alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature. in logs
Matching passage: Sigma rule: Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.. Logsource: windows / registry_set. Rule: title: Microsoft Office Protected View Disabled id: a5c7a43f-6009-4a8c-80c5-32abf1c53ecc related: - id: 7c637634-c95d-4bbf-b26c-a82510874b34 type: obsolete status: test description: Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/ - https://yoroi.company/research/cyber-criminal-espionage-operation-insists-on-italian-manufacturing/ - https://admx.help/HKCU/software/policies/microsoft/office/16.0/excel/security/protectedview author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-06-08 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_set detection: selection_path: TargetObject|contains|all: - \SOFTWARE\Microsoft\Office\ - \Security\ProtectedView\ selection_values_1: Details: DWORD (0x00000001) TargetObject|endswith: - \DisableAttachementsInPV - \DisableInternetFilesInPV - \DisableIntranetCheck - \DisableUnsafeLocationsInPV selection_values_0: Details: DWORD (0x00000000) TargetObject|endswith: - \enabledatabasefileprotectedview - \enableforeigntextfileprotectedview condition: selection_path and 1 of selection_values_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects TacticalRMM agent installations where the --api, --auth, and related flags are used on the command line. These p. Logsource: windows / process_creation. Rule: title: Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server id: 2db93a3f-3249-4f73-9e68-0e77a0f8ae7e status: experimental description: 'Detects TacticalRMM agent installations where the --api, --auth, and related flags are used on the command line. These parameters configure the agent to connect to a specific RMM server with authentication, client ID, and site ID. This technique could indicate a threat actor attempting to register the agent with an attacker-controlled RMM infrastructure silently. ' references: - https://github.com/amidaware/tacticalrmm - https://apophis133.medium.com/powershell-script-tactical-rmm-installation-45afb639eff3 author: Ahmed Nosir (@egycondor) date: 2025-05-29 tags: - attack.command-and-control - attack.t1219 - attack.t1105 logsource: category: process_creation product: windows detection: selection: Image|contains: \TacticalAgent\tacticalrmm.exe CommandLine|contains|all: - --api - --auth - --client-id - --site-id - --agent-type condition: selection falsepositives: - Legitimate system administrator deploying TacticalRMM level: medium
Query: Suspicious Search Open Websites/Domains execution detected on endpoint
Matching passage: T1593 Search Open Websites/Domains. Tactics: reconnaissance. Description: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.(Citation: Cyware Social Media)(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking) Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Phishing](https://attack.mitre.org/techniques/T1566)).
Near-miss passage: T1593.002 Search Engines. Tactics: reconnaissance. Description: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes).(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking) Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Valid Accounts](https://attack.mitre.org/techniques/T1078) or [Phishing](https://attack.mitre.org/techniques/T1566)).
Query: write Sigma for Detects when a new owner is added to an application. This gives that account privileges to make modifications and config
Matching passage: Sigma rule: Detects when a new owner is added to an application. This gives that account privileges to make modifications and config. Logsource: azure / auditlogs. Rule: title: Added Owner To Application id: 74298991-9fc4-460e-a92e-511aa60baec1 status: test description: Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#new-owner author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' date: 2022-06-02 tags: - attack.t1552 - attack.credential-access logsource: product: azure service: auditlogs detection: selection: properties.message: Add owner to application condition: selection falsepositives: - When a new application owner is added by an administrator level: medium
Near-miss passage: Sigma rule: Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary. Logsource: windows / registry_event. Rule: title: UAC Bypass Via Wsreset id: 6ea3bf32-9680-422d-9f50-e90716b12a66 status: test description: Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary file contained in a low-privilege registry. references: - https://www.bleepingcomputer.com/news/security/trickbot-uses-a-new-windows-10-uac-bypass-to-launch-quietly - https://lolbas-project.github.io/lolbas/Binaries/Wsreset author: oscd.community, Dmitry Uchakin date: 2020-10-07 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: \AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-5853
Matching passage: CVE-2015-5853. CWE: CWE-200. CVSS: 3.299999952316284. AirScan in Apple OS X before 10.11 allows man-in-the-middle attackers to obtain eSCL packet payload data via unspecified vectors.
Near-miss passage: CVE-2015-8544. CWE: CWE-200. CVSS: 7.5. NetApp SnapDrive for Windows before 7.0.2P4, 7.0.3, and 7.1 before 7.1.3P1 allows remote attackers to obtain sensitive information via unspecified vectors.
Query: exploit The HybridAuth Social Login module 7.x-2.x before 7.x-2.10 for Drupal stores passwords in plaintext when the "Ask user for a password when registering" option is enabled, which all
Matching passage: CVE-2015-4395. CWE: CWE-200. CVSS: 3.5. The HybridAuth Social Login module 7.x-2.x before 7.x-2.10 for Drupal stores passwords in plaintext when the "Ask user for a password when registering" option is enabled, which allows remote authenticated users with certain permissions to obtain sensitive information by leveraging access to the database.
