alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: persistence using IDE Extensions
Matching passage: T1176.002 IDE Extensions. Tactics: persistence. Description: Adversaries may abuse an integrated development environment (IDE) extension to establish persistent access to victim systems.(Citation: Mnemonic misuse visual studio) IDEs such as Visual Studio Code, IntelliJ IDEA, and Eclipse support extensions - software components that add features like code linting, auto-completion, task automation, or integration with tools like Git and Docker. A malicious extension can be installed through an extension marketplace (i.e., [Compromise Software Dependencies and Development Tools](https://attack.mitre.org/techniques/T1195/001)) or side-loaded directly into the IDE.(Citation: Abramovsky VSCode Security)(Citation: Lakshmanan Visual Studio Marketplace) In addition to installing malicious extensions, adversaries may also leverage benign ones. For example, adversaries may establish persistent SSH tunnels via the use of the VSCode Remote SSH extension (i.e., [IDE Tunneling](https://attack.mitre.org/techniques/T1219/001)). Trust is typically established through the installation process; once installed, the malicious extension is run every time that the IDE is launched. The extension can then be used to execute arbitrary code, establish a backdoor, mine cryptocurrency, or exfiltrate data.(Citation: ExtensionTotal VSCode Extensions 2025)
Near-miss passage: T1176 Software Extensions. Tactics: persistence. Description: Adversaries may abuse software extensions to establish persistent access to victim systems. Software extensions are modular components that enhance or customize the functionality of software applications, including web browsers, Integrated Development Environments (IDEs), and other platforms.(Citation: Chrome Extension C2 Malware)(Citation: Abramovsky VSCode Security) Extensions are typically installed via official marketplaces, app stores, or manually loaded by users, and they often inherit the permissions and access levels of the host application. Malicious extensions can be introduced through various methods, including social engineering, compromised marketplaces, or direct installation by users or by adversaries who have already gained access to a system. Malicious extensions can be named similarly or identically to benign extensions in marketplaces. Security mechanisms in extension marketplaces may be insufficient to detect malicious components, allowing adversaries to bypass automated scanners or exploit trust established during the installation process. Adversaries may also abuse benign extensions to achieve their objectives, such as using legitimate functionality to tunnel data or bypass security controls. The modular nature of extensions and their integration with host applications make them an attractive target for adversaries seeking to exploit trusted software ecosystems. Detection can be challenging due to the inherent trust placed in extensions during installation and their ability to blend into normal application workflows.
Query: CVE similar to CVE-2015-8817
Matching passage: CVE-2015-8817. CWE: CWE-125. CVSS: 5.5. QEMU (aka Quick Emulator) built to use 'address_space_translate' to map an address to a MemoryRegionSection is vulnerable to an OOB r/w access issue. It could occur while doing pci_dma_read/write calls. Affects QEMU versions >= 1.6.0 and <= 2.3.1. A privileged user inside guest could use this flaw to crash the guest instance resulting in DoS.
Near-miss passage: CVE-2015-8897. CWE: CWE-125. CVSS: 5.5. The SpliceImage function in MagickCore/transform.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (application crash) via a crafted png file.
Query: write Sigma for Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".
Matching passage: Sigma rule: Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".. Logsource: windows / process_creation. Rule: title: Potential Arbitrary Command Execution Via FTP.EXE id: 06b401f4-107c-4ff9-947f-9ec1e7649f1e status: test description: Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe". references: - https://lolbas-project.github.io/lolbas/Binaries/Ftp/ author: Victor Sergeev, oscd.community date: 2020-10-09 modified: 2024-04-23 tags: - attack.execution - attack.stealth - attack.t1059 - attack.t1202 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \ftp.exe selection_child_img: - Image|endswith: \ftp.exe - OriginalFileName: ftp.exe selection_child_cli: CommandLine|contains|windash: '-s:' condition: selection_parent or all of selection_child_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the removal or uninstallation of an application via "Wmic.EXE".. Logsource: windows / process_creation. Rule: title: Application Removed Via Wmic.EXE id: b53317a0-8acf-4fd1-8de8-a5401e776b96 related: - id: 847d5ff3-8a31-4737-a970-aeae8fe21765 type: derived status: test description: Detects the removal or uninstallation of an application via "Wmic.EXE". references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md#atomic-test-10---application-uninstall-using-wmic author: frack113 date: 2022-01-28 modified: 2024-07-02 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WMIC.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains|all: - call - uninstall condition: all of selection_* falsepositives: - Unknown level: medium simulation: - type: atomic-red-team name: Application uninstall using WMIC technique: T1047 atomic_guid: c510d25b-1667-467d-8331-a56d3e9bc4ff regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_uninstall_application/info.yml
Query: vulnerability: The Reader View implementation in Mozilla Firefox before 42.0 has an improper whitelist, which makes it easier for remote attackers to bypass the Content Security Policy (CSP) prot
Matching passage: CVE-2015-4518. CWE: CWE-79. CVSS: 4.300000190734863. The Reader View implementation in Mozilla Firefox before 42.0 has an improper whitelist, which makes it easier for remote attackers to bypass the Content Security Policy (CSP) protection mechanism and conduct cross-site scripting (XSS) attacks via vectors involving SVG animations and the about:reader URL.
