alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / security
Matching passage: Sigma rule: Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz. Logsource: windows / security. Rule: title: Successful Overpass the Hash Attempt id: 192a0330-c20b-4356-90b6-7b7049ae0b87 status: test description: Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module. references: - https://web.archive.org/web/20220419045003/https://cyberwardog.blogspot.com/2017/04/chronicles-of-threat-hunter-hunting-for.html author: Roberto Rodriguez (source), Dominik Schaudel (rule) date: 2018-02-12 modified: 2021-11-27 tags: - attack.lateral-movement - attack.s0002 - attack.t1550.002 logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 9 LogonProcessName: seclogo AuthenticationPackageName: Negotiate condition: selection falsepositives: - Runas command-line tool using /netonly parameter level: high
Near-miss passage: Sigma rule: Detects the use of PSAttack PowerShell hack tool. Logsource: windows / ps_script. Rule: title: PowerShell PSAttack id: b7ec41a4-042c-4f31-a5db-d0fcde9fa5c5 status: test description: Detects the use of PSAttack PowerShell hack tool references: - https://adsecurity.org/?p=2921 author: Sean Metcalf (source), Florian Roth (Nextron Systems) date: 2017-03-05 modified: 2022-12-25 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: PS ATTACK!!! condition: selection falsepositives: - Unknown level: high
Query: vulnerability: Mozilla Firefox before 36.0 does not properly restrict transitions of JavaScript objects from a non-extensible state to an extensible state, which allows remote attackers to bypass
Matching passage: CVE-2015-0820. CWE: CWE-284. CVSS: 2.5999999046325684. Mozilla Firefox before 36.0 does not properly restrict transitions of JavaScript objects from a non-extensible state to an extensible state, which allows remote attackers to bypass a Caja Compiler sandbox protection mechanism or a Secure EcmaScript sandbox protection mechanism via a crafted web site.
Near-miss passage: CVE-2015-9243. CWE: CWE-284. CVSS: 5.900000095367432. When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like origin) would have those restrictions overridden by less restrictive defaults (e.g. origin defaults to all origins `*`).
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects a suspicious call to the user32.dll function that locks the user workstation. Logsource: windows / process_creation. Rule: title: Suspicious Workstation Locking via Rundll32 id: 3b5b0213-0460-4e3f-8937-3abf98ff7dcc status: test description: Detects a suspicious call to the user32.dll function that locks the user workstation references: - https://app.any.run/tasks/2aef9c63-f944-4763-b3ef-81eee209d128/ author: frack113 date: 2022-06-04 modified: 2023-02-09 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_call_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_call_parent: ParentImage|endswith: \cmd.exe selection_call_cli: CommandLine|contains: user32.dll, selection_function: CommandLine|contains: LockWorkStation condition: all of selection_* falsepositives: - Scripts or links on the user desktop used to lock the workstation instead of Windows+L or the menu option level: medium
Near-miss passage: Sigma rule: Detects the execution of "hh.exe" to open ".chm" files.. Logsource: windows / process_creation. Rule: title: HH.EXE Execution id: 68c8acb4-1b60-4890-8e82-3ddf7a6dba84 status: test description: Detects the execution of "hh.exe" to open ".chm" files. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.001/T1218.001.md - https://eqllib.readthedocs.io/en/latest/analytics/b25aa548-7937-11e9-8f5c-d46d6d62a49e.html - https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37 author: E.M. Anhaus (originally from Atomic Blue Detections, Dan Beavin), oscd.community date: 2019-10-24 modified: 2023-12-11 tags: - attack.stealth - attack.t1218.001 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: HH.exe - Image|endswith: \hh.exe selection_cli: CommandLine|contains: .chm condition: all of selection_* falsepositives: - False positives are expected with legitimate ".CHM" level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hh_chm_execution/info.yml
Query: describe CVE-2015-4242
Matching passage: CVE-2015-4242. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco FireSIGHT System Software 5.4.1.2 and 6.0.0 in FireSIGHT Management Center allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu94721.
