alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: explain T1027.007 Dynamic API Resolution
Matching passage: T1027.007 Dynamic API Resolution. Tactics: stealth. Description: Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis. Malware commonly uses various [Native API](https://attack.mitre.org/techniques/T1106) functions provided by the OS to perform various tasks such as those involving processes, files, and other system artifacts. API functions called by malware may leave static artifacts such as strings in payload files. Defensive analysts may also uncover which functions a binary file may execute via an import address table (IAT) or other structures that help dynamically link calling code to the shared modules that provide functions.(Citation: Huntress API Hash)(Citation: IRED API Hashing) To avoid static or other defensive analysis, adversaries may use dynamic API resolution to conceal malware characteristics and functionalities. Similar to [Software Packing](https://attack.mitre.org/techniques/T1027/002), dynamic API resolution may change file signatures and obfuscate malicious API function calls until they are resolved and invoked during runtime. Various methods may be used to obfuscate malware calls to API functions. For example, hashes of function names are commonly stored in malware in lieu of literal strings. Malware can use these hashes (or other identifiers) to manually reproduce the linking and loading process using functions such as `GetProcAddress()` and `LoadLibrary()`. These hashes/identifiers can also be further obfuscated using encryption or other string manipulation tricks (requiring various forms of [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) during execution).(Citation: BlackHat API Packers)(Citation: Drakonia HInvoke)(Citation: Huntress API Hash)
Near-miss passage: T1027.014 Polymorphic Code. Tactics: stealth. Description: Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection. Polymorphic code is a type of software capable of changing its runtime footprint during code execution.(Citation: polymorphic-blackberry) With each execution of the software, the code is mutated into a different version of itself that achieves the same purpose or objective as the original. This functionality enables the malware to evade traditional signature-based defenses, such as antivirus and antimalware tools.(Citation: polymorphic-sentinelone) Other obfuscation techniques can be used in conjunction with polymorphic code to accomplish the intended effects, including using mutation engines to conduct actions such as [Software Packing](https://attack.mitre.org/techniques/T1027/002), [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010), or [Encrypted/Encoded File](https://attack.mitre.org/techniques/T1027/013).(Citation: polymorphic-linkedin)(Citation: polymorphic-medium)
Query: CWE for Incorrect Resource Transfer Between Spheres
Matching passage: CWE-669 Incorrect Resource Transfer Between Spheres. The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
Near-miss passage: CWE-280 Improper Handling of Insufficient Permissions or Privileges. The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.
Query: playbook for alert: Encoded PowerShell / command-line abuse matching Component Object Model
Matching passage: Playbook for T1559.001 Component Object Model. 1) Validate alert telemetry against T1559.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: execution. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods
Near-miss passage: Playbook for T1559.003 XPC Services. Different response path focused on execution.
Query: Outbound C2 pattern associated with Brute Force
Matching passage: T1110 Brute Force. Tactics: credential access. Description: Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.(Citation: Dragos Crashoverride 2018) Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), [Account Discovery](https://attack.mitre.org/techniques/T1087), or [Password Policy Discovery](https://attack.mitre.org/techniques/T1201). Adversaries may also combine brute forcing activity with behaviors such as [External Remote Services](https://attack.mitre.org/techniques/T1133) as part of Initial Access. If an adversary guesses the correct password but fails to login to a compromised account due to location-based conditional access policies, they may change their infrastructure until they match the victim’s location and therefore bypass those policies.(Citation: ReliaQuest Health Care Social Engineering Campaign 2024)
Near-miss passage: T1110.004 Credential Stuffing. Tactics: credential access. Description: Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed. The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts. Credential stuffing is a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies. Typically, management services over commonly used ports are used when stuffing credentials. Commonly targeted services include the following: * SSH (22/TCP) * Telnet (23/TCP) * FTP (21/TCP) * NetBIOS / SMB / Samba (139/TCP & 445/TCP) * LDAP (389/TCP) * Kerberos (88/TCP) * RDP / Terminal Services (3389/TCP) * HTTP/HTTP Management Services (80/TCP & 443/TCP) * MSSQL (1433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP) * VNC (5900/TCP) In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018)
Query: weakness User Interface (UI) Misrepresentation of Critical Information
Matching passage: CWE-451 User Interface (UI) Misrepresentation of Critical Information. The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
Near-miss passage: CWE-1323 Improper Management of Sensitive Trace Data. Trace data collected from several sources on the System-on-Chip (SoC) is stored in unprotected locations or transported to untrusted agents.
Query: risk of Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 12.1.0.2 allows remote attackers to affect confidentiality via unknown vectors.
Matching passage: CVE-2015-4755. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 12.1.0.2 allows remote attackers to affect confidentiality via unknown vectors.
