alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it p
Matching passage: Sigma rule: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it p. Logsource: linux / auditd. Rule: title: Data Compressed id: a3b5e3e9-1b49-4119-8b8e-0344a01f21ee status: test description: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. references: - https://github.com/redcanaryco/atomic-red-team/blob/a78b9ed805ab9ea2e422e1aa7741e9407d82d7b1/atomics/T1560.001/T1560.001.md author: Timur Zinniatullin, oscd.community date: 2019-10-21 modified: 2023-07-28 tags: - attack.exfiltration - attack.collection - attack.t1560.001 logsource: product: linux service: auditd detection: selection1: type: execve a0: zip selection2: type: execve a0: gzip a1: -k selection3: type: execve a0: tar a1|contains: -c condition: 1 of selection* falsepositives: - Legitimate use of archiving tools by legitimate user. level: low
Near-miss passage: Sigma rule: Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or othe. Logsource: windows / process_creation. Rule: title: Unusual Child Process of dns.exe id: a4e3d776-f12e-42c2-8510-9e6ed1f43ec3 status: test description: Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed) references: - https://www.elastic.co/guide/en/security/current/unusual-child-process-of-dns-exe.html author: Tim Rauch, Elastic (idea) date: 2022-09-27 modified: 2023-02-05 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \dns.exe filter: Image|endswith: \conhost.exe condition: selection and not filter falsepositives: - Unknown level: high
Query: detection rule: Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file.
Matching passage: Sigma rule: Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file.. Logsource: windows / process_creation. Rule: title: Suspicious Diantz Alternate Data Stream Execution id: 6b369ced-4b1d-48f1-b427-fdc0de0790bd status: test description: Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file. references: - https://lolbas-project.github.io/lolbas/Binaries/Diantz/ author: frack113 date: 2021-11-26 modified: 2022-12-31 tags: - attack.stealth - attack.t1564.004 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - diantz.exe - .cab CommandLine|re: :[^\\] condition: selection falsepositives: - Very Possible level: medium
Near-miss passage: Sigma rule: Detect use of X509Enrollment. Logsource: windows / ps_script. Rule: title: Suspicious X509Enrollment - Ps Script id: 504d63cb-0dba-4d02-8531-e72981aace2c related: - id: 114de787-4eb2-48cc-abdb-c0b449f93ea4 type: similar status: test description: Detect use of X509Enrollment references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=42 - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=41 - https://learn.microsoft.com/en-us/dotnet/api/microsoft.hpc.scheduler.store.cx509enrollmentwebclassfactoryclass?view=hpc-sdk-5.1.6115 author: frack113 date: 2022-12-23 tags: - attack.defense-impairment - attack.t1553.004 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - X509Enrollment.CBinaryConverter - 884e2002-217d-11da-b2a4-000e7bbb2b09 condition: selection falsepositives: - Legitimate administrative script level: medium
Query: describe CVE-2015-0241
Matching passage: CVE-2015-0241. CWE: CWE-120. CVSS: 8.800000190734863. The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric formatting template, which triggers a buffer over-read, or (2) crafted timestamp formatting template, which triggers a buffer overflow.
Near-miss passage: CVE-2015-8126. CWE: CWE-120. CVSS: 7.5. Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.
