alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by
Matching passage: Sigma rule: Detects installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by. Logsource: windows / process_creation. Rule: title: Potential Shim Database Persistence via Sdbinst.EXE id: 517490a7-115a-48c6-8862-1a481504d5a8 related: - id: 18ee686c-38a3-4f65-9f44-48a077141f42 type: similar status: test description: 'Detects installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims ' references: - https://www.mandiant.com/resources/blog/fin7-shim-databases-persistence author: Markus Neis date: 2019-01-16 modified: 2023-12-06 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.011 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \sdbinst.exe - OriginalFileName: sdbinst.exe selection_cli: CommandLine|contains: .sdb filter_optional_iis: ParentImage|endswith: \msiexec.exe CommandLine|contains: - :\Program Files (x86)\IIS Express\iisexpressshim.sdb - :\Program Files\IIS Express\iisexpressshim.sdb condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. Thes. Logsource: windows / process_creation. Rule: title: Msxsl.EXE Execution id: 9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0 status: test description: 'Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. These files are commonly used to describe the processing and rendering of data within XML files. Adversaries can abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/ author: Timur Zinniatullin, oscd.community date: 2019-10-21 modified: 2023-11-09 tags: - attack.stealth - attack.t1220 logsource: category: process_creation product: windows detection: selection: Image|endswith: \msxsl.exe condition: selection falsepositives: - Msxsl is not installed by default and is deprecated, so unlikely on most systems. level: medium
Query: exploit The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with s
Matching passage: CVE-2015-8225. CWE: CWE-20. CVSS: 5.5. The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with software before V100R001C233B111 allows remote attackers to cause a denial of service (crash) via a crafted application with the system or camera permission, a different vulnerability than CVE-2015-8226.
Near-miss passage: CVE-2015-8731. CWE: CWE-20. CVSS: 5.5. The dissct_rsl_ipaccess_msg function in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not reject unknown TLV types, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.
Query: exploit Directory traversal vulnerability in the WifiHs20UtilityService on the Samsung S6 Edge LRX22G.G925VVRU1AOE2 allows remote attackers to overwrite or create arbitrary files as the sy
Matching passage: CVE-2015-7888. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in the WifiHs20UtilityService on the Samsung S6 Edge LRX22G.G925VVRU1AOE2 allows remote attackers to overwrite or create arbitrary files as the system-level user via a .. (dot dot) in the name of a file, compressed into a zipped file named cred.zip, and downloaded to /sdcard/Download.
Near-miss passage: CVE-2015-4670. CWE: CWE-22. CVSS: 6.400000095367432. Directory traversal vulnerability in the AjaxFileUpload control in DevExpress AJAX Control Toolkit (aka AjaxControlToolkit) before 15.1 allows remote attackers to write to arbitrary files via a .. (dot dot) in the fileId parameter to AjaxFileUploadHandler.axd.
Query: describe CVE-2015-9413
Matching passage: CVE-2015-9413. CWE: CWE-352. CVSS: 6.5. The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter.
Near-miss passage: CVE-2015-7678. CWE: CWE-352. CVSS: 8.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Ipswitch MOVEit Mobile 1.2.0.962 and earlier allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Query: Persistence mechanism resembling Modify Cloud Compute Infrastructure
Matching passage: T1578 Modify Cloud Compute Infrastructure. Tactics: defense impairment. Description: An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots. Permissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure. Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence.(Citation: Mandiant M-Trends 2020)
Near-miss passage: T1578.003 Delete Cloud Instance. Tactics: defense impairment. Description: An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence. Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable. An adversary may also [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and later terminate the instance after achieving their objectives.(Citation: Mandiant M-Trends 2020)
Query: CVE similar to CVE-2015-1609
Matching passage: CVE-2015-1609. CWE: CWE-20. CVSS: 5.0. MongoDB before 2.4.13 and 2.6.x before 2.6.8 allows remote attackers to cause a denial of service via a crafted UTF-8 string in a BSON request.
Near-miss passage: CVE-2015-5194. CWE: CWE-20. CVSS: 7.5. The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.
