alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. W
Matching passage: Sigma rule: Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. W. Logsource: windows / dns_query. Rule: title: DNS Query Request To OneLaunch Update Service id: df68f791-ad95-447f-a271-640a0dab9cf8 status: test description: 'Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. When the OneLaunch application is installed it will attempt to get updates from this domain. ' references: - https://www.malwarebytes.com/blog/detections/pup-optional-onelaunch-silentcf - https://www.myantispyware.com/2020/12/14/how-to-uninstall-onelaunch-browser-removal-guide/ - https://malware.guide/browser-hijacker/remove-onelaunch-virus/ author: Josh Nickels date: 2024-02-26 tags: - attack.credential-access - attack.collection - attack.t1056 logsource: category: dns_query product: windows detection: selection: QueryName: update.onelaunch.com Image|endswith: \OneLaunch.exe condition: selection falsepositives: - Unlikely level: low
Near-miss passage: Sigma rule: Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry. Logsource: windows / registry_set. Rule: title: Enable LM Hash Storage id: c420410f-c2d8-4010-856b-dffe21866437 related: - id: 98dedfdd-8333-49d4-9f23-d7018cccae53 type: similar status: test description: 'Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases. ' references: - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a - https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password - https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-12-15 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: System\CurrentControlSet\Control\Lsa\NoLMHash Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: high
Query: detect Detects volume shadow copy mount via Windows event log in logs
Matching passage: Sigma rule: Detects volume shadow copy mount via Windows event log. Logsource: windows / system. Rule: title: Volume Shadow Copy Mount id: f512acbf-e662-4903-843e-97ce4652b740 status: test description: Detects volume shadow copy mount via Windows event log references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-3---esentutlexe-sam-copy author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR) date: 2020-10-20 modified: 2022-12-25 tags: - attack.credential-access - attack.t1003.002 logsource: product: windows service: system detection: selection: Provider_Name: Microsoft-Windows-Ntfs EventID: 98 DeviceName|contains: HarddiskVolumeShadowCopy condition: selection falsepositives: - Legitimate use of volume shadow copy mounts (backups maybe). level: low
Near-miss passage: Sigma rule: Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting. Logsource: windows / process_creation. Rule: title: Potential Meterpreter/CobaltStrike Activity id: 15619216-e993-4721-b590-4c520615a67d status: test description: Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment - https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/ author: Teymur Kheirkhabarov, Ecco, Florian Roth date: 2019-10-26 modified: 2023-02-05 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.001 - attack.t1134.002 logsource: category: process_creation product: windows detection: selection_img: ParentImage|endswith: \services.exe selection_technique_1: CommandLine|contains|all: - /c - echo - \pipe\ CommandLine|contains: - cmd - '%COMSPEC%' selection_technique_2: CommandLine|contains|all: - rundll32 - .dll,a - '/p:' filter_defender: CommandLine|contains: MpCmdRun condition: selection_img and 1 of selection_technique_* and not 1 of filter_* falsepositives: - Commandlines containing components like cmd accidentally - Jobs and services started with cmd level: high
Query: vulnerability: SQL injection vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to execute arbitrary SQL commands via
Matching passage: CVE-2015-4062. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the where1 parameter in the nsp_search page to wp-admin/admin.php.
Near-miss passage: CVE-2015-2146. CWE: CWE-89. CVSS: 9.800000190734863. Multiple SQL injection vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to project.php, the (2) group_id parameter to group.php, the (3) status_id parameter to status.php, the (4) resolution_id parameter to resolution.php, the (5) severity_id parameter to severity.php, the (6) priority_id parameter to priority.php, the (7) os_id parameter to os.php, or the (8) site_id parameter to site.php.
Query: weakness Missing Ability to Patch ROM Code
Matching passage: CWE-1310 Missing Ability to Patch ROM Code. Missing an ability to patch ROM code may leave a System or System-on-Chip (SoC) in a vulnerable state.
Near-miss passage: CWE-1434 Insecure Setting of Generative AI/ML Model Inference Parameters. The product has a component that relies on a generative AI/ML model configured with inference parameters that produce an unacceptably high rate of erroneous or unexpected outputs.