Near-miss passage: CVE-2015-7610. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF token.
Query: patch priority for CVE-2015-5497
Matching passage: CVE-2015-5497. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Web Links module 6.x-2.x before 6.x-2.6 and 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-6138. CWE: CWE-79. CVSS: 4.300000190734863. Microsoft Internet Explorer 8 through 11 mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting (XSS) protection mechanism via unspecified vectors, aka "Internet Explorer XSS Filter Bypass Vulnerability."
Query: Suspicious Shared Modules execution detected on endpoint
Matching passage: T1129 Shared Modules. Tactics: execution. Description: Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., [Native API](https://attack.mitre.org/techniques/T1106)). Adversaries may use this functionality as a way to execute arbitrary payloads on a victim system. For example, adversaries can modularize functionality of their malware into shared objects that perform various functions such as managing C2 network communications or execution of specific actions on objective. The Linux & macOS module loader can load and execute shared objects from arbitrary local paths. This functionality resides in `dlfcn.h` in functions such as `dlopen` and `dlsym`. Although macOS can execute `.so` files, common practice uses `.dylib` files.(Citation: Apple Dev Dynamic Libraries)(Citation: Linux Shared Libraries)(Citation: RotaJakiro 2021 netlab360 analysis)(Citation: Unit42 OceanLotus 2017) The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in `NTDLL.dll` and is part of the Windows [Native API](https://attack.mitre.org/techniques/T1106) which is called from functions like `LoadLibrary` at run time.(Citation: Microsoft DLL)
Near-miss passage: T1674 Input Injection. Tactics: execution. Description: Adversaries may simulate keystrokes on a victim’s computer by various means to perform any type of action on behalf of the user, such as launching the command interpreter using keyboard shortcuts, typing an inline script to be executed, or interacting directly with a GUI-based application. These actions can be preprogrammed into adversary tooling or executed through physical devices such as Human Interface Devices (HIDs). For example, adversaries have used tooling that monitors the Windows message loop to detect when a user visits bank-specific URLs. If detected, the tool then simulates keystrokes to open the developer console or select the address bar, pastes malicious JavaScript from the clipboard, and executes it - enabling manipulation of content within the browser, such as replacing bank account numbers during transactions.(Citation: BleepingComputer BackSwap)(Citation: welivesecurity BackSwap) Adversaries have also used malicious USB devices to emulate keystrokes that launch PowerShell, leading to the download and execution of malware from adversary-controlled servers.(Citation: BleepingComputer USB)
Query: rule covering Detects enumeration of local network configuration
Matching passage: Sigma rule: Detects enumeration of local network configuration. Logsource: macos / process_creation. Rule: title: System Network Discovery - macOS id: 58800443-f9fc-4d55-ae0c-98a3966dfb97 status: test description: Detects enumeration of local network configuration references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md author: remotephone, oscd.community date: 2020-10-06 modified: 2024-08-29 tags: - attack.discovery - attack.t1016 logsource: product: macos category: process_creation detection: selection_1: Image|endswith: - /arp - /ifconfig - /netstat - /networksetup - /socketfilterfw selection_2: Image: /usr/bin/defaults CommandLine|contains|all: - /Library/Preferences/com.apple.alf - read filter_main_wifivelocityd: ParentImage|endswith: /wifivelocityd condition: 1 of selection_* and not 1 of filter_main_* falsepositives: - Legitimate administration activities level: informational
Near-miss passage: Sigma rule: Detects potential suspicious applet or osascript executing "osacompile".. Logsource: macos / process_creation. Rule: title: Osacompile Execution By Potentially Suspicious Applet/Osascript id: a753a6af-3126-426d-8bd0-26ebbcb92254 status: test description: Detects potential suspicious applet or osascript executing "osacompile". references: - https://redcanary.com/blog/mac-application-bundles/ author: Sohan G (D4rkCiph3r), Red Canary (Idea) date: 2023-04-03 tags: - attack.execution - attack.t1059.002 logsource: category: process_creation product: macos detection: selection: ParentImage|endswith: - /applet - /osascript CommandLine|contains: osacompile condition: selection falsepositives: - Unknown level: medium
Query: vulnerability: Resource Data Management Data Manager before 2.2 allows remote authenticated users to modify arbitrary passwords via unspecified vectors.
Matching passage: CVE-2015-6470. CWE: UNKNOWN. CVSS: 5.5. Resource Data Management Data Manager before 2.2 allows remote authenticated users to modify arbitrary passwords via unspecified vectors.
Near-miss passage: CVE-2015-0486. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 8u40 allows remote attackers to affect confidentiality via unknown vectors related to Deployment.
Query: describe CVE-2015-2490
Matching passage: CVE-2015-2490. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486, CVE-2015-2487, CVE-2015-2492, CVE-2015-2494, CVE-2015-2498, and CVE-2015-2499.
Near-miss passage: CVE-2015-1461. CWE: CWE-119. CVSS: 7.5. ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted (1) Yoda's crypter or (2) mew packer file, related to a "heap out of bounds condition."
Query: describe CVE-2015-3354
Matching passage: CVE-2015-3354. CWE: CWE-352. CVSS: 5.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Wishlist module before 6.x-2.7 and 7.x-2.x before 7.x-2.7 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that delete wishlist purchase intentions via unspecified vectors.
Near-miss passage: CVE-2015-4119. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7 allow remote attackers to hijack the authentication of (1) administrators for requests that create an administrator account via a request to admin/users_edit.php or (2) arbitrary users for requests that conduct SQL injection attacks via the server parameter to monitor/show_sys_state.php.
Query: patch priority for CVE-2015-1204
Matching passage: CVE-2015-1204. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fs[resource] parameter in the wp-slim-view-2 page to wp-admin/admin.php.
Near-miss passage: CVE-2015-4973. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in IBM Multi-Enterprise Integration Gateway 1.x through 1.0.0.1 and B2B Advanced Communications 1.0.0.2 and 1.0.0.3 before 1.0.0.3_2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Query: describe CVE-2015-8002
Matching passage: CVE-2015-8002. CWE: CWE-399. CVSS: 6.800000190734863. The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated users to cause a denial of service (disk consumption) via a file upload using one byte chunks.
Near-miss passage: CVE-2015-8877. CWE: CWE-399. CVSS: 7.5. The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function.
Query: detect Detects usage of the 'chattr' utility to remove immutable file attribute. in logs
Matching passage: Sigma rule: Detects usage of the 'chattr' utility to remove immutable file attribute.. Logsource: linux / process_creation. Rule: title: Remove Immutable File Attribute id: 34979410-e4b5-4e5d-8cfb-389fdff05c12 related: - id: a5b977d6-8a81-4475-91b9-49dbfcd941f7 type: derived status: test description: Detects usage of the 'chattr' utility to remove immutable file attribute. references: - https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-15 tags: - attack.defense-impairment - attack.t1222.002 logsource: product: linux category: process_creation detection: selection: Image|endswith: /chattr CommandLine|contains: ' -i ' condition: selection falsepositives: - Administrator interacting with immutable files (e.g. for instance backups). level: medium
Near-miss passage: Sigma rule: Detects the use of Windows Defender MpCmdRun.EXE to download files. Logsource: windows / process_creation. Rule: title: File Download Via Windows Defender MpCmpRun.EXE id: 46123129-1024-423e-9fae-43af4a0fa9a5 status: test description: Detects the use of Windows Defender MpCmdRun.EXE to download files references: - https://web.archive.org/web/20200903194959/https://twitter.com/djmtshepana/status/1301608169496612866 - https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/ author: Matthew Matchen date: 2020-09-04 modified: 2023-11-09 tags: - attack.stealth - attack.t1218 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: MpCmdRun.exe - Image|endswith: \MpCmdRun.exe - CommandLine|contains: MpCmdRun.exe - Description: Microsoft Malware Protection Command Line Utility selection_cli: CommandLine|contains|all: - DownloadFile - url condition: all of selection_* falsepositives: - Unknown level: high
Query: risk of SQL injection vulnerability in the EQ Event Calendar component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to eqfullevent.
Matching passage: CVE-2015-4654. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the EQ Event Calendar component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to eqfullevent.
Near-miss passage: CVE-2015-5148. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in LivelyCart 1.2.0 allows remote attackers to execute arbitrary SQL commands via the search_query parameter to product/search.
Query: detection rule: Detects uncommon child processes of the Add-In deployment cache updating utility (AddInutil.exe) which could be a sign o
Matching passage: Sigma rule: Detects uncommon child processes of the Add-In deployment cache updating utility (AddInutil.exe) which could be a sign o. Logsource: windows / process_creation. Rule: title: Uncommon Child Process Of AddinUtil.EXE id: b5746143-59d6-4603-8d06-acbd60e166ee status: test description: 'Detects uncommon child processes of the Add-In deployment cache updating utility (AddInutil.exe) which could be a sign of potential abuse of the binary to proxy execution via a custom Addins.Store payload. ' references: - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri) date: 2023-09-18 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \addinutil.exe filter_main_werfault: Image|endswith: - :\Windows\System32\conhost.exe - :\Windows\System32\werfault.exe - :\Windows\SysWOW64\werfault.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects Exfiltration Over Alternative Protocol - ICMP. Adversaries may steal data by exfiltrating it over an un-encrypte. Logsource: windows / ps_script. Rule: title: PowerShell ICMP Exfiltration id: 4c4af3cd-2115-479c-8193-6b8bfce9001c status: test description: Detects Exfiltration Over Alternative Protocol - ICMP. Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048.003/T1048.003.md#atomic-test-2---exfiltration-over-alternative-protocol---icmp author: Bartlomiej Czyz @bczyz1, oscd.community date: 2020-10-10 modified: 2022-12-25 tags: - attack.exfiltration - attack.t1048.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - New-Object - System.Net.NetworkInformation.Ping - .Send( condition: selection falsepositives: - Legitimate usage of System.Net.NetworkInformation.Ping class level: medium
Query: detection rule: Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts
Matching passage: Sigma rule: Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts. Logsource: ruby_on_rails / application. Rule: title: Ruby on Rails Framework Exceptions id: 0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a status: stable description: Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts references: - http://edgeguides.rubyonrails.org/security.html - http://guides.rubyonrails.org/action_controller_overview.html - https://stackoverflow.com/questions/25892194/does-rails-come-with-a-not-authorized-exception - https://github.com/rails/rails/blob/cd08e6bcc4cd8948fe01e0be1ea0c7ca60373a25/actionpack/lib/action_dispatch/middleware/exception_wrapper.rb author: Thomas Patzke date: 2017-08-06 modified: 2020-09-01 tags: - attack.initial-access - attack.t1190 logsource: category: application product: ruby_on_rails detection: keywords: - ActionController::InvalidAuthenticityToken - ActionController::InvalidCrossOriginRequest - ActionController::MethodNotAllowed - ActionController::BadRequest - ActionController::ParameterMissing condition: keywords falsepositives: - Application bugs level: medium
Near-miss passage: Sigma rule: Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.c. Logsource: zeek / http. Rule: title: Executable from Webdav id: aac2fd97-bcba-491b-ad66-a6edf89c71bf status: test description: Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/ references: - http://carnal0wnage.attackresearch.com/2012/06/webdav-server-to-download-custom.html - https://github.com/OTRF/detection-hackathon-apt29 author: SOC Prime, Adam Swan date: 2020-05-01 modified: 2021-11-27 tags: - attack.command-and-control - attack.t1105 logsource: product: zeek service: http detection: selection_webdav: - c-useragent|contains: WebDAV - c-uri|contains: webdav selection_executable: - resp_mime_types|contains: dosexec - c-uri|endswith: .exe condition: selection_webdav and selection_executable falsepositives: - Unknown level: medium