Query: Sigma YAML for windows / security
Matching passage: Sigma rule: Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lat. Logsource: windows / security. Rule: title: CobaltStrike Service Installations - Security id: d7a95147-145f-4678-b85d-d1ff4a3bb3f6 related: - id: 5a105d34-05fc-401e-8553-272b45c1522d type: derived status: test description: Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement references: - https://www.sans.org/webcasts/119395 - https://www.crowdstrike.com/blog/getting-the-bacon-from-cobalt-strike-beacon/ - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/ author: Florian Roth (Nextron Systems), Wojciech Lesicki date: 2021-05-26 modified: 2022-11-27 tags: - attack.persistence - attack.execution - attack.privilege-escalation - attack.lateral-movement - attack.t1021.002 - attack.t1543.003 - attack.t1569.002 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: event_id: EventID: 4697 selection1: ServiceFileName|contains|all: - ADMIN$ - .exe selection2: ServiceFileName|contains|all: - '%COMSPEC%' - start - powershell selection3: ServiceFileName|contains: powershell -nop -w hidden -encodedcommand selection4: ServiceFileName|base64offset|contains: 'IEX (New-Object Net.Webclient).DownloadString(''http://127.0.0.1:' condition: event_id and 1 of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52). Logsource: windows / process_creation. Rule: title: UAC Bypass Abusing Winsat Path Parsing - Process id: 7a01183d-71a2-46ad-ad5c-acd989ac1793 status: test description: Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 ParentImage|endswith: \AppData\Local\Temp\system32\winsat.exe ParentCommandLine|contains: C:\Windows \system32\winsat.exe condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-2420
Matching passage: CVE-2015-2420. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Microsoft System Center 2012 Operations Manager Gold before Rollup 8, SP1 before Rollup 10, and R2 before Rollup 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "System Center Operations Manager Web Console XSS Vulnerability."
Near-miss passage: CVE-2015-2840. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in help/rt/large_search.html in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to inject arbitrary web script or HTML via the searchQuery parameter.
Query: write Sigma for Detects the addition of new root, CA or AuthRoot certificates to the Windows registry
Matching passage: Sigma rule: Detects the addition of new root, CA or AuthRoot certificates to the Windows registry. Logsource: windows / registry_set. Rule: title: New Root or CA or AuthRoot Certificate to Store id: d223b46b-5621-4037-88fe-fda32eead684 status: test description: Detects the addition of new root, CA or AuthRoot certificates to the Windows registry references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md#atomic-test-6---add-root-certificate-to-currentuser-certificate-store - https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec author: frack113 date: 2022-04-04 modified: 2023-08-17 tags: - attack.impact - attack.t1490 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\ - \SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates\ - \SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\ - \SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\ - \SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates\ - \SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates\ - \SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\ - \SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot\Certificates\ - \SOFTWARE\Microsoft\EnterpriseCertificates\AuthRoot\Certificates\ TargetObject|endswith: \Blob Details: Binary Data condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence. Logsource: windows / file_delete. Rule: title: IIS WebServer Access Logs Deleted id: 3eb8c339-a765-48cc-a150-4364c04652bf related: - id: 0649be4a-aeb0-45b0-b89e-7f1668f6d9c0 type: similar status: test description: Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence references: - https://www.elastic.co/guide/en/security/current/webserver-access-logs-deleted.html author: Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-09-16 modified: 2023-02-15 tags: - attack.stealth - attack.t1070 logsource: category: file_delete product: windows detection: selection: TargetFilename|contains: \inetpub\logs\LogFiles\ TargetFilename|endswith: .log condition: selection falsepositives: - During uninstallation of the IIS service - During log rotation level: medium
Query: Persistence mechanism resembling Multi-Stage Channels
Matching passage: T1104 Multi-Stage Channels. Tactics: command and control. Description: Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions. Use of multiple stages may obfuscate the command and control channel to make detection more difficult. Remote access tools will call back to the first-stage command and control server for instructions. The first stage may have automated capabilities to collect basic host information, update tools, and upload additional files. A second remote access tool (RAT) could be uploaded at that point to redirect the host to the second-stage command and control server. The second stage will likely be more fully featured and allow the adversary to interact with the system through a reverse shell and additional RAT features. The different stages will likely be hosted separately with no overlapping infrastructure. The loader may also have backup first-stage callbacks or [Fallback Channels](https://attack.mitre.org/techniques/T1008) in case the original first-stage communication path is discovered and blocked.
