near-miss passage: CVE-2015-10048. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in bmattoso desafio_buzz_woody. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The identifier of the patch is cb8220cbae06082c969b1776fcb2fdafb3a1006b. It is recommended to apply a patch to fix this issue. The identifier VDB-218357 was assigned to this vulnerability.
Query: describe CVE-2015-4894
Matching passage: CVE-2015-4894. CWE: UNKNOWN. CVSS: 4.900000095367432. Unspecified vulnerability in the Mobile Server component in Oracle Database Mobile/Lite Server 10.3.0.3, 11.3.0.2, and 12.1.0.0 allows remote authenticated users to affect integrity and availability via unknown vectors.
Near-miss passage: CVE-2015-3910. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google V8 before 4.3.61.21, as used in Google Chrome before 43.0.2357.65, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Query: campaign using IDE Extensions
Matching passage: T1176.002 IDE Extensions. Tactics: persistence. Description: Adversaries may abuse an integrated development environment (IDE) extension to establish persistent access to victim systems.(Citation: Mnemonic misuse visual studio) IDEs such as Visual Studio Code, IntelliJ IDEA, and Eclipse support extensions - software components that add features like code linting, auto-completion, task automation, or integration with tools like Git and Docker. A malicious extension can be installed through an extension marketplace (i.e., [Compromise Software Dependencies and Development Tools](https://attack.mitre.org/techniques/T1195/001)) or side-loaded directly into the IDE.(Citation: Abramovsky VSCode Security)(Citation: Lakshmanan Visual Studio Marketplace) In addition to installing malicious extensions, adversaries may also leverage benign ones. For example, adversaries may establish persistent SSH tunnels via the use of the VSCode Remote SSH extension (i.e., [IDE Tunneling](https://attack.mitre.org/techniques/T1219/001)). Trust is typically established through the installation process; once installed, the malicious extension is run every time that the IDE is launched. The extension can then be used to execute arbitrary code, establish a backdoor, mine cryptocurrency, or exfiltrate data.(Citation: ExtensionTotal VSCode Extensions 2025)
Near-miss passage: T1176 Software Extensions. Tactics: persistence. Description: Adversaries may abuse software extensions to establish persistent access to victim systems. Software extensions are modular components that enhance or customize the functionality of software applications, including web browsers, Integrated Development Environments (IDEs), and other platforms.(Citation: Chrome Extension C2 Malware)(Citation: Abramovsky VSCode Security) Extensions are typically installed via official marketplaces, app stores, or manually loaded by users, and they often inherit the permissions and access levels of the host application. Malicious extensions can be introduced through various methods, including social engineering, compromised marketplaces, or direct installation by users or by adversaries who have already gained access to a system. Malicious extensions can be named similarly or identically to benign extensions in marketplaces. Security mechanisms in extension marketplaces may be insufficient to detect malicious components, allowing adversaries to bypass automated scanners or exploit trust established during the installation process. Adversaries may also abuse benign extensions to achieve their objectives, such as using legitimate functionality to tunnel data or bypass security controls. The modular nature of extensions and their integration with host applications make them an attractive target for adversaries seeking to exploit trusted software ecosystems. Detection can be challenging due to the inherent trust placed in extensions during installation and their ability to blend into normal application workflows.
Query: intelligence brief on T1078.003
Matching passage: T1078.003 Local Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. Local Accounts may also be abused to elevate privileges and harvest credentials through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement.
Near-miss passage: T1078.004 Cloud Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.(Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation) Service or user accounts may be targeted by adversaries through [Brute Force](https://attack.mitre.org/techniques/T1110), [Phishing](https://attack.mitre.org/techniques/T1566), or various other means to gain access to the environment. Federated or synced accounts may be a pathway for the adversary to affect both on-premises systems and cloud environments - for example, by leveraging shared credentials to log onto [Remote Services](https://attack.mitre.org/techniques/T1021). High privileged cloud accounts, whether federated, synced, or cloud-only, may also allow pivoting to on-premises environments by leveraging SaaS-based [Software Deployment Tools](https://attack.mitre.org/techniques/T1072) to run commands on hybrid-joined devices. An adversary may create long lasting [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) on a compromised cloud account to maintain persistence in the environment. Such credentials may also be used to bypass security controls such as multi-factor authentication. Cloud accounts may also be able to assume [Temporary Elevated Cloud Access](https://attack.mitre.org/techniques/T1548/005) or other privileges through various means within the environment. Misconfigurations in role assignments or role assumption policies may allow an adversar
Query: patch priority for CVE-2015-1318
Matching passage: CVE-2015-1318. CWE: CWE-264. CVSS: 7.199999809265137. The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a crafted usr/share/apport/apport file in a namespace (container).
Near-miss passage: CVE-2015-3793. CWE: CWE-264. CVSS: 4.300000190734863. CFPreferences in Apple iOS before 8.4.1 allows attackers to bypass the third-party app-sandbox protection mechanism and read arbitrary managed preferences via a crafted app.
Query: risk of Use-after-free vulnerability in the AppendElements function in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 on Linux, when the Fluendo MP3
Matching passage: CVE-2015-0813. CWE: UNKNOWN. CVSS: 5.099999904632568. Use-after-free vulnerability in the AppendElements function in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 on Linux, when the Fluendo MP3 plugin for GStreamer is used, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted MP3 file.
