alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects the use of CoercedPotato, a tool for privilege escalation
Matching passage: Sigma rule: Detects the use of CoercedPotato, a tool for privilege escalation. Logsource: windows / process_creation. Rule: title: HackTool - CoercedPotato Execution id: e8d34729-86a4-4140-adfd-0a29c2106307 status: test description: Detects the use of CoercedPotato, a tool for privilege escalation references: - https://github.com/hackvens/CoercedPotato - https://blog.hackvens.fr/articles/CoercedPotato.html author: Florian Roth (Nextron Systems) date: 2023-10-11 modified: 2024-11-23 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: category: process_creation product: windows detection: selection_loader_img: Image|endswith: \CoercedPotato.exe selection_params: CommandLine|contains: ' --exploitId ' selection_loader_imphash: Hashes|contains: - IMPHASH=A75D7669DB6B2E107A44C4057FF7F7D6 - IMPHASH=F91624350E2C678C5DCBE5E1F24E22C9 - IMPHASH=14C81850A079A87E83D50CA41C709A15 condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of the 'Pubprn.vbs' Microsoft signed script to execute commands.. Logsource: windows / process_creation. Rule: title: Pubprn.vbs Proxy Execution id: 1fb76ab8-fa60-4b01-bddd-71e89bf555da status: test description: Detects the use of the 'Pubprn.vbs' Microsoft signed script to execute commands. references: - https://lolbas-project.github.io/lolbas/Scripts/Pubprn/ author: frack113 date: 2022-05-28 tags: - attack.stealth - attack.t1216.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - \pubprn.vbs - 'script:' condition: selection falsepositives: - Unknown level: medium
Query: risk of OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of serv
Matching passage: CVE-2015-5286. CWE: CWE-264. CVSS: 6.800000190734863. OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.
Near-miss passage: CVE-2015-2480. CWE: CWE-264. CVSS: 9.300000190734863. The RyuJIT compiler in Microsoft .NET Framework 4.6 produces incorrect code during an attempt at optimization, which allows remote attackers to execute arbitrary code via a crafted .NET application, aka "RyuJIT Optimization Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2479 and CVE-2015-2481.
Query: patch priority for CVE-2015-4816
Matching passage: CVE-2015-4816. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.
Near-miss passage: CVE-2015-4827. CWE: UNKNOWN. CVSS: 6.400000095367432. Unspecified vulnerability in the Oracle Retail Open Commerce Platform component in Oracle Retail Applications 3.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Framework.
Query: detect Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more in logs
Matching passage: Sigma rule: Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more. Logsource: windows / process_creation. Rule: title: Registry Modification Via Regini.EXE id: 5f60740a-f57b-4e76-82a1-15b6ff2cb134 related: - id: 77946e79-97f1-45a2-84b4-f37b5c0d8682 type: derived status: test description: Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more text files. references: - https://lolbas-project.github.io/lolbas/Binaries/Regini/ - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regini author: Eli Salem, Sander Wiebing, oscd.community date: 2020-10-08 modified: 2023-02-08 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \regini.exe - OriginalFileName: REGINI.EXE filter: CommandLine|re: :[^ \\] condition: selection and not filter falsepositives: - Legitimate modification of keys level: low
Near-miss passage: Sigma rule: Detects Obfuscated use of Clip.exe to execute PowerShell. Logsource: windows / system. Rule: title: Invoke-Obfuscation CLIP+ Launcher - System id: f7385ee2-0e0c-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of Clip.exe to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-13 modified: 2023-02-20 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains|all: - cmd - '&&' - 'clipboard]::' condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-4470
Matching passage: CVE-2015-4470. CWE: CWE-189. CVSS: 4.300000190734863. Off-by-one error in the inflate function in mszipd.c in libmspack before 0.5 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted CAB archive.
Near-miss passage: CVE-2015-7222. CWE: CWE-189. CVSS: 6.800000190734863. Integer underflow in the Metadata::setData function in MetaData.cpp in libstagefright in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect memory allocation and application crash) via an MP4 video file with crafted covr metadata that triggers a buffer overflow.
Query: vulnerability: The CFNetwork HTTPProtocol component in Apple iOS before 9 mishandles HSTS state, which allows remote attackers to bypass the Safari private-browsing protection mechanism and track
Matching passage: CVE-2015-5860. CWE: CWE-200. CVSS: 5.0. The CFNetwork HTTPProtocol component in Apple iOS before 9 mishandles HSTS state, which allows remote attackers to bypass the Safari private-browsing protection mechanism and track users via a crafted web site.