Near-miss passage: T1095 Non-Application Layer Protocol. Tactics: command and control. Description: Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.(Citation: Wikipedia OSI) Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL). ICMP communication between hosts is one example.(Citation: Cisco Synful Knock Evolution) Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts.(Citation: Microsoft ICMP) However, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications. In ESXi environments, adversaries may leverage the Virtual Machine Communication Interface (VMCI) for communication between guest virtual machines and the ESXi host. This traffic is similar to client-server communications on traditional network sockets but is localized to the physical machine running the ESXi host, meaning it does not traverse external networks (routers, switches). This results in communications that are invisible to external monitoring and standard networking tools like tcpdump, netstat, nmap, and Wireshark. By adding a VMCI backdoor to a compromised ESXi host, adversaries may persistently regain access from any guest VM to the compromised ESXi host’s backdoor, regardless of network segmentation or firewall rules in place.(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023)
Query: intelligence brief on T1518.001
Matching passage: T1518.001 Security Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Example commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), <code>reg query</code> with [Reg](https://attack.mitre.org/software/S0075), <code>dir</code> with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software. Adversaries may also utilize the [Cloud API](https://attack.mitre.org/techniques/T1059/009) to discover cloud-native security software installed on compute infrastructure, such as the AWS CloudWatch agent, Azure VM Agent, and Google Cloud Monitor agent. These agents may collect metrics and logs from the VM, which may be centrally aggregated in a cloud-based monitoring platform.
Near-miss passage: T1518 Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from [Software Discovery](https://attack.mitre.org/techniques/T1518) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Such software may be deployed widely across the environment for configuration management or security reasons, such as [Software Deployment Tools](https://attack.mitre.org/techniques/T1072), and may allow adversaries broad access to infect devices or move laterally. Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable to [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).
Query: alert when An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm
Matching passage: Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / file_event. Rule: title: Anydesk Temporary Artefact id: 0b9ad457-2554-44c1-82c2-d56a99c42377 status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows author: frack113 date: 2022-02-11 modified: 2024-07-20 tags: - attack.command-and-control - attack.t1219.002 logsource: category: file_event product: windows detection: selection: TargetFilename|contains: - \AppData\Roaming\AnyDesk\user.conf - \AppData\Roaming\AnyDesk\system.conf condition: selection falsepositives: - Legitimate use level: medium regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_anydesk_artefact/info.yml
Near-miss passage: Sigma rule: Detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe. ArcSOC.exe is the. Logsource: windows / process_creation. Rule: title: Suspicious ArcSOC.exe Child Process id: 8e95e73e-ba02-4a87-b4d7-0929b8053038 status: experimental description: 'Detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe. ArcSOC.exe is the process name which hosts ArcGIS Server REST services. If an attacker compromises an ArcGIS Server system and uploads a malicious Server Object Extension (SOE), they can send crafted requests to the corresponding service endpoint and remotely execute code from the ArcSOC.exe process. ' references: - https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/ - https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm author: Micah Babinski date: 2025-11-25 tags: - attack.execution - attack.t1059 - attack.t1203 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \ArcSOC.exe Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wmic.exe - \wscript.exe filter_main_cmd: Image|endswith: \cmd.exe CommandLine: cmd.exe /c "ver" condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: describe CVE-2015-2568
Matching passage: CVE-2015-2568. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote attackers to affect availability via unknown vectors related to Server : Security : Privileges.
Near-miss passage: CVE-2015-3342. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the Ubercart Currency Conversion module before 6.x-1.2 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination query parameter.
Query: patch priority for CVE-2015-7625
Matching passage: CVE-2015-7625. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7626, CVE-2015-7627, CVE-2015-7630, CVE-2015-7633, and CVE-2015-7634.
Near-miss passage: CVE-2015-8407. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8457.
Query: patch priority for CVE-2015-0593
Matching passage: CVE-2015-0593. CWE: CWE-399. CVSS: 7.099999904632568. The Zone-Based Firewall implementation in Cisco IOS 12.4(122)T and earlier does not properly manage session-object structures, which allows remote attackers to cause a denial of service (device reload) via crafted network traffic, aka Bug ID CSCul65003.
Near-miss passage: CVE-2015-6422. CWE: CWE-399. CVSS: 4.0. The self-service application in Cisco Unified Communications Domain Manager (CUCDM) 10.6(1) allows remote authenticated users to cause a denial of service (subapplication outage) via malformed requests, aka Bug ID CSCuu10981.