Near-miss passage: CVE-2015-7846. CWE: CWE-200. CVSS: 4.599999904632568. Huawei S7700, S9700, S9300 before V200R07C00SPC500, and AR200, AR1200, AR2200, AR3200 before V200R005C20SPC200 allows attackers with physical access to the CF card to obtain sensitive information.
Query: describe CVE-2015-1059
Matching passage: CVE-2015-1059. CWE: CWE-94. CVSS: 6.5. Unrestricted file upload vulnerability in admin/files/add in AdaptCMS 3.0.3 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in /app/webroot/uploads.
Near-miss passage: CVE-2015-2252. CWE: CWE-94. CVSS: 8.800000190734863. Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to execute arbitrary code with root privileges via a crafted UDS patch with shell scripts.
Query: explain CWE-286
Matching passage: CWE-286 Incorrect User Management. The product does not properly manage a user within its environment.
Near-miss passage: CWE-762 Mismatched Memory Management Routines. The product attempts to return a memory resource to the system, but it calls a release function that is not compatible with the function that was originally used to allocate that resource.
Query: describe CVE-2015-2177
Matching passage: CVE-2015-2177. CWE: CWE-20. CVSS: 7.5. Siemens SIMATIC S7-300 CPU devices allow remote attackers to cause a denial of service (defect-mode transition) via crafted packets on (1) TCP port 102 or (2) Profibus.
Near-miss passage: CVE-2015-8732. CWE: CWE-20. CVSS: 5.5. The dissect_zcl_pwr_prof_pwrprofstatersp function in epan/dissectors/packet-zbee-zcl-general.c in the ZigBee ZCL dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the Total Profile Number field, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.
Query: describe CVE-2015-8784
Matching passage: CVE-2015-8784. CWE: CWE-787. CVSS: 6.5. The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image, as demonstrated by libtiff5.tif.
Near-miss passage: CVE-2015-5237. CWE: CWE-787. CVSS: 8.800000190734863. protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.
Query: rule covering Detects download of certain file types from hosts with dynamic DNS names (selected list)
Matching passage: Sigma rule: Detects download of certain file types from hosts with dynamic DNS names (selected list). Logsource: proxy. Rule: title: Download from Suspicious Dyndns Hosts id: 195c1119-ef07-4909-bb12-e66f5e07bf3c status: test description: Detects download of certain file types from hosts with dynamic DNS names (selected list) references: - https://www.alienvault.com/blogs/security-essentials/dynamic-dns-security-and-potential-threats author: Florian Roth (Nextron Systems) date: 2017-11-08 modified: 2023-05-18 tags: - attack.command-and-control - attack.t1105 - attack.t1568 logsource: category: proxy detection: selection: c-uri-extension: - exe - vbs - bat - rar - ps1 - doc - docm - xls - xlsm - pptm - rtf - hta - dll - ws - wsf - sct - zip cs-host|endswith: - .hopto.org - .no-ip.org - .no-ip.info - .no-ip.biz - .no-ip.com - .noip.com - .ddns.name - .myftp.org - .myftp.biz - .serveblog.net - .servebeer.com - .servemp3.com - .serveftp.com - .servequake.com - .servehalflife.com - .servehttp.com - .servegame.com - .servepics.com - .myvnc.com - .ignorelist.com - .jkub.com - .dlinkddns.com - .jumpingcrab.com - .ddns.info - .mooo.com - .dns-dns.com - .strangled.net - .adultdns.net - .craftx.biz - .ddns01.com - .dns53.biz - .dnsapi.info - .dnsd.info - .dnsdynamic.com - .dnsdynamic.net - .dnsget.org - .fe100.net - .flashserv.net - .ftp21.net - .http01.com - .http80.info - .https443.com - .imap01.com - .kadm5.com - .mysq1.net - .ns360.info - .ntdll.net - .ole32.com - .proxy8080.com - .sql01.com - .ssh01.com - .ssh22.net - .tempors.com - .tftpd.net - .ttl60.com - .ttl60.org - .user32.com - .voip01.com - .wow64.net - .x64.me - .xns01.com - .dyndns.org - .dyndns.info - .dyndns.tv - .dyndns-at-home.com - .dnsomatic.com - .zapto.org - .webhop.net - .25u.com - .slyip.net condition: selection falsepositives: - Software downloads level: medium
Near-miss passage: Sigma rule: Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting. Logsource: windows / process_creation. Rule: title: Use of OpenConsole id: 814c95cc-8192-4378-a70a-f1aafd877af1 status: test description: Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting references: - https://twitter.com/nas_bench/status/1537563834478645252 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-16 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: OpenConsole.exe - Image|endswith: \OpenConsole.exe filter: Image|startswith: C:\Program Files\WindowsApps\Microsoft.WindowsTerminal condition: selection and not filter falsepositives: - Legitimate use by an administrator level: medium
Query: detection rule: Detects logon events that specify new credentials
Matching passage: Sigma rule: Detects logon events that specify new credentials. Logsource: windows / security. Rule: title: Outgoing Logon with New Credentials id: def8b624-e08f-4ae1-8612-1ba21190da6b status: test description: Detects logon events that specify new credentials references: - https://go.recordedfuture.com/hubfs/reports/mtp-2021-0914.pdf author: Max Altgelt (Nextron Systems) date: 2022-04-06 tags: - attack.lateral-movement - attack.t1550 logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 9 condition: selection falsepositives: - Legitimate remote administration activity level: low
