alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: campaign using System Owner/User Discovery
Matching passage: T1033 System Owner/User Discovery. Tactics: discovery. Description: Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Various utilities and commands may acquire this information, including <code>whoami</code>. In macOS and Linux, the currently logged in user can be identified with <code>w</code> and <code>who</code>. On macOS the <code>dscl . list /Users | grep -v '_'</code> command can also be used to enumerate user accounts. Environment variables, such as <code>%USERNAME%</code> and <code>$USER</code>, may also be used to access this information. On network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show users` and `show ssh` can be used to display users currently logged into the device.(Citation: show_ssh_users_cmd_cisco)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)
Near-miss passage: T1069.002 Domain Groups. Tactics: discovery. Description: Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators. Commands such as <code>net group /domain</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscacheutil -q group</code> on macOS, and <code>ldapsearch</code> on Linux can list domain-level groups.
Query: vulnerability: Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Solaris Kernel Zones, 
Matching passage: CVE-2015-4907. CWE: UNKNOWN. CVSS: 4.599999904632568. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than CVE-2015-4820.
Near-miss passage: CVE-2015-0978. CWE: UNKNOWN. CVSS: 6.900000095367432. Multiple untrusted search path vulnerabilities in (1) EQATEC.Analytics.Monitor.Win32_vc100.dll and (2) EQATEC.Analytics.Monitor.Win32_vc100-x64.dll in Elipse E3 4.5.232 through 4.6.161 allow local users to gain privileges via a Trojan horse DLL in an unspecified directory. NOTE: this may overlap CVE-2015-2264.
Query: CVE similar to CVE-2015-2849
Matching passage: CVE-2015-2849. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in main.ant in the ANTlabs InnGate firmware on IG 3100, InnGate 3.01 E, InnGate 3.10 E, InnGate 3.10 M, SG 4, and SSG 4 devices, when https is used, allows remote attackers to execute arbitrary SQL commands via the ppli parameter.
Near-miss passage: CVE-2015-5591. CWE: CWE-89. CVSS: 7.199999809265137. SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute arbitrary SQL commands.
Query: risk of The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspeci
Matching passage: CVE-2015-7976. CWE: CWE-254. CVSS: 4.300000190734863. The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a crafted filename.
Near-miss passage: CVE-2015-0233. CWE: CWE-254. CVSS: 4.199999809265137. Multiple insecure Temporary File vulnerabilities in 389 Administration Server before 1.1.38.
Query: patch priority for CVE-2015-6614
Matching passage: CVE-2015-6614. CWE: CWE-264. CVSS: 5.800000190734863. Telephony in Android 5.x before 5.1.1 LMY48X allows attackers to gain privileges, and consequently bypass intended network-interface restrictions, perform expensive data transfers, or cause a denial of service (call-reception outage or mute manipulation), via a crafted application, aka internal bug 21900139.
Near-miss passage: CVE-2015-3335. CWE: CWE-264. CVSS: 7.5. The NaClSandbox::InitializeLayerTwoSandbox function in components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc in Google Chrome before 42.0.2311.90 does not have RLIMIT_AS and RLIMIT_DATA limits for Native Client (aka NaCl) processes, which might make it easier for remote attackers to conduct row-hammer attacks or have unspecified other impact by leveraging the ability to run a crafted program in the NaCl sandbox.
Query: write Sigma for Detects the recovery of a new public database instance from a snapshot. It may be a part of data exfiltration.
Matching passage: Sigma rule: Detects the recovery of a new public database instance from a snapshot. It may be a part of data exfiltration.. Logsource: aws / cloudtrail. Rule: title: Restore Public AWS RDS Instance id: c3f265c7-ff03-4056-8ab2-d486227b4599 status: test description: Detects the recovery of a new public database instance from a snapshot. It may be a part of data exfiltration. references: - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/rds__explore_snapshots/main.py author: faloker date: 2020-02-12 modified: 2022-10-09 tags: - attack.exfiltration - attack.t1020 logsource: product: aws service: cloudtrail detection: selection_source: eventSource: rds.amazonaws.com responseElements.publiclyAccessible: 'true' eventName: RestoreDBInstanceFromDBSnapshot condition: selection_source falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects DNS queries for subdomains related to MEGA sharing website. Logsource: windows / dns-client. Rule: title: DNS Query To MEGA Hosting Website - DNS Client id: 66474410-b883-415f-9f8d-75345a0a66a6 related: - id: 613c03ba-0779-4a53-8a1f-47f914a4ded3 type: similar status: test description: Detects DNS queries for subdomains related to MEGA sharing website references: - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-16 tags: - attack.exfiltration - attack.t1567.002 logsource: product: windows service: dns-client definition: 'Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events.' detection: selection: EventID: 3008 QueryName|contains: userstorage.mega.co.nz condition: selection falsepositives: - Legitimate DNS queries and usage of Mega level: medium
Query: risk of In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, 
Matching passage: CVE-2015-9127. CWE: CWE-476. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, and SD 810, possible null pointer dereference occurs due to failure of memory allocation when a large value is passed for buffer allocation in the Playready App.
