alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: adversary uses Bootkit
Matching passage: T1542.003 Bootkit. Tactics: stealth, persistence. Description: Adversaries may use bootkits to persist on systems. A bootkit is a malware variant that modifies the boot sectors of a hard drive, allowing malicious code to execute before a computer's operating system has loaded. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly. In BIOS systems, a bootkit may modify the Master Boot Record (MBR) and/or Volume Boot Record (VBR).(Citation: Mandiant M Trends 2016) The MBR is the section of disk that is first loaded after completing hardware initialization by the BIOS. It is the location of the boot loader. An adversary who has raw access to the boot drive may overwrite this area, diverting execution during startup from the normal boot loader to adversary code.(Citation: Lau 2011) The MBR passes control of the boot process to the VBR. Similar to the case of MBR, an adversary who has raw access to the boot drive may overwrite the VBR to divert execution during startup to adversary code. In UEFI (Unified Extensible Firmware Interface) systems, a bootkit may instead create or modify files in the EFI system partition (ESP). The ESP is a partition on data storage used by devices containing UEFI that allows the system to boot the OS and other utilities used by the system. An adversary can use the newly created or patched files in the ESP to run malicious kernel code.(Citation: Microsoft Security)(Citation: welivesecurity)
Near-miss passage: T1542 Pre-OS Boot. Tactics: stealth, persistence. Description: Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting) Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.
Query: discovery using Cloud Service Dashboard
Matching passage: T1538 Cloud Service Dashboard. Tactics: discovery. Description: An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features. For example, the GCP Command Center can be used to view all assets, review findings of potential security risks, and run additional queries, such as finding public IP addresses and open ports.(Citation: Google Command Center Dashboard) Depending on the configuration of the environment, an adversary may be able to enumerate more information via the graphical dashboard than an API. This also allows the adversary to gain information without manually making any API requests.
Near-miss passage: T1673 Virtual Machine Discovery. Tactics: discovery. Description: An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host or hypervisor. For example, adversaries may enumerate a list of VMs on an ESXi hypervisor using a [Hypervisor CLI](https://attack.mitre.org/techniques/T1059/012) such as `esxcli` or `vim-cmd` (e.g. `esxcli vm process list or vim-cmd vmsvc/getallvms`).(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: TrendMicro Play) Adversaries may also directly leverage a graphical user interface, such as VMware vCenter, in order to view virtual machines on a host. Adversaries may use the information from [Virtual Machine Discovery](https://attack.mitre.org/techniques/T1673) during discovery to shape follow-on behaviors. Subsequently discovered VMs may be leveraged for follow-on activities such as [Service Stop](https://attack.mitre.org/techniques/T1489) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486).(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)
Query: alert when Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation
Matching passage: Sigma rule: Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation. Logsource: windows / process_creation. Rule: title: Powershell Token Obfuscation - Process Creation id: deb9b646-a508-44ee-b7c9-d8965921c6b6 related: - id: f3a98ce4-6164-4dd4-867c-4d83de7eca51 type: similar status: test description: Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation references: - https://github.com/danielbohannon/Invoke-Obfuscation author: frack113 date: 2022-12-27 modified: 2026-03-16 tags: - attack.stealth - attack.t1027.009 logsource: category: process_creation product: windows detection: selection: - CommandLine|re: \w+`(?:\w+|-|.)`[\w+|\s] - CommandLine|re: '"(?:\{\d\})+"\s*-f' - CommandLine|re: (?i)\$\{`?e`?n`?v`?:`?p`?a`?t`?h`?\} filter_main_envpath: CommandLine|contains: ${env:path} condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detec. Logsource: macos / process_creation. Rule: title: Scheduled Cron Task/Job - MacOs id: 7c3b43d8-d794-47d2-800a-d277715aa460 status: test description: Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md author: Alejandro Ortuno, oscd.community date: 2020-10-06 modified: 2022-11-27 tags: - attack.execution - attack.persistence - attack.privilege-escalation - attack.t1053.003 logsource: category: process_creation product: macos detection: selection: Image|endswith: /crontab CommandLine|contains: /tmp/ condition: selection falsepositives: - Legitimate administration activities level: medium
Query: explain CWE-34
Matching passage: CWE-34 Path Traversal: '....//'. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '....//' (doubled dot dot slash) sequences that can resolve to a location that is outside of that directory.
Near-miss passage: CWE-140 Improper Neutralization of Delimiters. The product does not neutralize or incorrectly neutralizes delimiters.
Query: CWE for Improper Control of Dynamically-Managed Code Resources
Matching passage: CWE-913 Improper Control of Dynamically-Managed Code Resources. The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
Near-miss passage: CWE-172 Encoding Error. The product does not properly encode or decode the data, resulting in unexpected values.