Query: Encoded PowerShell / command-line abuse matching Disable Crypto Hardware
Matching passage: T1600.002 Disable Crypto Hardware. Tactics: defense impairment. Description: Adversaries disable a network device’s dedicated hardware encryption, which may enable them to leverage weaknesses in software encryption in order to reduce the effort involved in collecting, manipulating, and exfiltrating transmitted data. Many network devices such as routers, switches, and firewalls, perform encryption on network traffic to secure transmission across networks. Often, these devices are equipped with special, dedicated encryption hardware to greatly increase the speed of the encryption process as well as to prevent malicious tampering. When an adversary takes control of such a device, they may disable the dedicated hardware, for example, through use of [Modify System Image](https://attack.mitre.org/techniques/T1601), forcing the use of software to perform encryption on general processors. This is typically used in conjunction with attacks to weaken the strength of the cipher in software (e.g., [Reduce Key Space](https://attack.mitre.org/techniques/T1600/001)). (Citation: Cisco Blog Legacy Device Attacks)
Near-miss passage: T1600 Weaken Encryption. Tactics: defense impairment. Description: Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications.(Citation: Cisco Synful Knock Evolution) Encryption can be used to protect transmitted network traffic to maintain its confidentiality (protect against unauthorized disclosure) and integrity (protect against unauthorized changes). Encryption ciphers are used to convert a plaintext message to ciphertext and can be computationally intensive to decipher without the associated decryption key. Typically, longer keys increase the cost of cryptanalysis, or decryption without the key. Adversaries can compromise and manipulate devices that perform encryption of network traffic. For example, through behaviors such as [Modify System Image](https://attack.mitre.org/techniques/T1601), [Reduce Key Space](https://attack.mitre.org/techniques/T1600/001), and [Disable Crypto Hardware](https://attack.mitre.org/techniques/T1600/002), an adversary can negatively effect and/or eliminate a device’s ability to securely encrypt network traffic. This poses a greater risk of unauthorized disclosure and may help facilitate data manipulation, Credential Access, or Collection efforts.(Citation: Cisco Blog Legacy Device Attacks)
Query: CVE similar to CVE-2015-5581
Matching passage: CVE-2015-5581. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5570, CVE-2015-5574, CVE-2015-5584, and CVE-2015-6682.
Near-miss passage: CVE-2015-4857. CWE: UNKNOWN. CVSS: 5.5. Unspecified vulnerability in the RDBMS component in Oracle Database Server 12.1.0.1 and 12.1.0.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
Query: vulnerability: Directory traversal vulnerability in ES File Explorer 3.2.4.1.
Matching passage: CVE-2015-1876. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in ES File Explorer 3.2.4.1.
Near-miss passage: CVE-2015-2995. CWE: CWE-22. CVSS: 6.800000190734863. The RdsLogsEntry servlet in SysAid Help Desk before 15.2 does not properly check file extensions, which allows remote attackers to upload and execute arbitrary files via a NULL byte after the extension, as demonstrated by a .war%00 file.
Query: exploit Cross-site scripting (XSS) vulnerability in Cisco Unified Email Interaction Manager and Unified Web Interaction Manager 11.0(1) allows remote attackers to inject arbitrary web scri
Matching passage: CVE-2015-6416. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Cisco Unified Email Interaction Manager and Unified Web Interaction Manager 11.0(1) allows remote attackers to inject arbitrary web script or HTML a crafted URL, aka Bug ID CSCuw24479.