Near-miss passage: CVE-2015-3058. CWE: CWE-200. CVSS: 5.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to obtain sensitive information from process memory via unspecified vectors.
Query: explain CWE-574
Matching passage: CWE-574 EJB Bad Practices: Use of Synchronization Primitives. The product violates the Enterprise JavaBeans (EJB) specification by using thread synchronization primitives.
Near-miss passage: CWE-833 Deadlock. The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.
Query: SOC runbook when seeing Encoded PowerShell / command-line abuse matching GUI Input Capture
Matching passage: Playbook for T1056.002 GUI Input Capture. 1) Validate alert telemetry against T1056.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: collection, credential access. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](h
Near-miss passage: Playbook for T1056 Input Capture. Different response path focused on collection, credential access.
Query: secure coding against Improper Protection of Physical Side Channels
Matching passage: CWE-1300 Improper Protection of Physical Side Channels. The device does not contain sufficient protection mechanisms to prevent physical side channels from exposing sensitive information due to patterns in physically observable phenomena such as variations in power consumption, electromagnetic emissions (EME), or acoustic emissions.
Near-miss passage: CWE-1239 Improper Zeroization of Hardware Register. The hardware product does not properly clear sensitive information from built-in registers when the user of the hardware block changes.
Query: vulnerability: Untrusted search path vulnerability in python.exe in Python through 3.5.0 on Windows allows local users to gain privileges via a Trojan horse readline.pyd file in the current worki
Matching passage: CVE-2015-5652. CWE: UNKNOWN. CVSS: 7.199999809265137. Untrusted search path vulnerability in python.exe in Python through 3.5.0 on Windows allows local users to gain privileges via a Trojan horse readline.pyd file in the current working directory. NOTE: the vendor says "It was determined that this is a longtime behavior of Python that cannot really be altered at this point."
Near-miss passage: CVE-2015-2572. CWE: UNKNOWN. CVSS: 4.599999904632568. Unspecified vulnerability in the Oracle Hyperion Smart View for Office component in Oracle Hyperion 11.1.2.5.216 and earlier, when running on Windows, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core.
Query: detect Detects Obfuscated Powershell via COMPRESS OBFUSCATION in logs
Matching passage: Sigma rule: Detects Obfuscated Powershell via COMPRESS OBFUSCATION. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module id: 7034cbbb-cc55-4dc2-8dad-36c0b942e8f1 related: - id: 20e5497e-331c-4cd5-8d36-935f6e2a9a07 type: derived status: test description: Detects Obfuscated Powershell via COMPRESS OBFUSCATION references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|contains|all: - new-object - text.encoding]::ascii Payload|contains: - system.io.compression.deflatestream - system.io.streamreader Payload|endswith: readtoend condition: selection_4103 falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path. The. Logsource: windows / file_event. Rule: title: Registry Hive File Staged Outside Standard User Profile Path id: a7f3c891-2e4d-4b6a-9f8c-d5e2a1b04c73 status: experimental description: 'Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path. These files generally contain various user-specific registry settings and are typically located in the user''s profile directory. Staging these files outside of the standard path can be indicative of an attacker attempting to manipulate user registry settings for persistence, privilege escalation, or dump user registry hives for credential harvesting. ' references: - https://github.com/MSNightmare/LegacyHive - https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-23 tags: - attack.privilege-escalation - attack.t1548 - attack.credential-access - attack.t1003 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - \UsrClass.dat - \NTUSER.DAT filter_main_usrclass: TargetFilename|endswith: \AppData\Local\Microsoft\Windows\UsrClass.dat filter_main_ntuser: TargetFilename|re|i: ^C:\\Users\\[^\\]+\\NTUSER\.DAT$ filter_main_system: TargetFilename|startswith: - C:\Windows\System32\config\ - C:\Windows\SYSVOL\ - C:\Windows\ServiceProfiles\ condition: selection and not 1 of filter_main_* falsepositives: - Backup or profile migration software - Forensic acquisition tools level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_registry_hive_file_creation/info.yml
Query: exploit Business Space in IBM WebSphere Process Server 6.1.2.0 through 7.0.0.5 and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0.x through 8.5.0.2, 
Matching passage: CVE-2015-7454. CWE: CWE-264. CVSS: 4.300000190734863. Business Space in IBM WebSphere Process Server 6.1.2.0 through 7.0.0.5 and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0.x through 8.5.0.2, 8.5.5.x through 8.5.5.0, and 8.5.6.x through 8.5.6.2 allows remote authenticated users to bypass intended access restrictions and create an arbitrary page or space via unspecified vectors.
