alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: SIEM correlation: command and control activity consistent with Domain Fronting
Matching passage: T1090.004 Domain Fronting. Tactics: command and control. Description: Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. (Citation: Fifield Blocking Resistent Communication through domain fronting 2015) Domain fronting involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation of the the technique, "domainless" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored). For example, if domain-x and domain-y are customers of the same CDN, it is possible to place domain-x in the TLS header and domain-y in the HTTP header. Traffic will appear to be going to domain-x, however the CDN may route it to domain-y.
Near-miss passage: T1090.001 Internal Proxy. Tactics: command and control. Description: Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment. By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.
Query: hunt for Polymorphic Code activity
Matching passage: T1027.014 Polymorphic Code. Tactics: stealth. Description: Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection. Polymorphic code is a type of software capable of changing its runtime footprint during code execution.(Citation: polymorphic-blackberry) With each execution of the software, the code is mutated into a different version of itself that achieves the same purpose or objective as the original. This functionality enables the malware to evade traditional signature-based defenses, such as antivirus and antimalware tools.(Citation: polymorphic-sentinelone) Other obfuscation techniques can be used in conjunction with polymorphic code to accomplish the intended effects, including using mutation engines to conduct actions such as [Software Packing](https://attack.mitre.org/techniques/T1027/002), [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010), or [Encrypted/Encoded File](https://attack.mitre.org/techniques/T1027/013).(Citation: polymorphic-linkedin)(Citation: polymorphic-medium)
Near-miss passage: T1027.003 Steganography. Tactics: stealth. Description: Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files. [Duqu](https://attack.mitre.org/software/S0038) was an early example of malware that used steganography. It encrypted the gathered information from a victim's system and hid it within an image before exfiltrating the image to a C2 server.(Citation: Wikipedia Duqu) By the end of 2017, a threat group used <code>Invoke-PSImage</code> to hide [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands in an image file (.png) and execute the code on a victim's system. In this particular case the [PowerShell](https://attack.mitre.org/techniques/T1059/001) code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary.(Citation: McAfee Malicious Doc Targets Pyeongchang Olympics)
Query: rule covering Detects potential SQL injection attempts via GET requests in access logs.
Matching passage: Sigma rule: Detects potential SQL injection attempts via GET requests in access logs.. Logsource: webserver. Rule: title: SQL Injection Strings In URI id: 5513deaf-f49a-46c2-a6c8-3f111b5cb453 status: test description: Detects potential SQL injection attempts via GET requests in access logs. references: - https://www.acunetix.com/blog/articles/exploiting-sql-injection-example/ - https://www.acunetix.com/blog/articles/using-logs-to-investigate-a-web-application-attack/ - https://brightsec.com/blog/sql-injection-payloads/ - https://github.com/payloadbox/sql-injection-payload-list - https://book.hacktricks.xyz/pentesting-web/sql-injection/mysql-injection author: Saw Win Naung, Nasreddine Bencherchali (Nextron Systems), Thurein Oo (Yoma Bank) date: 2020-02-22 modified: 2023-09-04 tags: - attack.initial-access - attack.t1190 logsource: category: webserver detection: selection: cs-method: GET keywords: - '@@version' - '%271%27%3D%271' - '=select ' - =select( - =select%20 - concat_ws( - CONCAT(0x - from mysql.innodb_table_stats - from%20mysql.innodb_table_stats - group_concat( - information_schema.tables - json_arrayagg( - or 1=1# - or%201=1# - 'order by ' - order%20by%20 - 'select * ' - select database() - select version() - select%20*%20 - select%20database() - select%20version() - select%28sleep%2810%29 - SELECTCHAR( - table_schema - UNION ALL SELECT - UNION SELECT - UNION%20ALL%20SELECT - UNION%20SELECT - '''1''=''1' filter_main_status: sc-status: 404 condition: selection and keywords and not 1 of filter_main_* falsepositives: - Java scripts and CSS Files - User searches in search boxes of the respective website - Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as "User Agent" strings and more response codes level: high
Near-miss passage: Sigma rule: Detects chromium based browsers starting in headless and debugging mode and pointing to a user profile. This could be a. Logsource: windows / process_creation. Rule: title: Potential Data Stealing Via Chromium Headless Debugging id: 3e8207c5-fcd2-4ea6-9418-15d45b4890e4 related: - id: b3d34dc5-2efd-4ae3-845f-8ec14921f449 type: derived status: test description: Detects chromium based browsers starting in headless and debugging mode and pointing to a user profile. This could be a sign of data stealing or remote control references: - https://github.com/defaultnamehere/cookie_crimes/ - https://mango.pdf.zone/stealing-chrome-cookies-without-a-password - https://embracethered.com/blog/posts/2020/cookie-crimes-on-mirosoft-edge/ - https://embracethered.com/blog/posts/2020/chrome-spy-remote-control/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-23 tags: - attack.credential-access - attack.collection - attack.stealth - attack.t1185 - attack.t1564.003 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - --remote-debugging- - --user-data-dir - --headless condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-6319
Matching passage: CVE-2015-6319. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in the web-based management interface on Cisco RV220W devices allows remote attackers to execute arbitrary SQL commands via a crafted header in an HTTP request, aka Bug ID CSCuv29574.