Near-miss passage: CVE-2015-2595. CWE: UNKNOWN. CVSS: 6.5. Unspecified vulnerability in the Oracle OLAP component in Oracle Database Server 12.1.0.1 and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
Query: detect Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes. Tools like ProcessHacker an in logs
Matching passage: Sigma rule: Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes. Tools like ProcessHacker an. Logsource: windows / image_load. Rule: title: Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded id: bdc64095-d59a-42a2-8588-71fd9c9d9abc related: - id: 0e277796-5f23-4e49-a490-483131d4f6e1 type: similar status: test description: 'Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes. Tools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll. As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker''s machine. ' references: - https://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump - https://www.pinvoke.net/default.aspx/dbghelp/MiniDumpWriteDump.html - https://medium.com/@fsx30/bypass-edrs-memory-protection-introduction-to-hooking-2efb21acffd6 author: Perez Diego (@darkquassar), oscd.community, Ecco date: 2019-10-27 modified: 2022-12-09 tags: - attack.credential-access - attack.t1003.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: - \dbghelp.dll - \dbgcore.dll Signed: 'false' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: This rule detects the execution of Run Once task as configured in the registry. Logsource: windows / process_creation. Rule: title: Run Once Task Execution as Configured in Registry id: 198effb6-6c98-4d0c-9ea3-451fa143c45c status: test description: This rule detects the execution of Run Once task as configured in the registry references: - https://twitter.com/pabraeken/status/990717080805789697 - https://lolbas-project.github.io/lolbas/Binaries/Runonce/ - https://twitter.com/0gtweet/status/1602644163824156672?s=20&t=kuxbUnZPltpvFPZdCrqPXA author: Avneet Singh @v3t0_, oscd.community, Christopher Peacock @SecurePeacock (updated) date: 2020-10-18 modified: 2022-12-13 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \runonce.exe - Description: Run Once Wrapper selection_cli: - CommandLine|contains: /AlternateShellStartup - CommandLine|endswith: /r condition: all of selection_* falsepositives: - Unknown level: low
Query: CVE similar to CVE-2015-1047
Matching passage: CVE-2015-1047. CWE: CWE-20. CVSS: 5.0. vpxd in VMware vCenter Server 5.0 before u3e, 5.1 before u3, and 5.5 before u2 allows remote attackers to cause a denial of service via a long heartbeat message.
Near-miss passage: CVE-2015-6172. CWE: CWE-20. CVSS: 9.300000190734863. Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2016, Word 2013 RT SP1, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted email message processed by Outlook, aka "Microsoft Office RCE Vulnerability."
Query: alert when Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abus
Matching passage: Sigma rule: Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abus. Logsource: windows / file_event. Rule: title: Suspicious LNK Double Extension File Created id: 3215aa19-f060-4332-86d5-5602511f3ca8 related: - id: b4926b47-a9d7-434c-b3a0-adc3fa0bd13e type: derived status: test description: 'Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abuse the fact that Windows hides the "LNK" extension by default. ' references: - https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/ - https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations - https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles - https://twitter.com/malwrhunterteam/status/1235135745611960321 - https://twitter.com/luc4m/status/1073181154126254080 author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2022-11-07 modified: 2023-10-18 tags: - attack.stealth - attack.t1036.007 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: .lnk TargetFilename|contains: - .doc. - .docx. - .jpg. - .pdf. - .ppt. - .pptx. - .xls. - .xlsx. filter_main_recent: TargetFilename|contains: \AppData\Roaming\Microsoft\Windows\Recent\ filter_optional_office_recent: Image|endswith: - \excel.exe - \powerpnt.exe - \winword.exe TargetFilename|contains: \AppData\Roaming\Microsoft\Office\Recent\ filter_optional_office_excel: Image|endswith: \excel.exe TargetFilename|contains: \AppData\Roaming\Microsoft\Excel filter_optional_office_powerpoint: Image|endswith: \powerpnt.exe TargetFilename|contains: \AppData\Roaming\Microsoft\PowerPoint filter_optional_office_word: Image|endswith: \winword.exe TargetFilename|contains: \AppData\Roaming\Microsoft\Word condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Some tuning is required for other general purpose directories of third party apps level: medium regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_lnk_double_extension/info.yml
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64). Logsource: windows / file_event. Rule: title: UAC Bypass Using IEInstal - File id: bdd8157d-8e85-4397-bb82-f06cc9c71dbb status: test description: Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: file_event product: windows detection: selection: Image: C:\Program Files\Internet Explorer\IEInstal.exe TargetFilename|startswith: C:\Users\ TargetFilename|contains: \AppData\Local\Temp\ TargetFilename|endswith: consent.exe condition: selection falsepositives: - Unknown level: high
Query: write Sigma for Detects the execution of rundll32 with a command line that doesn't contain a common extension