Query: Sigma rule for Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access
Matching passage: Sigma rule: Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access. Logsource: windows / process_creation. Rule: title: Suspicious Invoke-WebRequest Execution With DirectIP id: 1edff897-9146-48d2-9066-52e8d8f80a2f status: test description: Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access references: - https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-21 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - powershell_ise.EXE - PowerShell.EXE - pwsh.dll selection_commands: CommandLine|contains: - 'curl ' - Invoke-RestMethod - Invoke-WebRequest - ' irm ' - 'iwr ' - 'wget ' selection_ip: CommandLine|contains: - ://1 - ://2 - ://3 - ://4 - ://5 - ://6 - ://7 - ://8 - ://9 condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump th. Logsource: windows / process_creation. Rule: title: Process Access via TrolleyExpress Exclusion id: 4c0aaedc-154c-4427-ada0-d80ef9c9deb6 status: test description: Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump the lsass process memory references: - https://twitter.com/_xpn_/status/1491557187168178176 - https://www.youtube.com/watch?v=Ie831jF0bb0 author: Florian Roth (Nextron Systems) date: 2022-02-10 modified: 2022-05-13 tags: - attack.stealth - attack.t1218.011 - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - \TrolleyExpress 7 - \TrolleyExpress 8 - \TrolleyExpress 9 - \TrolleyExpress.exe 7 - \TrolleyExpress.exe 8 - \TrolleyExpress.exe 9 - '\TrolleyExpress.exe -ma ' renamed: Image|endswith: \TrolleyExpress.exe filter_renamed: OriginalFileName|contains: CtxInstall filter_empty: OriginalFileName: null condition: selection or ( renamed and not 1 of filter* ) falsepositives: - Unknown level: high
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in CA Release Automation (formerly LISA Release Automation) 5.0.2 before 5.0.2-227, 5.5.1 before 5.5.1-1616, 5.5.2 before 5.5.2-
Matching passage: CVE-2015-8699. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in CA Release Automation (formerly LISA Release Automation) 5.0.2 before 5.0.2-227, 5.5.1 before 5.5.1-1616, 5.5.2 before 5.5.2-434, and 6.1.0 before 6.1.0-1026 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-0072. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy and inject arbitrary web script or HTML via vectors involving an IFRAME element that triggers a redirect, a second IFRAME element that does not trigger a redirect, and an eval of a WindowProxy object, aka "Universal XSS (UXSS)."
Query: alert when Detects use of WSReset.exe to bypass User Account Control (UAC). Adversaries use this technique to execute privileged pr
Matching passage: Sigma rule: Detects use of WSReset.exe to bypass User Account Control (UAC). Adversaries use this technique to execute privileged pr. Logsource: windows / process_creation. Rule: title: Bypass UAC via WSReset.exe id: d797268e-28a9-49a7-b9a8-2f5039011c5c related: - id: bdc8918e-a1d5-49d1-9db7-ea0fd91aa2ae type: obsolete status: test description: Detects use of WSReset.exe to bypass User Account Control (UAC). Adversaries use this technique to execute privileged processes. references: - https://eqllib.readthedocs.io/en/latest/analytics/532b5ed4-7930-11e9-8f5c-d46d6d62a49e.html - https://lolbas-project.github.io/lolbas/Binaries/Wsreset/ - https://www.activecyber.us/activelabs/windows-uac-bypass - https://twitter.com/ReaQta/status/1222548288731217921 author: E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community, Florian Roth date: 2019-10-24 modified: 2022-05-13 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \wsreset.exe filter: - Image|endswith: \conhost.exe - OriginalFileName: CONHOST.EXE condition: selection and not filter falsepositives: - Unknown sub processes of Wsreset.exe level: high
Near-miss passage: Sigma rule: Detects usage of COM objects that can be abused to download files in PowerShell by CLSID. Logsource: windows / ps_script. Rule: title: Potential COM Objects Download Cradles Usage - PS Script id: 3c7d1587-3b13-439f-9941-7d14313dbdfe related: - id: 02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf type: similar status: test description: Detects usage of COM objects that can be abused to download files in PowerShell by CLSID references: - https://learn.microsoft.com/en-us/dotnet/api/system.type.gettypefromclsid?view=net-7.0 - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=57 author: frack113 date: 2022-12-25 tags: - attack.command-and-control - attack.t1105 logsource: product: windows category: ps_script definition: Script Block Logging must be enable detection: selection_1: ScriptBlockText|contains: '[Type]::GetTypeFromCLSID(' selection_2: ScriptBlockText|contains: - 0002DF01-0000-0000-C000-000000000046 - F6D90F16-9C73-11D3-B32E-00C04F990BB4 - F5078F35-C551-11D3-89B9-0000F81FE221 - 88d96a0a-f192-11d4-a65f-0040963251e5 - AFBA6B42-5692-48EA-8141-DC517DCF0EF1 - AFB40FFD-B609-40A3-9828-F88BBE11E4E3 - 88d96a0b-f192-11d4-a65f-0040963251e5 - 2087c2f4-2cef-4953-a8ab-66779b670495 - 000209FF-0000-0000-C000-000000000046 - 00024500-0000-0000-C000-000000000046 condition: all of selection_* falsepositives: - Legitimate use of the library level: medium
Query: Sigma rule for Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Cont
Matching passage: Sigma rule: Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Cont. Logsource: windows / application. Rule: title: Atera Agent Installation id: 87261fb2-69d0-42fe-b9de-88c6b5f65a43 status: test description: Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Conti operators references: - https://www.advintel.io/post/secret-backdoor-behind-conti-ransomware-operation-introducing-atera-agent author: Bhabesh Raj date: 2021-09-01 modified: 2022-12-25 tags: - attack.command-and-control - attack.t1219.002 logsource: service: application product: windows detection: selection: EventID: 1033 Provider_Name: MsiInstaller Message|contains: AteraAgent condition: selection falsepositives: - Legitimate Atera agent installation level: high
Near-miss passage: Sigma rule: Detects the execution of a script event consumer. When scrcons.exe launches, it does so in response to the creation of a. Logsource: windows / process_creation. Rule: title: WMI Persistence - Script Event Consumer id: ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e status: test description: 'Detects the execution of a script event consumer. When scrcons.exe launches, it does so in response to the creation of an ActiveScriptEventConsumer instance and will execute registered JScript or VBScript code as a result. Script event consumers are a built-in Windows Management Instrumentation (WMI) class that automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs. Adversaries often abuse script event consumers to maintain persistence on a compromised host by executing a malicious script whenever a specific event occurs. ' references: - https://redcanary.com/blog/threat-detection/child-processes/ - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ author: Thomas Patzke date: 2018-03-07 modified: 2022-10-11 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.003 logsource: category: process_creation product: windows detection: selection: Image: C:\WINDOWS\system32\wbem\scrcons.exe ParentImage: C:\Windows\System32\svchost.exe condition: selection falsepositives: - Legitimate event consumers - Dell computers on some versions register an event consumer that is known to cause false positives when brightness is changed by the corresponding keyboard button level: medium
Query: threat report mentioning JamPlus
Matching passage: T1127.003 JamPlus. Tactics: stealth, execution. Description: Adversaries may use `JamPlus` to proxy the execution of a malicious script. `JamPlus` is a build utility tool for code and data build systems. It works with several popular compilers and can be used for generating workspaces in code editors such as Visual Studio.(Citation: JamPlus manual) Adversaries may abuse the `JamPlus` build utility to execute malicious scripts via a `.jam` file, which describes the build process and required dependencies. Because the malicious script is executed from a reputable developer tool, it may subvert application control security systems such as Smart App Control.(Citation: Cyble)(Citation: Elastic Security Labs)
Near-miss passage: T1127.002 ClickOnce. Tactics: stealth, execution. Description: Adversaries may use ClickOnce applications (.appref-ms and .application files) to proxy execution of code through a trusted Windows utility.(Citation: Burke/CISA ClickOnce BlackHat) ClickOnce is a deployment that enables a user to create self-updating Windows-based .NET applications (i.e, .XBAP, .EXE, or .DLL) that install and run from a file share or web page with minimal user interaction. The application launches as a child process of DFSVC.EXE, which is responsible for installing, launching, and updating the application.(Citation: SpectorOps Medium ClickOnce) Because ClickOnce applications receive only limited permissions, they do not require administrative permissions to install.(Citation: Microsoft Learn ClickOnce) As such, adversaries may abuse ClickOnce to proxy execution of malicious code without needing to escalate privileges. ClickOnce may be abused in a number of ways. For example, an adversary may rely on [User Execution](https://attack.mitre.org/techniques/T1204). When a user visits a malicious website, the .NET malware is disguised as legitimate software and a ClickOnce popup is displayed for installation.(Citation: NetSPI ClickOnce) Adversaries may also abuse ClickOnce to execute malware via a [Rundll32](https://attack.mitre.org/techniques/T1218/011) script using the command `rundll32.exe dfshim.dll,ShOpenVerbApplication1`.(Citation: LOLBAS /Dfsvc.exe) Additionally, an adversary can move the ClickOnce application file to a remote user’s startup folder for continued malicious code deployment (i.e., [Registry Run Keys / Startup Folder](https://attack.mitre.org/techniques/T1547/001)).(Citation: Burke/CISA ClickOnce BlackHat)(Citation: Burke/CISA ClickOnce Paper)
Query: describe CVE-2015-6174
Matching passage: CVE-2015-6174. CWE: CWE-264. CVSS: 7.199999809265137. The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-6171 and CVE-2015-6173.
Near-miss passage: CVE-2015-2512. CWE: CWE-264. CVSS: 7.199999809265137. The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Font Driver Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2507.