Near-miss passage: CVE-2015-1367. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in index.php in CatBot 0.4.2 allows remote attackers to execute arbitrary SQL commands via the lastcatbot parameter.
Query: CVE similar to CVE-2015-8940
Matching passage: CVE-2015-8940. CWE: CWE-264. CVSS: 7.800000190734863. Integer overflow in sound/soc/msm/qdsp6v2/q6lsm.c in the Qualcomm components in Android before 2016-08-05 on Nexus 6 devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28813987 and Qualcomm internal bug CR792367.
Near-miss passage: CVE-2015-1458. CWE: CWE-264. CVSS: 6.900000095367432. Fortinet FortiAuthenticator 3.0.0 allows local users to bypass intended restrictions and gain privileges by creating /tmp/privexec/dbgcore_enable_shell_access and executing the "shell" command.
Query: patch priority for CVE-2015-4869
Matching passage: CVE-2015-4869. CWE: UNKNOWN. CVSS: 4.900000095367432. Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect availability via unknown vectors related to Kernel.
Near-miss passage: CVE-2015-4745. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in the Oracle Endeca Information Discovery Studio component in Oracle Fusion Middleware 2.2.2, 2.3, 2.4, 3.0, and 3.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Integrator, a different vulnerability than CVE-2015-2602, CVE-2015-2603, CVE-2015-2604, CVE-2015-2605, and CVE-2015-2606.
Query: patch priority for CVE-2015-6668
Matching passage: CVE-2015-6668. CWE: CWE-200. CVSS: 7.5. The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload directory structure, related to an insecure direct object reference.
Near-miss passage: CVE-2015-2748. CWE: CWE-200. CVSS: 5.0. Websense TRITON AP-WEB before 8.0.0 does not properly restrict access to files in explorer_wse/, which allows remote attackers to obtain sensitive information via a direct request to a (1) Web Security incident report or the (2) Explorer configuration (websense.ini) file.
Query: risk of Cisco Digital Content Manager (DCM) 15.0.0 might allow remote ad servers to cause a denial of service (reboot) via malformed ad messages, aka Bug ID CSCur13999.
Matching passage: CVE-2015-4228. CWE: CWE-399. CVSS: 5.400000095367432. Cisco Digital Content Manager (DCM) 15.0.0 might allow remote ad servers to cause a denial of service (reboot) via malformed ad messages, aka Bug ID CSCur13999.
Near-miss passage: CVE-2015-4239. CWE: CWE-399. CVSS: 6.099999904632568. Cisco Adaptive Security Appliance (ASA) Software 9.3(2.243) and 100.13(0.21) allows remote attackers to cause a denial of service (device reload) by sending crafted OSPFv2 packets on the local network, aka Bug ID CSCus84220.
Query: describe CVE-2015-5714
Matching passage: CVE-2015-5714. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags.
Near-miss passage: CVE-2015-9319. CWE: CWE-79. CVSS: 6.099999904632568. The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.
Query: risk of Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Fire
Matching passage: CVE-2015-4767. CWE: UNKNOWN. CVSS: 1.7000000476837158. Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Firewall, a different vulnerability than CVE-2015-4769.