Near-miss passage: CVE-2015-7515. CWE: CWE-476. CVSS: 4.599999904632568. The aiptek_probe function in drivers/input/tablet/aiptek.c in the Linux kernel before 4.4 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted USB device that lacks endpoints.
Query: containment actions for Encoded PowerShell / command-line abuse matching Trusted Developer Utilities Proxy Execution
Matching passage: Playbook for T1127 Trusted Developer Utilities Proxy Execution. 1) Validate alert telemetry against T1127. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth, execution. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering.(Citation: engima0x3 DNX Bypass)(Citation: engima0x3 RCSI Bypass)(Citation: Exploit Monday WinDbg)(Citation: LOLBAS
Near-miss passage: Playbook for T1127.003 JamPlus. Different response path focused on stealth, execution.
Query: risk of WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application cras
Matching passage: CVE-2015-5821. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-5545. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5552, and CVE-2015-5553.
Query: vulnerability: IOAcceleratorFamily in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruptio
Matching passage: CVE-2015-6996. CWE: CWE-119. CVSS: 6.800000190734863. IOAcceleratorFamily in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app.
Near-miss passage: CVE-2015-8221. CWE: CWE-119. CVSS: 10.0. Integer overflow in Google Picasa before 3.9.140 Build 259 allows remote attackers to execute arbitrary code via the CAMF section in a FOVb image, which triggers a heap-based buffer overflow.
Query: Sigma rule for Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.
Matching passage: Sigma rule: Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.. Logsource: windows / file_event. Rule: title: Potential Homoglyph Attack Using Lookalike Characters in Filename id: 4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6 status: test description: 'Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters. ' references: - https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish - http://www.irongeek.com/homoglyph-attack-generator.php author: Micah Babinski, @micahbabinski date: 2023-05-08 tags: - attack.stealth - attack.t1036 - attack.t1036.003 logsource: category: file_event product: windows detection: selection_upper: TargetFilename|contains: - А - В - Е - К - М - Н - О - Р - С - Т - Х - Ѕ - І - Ј - Ү - Ӏ - Ԍ - Ԛ - Ԝ - Α - Β - Ε - Ζ - Η - Ι - Κ - Μ - Ν - Ο - Ρ - Τ - Υ - Χ selection_lower: TargetFilename|contains: - а - е - о - р - с - х - ѕ - і - ӏ - ј - һ - ԁ - ԛ - ԝ - ο condition: 1 of selection_* falsepositives: - File names with legitimate Cyrillic text. Will likely require tuning (or not be usable) in countries where these alphabets are in use. level: medium
Near-miss passage: Sigma rule: Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by. Logsource: windows / process_creation. Rule: title: Suspicious Rundll32 Invoking Inline VBScript id: 1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd status: test description: Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452 references: - https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ author: Florian Roth (Nextron Systems) date: 2021-03-05 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - rundll32.exe - Execute - RegRead - window.close condition: selection falsepositives: - Unknown level: high
Query: alert when Detects the executiob of TTDInject.exe, which is used by Windows 10 v1809 and newer to debug time travel (underlying cal
Matching passage: Sigma rule: Detects the executiob of TTDInject.exe, which is used by Windows 10 v1809 and newer to debug time travel (underlying cal. Logsource: windows / process_creation. Rule: title: Use of TTDInject.exe id: b27077d6-23e6-45d2-81a0-e2b356eea5fd status: test description: Detects the executiob of TTDInject.exe, which is used by Windows 10 v1809 and newer to debug time travel (underlying call of tttracer.exe) references: - https://lolbas-project.github.io/lolbas/Binaries/Ttdinject/ author: frack113 date: 2022-05-16 tags: - attack.execution - attack.stealth - attack.t1127 logsource: product: windows category: process_creation detection: selection: - Image|endswith: ttdinject.exe - OriginalFileName: TTDInject.EXE condition: selection falsepositives: - Legitimate use level: medium
Near-miss passage: Sigma rule: Detects remote RPC calls to read information about scheduled tasks. Logsource: rpc_firewall / application. Rule: title: Remote Schedule Task Recon via ITaskSchedulerService id: 7f7c49eb-2977-4ac8-8ab0-ab1bae14730e status: test description: Detects remote RPC calls to read information about scheduled tasks references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.discovery logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:86d35949-83c9-4044-b424-db363231fd0c"' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 86d35949-83c9-4044-b424-db363231fd0c filter: OpNum: - 1 - 3 - 4 - 10 - 11 - 12 - 13 - 14 - 15 condition: selection and not filter falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-1402
Matching passage: CVE-2015-1402. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-8797. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/plugins.js in the stats page in the Admin UI in Apache Solr before 5.3.1 allows remote attackers to inject arbitrary web script or HTML via the entry parameter to a plugins/cache URI.
Query: CVE similar to CVE-2015-8254
Matching passage: CVE-2015-8254. CWE: CWE-345. CVSS: 5.900000095367432. The Frontel protocol before 3 on RSI Video Technologies Videofied devices does not use integrity protection, which makes it easier for man-in-the-middle attackers to (1) initiate a false alarm or (2) deactivate an alarm by modifying the client-server data stream.