Query: detection rule: Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintex
Matching passage: Sigma rule: Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintex. Logsource: windows / registry_event. Rule: title: Security Support Provider (SSP) Added to LSA Configuration id: eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc status: test description: 'Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows. ' references: - https://powersploit.readthedocs.io/en/latest/Persistence/Install-SSP/ - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/data/module_source/persistence/Install-SSP.ps1#L157 author: iwillkeepwatch date: 2019-01-18 modified: 2026-03-30 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.005 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: - \Control\Lsa\Security Packages - \Control\Lsa\OSConfig\Security Packages filter_main_msiexec: Image: - C:\Windows\system32\msiexec.exe - C:\Windows\syswow64\MsiExec.exe filter_main_image_null: Image: null condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions). Logsource: windows / process_creation. Rule: title: Suspicious SysAidServer Child id: 60bfeac3-0d35-4302-8efb-1dd16f715bc6 status: test description: Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions) references: - https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/ author: Florian Roth (Nextron Systems) date: 2022-08-26 tags: - attack.lateral-movement - attack.t1210 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \java.exe - \javaw.exe ParentCommandLine|contains: SysAidServer condition: selection falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-7820
Matching passage: CVE-2015-7820. CWE: CWE-362. CVSS: 7.099999904632568. Race condition in the administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows remote attackers to obtain privileged-account access, and consequently provide ZipDownload.jsp input containing directory traversal sequences to read arbitrary files, via a request to port 40080 or 40443.
Near-miss passage: CVE-2015-7553. CWE: CWE-362. CVSS: 4.699999809265137. Race condition in the kernel in Red Hat Enterprise Linux 7, kernel-rt and Red Hat Enterprise MRG 2, when the nfnetlink_log module is loaded, allows local users to cause a denial of service (panic) by creating netlink sockets.
Query: patch priority for CVE-2015-2351
Matching passage: CVE-2015-2351. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Alkacon OpenCms 9.5.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) homelink parameter to system/modules/org.opencms.workplace.help/jsptemplates/help_head.jsp, (2) workplaceresource parameter to system/workplace/locales/en/help/index.html, (3) path parameter to system/workplace/views/admin/admin-main.jsp, (4) mode parameter to system/workplace/views/explorer/explorer_files.jsp, or (5) query parameter in a search action to system/modules/org.opencms.workplace.help/elements/search.jsp.
Near-miss passage: CVE-2015-0551. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop 6.7SP1 before P31, 6.7SP2 before P23, and 6.8 before P01; Documentum Administrator 6.7SP1 before P31, 6.7SP2 before P23, 7.0 before P18, 7.1 before P15, and 7.2 before P01; Documentum Digital Assets Manager 6.5SP6 before P25; Documentum Web Publishers 6.5 SP7 before P25; and Documentum Task Space 6.7SP1 before P31 and 6.7SP2 before P23 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Query: CVE similar to CVE-2015-0854
Matching passage: CVE-2015-0854. CWE: CWE-19. CVSS: 7.800000190734863. App/HelperFunctions.pm in Shutter through 0.93.1 allows user-assisted remote attackers to execute arbitrary commands via a crafted image name that is mishandled during a "Show in Folder" action.
Near-miss passage: CVE-2015-7575. CWE: CWE-19. CVSS: 5.900000095367432. Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.
Query: secure coding against Improper Isolation of Shared Resources in Network On Chip (NoC)
Matching passage: CWE-1331 Improper Isolation of Shared Resources in Network On Chip (NoC). The Network On Chip (NoC) does not isolate or incorrectly isolates its on-chip-fabric and internal resources such that they are shared between trusted and untrusted agents, creating timing channels.
Near-miss passage: CWE-165 Improper Neutralization of Multiple Internal Special Elements. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple internal special elements that could be interpreted in unexpected ways when they are sent to a downstream component.
Query: risk of Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not properly implement the DCE-RPC layer, which allows remote attackers to perform protocol-downgra
Matching passage: CVE-2015-5370. CWE: UNKNOWN. CVSS: 5.900000095367432. Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not properly implement the DCE-RPC layer, which allows remote attackers to perform protocol-downgrade attacks, cause a denial of service (application crash or CPU consumption), or possibly execute arbitrary code on a client system via unspecified vectors.
Near-miss passage: CVE-2015-5895. CWE: UNKNOWN. CVSS: 10.0. Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and attack vectors.