Matching passage: Sigma rule: Detects the execution of rundll32 with a command line that doesn't contain a common extension. Logsource: windows / process_creation. Rule: title: Rundll32 Execution With Uncommon DLL Extension id: c3a99af4-35a9-4668-879e-c09aeb4f2bdf status: test description: Detects the execution of rundll32 with a command line that doesn't contain a common extension references: - https://twitter.com/mrd0x/status/1481630810495139841?s=12 author: Tim Shelton, Florian Roth (Nextron Systems), Yassine Oukessou date: 2022-01-13 modified: 2024-04-04 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE filter_main_null: CommandLine: null filter_main_empty: CommandLine: '' filter_main_known_extension: - CommandLine|contains: - '.cpl ' - .cpl, - .cpl" - .cpl' - '.dll ' - .dll, - .dll" - .dll' - '.inf ' - .inf, - .inf" - .inf' - CommandLine|endswith: - .cpl - .dll - '.inf' filter_main_localserver: CommandLine|contains: ' -localserver ' filter_main_zzzzInvokeManagedCustomActionOutOfProc: ParentImage|endswith: \msiexec.exe CommandLine|contains|all: - :\Windows\Installer\ - .tmp - zzzzInvokeManagedCustomActionOutOfProc filter_optional_EdgeUpdate: ParentCommandLine|contains|all: - :\Users\ - \AppData\Local\Microsoft\EdgeUpdate\Install\{ - \EDGEMITMP_ - .tmp\setup.exe - --install-archive= - --previous-version= - --msedgewebview --verbose-logging --do-not-launch-msedge --user-level condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any. Logsource: windows / process_creation. Rule: title: MpiExec Lolbin id: 729ce0ea-5d8f-4769-9762-e35de441586d status: test description: Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary references: - https://twitter.com/mrd0x/status/1465058133303246867 - https://learn.microsoft.com/en-us/powershell/high-performance-computing/mpiexec?view=hpc19-ps author: Florian Roth (Nextron Systems) date: 2022-01-11 modified: 2024-11-23 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_binary: - Image|endswith: \mpiexec.exe - Hashes|contains: IMPHASH=d8b52ef6aaa3a81501bdfff9dbb96217 selection_flags: CommandLine|contains: - ' /n 1 ' - ' -n 1 ' condition: all of selection* falsepositives: - Unknown level: high
Query: risk of Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified
Matching passage: CVE-2015-3069. CWE: CWE-284. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3062, CVE-2015-3063, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3071, CVE-2015-3072, CVE-2015-3073, and CVE-2015-3074.
Near-miss passage: CVE-2015-8021. CWE: CWE-284. CVSS: 4.300000190734863. Incomplete blacklist vulnerability in the Configuration utility in F5 BIG-IP LTM, Analytics, APM, ASM, GTM, Link Controller, and PSM 11.x before 11.2.1 HF11, 11.3.x, 11.4.0 before HF8, and 11.4.1 before HF6; BIG-IP AAM 11.4.0 before HF8 and 11.4.1 before HF6; BIG-IP AFM and PEM 11.3.x, 11.4.0 before HF8, and 11.4.1 before HF6; and BIG-IP Edge Gateway, WebAccelerator, and WOM 11.x before 11.2.1 HF11 and 11.3.0 allows remote authenticated users to upload files via uploadImage.php.
Query: detection rule: Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz
Matching passage: Sigma rule: Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz. Logsource: windows / security. Rule: title: Successful Overpass the Hash Attempt id: 192a0330-c20b-4356-90b6-7b7049ae0b87 status: test description: Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module. references: - https://web.archive.org/web/20220419045003/https://cyberwardog.blogspot.com/2017/04/chronicles-of-threat-hunter-hunting-for.html author: Roberto Rodriguez (source), Dominik Schaudel (rule) date: 2018-02-12 modified: 2021-11-27 tags: - attack.lateral-movement - attack.s0002 - attack.t1550.002 logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 9 LogonProcessName: seclogo AuthenticationPackageName: Negotiate condition: selection falsepositives: - Runas command-line tool using /netonly parameter level: high
Near-miss passage: Sigma rule: Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands. Logsource: windows / process_creation. Rule: title: PUA - Rclone Execution id: e37db05d-d1f9-49c8-b464-cee1a4b11638 related: - id: a0d63692-a531-4912-ad39-4393325b2a9c type: obsolete - id: cb7286ba-f207-44ab-b9e6-760d82b84253 type: obsolete status: test description: Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc references: - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/ - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a - https://labs.sentinelone.com/egregor-raas-continues-the-chaos-with-cobalt-strike-and-rclone - https://www.splunk.com/en_us/blog/security/darkside-ransomware-splunk-threat-update-and-detections.html author: Bhabesh Raj, Sittikorn S, Aaron Greetham (@beardofbinary) - NCC Group date: 2021-05-10 modified: 2023-03-05 tags: - attack.exfiltration - attack.t1567.002 logsource: product: windows category: process_creation detection: selection_specific_options: CommandLine|contains|all: - '--config ' - '--no-check-certificate ' - ' copy ' selection_rclone_img: - Image|endswith: \rclone.exe - Description: Rsync for cloud storage selection_rclone_cli: CommandLine|contains: - pass - user - copy - sync - config - lsd - remote - ls - mega - pcloud - ftp - ignore-existing - auto-confirm - transfers - multi-thread-streams - 'no-check-certificate ' condition: selection_specific_options or all of selection_rclone_* falsepositives: - Unknown level: high