Near-miss passage: CVE-2015-6854. CWE: CWE-345. CVSS: 9.100000381469727. The non-Domino web agents in CA Single Sign-On (aka SSO, formerly SiteMinder) R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, and R12.5 before CR5 allow remote attackers to cause a denial of service (daemon crash) or obtain sensitive information via a crafted request.
Query: CVE similar to CVE-2015-0039
Matching passage: CVE-2015-0039. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0027, CVE-2015-0035, CVE-2015-0052, and CVE-2015-0068.
Near-miss passage: CVE-2015-6309. CWE: CWE-399. CVSS: 6.800000190734863. Cisco Email Security Appliance (ESA) 8.5.6-106 and 9.6.0-042 allows remote authenticated users to cause a denial of service (file-descriptor consumption and device reload) via crafted HTTP requests, aka Bug ID CSCuw32211.
Query: Sigma rule for Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to
Matching passage: Sigma rule: Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to. Logsource: windows / msexchange-management. Rule: title: Mailbox Export to Exchange Webserver id: 516376b4-05cd-4122-bae0-ad7641c38d48 status: test description: Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it references: - https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html author: Florian Roth (Nextron Systems), Rich Warren, Christian Burkard (Nextron Systems) date: 2021-08-09 modified: 2023-04-30 tags: - attack.persistence - attack.t1505.003 logsource: service: msexchange-management product: windows detection: export_command: '|all': - New-MailboxExportRequest - ' -Mailbox ' export_params: - -FilePath "\\\\ - .aspx role_assignment: '|all': - New-ManagementRoleAssignment - ' -Role "Mailbox Import Export"' - ' -User ' condition: (export_command and export_params) or role_assignment falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: Detects a registry key used by IceID in a campaign that distributes malicious OneNote files. Logsource: windows / registry_event. Rule: title: Potential Qakbot Registry Activity id: 1c8e96cd-2bed-487d-9de0-b46c90cade56 status: test description: Detects a registry key used by IceID in a campaign that distributes malicious OneNote files references: - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution author: Hieu Tran date: 2023-03-13 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: \Software\firm\soft\Name condition: selection falsepositives: - Unknown level: high
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects potential tampering with Windows Defender settings such as adding exclusion using wmic. Logsource: windows / process_creation. Rule: title: Potential Windows Defender Tampering Via Wmic.EXE id: 51cbac1e-eee3-4a90-b1b7-358efb81fa0a status: test description: Detects potential tampering with Windows Defender settings such as adding exclusion using wmic references: - https://github.com/redcanaryco/atomic-red-team/blob/5c1e6f1b4fafd01c8d1ece85f510160fc1275fbf/atomics/T1562.001/T1562.001.md - https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/ - https://www.bleepingcomputer.com/news/security/iobit-forums-hacked-to-spread-ransomware-to-its-members/ author: frack113 date: 2022-12-11 modified: 2023-02-14 tags: - attack.execution - attack.defense-impairment - attack.t1047 - attack.t1685 logsource: product: windows category: process_creation detection: selection_img: - OriginalFileName: wmic.exe - Image|endswith: \WMIC.exe selection_cli: CommandLine|contains: /Namespace:\\\\root\\Microsoft\\Windows\\Defender condition: all of selection_* falsepositives: - Unknown level: high simulation: - type: atomic-red-team name: WMIC Tamper with Windows Defender Evade Scanning Folder technique: T1562.001 atomic_guid: 59d386fc-3a4b-41b8-850d-9e3eee24dfe4 regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_namespace_defender/info.yml
Near-miss passage: Sigma rule: Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware.. Logsource: windows / process_creation. Rule: title: PowerShell Execution With Potential Decryption Capabilities id: 434c08ba-8406-4d15-8b24-782cb071a691 status: test description: Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware. references: - https://research.checkpoint.com/2023/chinese-threat-actors-targeting-europe-in-smugx-campaign/ author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-06-30 modified: 2023-12-05 tags: - attack.execution logsource: product: windows category: process_creation detection: selection_img: Image|endswith: - \powershell.exe - \pwsh.exe OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli_dir: CommandLine|contains: - 'Get-ChildItem ' - 'dir ' - 'gci ' - 'ls ' selection_cli_gc: CommandLine|contains: - 'Get-Content ' - 'gc ' - 'cat ' - 'type ' - ReadAllBytes selection_cli_specific: - CommandLine|contains|all: - ' ^| ' - \*.lnk - -Recurse - '-Skip ' - CommandLine|contains|all: - ' -ExpandProperty ' - \*.lnk - WriteAllBytes - ' .length ' condition: all of selection_* falsepositives: - Unlikely level: high
Query: CVE similar to CVE-2015-0383
Matching passage: CVE-2015-0383. CWE: UNKNOWN. CVSS: 5.400000095367432. Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows local users to affect integrity and availability via unknown vectors related to Hotspot.
Near-miss passage: CVE-2015-7917. CWE: UNKNOWN. CVSS: 7.199999809265137. Untrusted search path vulnerability in Open Automation OPC Systems.NET 8.00.0023 and earlier allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.