Near-miss passage: CVE-2015-0496. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote authenticated users to affect confidentiality via vectors related to PIA Search Functionality.
Query: vulnerability: Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explore
Matching passage: CVE-2015-6146. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6145.
Near-miss passage: CVE-2015-2426. CWE: CWE-119. CVSS: 8.800000190734863. Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Driver Vulnerability."
Query: patch priority for CVE-2015-9147
Matching passage: CVE-2015-9147. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, SD 400, and SD 800, userspace-provided pointer arguments are not validated.
Near-miss passage: CVE-2015-7234. CWE: CWE-20. CVSS: 4.0. The OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology and OSF Import modules are enabled, allows user-assisted remote attackers to delete arbitrary files via unspecified vectors.
Query: detect Detects potential exfiltration attempt via audio file using PowerShell in logs
Matching passage: Sigma rule: Detects potential exfiltration attempt via audio file using PowerShell. Logsource: windows / ps_script. Rule: title: Potential Data Exfiltration Via Audio File id: e4f93c99-396f-47c8-bb0f-201b1fa69034 status: test description: Detects potential exfiltration attempt via audio file using PowerShell references: - https://github.com/gtworek/PSBits/blob/e97cbbb173b31cbc4d37244d3412de0a114dacfb/NoDLP/bin2wav.ps1 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-16 tags: - attack.exfiltration logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_main: ScriptBlockText|contains|all: - '[System.Math]::' - '[IO.FileMode]::' - BinaryWriter selection_header_wav: ScriptBlockText|contains|all: - '0x52' - '0x49' - '0x46' - '0x57' - '0x41' - '0x56' - '0x45' - '0xAC' condition: selection_main and 1 of selection_header_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been. Logsource: windows / process_creation. Rule: title: Remote Access Tool - Team Viewer Session Started On Windows Host id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357 related: - id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d type: similar - id: f459ccb4-9805-41ea-b5b2-55e279e2424a type: similar status: test description: 'Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder. ' references: - Internal Research author: Josh Nickels, Qi Nan date: 2024-03-11 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: process_creation product: windows detection: selection: Image: TeamViewer_Desktop.exe ParentImage: TeamViewer_Service.exe CommandLine|endswith: TeamViewer_Desktop.exe --IPCport 5939 --Module 1 condition: selection falsepositives: - Legitimate usage of TeamViewer level: low
Query: alert when Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.
Matching passage: Sigma rule: Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.. Logsource: windows / registry_set. Rule: title: Microsoft Office Protected View Disabled id: a5c7a43f-6009-4a8c-80c5-32abf1c53ecc related: - id: 7c637634-c95d-4bbf-b26c-a82510874b34 type: obsolete status: test description: Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/ - https://yoroi.company/research/cyber-criminal-espionage-operation-insists-on-italian-manufacturing/ - https://admx.help/HKCU/software/policies/microsoft/office/16.0/excel/security/protectedview author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-06-08 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_set detection: selection_path: TargetObject|contains|all: - \SOFTWARE\Microsoft\Office\ - \Security\ProtectedView\ selection_values_1: Details: DWORD (0x00000001) TargetObject|endswith: - \DisableAttachementsInPV - \DisableInternetFilesInPV - \DisableIntranetCheck - \DisableUnsafeLocationsInPV selection_values_0: Details: DWORD (0x00000000) TargetObject|endswith: - \enabledatabasefileprotectedview - \enableforeigntextfileprotectedview condition: selection_path and 1 of selection_values_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files wr. Logsource: windows / process_creation. Rule: title: Malicious Windows Script Components File Execution by TAEF Detection id: 634b00d5-ccc3-4a06-ae3b-0ec8444dd51b status: test description: 'Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files written on different languages (C, C#, Microsoft COM Scripting interfaces Adversaries may execute malicious code (such as WSC file with VBScript, dll and so on) directly by running te.exe ' references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Te/ - https://twitter.com/pabraeken/status/993298228840992768 - https://learn.microsoft.com/en-us/windows-hardware/drivers/taef/ author: Agro (@agro_sev) oscd.community date: 2020-10-13 modified: 2021-11-27 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \te.exe - ParentImage|endswith: \te.exe - OriginalFileName: \te.exe condition: selection falsepositives: - It's not an uncommon to use te.exe directly to execute legal TAEF tests level: low