Near-miss passage: CVE-2015-9453. CWE: CWE-79. CVSS: 6.099999904632568. The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or othe. Logsource: windows / process_creation. Rule: title: Unusual Child Process of dns.exe id: a4e3d776-f12e-42c2-8510-9e6ed1f43ec3 status: test description: Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed) references: - https://www.elastic.co/guide/en/security/current/unusual-child-process-of-dns-exe.html author: Tim Rauch, Elastic (idea) date: 2022-09-27 modified: 2023-02-05 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \dns.exe filter: Image|endswith: \conhost.exe condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of "awk" or it's sibling commands, to invoke a shell using the system() function. This behavior is. Logsource: linux / process_creation. Rule: title: Suspicious Invocation of Shell via AWK - Linux id: 8c1a5675-cb85-452f-a298-b01b22a51856 status: test description: 'Detects the execution of "awk" or it''s sibling commands, to invoke a shell using the system() function. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation. ' references: - https://gtfobins.github.io/gtfobins/awk/#shell - https://gtfobins.github.io/gtfobins/gawk/#shell - https://gtfobins.github.io/gtfobins/nawk/#shell - https://gtfobins.github.io/gtfobins/mawk/#shell author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-09-02 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: - /awk - /gawk - /mawk - /nawk CommandLine|contains: BEGIN {system selection_cli: CommandLine|contains: - /bin/bash - /bin/dash - /bin/fish - /bin/sh - /bin/zsh condition: all of selection_* falsepositives: - Unknown level: high
Query: EDR alert: possible Vulnerability Scanning (T1595.002)
Matching passage: T1595.002 Vulnerability Scanning. Tactics: reconnaissance. Description: Adversaries may scan victims for vulnerabilities that can be used during targeting. Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit the adversary may seek to use. These scans may also include more broad attempts to [Gather Victim Host Information](https://attack.mitre.org/techniques/T1592) that can be used to identify more commonly known, exploitable vulnerabilities. Vulnerability scans typically harvest running software and version numbers via server banners, listening ports, or other network artifacts.(Citation: OWASP Vuln Scanning) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).
Near-miss passage: T1595.003 Wordlist Scanning. Tactics: reconnaissance. Description: Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques. While this technique employs similar methods to [Brute Force](https://attack.mitre.org/techniques/T1110), its goal is the identification of content and infrastructure rather than the discovery of valid credentials. Wordlists used in these scans may contain generic, commonly used names and file extensions or terms specific to a particular software. Adversaries may also create custom, target-specific wordlists using data gathered from other Reconnaissance techniques (ex: [Gather Victim Org Information](https://attack.mitre.org/techniques/T1591), or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)). For example, adversaries may use web content discovery tools such as Dirb, DirBuster, and GoBuster and generic or custom wordlists to enumerate a website’s pages and directories.(Citation: ClearSky Lebanese Cedar Jan 2021) This can help them to discover old, vulnerable pages or hidden administrative portals that could become the target of further operations (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [Brute Force](https://attack.mitre.org/techniques/T1110)). As cloud storage solutions typically use globally unique names, adversaries may also use target-specific wordlists and tools such as s3recon and GCPBucketBrute to enumerate public and private buckets on cloud infrastructure.(Citation: S3Recon GitHub)(Citation: GCPBucketBrute) Once storage objects are discovered, adversaries may leverage [Data from Cloud Storage](https://attack.mitre.org/techniques/T1530) to access valuable information that can be exfiltrated or used to escalate privileges and move laterally.
Query: Sigma rule for Detects the deletion of a prefetch file which may indicate an attempt to destroy forensic evidence
Matching passage: Sigma rule: Detects the deletion of a prefetch file which may indicate an attempt to destroy forensic evidence. Logsource: windows / file_delete. Rule: title: Prefetch File Deleted id: 0a1f9d29-6465-4776-b091-7f43b26e4c89 status: test description: Detects the deletion of a prefetch file which may indicate an attempt to destroy forensic evidence references: - Internal Research - https://www.group-ib.com/blog/hunting-for-ttps-with-prefetch-files/ author: Cedric MAURUGEON date: 2021-09-29 modified: 2024-01-25 tags: - attack.stealth - attack.t1070.004 logsource: product: windows category: file_delete detection: selection: TargetFilename|contains: :\Windows\Prefetch\ TargetFilename|endswith: .pf filter_main_svchost: Image|endswith: :\windows\system32\svchost.exe User|contains: - AUTHORI - AUTORI condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious parent process for cmd.exe. Logsource: windows / process_creation. Rule: title: Unusual Parent Process For Cmd.EXE id: 4b991083-3d0e-44ce-8fc4-b254025d8d4b status: test description: Detects suspicious parent process for cmd.exe references: - https://www.elastic.co/guide/en/security/current/unusual-parent-process-for-cmd.exe.html author: Tim Rauch, Elastic (idea) date: 2022-09-21 modified: 2023-12-05 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: Image|endswith: \cmd.exe ParentImage|endswith: - \csrss.exe - \ctfmon.exe - \dllhost.exe - \epad.exe - \FlashPlayerUpdateService.exe - \GoogleUpdate.exe - \jucheck.exe - \jusched.exe - \LogonUI.exe - \lsass.exe - \regsvr32.exe - \SearchIndexer.exe - \SearchProtocolHost.exe - \SIHClient.exe - \sihost.exe - \slui.exe - \spoolsv.exe - \sppsvc.exe - \taskhostw.exe - \unsecapp.exe - \WerFault.exe - \wermgr.exe - \wlanext.exe - \WUDFHost.exe condition: selection falsepositives: - Unknown level: medium
Query: describe CVE-2015-1207
Matching passage: CVE-2015-1207. CWE: CWE-415. CVSS: 6.5. Double-free vulnerability in libavformat/mov.c in FFMPEG in Google Chrome 41.0.2251.0 allows remote attackers to cause a denial of service (memory corruption and crash) via a crafted .m4a file.
