alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows t
Matching passage: Sigma rule: Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows t. Logsource: windows / ps_script. Rule: title: Suspicious PowerShell WindowStyle Option id: 313fbb0a-a341-4682-848d-6d6f8c4fab7c status: test description: 'Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.003/T1564.003.md author: frack113, Tim Shelton (fp AWS) date: 2021-10-20 modified: 2023-01-03 tags: - attack.stealth - attack.t1564.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - powershell - WindowStyle - Hidden filter: ScriptBlockText|contains|all: - :\Program Files\Amazon\WorkSpacesConfig\Scripts\ - $PSScriptRoot\Module\WorkspaceScriptModule\WorkspaceScriptModule condition: selection and not filter falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when a new admin is created.. Logsource: azure / auditlogs. Rule: title: Privileged Account Creation id: f7b5b004-dece-46e4-a4a5-f6fd0e1c6947 status: test description: Detects when a new admin is created. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#changes-to-privileged-accounts author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Tim Shelton date: 2022-08-11 modified: 2022-08-16 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.stealth - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: properties.message|contains|all: - Add user - Add member to role Status: Success condition: selection falsepositives: - A legitimate new admin account being created level: medium
Query: describe CVE-2015-8874
Matching passage: CVE-2015-8874. CWE: CWE-119. CVSS: 7.5. Stack consumption vulnerability in GD in PHP before 5.6.12 allows remote attackers to cause a denial of service via a crafted imagefilltoborder call.
Near-miss passage: CVE-2015-0824. CWE: CWE-119. CVSS: 5.0. The mozilla::layers::BufferTextureClient::AllocateForSurface function in Mozilla Firefox before 36.0 allows remote attackers to cause a denial of service (out-of-bounds write of zero values, and application crash) via vectors that trigger use of DrawTarget and the Cairo library for image drawing.
Query: adversary uses Terminal Services DLL
Matching passage: T1505.005 Terminal Services DLL. Tactics: persistence. Description: Adversaries may abuse components of Terminal Services to enable persistent access to systems. Microsoft Terminal Services, renamed to Remote Desktop Services in some Windows Server OSs as of 2022, enable remote terminal connections to hosts. Terminal Services allows servers to transmit a full, interactive, graphical user interface to clients via RDP.(Citation: Microsoft Remote Desktop Services) [Windows Service](https://attack.mitre.org/techniques/T1543/003)s that are run as a "generic" process (ex: <code>svchost.exe</code>) load the service's DLL file, the location of which is stored in a Registry entry named <code>ServiceDll</code>.(Citation: Microsoft System Services Fundamentals) The <code>termsrv.dll</code> file, typically stored in `%SystemRoot%\System32\`, is the default <code>ServiceDll</code> value for Terminal Services in `HKLM\System\CurrentControlSet\services\TermService\Parameters\`. Adversaries may modify and/or replace the Terminal Services DLL to enable persistent access to victimized hosts.(Citation: James TermServ DLL) Modifications to this DLL could be done to execute arbitrary payloads (while also potentially preserving normal <code>termsrv.dll</code> functionality) as well as to simply enable abusable features of Terminal Services. For example, an adversary may enable features such as concurrent [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) sessions by either patching the <code>termsrv.dll</code> file or modifying the <code>ServiceDll</code> value to point to a DLL that provides increased RDP functionality.(Citation: Windows OS Hub RDP)(Citation: RDPWrap Github) On a non-server Windows OS this increased functionality may also enable an adversary to avoid Terminal Services prompts that warn/log out users of a system when a new RDP session is created.
Near-miss passage: T1505 Server Software Component. Tactics: persistence. Description: Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.(Citation: volexity_0day_sophos_FW)
Query: detection engineering for Compute Hijacking
Matching passage: T1496.001 Compute Hijacking. Tactics: impact. Description: Adversaries may leverage the compute resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. One common purpose for [Compute Hijacking](https://attack.mitre.org/techniques/T1496/001) is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive.(Citation: Kaspersky Lazarus Under The Hood Blog 2017) Servers and cloud-based systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for [Compute Hijacking](https://attack.mitre.org/techniques/T1496/001) and cryptocurrency mining.(Citation: CloudSploit - Unused AWS Regions) Containerized environments may also be targeted due to the ease of deployment via exposed APIs and the potential for scaling mining activities by deploying or compromising multiple containers within an environment or cluster.(Citation: Unit 42 Hildegard Malware)(Citation: Trend Micro Exposed Docker APIs) Additionally, some cryptocurrency mining malware identify then kill off processes for competing malware to ensure it’s not competing for resources.(Citation: Trend Micro War of Crypto Miners)
Near-miss passage: T1496 Resource Hijacking. Tactics: impact. Description: Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Resource hijacking may take a number of different forms. For example, adversaries may: * Leverage compute resources in order to mine cryptocurrency * Sell network bandwidth to proxy networks * Generate SMS traffic for profit * Abuse cloud-based messaging services to send large quantities of spam messages In some cases, adversaries may leverage multiple types of Resource Hijacking at once.(Citation: Sysdig Cryptojacking Proxyjacking 2023)
Query: exploit The anti-spam scanner on Cisco Email Security Appliance (ESA) devices 3.3.1-09, 7.5.1-gpl-022, and 8.5.6-074 allows remote attackers to bypass intended e-mail restrictions via a ma
Matching passage: CVE-2015-4184. CWE: CWE-20. CVSS: 5.0. The anti-spam scanner on Cisco Email Security Appliance (ESA) devices 3.3.1-09, 7.5.1-gpl-022, and 8.5.6-074 allows remote attackers to bypass intended e-mail restrictions via a malformed DNS SPF record, aka Bug IDs CSCuu35853 and CSCuu37733.