Near-miss passage: Sigma rule: Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with S. Logsource: windows / process_creation. Rule: title: Potential Privilege Escalation To LOCAL SYSTEM id: 207b0396-3689-42d9-8399-4222658efc99 related: - id: 8834e2f7-6b4b-4f09-8906-d2276470ee23 type: similar status: test description: Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with SYSTEM Privileges references: - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec - https://www.poweradmin.com/paexec/ - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-05-22 modified: 2024-03-05 tags: - attack.resource-development - attack.t1587.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|windash: - ' -s cmd' - ' -s -i cmd' - ' -i -s cmd' - ' -s pwsh' - ' -s -i pwsh' - ' -i -s pwsh' - ' -s powershell' - ' -s -i powershell' - ' -i -s powershell' filter_main_exclude_coverage: CommandLine|contains: - paexec - PsExec - accepteula condition: selection and not 1 of filter_main_* falsepositives: - Weird admins that rename their tools - Software companies that bundle PsExec/PAExec with their software and rename it, so that it is less embarrassing level: high
Query: patch priority for CVE-2015-5805
Matching passage: CVE-2015-5805. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-7829. CWE: CWE-119. CVSS: 1.899999976158142. Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows mishandle junctions in the Synchronizer directory, which allows attackers to delete arbitrary files via Adobe Collaboration Sync, a related issue to CVE-2015-2428.
Query: vulnerability: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, A
Matching passage: CVE-2015-8046. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, and CVE-2015-8044.
Near-miss passage: CVE-2015-0430. CWE: UNKNOWN. CVSS: 1.899999976158142. Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect confidentiality via vectors related to RPC Utility.
Query: patch priority for CVE-2015-1139
Matching passage: CVE-2015-1139. CWE: CWE-20. CVSS: 6.800000190734863. ImageIO in Apple OS X before 10.10.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .sgi file.
Near-miss passage: CVE-2015-2776. CWE: CWE-20. CVSS: 4.300000190734863. The parse_SST function in FreeXL before 1.0.0i allows remote attackers to cause a denial of service (memory consumption) via a crafted shared strings table in a workbook.
Query: CVE similar to CVE-2015-7651
Matching passage: CVE-2015-7651. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted DefineFunction atoms, a different vulnerability than CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
Near-miss passage: CVE-2015-4909. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.4.0, 12.1.2.0.0, and 12.1.3.0.0 allows remote attackers to affect integrity via vectors related to ADF Faces.
Query: containment actions for EDR alert: possible Cloud Accounts (T1586.003)
Matching passage: Playbook for T1586.003 Cloud Accounts. 1) Validate alert telemetry against T1586.003. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: resource development. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may compromise cloud accounts that can be used during targeting. Adversaries can use compromised cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002
Near-miss passage: Playbook for T1586 Compromise Accounts. Different response path focused on resource development.
Query: describe CVE-2015-5813
Matching passage: CVE-2015-5813. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-8981. CWE: CWE-119. CVSS: 9.800000190734863. Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in base/PdfParser.cpp in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.
Query: detection rule: Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploitin
Matching passage: Sigma rule: Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploitin. Logsource: linux / sshd. Rule: title: Suspicious OpenSSH Daemon Error id: e76b413a-83d0-4b94-8e4c-85db4a5b8bdc status: test description: Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts references: - https://github.com/openssh/openssh-portable/blob/c483a5c0fb8e8b8915fad85c5f6113386a4341ca/ssherr.c - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/sshd_rules.xml author: Florian Roth (Nextron Systems) date: 2017-06-30 modified: 2021-11-27 tags: - attack.initial-access - attack.t1190 logsource: product: linux service: sshd detection: keywords: - unexpected internal error - unknown or unsupported key type - invalid certificate signing key - invalid elliptic curve value - incorrect signature - error in libcrypto - unexpected bytes remain after decoding - 'fatal: buffer_get_string: bad string' - 'Local: crc32 compensation attack' - bad client public DH value - Corrupted MAC on input condition: keywords falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of shells from a parent process located in a temporary (/tmp) directory. Logsource: linux / process_creation. Rule: title: Shell Execution Of Process Located In Tmp Directory id: 2fade0b6-7423-4835-9d4f-335b39b83867 status: test description: Detects execution of shells from a parent process located in a temporary (/tmp) directory references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.execution logsource: product: linux category: process_creation detection: selection: ParentImage|startswith: /tmp/ Image|endswith: - /bash - /csh - /dash - /fish - /ksh - /sh - /zsh condition: selection falsepositives: - Unknown level: high