Near-miss passage: CVE-2015-6356. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the WeChat page in Cisco Social Miner 10.0(1) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuw60212.
Query: Suspicious Application Layer Protocol execution detected on endpoint
Matching passage: T1071 Application Layer Protocol. Tactics: command and control. Description: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.(Citation: Mandiant APT29 Eye Spy Email Nov 22)
Near-miss passage: T1071.003 Mail Protocols. Tactics: command and control. Description: Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as SMTP/S, POP3/S, and IMAP that carry electronic mail may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the email messages themselves. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: FireEye APT28)
Query: vulnerability: Cross-site request forgery (CSRF) vulnerability in Advantech WebAccess before 8.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Matching passage: CVE-2015-3946. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in Advantech WebAccess before 8.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Near-miss passage: CVE-2015-6376. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco TelePresence Video Communication Server (VCS) X8.5.1 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuv72412.
Query: describe CVE-2015-0802
Matching passage: CVE-2015-0802. CWE: CWE-264. CVSS: 5.0. Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of a privileged window with an unintended persistence of access to restricted internal methods.
Near-miss passage: CVE-2015-4232. CWE: CWE-264. CVSS: 4.599999904632568. Cisco NX-OS 6.2(10) on Nexus and MDS 9000 devices allows local users to execute arbitrary OS commands by entering crafted tar parameters in the CLI, aka Bug ID CSCus44856.
Query: patch priority for CVE-2015-8594
Matching passage: CVE-2015-8594. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in RFA-1x.
Near-miss passage: CVE-2015-8386. CWE: CWE-119. CVSS: 9.800000190734863. PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Query: Sigma rule for Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to
Matching passage: Sigma rule: Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to. Logsource: windows / process_creation. Rule: title: LSASS Dump Keyword In CommandLine id: ffa6861c-4461-4f59-8a41-578c39f3f23e related: - id: a5a2d357-1ab8-4675-a967-ef9990a59391 type: derived status: test description: 'Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process. ' references: - https://github.com/Hackndo/lsassy - https://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/credential_access_lsass_memdump_file_created.toml - https://www.whiteoaksecurity.com/blog/attacks-defenses-dumping-lsass-no-mimikatz/ - https://github.com/helpsystems/nanodump - https://github.com/CCob/MirrorDump author: E.M. Anhaus, Tony Lambert, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2019-10-24 modified: 2023-08-29 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: - CommandLine|contains: - lsass.dmp - lsass.zip - lsass.rar - Andrew.dmp - Coredump.dmp - NotLSASS.zip - lsass_2 - lsassdump - lsassdmp - CommandLine|contains|all: - lsass - .dmp - CommandLine|contains|all: - SQLDmpr - .mdmp - CommandLine|contains|all: - nanodump - .dmp condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for b. Logsource: windows / process_creation. Rule: title: Potential UAC Bypass Via Sdclt.EXE id: 40f9af16-589d-4984-b78d-8c2aec023197 status: test description: A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques. references: - https://github.com/OTRF/detection-hackathon-apt29/issues/6 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.B.2_C36B49B5-DF58-4A34-9FE9-56189B9DEFEA.md author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: Image|endswith: sdclt.exe IntegrityLevel: - High - S-1-16-12288 condition: selection falsepositives: - Unknown level: medium
Query: vulnerability: GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows remote attackers to cause a denial of ser
Matching passage: CVE-2015-0797. CWE: UNKNOWN. CVSS: 6.800000190734863. GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows remote attackers to cause a denial of service (buffer over-read and application crash) or possibly execute arbitrary code via crafted H.264 video data in an m4v file.
Near-miss passage: CVE-2015-6662. CWE: UNKNOWN. CVSS: 6.800000190734863. XML external entity (XXE) vulnerability in SAP NetWeaver Portal 7.4 allows remote attackers to read arbitrary files and possibly have other unspecified impact via crafted XML data, aka SAP Security Note 2168485.
Query: exploit Multiple unspecified vulnerabilities in Google V8 before 4.1.0.21, as used in Google Chrome before 41.0.2272.76, allow attackers to cause a denial of service or possibly have other
Matching passage: CVE-2015-2238. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google V8 before 4.1.0.21, as used in Google Chrome before 41.0.2272.76, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Near-miss passage: CVE-2015-4952. CWE: UNKNOWN. CVSS: 8.800000190734863. The on-demand plugin in IBM Endpoint Manager for Remote Control 9.0.1 and 9.1.0 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors. IBM X-Force ID: 105196.