Near-miss passage: CVE-2015-2951. CWE: CWE-20. CVSS: 5.0. JWT.php in F21 JWT before 2.0 allows remote attackers to bypass signature verification via crafted tokens.
Query: exploit The web management interface on Belkin F9K1102 2 devices with firmware 2.10.17 has a blank password, which allows remote attackers to obtain administrative privileges by leveraging
Matching passage: CVE-2015-5988. CWE: CWE-255. CVSS: 9.800000190734863. The web management interface on Belkin F9K1102 2 devices with firmware 2.10.17 has a blank password, which allows remote attackers to obtain administrative privileges by leveraging a LAN session.
Near-miss passage: CVE-2015-4966. CWE: CWE-255. CVSS: 6.5. IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 FP009, and 7.6.0 before 7.6.0.2 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9 FP009, 7.5.1, and 7.6.0 before 7.6.0.2 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products have a default administrator account, which makes it easier for remote authenticated users to obtain access via unspecified vectors.
Query: patch priority for CVE-2015-9039
Matching passage: CVE-2015-9039. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in eMBMS where an assertion can be reached by a sequence of downlink messages.
Near-miss passage: CVE-2015-1611. CWE: CWE-20. CVSS: 7.5. OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to "fake LLDP injection."
Query: risk of The ActiveMQ Broker in Samsung Security Manager (SSM) before 1.31 allows remote attackers to delete arbitrary files, and consequently cause a denial of service, via a DELETE reques
Matching passage: CVE-2015-1499. CWE: CWE-264. CVSS: 8.5. The ActiveMQ Broker in Samsung Security Manager (SSM) before 1.31 allows remote attackers to delete arbitrary files, and consequently cause a denial of service, via a DELETE request.
Near-miss passage: CVE-2015-4596. CWE: CWE-264. CVSS: 7.800000190734863. Lenovo Mouse Suite before 6.73 allows local users to run arbitrary code with administrator privileges.
Query: risk of Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) 
Matching passage: CVE-2015-3057. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-9161, CVE-2015-3046, CVE-2015-3049, CVE-2015-3050, CVE-2015-3051, CVE-2015-3052, CVE-2015-3056, CVE-2015-3070, and CVE-2015-3076.
Near-miss passage: CVE-2015-7065. CWE: CWE-119. CVSS: 6.800000190734863. OpenGL in Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Query: CVE similar to CVE-2015-8446
Matching passage: CVE-2015-8446. CWE: CWE-119. CVSS: 9.300000190734863. Heap-based buffer overflow in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via an MP3 file with COMM tags that are mishandled during memory allocation, a different vulnerability than CVE-2015-8438.
Near-miss passage: CVE-2015-8472. CWE: CWE-119. CVSS: 7.300000190734863. Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126.
Query: detection rule: Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation
Matching passage: Sigma rule: Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation. Logsource: windows / security. Rule: title: Meterpreter or Cobalt Strike Getsystem Service Installation - Security id: ecbc5e16-58e0-4521-9c60-eb9a7ea4ad34 related: - id: 843544a7-56e0-4dcc-a44f-5cc266dd97d6 type: derived status: test description: Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment - https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/ author: Teymur Kheirkhabarov, Ecco, Florian Roth (Nextron Systems) date: 2019-10-26 modified: 2023-11-15 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.001 - attack.t1134.002 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection_eid: EventID: 4697 selection_cli_cmd: ServiceFileName|contains|all: - /c - echo - \pipe\ ServiceFileName|contains: - cmd - '%COMSPEC%' selection_cli_rundll: ServiceFileName|contains|all: - rundll32 - .dll,a - '/p:' selection_cli_share: ServiceFileName|startswith: \\\\127.0.0.1\\ADMIN$\ condition: selection_eid and 1 of selection_cli_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the creation of a new PowerShell module in the first folder of the module directory structure "\WindowsPowerShel. Logsource: windows / file_event. Rule: title: Potential Suspicious PowerShell Module File Created id: e8a52bbd-bced-459f-bd93-64db45ce7657 status: test description: Detects the creation of a new PowerShell module in the first folder of the module directory structure "\WindowsPowerShell\Modules\malware\malware.psm1". This is somewhat an uncommon practice as legitimate modules often includes a version folder. references: - Internal Research - https://learn.microsoft.com/en-us/powershell/scripting/developer/module/understanding-a-windows-powershell-module?view=powershell-7.3 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-09 tags: - attack.persistence logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - \\WindowsPowerShell\\Modules\\*\.ps - \\WindowsPowerShell\\Modules\\*\.dll condition: selection falsepositives: - False positive rate will vary depending on the environments. Additional filters might be required to make this logic usable in production. level: medium
Query: how to detect Peripheral Device Discovery
Matching passage: T1120 Peripheral Device Discovery. Tactics: discovery. Description: Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.(Citation: Peripheral Discovery Linux)(Citation: Peripheral Discovery macOS) Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Near-miss passage: T1069.001 Local Groups. Tactics: discovery. Description: Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group. Commands such as <code>net localgroup</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscl . -list /Groups</code> on macOS, and <code>groups</code> on Linux can list local groups.