Near-miss passage: CVE-2015-0490. CWE: UNKNOWN. CVSS: 4.900000095367432. Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suite 6.1.3.0 allows remote authenticated users to affect confidentiality and integrity via vectors related to BAS - Base Component.
Query: hunt for Data from Network Shared Drive activity
Matching passage: T1039 Data from Network Shared Drive. Tactics: collection. Description: Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.
Near-miss passage: T1056.002 GUI Input Capture. Tactics: collection, credential access. Description: Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)). Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite.(Citation: OSX Malware Exploits MacKeeper) This type of prompt can be used to collect credentials via various languages such as [AppleScript](https://attack.mitre.org/techniques/T1059/002)(Citation: LogRhythm Do You Trust Oct 2014)(Citation: OSX Keydnap malware)(Citation: Spoofing credential dialogs) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).(Citation: LogRhythm Do You Trust Oct 2014)(Citation: Enigma Phishing for Credentials Jan 2015)(Citation: Spoofing credential dialogs) On Linux systems adversaries may launch dialog boxes prompting users for credentials from malicious shell scripts or the command line (i.e. [Unix Shell](https://attack.mitre.org/techniques/T1059/004)).(Citation: Spoofing credential dialogs) Adversaries may also mimic common software authentication requests, such as those from browsers or email clients. This may also be paired with user activity monitoring (i.e., [Browser Information Discovery](https://attack.mitre.org/techniques/T1217) and/or [Application Window Discovery](https://attack.mitre.org/techniques/T1010)) to spoof prompts when users are naturally accessing sensitive sites/data.
Query: detection rule: Detects when a new admin role assignment is created. Which could be a sign of privilege escalation or persistence
Matching passage: Sigma rule: Detects when a new admin role assignment is created. Which could be a sign of privilege escalation or persistence. Logsource: okta / okta. Rule: title: Okta Admin Role Assignment Created id: 139bdd4b-9cd7-49ba-a2f4-744d0a8f5d8c status: test description: Detects when a new admin role assignment is created. Which could be a sign of privilege escalation or persistence references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Nikita Khalimonenkov date: 2023-01-19 modified: 2026-04-27 tags: - attack.persistence logsource: product: okta service: okta detection: selection: eventType: iam.resourceset.bindings.add condition: selection falsepositives: - Legitimate creation of a new admin role assignment level: medium
Near-miss passage: Sigma rule: Detects the deletion of backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware. Logsource: windows / process_creation. Rule: title: Windows Backup Deleted Via Wbadmin.EXE id: 89f75308-5b1b-4390-b2d8-d6b2340efaf8 related: - id: 639c9081-f482-47d3-a0bd-ddee3d4ecd76 type: derived status: test description: 'Detects the deletion of backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell - https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md - https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/ - https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-report-avaddon-and-new-techniques-emerge-industrial-sector-targeted - https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-delete-systemstatebackup author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-12-13 modified: 2024-05-10 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wbadmin.exe - OriginalFileName: WBADMIN.EXE selection_cli: CommandLine|contains|all: - 'delete ' - backup filter_main_keep_versions: CommandLine|contains: keepVersions:0 condition: all of selection_* and not 1 of filter_main_* falsepositives: - Legitimate backup activity from administration scripts and software. level: medium
Query: CVE similar to CVE-2015-3450
Matching passage: CVE-2015-3450. CWE: CWE-119. CVSS: 8.800000190734863. Heap-based buffer overflow in libaxl 0.6.9 allows attackers to cause a denial of service (memory corruption) or execute arbitrary code via a crafted XML document.
Near-miss passage: CVE-2015-3702. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3700, and CVE-2015-3701.
Query: hunt for Launchctl activity
Matching passage: T1569.001 Launchctl. Tactics: execution. Description: Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.(Citation: Launchctl Man) Adversaries use launchctl to execute commands and programs as [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s. Common subcommands include: <code>launchctl load</code>,<code>launchctl unload</code>, and <code>launchctl start</code>. Adversaries can use scripts or manually run the commands <code>launchctl load -w "%s/Library/LaunchAgents/%s"</code> or <code>/bin/launchctl load</code> to execute [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s.(Citation: Sofacy Komplex Trojan)(Citation: 20 macOS Common Tools and Techniques)
Near-miss passage: T1569.003 Systemctl. Tactics: execution. Description: Adversaries may abuse systemctl to execute commands or programs. Systemctl is the primary interface for systemd, the Linux init system and service manager. Typically invoked from a shell, Systemctl can also be integrated into scripts or applications. Adversaries may use systemctl to execute commands or programs as [Systemd Service](https://attack.mitre.org/techniques/T1543/002)s. Common subcommands include: `systemctl start`, `systemctl stop`, `systemctl enable`, `systemctl disable`, and `systemctl status`.(Citation: Red Hat Systemctl 2022)
Query: describe CVE-2015-4525
Matching passage: CVE-2015-4525. CWE: CWE-77. CVSS: 9.0. The log-gather implementation in the web administration interface in EMC Isilon OneFS 6.5.x.x through 7.1.1.x before 7.1.1.5 and 7.2.0.x before 7.2.0.2 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors.
Near-miss passage: CVE-2015-4974. CWE: CWE-77. CVSS: 7.199999809265137. IBM General Parallel File System (GPFS) 3.5.x before 3.5.0.27 and 4.1.x before 4.1.1.2 and Spectrum Scale 4.1.1.x before 4.1.1.2 allow local users to obtain root privileges for command execution via unspecified vectors.