Near-miss passage: CVE-2015-8150. CWE: CWE-264. CVSS: 7.800000190734863. Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows local users to obtain root access by modifying a batch file.
Query: explain CWE-570
Matching passage: CWE-570 Expression is Always False. The product contains an expression that will always evaluate to false.
Near-miss passage: CWE-31 Path Traversal: 'dir....filename'. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize 'dir....filename' (multiple internal backslash dot dot) sequences that can resolve to a location that is outside of that directory.
Query: risk of The SMB client in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified
Matching passage: CVE-2015-3773. CWE: CWE-119. CVSS: 7.5. The SMB client in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.
Near-miss passage: CVE-2015-1271. CWE: CWE-119. CVSS: 6.800000190734863. PDFium, as used in Google Chrome before 44.0.2403.89, does not properly handle certain out-of-memory conditions, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted PDF document that triggers a large memory allocation.
Query: detect Detects the use of stordiag.exe to execute schtasks.exe systeminfo.exe and fltmc.exe in logs
Matching passage: Sigma rule: Detects the use of stordiag.exe to execute schtasks.exe systeminfo.exe and fltmc.exe. Logsource: windows / process_creation. Rule: title: Execution via stordiag.exe id: 961e0abb-1b1e-4c84-a453-aafe56ad0d34 status: test description: Detects the use of stordiag.exe to execute schtasks.exe systeminfo.exe and fltmc.exe references: - https://strontic.github.io/xcyclopedia/library/stordiag.exe-1F08FC87C373673944F6A7E8B18CD845.html - https://twitter.com/eral4m/status/1451112385041911809 author: Austin Songer (@austinsonger) date: 2021-10-21 modified: 2022-12-25 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \stordiag.exe Image|endswith: - \schtasks.exe - \systeminfo.exe - \fltmc.exe filter: ParentImage|startswith: - c:\windows\system32\ - c:\windows\syswow64\ condition: selection and not filter falsepositives: - Legitimate usage of stordiag.exe. level: high
Near-miss passage: Sigma rule: Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller. Logsource: windows / process_creation. Rule: title: HackTool - SharpLdapWhoami Execution id: d9367cbb-c2e0-47ce-bdc0-128cb6da898d status: test description: Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller references: - https://github.com/bugch3ck/SharpLdapWhoami author: Florian Roth (Nextron Systems) date: 2022-08-29 modified: 2023-02-04 tags: - attack.discovery - attack.t1033 - car.2016-03-001 logsource: category: process_creation product: windows detection: selection_name: Image|endswith: \SharpLdapWhoami.exe selection_pe: - OriginalFileName|contains: SharpLdapWhoami - Product: SharpLdapWhoami selection_flags1: CommandLine|endswith: - ' /method:ntlm' - ' /method:kerb' - ' /method:nego' - ' /m:nego' - ' /m:ntlm' - ' /m:kerb' condition: 1 of selection* falsepositives: - Programs that use the same command line flags level: high
Query: detection rule: Detects execution of client32.exe (NetSupport RAT) from an unusual location (outside of 'C:\Program Files')
Matching passage: Sigma rule: Detects execution of client32.exe (NetSupport RAT) from an unusual location (outside of 'C:\Program Files'). Logsource: windows / process_creation. Rule: title: Remote Access Tool - NetSupport Execution From Unusual Location id: 37e8d358-6408-4853-82f4-98333fca7014 status: test description: Detects execution of client32.exe (NetSupport RAT) from an unusual location (outside of 'C:\Program Files') references: - https://redcanary.com/blog/misbehaving-rats/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-19 modified: 2024-11-23 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: - Image|endswith: \client32.exe - Product|contains: NetSupport Remote Control - OriginalFileName|contains: client32.exe - Hashes|contains: IMPHASH=a9d50692e95b79723f3e76fcf70d023e filter: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ condition: selection and not filter falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious parent process for cmd.exe. Logsource: windows / process_creation. Rule: title: Unusual Parent Process For Cmd.EXE id: 4b991083-3d0e-44ce-8fc4-b254025d8d4b status: test description: Detects suspicious parent process for cmd.exe references: - https://www.elastic.co/guide/en/security/current/unusual-parent-process-for-cmd.exe.html author: Tim Rauch, Elastic (idea) date: 2022-09-21 modified: 2023-12-05 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: Image|endswith: \cmd.exe ParentImage|endswith: - \csrss.exe - \ctfmon.exe - \dllhost.exe - \epad.exe - \FlashPlayerUpdateService.exe - \GoogleUpdate.exe - \jucheck.exe - \jusched.exe - \LogonUI.exe - \lsass.exe - \regsvr32.exe - \SearchIndexer.exe - \SearchProtocolHost.exe - \SIHClient.exe - \sihost.exe - \slui.exe - \spoolsv.exe - \sppsvc.exe - \taskhostw.exe - \unsecapp.exe - \WerFault.exe - \wermgr.exe - \wlanext.exe - \WUDFHost.exe condition: selection falsepositives: - Unknown level: medium