Query: playbook for alert: SIEM correlation: impact activity consistent with Data Manipulation
Matching passage: Playbook for T1565 Data Manipulation. 1) Validate alert telemetry against T1565. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: impact. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: Sygnia Elephant Beetle Jan 2022) By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making. The type of modification and the impact it will have depends on the target app
Near-miss passage: Playbook for T1565.001 Stored Data Manipulation. Different response path focused on impact.
Query: weakness Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Matching passage: CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection'). The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
Near-miss passage: CWE-240 Improper Handling of Inconsistent Structural Elements. The product does not handle or incorrectly handles when two or more structural elements should be consistent, but are not.
Query: detection rule: Detetcts PowerShell activity in which Get-Addefaultdomainpasswordpolicy is used to get the default password policy for a
Matching passage: Sigma rule: Detetcts PowerShell activity in which Get-Addefaultdomainpasswordpolicy is used to get the default password policy for a. Logsource: windows / ps_script. Rule: title: Password Policy Discovery With Get-AdDefaultDomainPasswordPolicy id: bbb9495b-58fc-4016-b9df-9a3a1b67ca82 status: test description: Detetcts PowerShell activity in which Get-Addefaultdomainpasswordpolicy is used to get the default password policy for an Active Directory domain. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1201/T1201.md#atomic-test-9---enumerate-active-directory-password-policy-with-get-addefaultdomainpasswordpolicy - https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2022-ps author: frack113 date: 2022-03-17 tags: - attack.discovery - attack.t1201 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: Get-AdDefaultDomainPasswordPolicy condition: selection falsepositives: - Legitimate PowerShell scripts level: low
Near-miss passage: Sigma rule: Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts. Logsource: windows / ps_script. Rule: title: AMSI Bypass Pattern Assembly GetType id: e0d6c087-2d1c-47fd-8799-3904103c5a98 status: test description: Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts references: - https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/ - https://twitter.com/cyb3rops/status/1588574518057979905?s=20&t=A7hh93ONM7ni1Rj1jO5OaA author: Florian Roth (Nextron Systems) date: 2022-11-09 tags: - attack.defense-impairment - attack.t1685 - attack.execution logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - '[Ref].Assembly.GetType' - SetValue($null,$true) - NonPublic,Static condition: selection falsepositives: - Unknown level: high
Query: detect Masquerade File Type
Matching passage: T1036.008 Masquerade File Type. Tactics: stealth. Description: Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type. For example, the header of a JPEG file, is <code> 0xFF 0xD8</code> and the file extension is either `.JPE`, `.JPEG` or `.JPG`. Adversaries may edit the header’s hex code and/or the file extension of a malicious payload in order to bypass file validation checks and/or input sanitization. This behavior is commonly used when payload files are transferred (e.g., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and stored (e.g., [Upload Malware](https://attack.mitre.org/techniques/T1608/001)) so that adversaries may move their malware without triggering detections. Common non-executable file types and extensions, such as text files (`.txt`) and image files (`.jpg`, `.gif`, etc.) may be typically treated as benign. Based on this, adversaries may use a file extension to disguise malware, such as naming a PHP backdoor code with a file name of <code>test.gif</code>. A user may not know that a file is malicious due to the benign appearance and file extension. Polyglot files, which are files that have multiple different file types and that function differently based on the application that will execute them, may also be used to disguise malicious malware and capabilities.(Citation: polygot_icedID)
Near-miss passage: T1036.003 Rename Legitimate Utilities. Tactics: stealth. Description: Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython.(Citation: LOLBAS Main Site)(Citation: Huntress Python Malware 2025)(Citation: The DFIR Report AutoHotKey 2023)(Citation: Splunk Detect Renamed PSExec) It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename <code>rundll32.exe</code>).(Citation: Elastic Masquerade Ball) An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.(Citation: F-Secure CozyDuke)