Query: alert when Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a netw
Matching passage: Sigma rule: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a netw. Logsource: windows / process_creation. Rule: title: Suspicious Scan Loop Network id: f8ad2e2c-40b6-4117-84d7-20b89896ab23 status: test description: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md - https://ss64.com/nt/for.html - https://ss64.com/ps/foreach-object.html author: frack113 date: 2022-03-12 tags: - attack.execution - attack.t1059 - attack.discovery - attack.t1018 logsource: category: process_creation product: windows detection: selection_loop: CommandLine|contains: - 'for ' - 'foreach ' selection_tools: CommandLine|contains: - nslookup - ping condition: all of selection_* falsepositives: - Legitimate script level: medium
Near-miss passage: Sigma rule: Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build. Logsource: windows / process_creation. Rule: title: Curl Download And Execute Combination id: 21dd6d38-2b18-4453-9404-a0fe4a0cc288 status: test description: Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later. references: - https://medium.com/@reegun/curl-exe-is-the-new-rundll32-exe-lolbin-3f79c5f35983 author: Sreeman, Nasreddine Bencherchali (Nextron Systems) date: 2020-01-13 modified: 2024-03-05 tags: - attack.stealth - attack.t1218 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|windash: ' -c ' CommandLine|contains|all: - 'curl ' - http - -o - '&' condition: selection falsepositives: - Unknown level: high
Query: weakness Double-Checked Locking
Matching passage: CWE-609 Double-Checked Locking. The product uses double-checked locking to access a resource without the overhead of explicit synchronization, but the locking is insufficient.
Near-miss passage: CWE-328 Use of Weak Hash. The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).
Query: alert when Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p.
Matching passage: Sigma rule: Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p.. Logsource: windows / process_creation. Rule: title: DLL Execution via Rasautou.exe id: cd3d1298-eb3b-476c-ac67-12847de55813 status: test description: Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p. references: - https://lolbas-project.github.io/lolbas/Binaries/Rasautou/ - https://github.com/fireeye/DueDLLigence - https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html author: Julia Fomina, oscd.community date: 2020-10-09 tags: - attack.stealth - attack.t1218 logsource: product: windows category: process_creation definition: Since options '-d' and '-p' were removed in Windows 10 this rule is relevant only for Windows before 10. And as Windows 7 doesn't log command line in 4688 by default, to detect this attack you need Sysmon 1 configured or KB3004375 installed for command-line auditing (https://support.microsoft.com/en-au/help/3004375/microsoft-security-advisory-update-to-improve-windows-command-line-aud) detection: selection_img: - Image|endswith: \rasautou.exe - OriginalFileName: rasdlui.exe selection_cli: CommandLine|contains|all: - ' -d ' - ' -p ' condition: all of selection* falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Detects WerFault creating a dump file with a name that indicates that the dump file could be an LSASS process memory, wh. Logsource: windows / file_event. Rule: title: WerFault LSASS Process Memory Dump id: c3e76af5-4ce0-4a14-9c9a-25ceb8fda182 status: test description: Detects WerFault creating a dump file with a name that indicates that the dump file could be an LSASS process memory, which contains user credentials references: - https://github.com/helpsystems/nanodump author: Florian Roth (Nextron Systems) date: 2022-06-27 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: file_event detection: selection: Image: C:\WINDOWS\system32\WerFault.exe TargetFilename|contains: - \lsass - lsass.exe condition: selection falsepositives: - Unknown level: high
Query: exploit The virtual filesystem in ownCloud Server before 6.0.9, 7.0.x before 7.0.7, and 8.0.x before 8.0.5 does not consider that NULL is a valid getPath return value, which allows remote 
Matching passage: CVE-2015-5954. CWE: UNKNOWN. CVSS: 4.0. The virtual filesystem in ownCloud Server before 6.0.9, 7.0.x before 7.0.7, and 8.0.x before 8.0.5 does not consider that NULL is a valid getPath return value, which allows remote authenticated users to bypass intended access restrictions and gain access to users files via a sharing link to a file with a deleted parent folder.
Near-miss passage: CVE-2015-0412. CWE: UNKNOWN. CVSS: 7.199999809265137. Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Download and compress a remote file and store it in a cab file on local machine.. Logsource: windows / process_creation. Rule: title: Suspicious Diantz Download and Compress Into a CAB File id: 185d7418-f250-42d0-b72e-0c8b70661e93 status: test description: Download and compress a remote file and store it in a cab file on local machine. references: - https://lolbas-project.github.io/lolbas/Binaries/Diantz/ author: frack113 date: 2021-11-26 modified: 2022-08-13 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - diantz.exe - ' \\\\' - .cab condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operati. Logsource: windows / file_delete. Rule: title: Backup Files Deleted id: 06125661-3814-4e03-bfa2-1e4411c60ac3 status: test description: Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-6---windows---delete-backup-files author: frack113 date: 2022-01-02 modified: 2023-02-15 tags: - attack.impact - attack.t1490 logsource: product: windows category: file_delete detection: selection: Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - \wt.exe - \rundll32.exe - \regsvr32.exe TargetFilename|endswith: - .VHD - .bac - .bak - .wbcat - .bkf - .set - .win - .dsk condition: selection falsepositives: - Legitimate usage level: medium