Query: write Sigma for Detects default PsExec service filename which indicates PsExec service installation and execution
Matching passage: Sigma rule: Detects default PsExec service filename which indicates PsExec service installation and execution. Logsource: windows / file_event. Rule: title: PsExec Service File Creation id: 259e5a6a-b8d2-4c38-86e2-26c5e651361d related: - id: 42c575ea-e41e-41f1-b248-8093c3e82a28 type: derived status: test description: Detects default PsExec service filename which indicates PsExec service installation and execution references: - https://www.jpcert.or.jp/english/pub/sr/ir_research.html - https://jpcertcc.github.io/ToolAnalysisResultSheet author: Thomas Patzke date: 2017-06-12 modified: 2022-10-26 tags: - attack.execution - attack.t1569.002 - attack.s0029 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: \PSEXESVC.exe condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files are located in poten. Logsource: windows / process_creation. Rule: title: File In Suspicious Location Encoded To Base64 Via Certutil.EXE id: 82a6714f-4899-4f16-9c1e-9a333544d4c3 related: - id: e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a type: derived status: test description: Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files are located in potentially suspicious locations references: - https://www.virustotal.com/gui/file/35c22725a92d5cb1016b09421c0a6cdbfd860fd4778b3313669b057d4a131cb7/behavior - https://www.virustotal.com/gui/file/427616528b7dbc4a6057ac89eb174a3a90f7abcf3f34e5a359b7a910d82f7a72/behavior - https://www.virustotal.com/gui/file/34de4c8beded481a4084a1fd77855c3e977e8ac643e5c5842d0f15f7f9b9086f/behavior - https://www.virustotal.com/gui/file/4abe1395a09fda06d897a9c4eb247278c1b6cddda5d126ce5b3f4f499e3b8fa2/behavior author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-15 modified: 2024-03-05 tags: - attack.stealth - attack.t1027 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certutil.exe - OriginalFileName: CertUtil.exe selection_cli: CommandLine|contains|windash: -encode selection_extension: CommandLine|contains: - \AppData\Roaming\ - \Desktop\ - \Local\Temp\ - \PerfLogs\ - \Users\Public\ - \Windows\Temp\ - $Recycle.Bin condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_location/info.yml
Query: write Sigma for Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as thre
Matching passage: Sigma rule: Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as thre. Logsource: windows / process_creation. Rule: title: Phishing Pattern ISO in Archive id: fcdf69e5-a3d3-452a-9724-26f2308bf2b1 status: test description: Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web) references: - https://twitter.com/1ZRR4H/status/1534259727059787783 - https://app.any.run/tasks/e1fe6a62-bce8-4323-a49a-63795d9afd5d/ author: Florian Roth (Nextron Systems) date: 2022-06-07 tags: - attack.initial-access - attack.t1566 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \Winrar.exe - \7zFM.exe - \peazip.exe Image|endswith: - \isoburn.exe - \PowerISO.exe - \ImgBurn.exe condition: selection falsepositives: - Legitimate cases in which archives contain ISO or IMG files and the user opens the archive and the image via clicking and not extraction level: high
Near-miss passage: Sigma rule: Detects changes to the NGenAssemblyUsageLog registry key. .NET Usage Log output location can be controlled by setting th. Logsource: windows / registry_set. Rule: title: NET NGenAssemblyUsageLog Registry Key Tamper id: 28036918-04d3-423d-91c0-55ecf99fb892 status: test description: 'Detects changes to the NGenAssemblyUsageLog registry key. .NET Usage Log output location can be controlled by setting the NGenAssemblyUsageLog CLR configuration knob in the Registry or by configuring an environment variable (as described in the next section). By simplify specifying an arbitrary value (e.g. fake output location or junk data) for the expected value, a Usage Log file for the .NET execution context will not be created. ' references: - https://bohops.com/2021/03/16/investigating-net-clr-usage-log-tampering-techniques-for-edr-evasion/ author: frack113 date: 2022-11-18 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: SOFTWARE\Microsoft\.NETFramework\NGenAssemblyUsageLog condition: selection falsepositives: - Unknown level: high