Near-miss passage: CVE-2015-0312. CWE: CWE-415. CVSS: 9.300000190734863. Double free vulnerability in Adobe Flash Player before 13.0.0.264 and 14.x through 16.x before 16.0.0.296 on Windows and OS X and before 11.2.202.440 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Query: describe CVE-2015-3691
Matching passage: CVE-2015-3691. CWE: CWE-284. CVSS: 9.300000190734863. The Monitor Control Command Set kernel extension in the Display Drivers subsystem in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages control of a function pointer.
Near-miss passage: CVE-2015-8627. CWE: CWE-284. CVSS: 5.300000190734863. MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly normalize IP addresses containing zero-padded octets, which might allow remote attackers to bypass intended access restrictions by using an IP address that was not supposed to have been allowed.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a UAC bypass attempt. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Event Viewer Child Process id: be344333-921d-4c4d-8bb8-e584cf584780 related: - id: 7c81fec3-1c1d-43b0-996a-46753041b1b6 type: derived status: test description: Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a UAC bypass attempt references: - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ - https://www.hybrid-analysis.com/sample/e122bc8bf291f15cab182a5d2d27b8db1e7019e4e96bb5cdbd1dfe7446f3f51f?environmentId=100 author: Florian Roth (Nextron Systems) date: 2017-03-19 modified: 2023-09-28 tags: - attack.privilege-escalation - attack.t1548.002 - car.2019-04-001 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \eventvwr.exe filter_main_generic: Image|endswith: - :\Windows\System32\mmc.exe - :\Windows\System32\WerFault.exe - :\Windows\SysWOW64\WerFault.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential. Logsource: windows / ps_script. Rule: title: Create Volume Shadow Copy with Powershell id: afd12fed-b0ec-45c9-a13d-aa86625dac81 status: test description: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1&viewFallbackFrom=powershell-7 author: frack113 date: 2022-01-12 tags: - attack.credential-access - attack.t1003.003 - attack.ds0005 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Win32_ShadowCopy - ).Create( - ClientAccessible condition: selection falsepositives: - Legitimate PowerShell scripts level: high
Query: exploit AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. NOTE: This vulnerability exists due to an incomplete fix for CVE-2015-7723.
Matching passage: CVE-2015-7724. CWE: CWE-59. CVSS: 7.800000190734863. AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. NOTE: This vulnerability exists due to an incomplete fix for CVE-2015-7723.
Near-miss passage: CVE-2015-5705. CWE: CWE-59. CVSS: 7.5. Argument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to arbitrary files via a crafted symlink and crafted filename.
Query: risk of mustache package before 2.2.1 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted.
Matching passage: CVE-2015-8862. CWE: CWE-79. CVSS: 6.099999904632568. mustache package before 2.2.1 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted.
Near-miss passage: CVE-2015-7989. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted e-mail address, a different vulnerability than CVE-2015-5714.
Query: CVE similar to CVE-2015-6086
Matching passage: CVE-2015-6086. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-9001. CWE: CWE-200. CVSS: 5.5. In TrustZone an information exposure vulnerability can potentially occur in all Android releases from CAF using the Linux kernel.