Query: playbook for alert: Encoded PowerShell / command-line abuse matching Internet Connection Discovery
Matching passage: Playbook for T1016.001 Internet Connection Discovery. 1) Validate alert telemetry against T1016.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: discovery. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using [Ping](https://attack.mitre.org/software/S0097), <code>tracert</code>, and GET requests to websites, or performing initial speed testing to confirm bandwidth. Adversaries may use the results and responses from these requests
Near-miss passage: Playbook for T1016 System Network Configuration Discovery. Different response path focused on discovery.
Query: patch priority for CVE-2015-8988
Matching passage: CVE-2015-8988. CWE: CWE-77. CVSS: 8.800000190734863. Unquoted executable path vulnerability in Client Management and Gateway components in McAfee (now Intel Security) ePO Deep Command (eDC) 2.2 and 2.1 allows authenticated users to execute a command of their choice via dropping a malicious file for the path.
Near-miss passage: CVE-2015-1986. CWE: CWE-77. CVSS: 10.0. The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to execute arbitrary commands via unspecified vectors, a different vulnerability than CVE-2015-1938.
Query: CWE for Improper Neutralization of Input Leaders
Matching passage: CWE-148 Improper Neutralization of Input Leaders. The product does not properly handle when a leading character or sequence (leader) is missing or malformed, or if multiple leaders are used when only one should be allowed.
Near-miss passage: CWE-1329 Reliance on Component That is Not Updateable. The product contains a component that cannot be updated or patched in order to remove vulnerabilities or significant bugs.
Query: rule covering Detects the presence of a loaded unsigned kernel module on the system.
Matching passage: Sigma rule: Detects the presence of a loaded unsigned kernel module on the system.. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Unsigned Kernel Module Loaded id: 951f8d29-f2f6-48a7-859f-0673ff105e6f status: test description: Detects the presence of a loaded unsigned kernel module on the system. references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-06 tags: - attack.privilege-escalation logsource: product: windows service: codeintegrity-operational detection: selection: EventID: 3001 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects macOS Gatekeeper bypass via xattr utility. Logsource: macos / process_creation. Rule: title: Gatekeeper Bypass via Xattr id: f5141b6d-9f42-41c6-a7bf-2a780678b29b status: test description: Detects macOS Gatekeeper bypass via xattr utility references: - https://github.com/redcanaryco/atomic-red-team/blob/1fed40dc7e48f16ed44dcdd9c73b9222a70cca85/atomics/T1553.001/T1553.001.md - https://www.loobins.io/binaries/xattr/ author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2024-04-18 tags: - attack.defense-impairment - attack.t1553.001 logsource: category: process_creation product: macos detection: selection: Image|endswith: /xattr CommandLine|contains|all: - -d - com.apple.quarantine condition: selection falsepositives: - Legitimate activities level: low
Query: risk of Cisco TelePresence Video Communication Server (VCS) X8.6 uses the same encryption key across different customers' installations, which makes it easier for local users to defeat cry
Matching passage: CVE-2015-6414. CWE: CWE-200. CVSS: 2.0999999046325684. Cisco TelePresence Video Communication Server (VCS) X8.6 uses the same encryption key across different customers' installations, which makes it easier for local users to defeat cryptographic protection mechanisms by leveraging knowledge of a key from another installation, aka Bug ID CSCuw64516.
Near-miss passage: CVE-2015-0094. CWE: CWE-200. CVSS: 2.0999999046325684. The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly restrict the availability of address information during a function call, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability."