alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by chec
Matching passage: Sigma rule: The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by chec. Logsource: windows / security. Rule: title: User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess' id: 6daac7fc-77d1-449a-a71a-e6b4d59a0e54 status: test description: The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by checking that it has the SeTcbPrivilege privilege set. Possible Rubeus tries to get a handle to LSA. references: - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1 author: Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community date: 2019-10-24 modified: 2022-12-25 tags: - attack.credential-access - attack.lateral-movement - attack.privilege-escalation - attack.t1558.003 logsource: product: windows service: security detection: selection: EventID: 4673 Service: LsaRegisterLogonProcess() Keywords: '0x8010000000000000' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class. Logsource: windows / image_load. Rule: title: Potential DCOM InternetExplorer.Application DLL Hijack - Image Load id: f354eba5-623b-450f-b073-0b5b2773b6aa related: - id: e554f142-5cf3-4e55-ace9-a1b59e0def65 type: obsolete - id: 2f7979ae-f82b-45af-ac1d-2b10e93b0baa type: similar status: test description: Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class references: - https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), wagga date: 2020-10-12 modified: 2022-12-18 tags: - attack.lateral-movement - attack.t1021.002 - attack.t1021.003 logsource: product: windows category: image_load detection: selection: Image|endswith: \Internet Explorer\iexplore.exe ImageLoaded|endswith: \Internet Explorer\iertutil.dll condition: selection falsepositives: - Unknown level: critical
Query: common weakness: Improper Handling of Unexpected Data Type
Matching passage: CWE-241 Improper Handling of Unexpected Data Type. The product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (A-Z).
Near-miss passage: CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag. The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
Query: rule covering Detects when Kubernetes Secrets are Modified or Deleted.
Matching passage: Sigma rule: Detects when Kubernetes Secrets are Modified or Deleted.. Logsource: kubernetes / audit. Rule: title: Kubernetes Secrets Modified or Deleted id: 58d31a75-a4f8-4c40-985b-373d58162ca2 related: - id: 2f0bae2d-bf20-4465-be86-1311addebaa3 type: similar status: test description: 'Detects when Kubernetes Secrets are Modified or Deleted. ' references: - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/ - https://commandk.dev/blog/guide-to-audit-k8s-secrets-for-compliance/ author: kelnage date: 2024-07-11 tags: - attack.credential-access logsource: product: kubernetes service: audit detection: selection: objectRef.resource: secrets verb: - create - delete - patch - replace - update condition: selection falsepositives: - Secrets being modified or deleted may be performed by a system administrator. - Automated processes may need to take these actions and may need to be filtered. level: medium
Near-miss passage: Sigma rule: Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection ch. Logsource: windows / process_creation. Rule: title: Suspicious PowerShell Encoded Command Patterns id: b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c status: test description: Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains references: - https://app.any.run/tasks/b9040c63-c140-479b-ad59-f1bb56ce7a97/ author: Florian Roth (Nextron Systems) date: 2022-05-24 modified: 2023-01-05 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.Exe - pwsh.dll selection_flags: CommandLine|contains: - ' -e ' - ' -en ' - ' -enc ' - ' -enco' selection_encoded: CommandLine|contains: - ' JAB' - ' SUVYI' - ' SQBFAFgA' - ' aWV4I' - ' IAB' - ' PAA' - ' aQBlAHgA' filter_gcworker: ParentImage|contains: - C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\ - \gc_worker.exe condition: all of selection_* and not 1 of filter_* falsepositives: - Other tools that work with encoded scripts in the command line instead of script files level: high
Query: describe CVE-2015-9179
Matching passage: CVE-2015-9179. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MSM8974, lack of length checking in OEMCrypto_DeriveKeysFromSessionKey() could lead to a buffer overflow vulnerability.
Near-miss passage: CVE-2015-7673. CWE: CWE-119. CVSS: 6.800000190734863. io-tga.c in gdk-pixbuf before 2.32.0 uses heap memory after its allocation failed, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) and possibly execute arbitrary code via a crafted Truevision TGA (TARGA) file.
Query: risk of bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (infinite loop) via an ISO with a directory that is a member of itself.
Matching passage: CVE-2015-8930. CWE: CWE-20. CVSS: 7.5. bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (infinite loop) via an ISO with a directory that is a member of itself.
Near-miss passage: CVE-2015-7094. CWE: CWE-20. CVSS: 2.5999999046325684. CFNetwork HTTPProtocol in Apple iOS before 9.2 and OS X before 10.11.2 allows man-in-the-middle attackers to bypass the HSTS protection mechanism via a crafted URL.
Query: risk of Cross-site scripting (XSS) vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authenticated users with permission to create or edit a stickynote to 
Matching passage: CVE-2015-7879. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authenticated users with permission to create or edit a stickynote to inject arbitrary web script or HTML via note text on the admin listing page.
Near-miss passage: CVE-2015-6037. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in Microsoft Excel Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps 2010 SP2, Excel Web App 2010 SP2, Office Web Apps Server 2013 SP1, and SharePoint Foundation 2013 SP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka "Microsoft Office Web Apps XSS Spoofing Vulnerability."
Query: risk of The Podcasts component in Apple iOS before 8.3 and Apple TV before 7.2 allows remote attackers to discover unique identifiers by reading asset-download request data.
Matching passage: CVE-2015-1110. CWE: CWE-200. CVSS: 5.0. The Podcasts component in Apple iOS before 8.3 and Apple TV before 7.2 allows remote attackers to discover unique identifiers by reading asset-download request data.
Near-miss passage: CVE-2015-7926. CWE: CWE-200. CVSS: 9.899999618530273. eWON devices with firmware before 10.1s0 omit RBAC for I/O server information and status requests, which allows remote attackers to obtain sensitive information via an unspecified URL.
Query: secure coding against Improper Handling of Insufficient Permissions or Privileges
Matching passage: CWE-280 Improper Handling of Insufficient Permissions or Privileges. The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.
Near-miss passage: CWE-302 Authentication Bypass by Assumed-Immutable Data. The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
Query: CVE similar to CVE-2015-0284
Matching passage: CVE-2015-0284. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7811.
Near-miss passage: CVE-2015-7775. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-1197.
Query: risk of The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM
Matching passage: CVE-2015-8615. CWE: CWE-254. CVSS: 5.0. The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ).
Near-miss passage: CVE-2015-7044. CWE: CWE-254. CVSS: 7.599999904632568. The System Integrity Protection feature in Apple OS X before 10.11.2 mishandles union mounts, which allows attackers to execute arbitrary code in a privileged context via a crafted app with root privileges.
Query: describe CVE-2015-2513
Matching passage: CVE-2015-2513. CWE: CWE-20. CVSS: 9.300000190734863. Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted .jnt file, aka "Windows Journal RCE Vulnerability," a different vulnerability than CVE-2015-2514 and CVE-2015-2530.
Near-miss passage: CVE-2015-9052. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached while processing a downlink message.
Query: incident response steps for EDR alert: possible Unused/Unsupported Cloud Regions (T1535)
Matching passage: Playbook for T1535 Unused/Unsupported Cloud Regions. 1) Validate alert telemetry against T1535. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure. Cloud service providers often provide infrastructure throughout the world in order to improve performance, provide redundancy, and allow customers to meet compliance requirements. Oftentimes, a custome
Near-miss passage: Playbook for T1218 System Binary Proxy Execution. Different response path focused on stealth.
Query: patch priority for CVE-2015-6248
Matching passage: CVE-2015-6248. CWE: CWE-20. CVSS: 4.300000190734863. The ptvcursor_add function in the ptvcursor implementation in epan/proto.c in Wireshark 1.12.x before 1.12.7 does not check whether the expected amount of data is available, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Near-miss passage: CVE-2015-6546. CWE: CWE-20. CVSS: 6.099999904632568. The vCMP host in F5 BIG-IP Analytics, APM, ASM, GTM, Link Controller, and LTM 11.0.0 before 11.6.0, BIG-IP AAM 11.4.0 before 11.6.0, BIG-IP AFM and PEM 11.3.0 before 11.6.0, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.0.0 through 11.3.0, BIG-IP PSM 11.0.0 through 11.4.1 allows remote attackers to cause a denial of service via "malicious traffic."
Query: CVE similar to CVE-2015-2704
Matching passage: CVE-2015-2704. CWE: CWE-74. CVSS: 5.0. realmd allows remote attackers to inject arbitrary configurations in to sssd.conf and smb.conf via a newline character in an LDAP response.
Near-miss passage: CVE-2015-4075. CWE: CWE-74. CVSS: 8.100000381469727. The Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to write to arbitrary .ini files via a crafted language.save task.
Query: exploit Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote a
Matching passage: CVE-2015-3884. CWE: CWE-434. CVSS: 8.800000190734863. Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/attachments/ or uploads/users/.
Near-miss passage: CVE-2015-0796. CWE: CWE-434. CVSS: 7.800000190734863. In open buildservice 2.6 before 2.6.3, 2.5 before 2.5.7 and 2.4 before 2.4.8 the source service patch application could generate non-standard files like symlinks or device nodes, which could allow buildservice users to break of confinement or cause denial of service attacks on the source service.
Query: exploit Cybozu Garoon 3.x and 4.x before 4.2.0 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail messa
Matching passage: CVE-2015-7776. CWE: CWE-200. CVSS: 4.300000190734863. Cybozu Garoon 3.x and 4.x before 4.2.0 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail message, a different vulnerability than CVE-2016-1196.
Near-miss passage: CVE-2015-2855. CWE: CWE-200. CVSS: 4.300000190734863. The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not set the secure flag for the administrator's cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, a different vulnerability than CVE-2015-4138.
Query: detect Modify Registry
Matching passage: T1112 Modify Registry. Tactics: defense impairment, persistence. Description: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution. Access to specific areas of the Registry depends on account permissions, with some keys requiring administrator-level access. The built-in Windows command-line utility [Reg](https://attack.mitre.org/software/S0075) may be used for local or remote Registry modification.(Citation: Microsoft Reg) Other tools, such as remote access tools, may also contain functionality to interact with the Registry through the Windows API. The Registry may be modified in order to hide configuration information or malicious payloads via [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027).(Citation: Unit42 BabyShark Feb 2019)(Citation: Avaddon Ransomware 2021)(Citation: Microsoft BlackCat Jun 2022)(Citation: CISA Russian Gov Critical Infra 2018) The Registry may also be modified to impair defenses, such as by enabling macros for all Microsoft Office products, allowing privilege escalation without alerting the user, increasing the maximum number of allowed outbound requests, and/or modifying systems to store plaintext credentials in memory.(Citation: CISA LockBit 2023)(Citation: Unit42 BabyShark Feb 2019) The Registry of a remote system may be modified to aid in execution of files as part of lateral movement. It requires the remote Registry service to be running on the target system.(Citation: Microsoft Remote) Often [Valid Accounts](https://attack.mitre.org/techniques/T1078) are required, along with access to the remote system's [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) for RPC communication. Finally, Registry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via [Reg](https://attack.mitre.org/software/S0075) or other utilities using the Win32 API.(Citation: Microsoft Reghide NOV 2
Near-miss passage: T1137.005 Outlook Rules. Tactics: persistence. Description: Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system. Outlook rules allow a user to define automated behavior to manage email messages. A benign rule might, for example, automatically move an email to a particular folder in Outlook if it contains specific words from a specific sender. Malicious Outlook rules can be created that can trigger code execution when an adversary sends a specifically crafted email to that user.(Citation: SilentBreak Outlook Rules) Once malicious rules have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious rules will execute when an adversary sends a specifically crafted email to the user.(Citation: SilentBreak Outlook Rules)
Query: SIEM correlation: stealth activity consistent with Local Accounts
Matching passage: T1078.003 Local Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. Local Accounts may also be abused to elevate privileges and harvest credentials through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement.
Near-miss passage: T1078.002 Domain Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.(Citation: TechNet Credential Theft) Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.(Citation: Microsoft AD Accounts) Adversaries may compromise domain accounts, some with a high level of privileges, through various means such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or password reuse, allowing access to privileged resources of the domain.
Query: Sigma rule for Remove SD (Security Descriptor) value in \Schedule\TaskCache\Tree registry hive to hide schedule task. This technique is
Matching passage: Sigma rule: Remove SD (Security Descriptor) value in \Schedule\TaskCache\Tree registry hive to hide schedule task. This technique is. Logsource: windows / registry_delete. Rule: title: Removal Of SD Value to Hide Schedule Task - Registry id: acd74772-5f88-45c7-956b-6a7b36c294d2 related: - id: 526cc8bc-1cdc-48ad-8b26-f19bff969cec type: similar status: test description: Remove SD (Security Descriptor) value in \Schedule\TaskCache\Tree registry hive to hide schedule task. This technique is used by Tarrask malware references: - https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/ author: Sittikorn S date: 2022-04-15 modified: 2025-10-25 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_delete detection: selection: TargetObject|contains|all: - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ - SD condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_sd_value_removal/info.yml
Near-miss passage: Sigma rule: Detect Attempt PrintNightmare (CVE-2021-1675) Remote code execution in Windows Spooler Service. Logsource: windows / smbclient-security. Rule: title: Suspicious Rejected SMB Guest Logon From IP id: 71886b70-d7b4-4dbf-acce-87d2ca135262 status: test description: Detect Attempt PrintNightmare (CVE-2021-1675) Remote code execution in Windows Spooler Service references: - https://twitter.com/KevTheHermit/status/1410203844064301056 - https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/ - https://web.archive.org/web/20210701042336/https://github.com/afwu/PrintNightmare author: Florian Roth (Nextron Systems), KevTheHermit, fuzzyf10w date: 2021-06-30 modified: 2023-01-02 tags: - attack.credential-access - attack.t1110.001 logsource: product: windows service: smbclient-security detection: selection: EventID: 31017 UserName: '' ServerName|startswith: \1 condition: selection falsepositives: - Account fallback reasons (after failed login with specific account) level: medium
Query: detect Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of a in logs
Matching passage: Sigma rule: Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of a. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting id: 396ae3eb-4174-4b9b-880e-dc0364d78a19 status: test description: Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module references: - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53 - https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/ author: Nasreddine Bencherchali (Nextron Systems) date: 2021-04-05 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.command-and-control - attack.t1137 - attack.t1008 - attack.t1546 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Outlook\LoadMacroProviderOnBoot Details|contains: '0x00000001' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential DLL sideloading using the Microsoft Office winword process via the '/l' flag.. Logsource: windows / process_creation. Rule: title: Potential Arbitrary DLL Load Using Winword id: f7375e28-5c14-432f-b8d1-1db26c832df3 related: - id: 2621b3a6-3840-4810-ac14-a02426086171 type: obsolete status: test description: Detects potential DLL sideloading using the Microsoft Office winword process via the '/l' flag. references: - https://github.com/D4Vinci/One-Lin3r/blob/9fdfa5f0b9c698dfbd4cdfe7d2473192777ae1c6/one_lin3r/core/liners/windows/cmd/dll_loader_word.py author: Victor Sergeev, oscd.community date: 2020-10-09 modified: 2023-03-29 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WINWORD.exe - OriginalFileName: WinWord.exe selection_dll: CommandLine|contains|all: - '/l ' - .dll condition: all of selection_* falsepositives: - Unknown level: medium