Query: patch priority for CVE-2015-6418
Matching passage: CVE-2015-6418. CWE: CWE-200. CVSS: 4.300000190734863. The random-number generator on Cisco Small Business RV routers 4.x and SA500 security appliances 2.2.07 does not have sufficient entropy, which makes it easier for remote attackers to determine a TLS key pair via unspecified computations upon handshake key-exchange data, aka Bug ID CSCus15224.
Near-miss passage: CVE-2015-5070. CWE: CWE-200. CVSS: 3.0999999046325684. The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensitive filesystem is used, allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5069.
Query: secure coding against Authentication Bypass by Primary Weakness
Matching passage: CWE-305 Authentication Bypass by Primary Weakness. The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
Near-miss passage: CWE-606 Unchecked Input for Loop Condition. The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
Query: detect Detects Obfuscated Powershell via COMPRESS OBFUSCATION in logs
Matching passage: Sigma rule: Detects Obfuscated Powershell via COMPRESS OBFUSCATION. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell id: 20e5497e-331c-4cd5-8d36-935f6e2a9a07 status: test description: Detects Obfuscated Powershell via COMPRESS OBFUSCATION references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|contains|all: - new-object - text.encoding]::ascii ScriptBlockText|contains: - system.io.compression.deflatestream - system.io.streamreader ScriptBlockText|endswith: readtoend condition: selection_4104 falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.. Logsource: proxy. Rule: title: Potential Base64 Encoded User-Agent id: 894a8613-cf12-48b3-8e57-9085f54aa0c3 related: - id: d443095b-a221-4957-a2c4-cd1756c9b747 type: derived status: test description: Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding. references: - https://blogs.jpcert.or.jp/en/2022/07/yamabot.html - https://deviceatlas.com/blog/list-of-user-agent-strings#desktop author: Florian Roth (Nextron Systems), Brian Ingram (update) date: 2022-07-08 modified: 2023-05-04 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent|endswith: '=' condition: selection falsepositives: - Unknown level: medium
Query: secure coding against Failure to Handle Missing Parameter
Matching passage: CWE-234 Failure to Handle Missing Parameter. If too few arguments are sent to a function, the function will still pop the expected number of arguments from the stack. Potentially, a variable number of arguments could be exhausted in a function as well.
Near-miss passage: CWE-67 Improper Handling of Windows Device Names. The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file.
Query: detect Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target in logs
Matching passage: Sigma rule: Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target. Logsource: aws / cloudtrail. Rule: title: AWS EFS Fileshare Mount Modified or Deleted id: 6a7ba45c-63d8-473e-9736-2eaabff79964 status: test description: Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts. references: - https://docs.aws.amazon.com/efs/latest/ug/API_DeleteMountTarget.html author: Austin Songer @austinsonger date: 2021-08-15 modified: 2022-10-09 tags: - attack.impact - attack.t1485 logsource: product: aws service: cloudtrail detection: selection: eventSource: elasticfilesystem.amazonaws.com eventName: DeleteMountTarget condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of WebBrowserPassView.exe. A password recovery tool that reveals the passwords stored by the follo. Logsource: windows / process_creation. Rule: title: PUA - WebBrowserPassView Execution id: d0dae994-26c6-4d2d-83b5-b3c8b79ae513 status: test description: Detects the execution of WebBrowserPassView.exe. A password recovery tool that reveals the passwords stored by the following Web browsers, Internet Explorer (Version 4.0 - 11.0), Mozilla Firefox (All Versions), Google Chrome, Safari, and Opera references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1555.003/T1555.003.md author: frack113 date: 2022-08-20 modified: 2023-02-14 tags: - attack.credential-access - attack.t1555.003 logsource: category: process_creation product: windows detection: selection: - Description: Web Browser Password Viewer - Image|endswith: \WebBrowserPassView.exe condition: selection falsepositives: - Legitimate use level: medium
Query: alert when Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been
Matching passage: Sigma rule: Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been. Logsource: aws / cloudtrail. Rule: title: New Network ACL Entry Added id: e1f7febb-7b94-4234-b5c6-00fb8500f5dd status: test description: 'Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been opened up in the AWS account. ' references: - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/ author: jamesc-grafana date: 2024-07-11 tags: - attack.defense-impairment - attack.t1686.001 logsource: product: aws service: cloudtrail detection: selection: eventSource: ec2.amazonaws.com eventName: CreateNetworkAclEntry condition: selection falsepositives: - Legitimate use of ACLs to enable customer and staff access from the public internet into a public VPC level: low
Near-miss passage: Sigma rule: Detects any GAC DLL being loaded by an Office Product. Logsource: windows / image_load. Rule: title: GAC DLL Loaded Via Office Applications id: 90217a70-13fc-48e4-b3db-0d836c5824ac status: test description: Detects any GAC DLL being loaded by an Office Product references: - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16 author: Antonlovesdnb date: 2020-02-19 modified: 2023-02-10 tags: - attack.execution - attack.t1204.002 logsource: category: image_load product: windows detection: selection: Image|endswith: - \excel.exe - \mspub.exe - \onenote.exe - \onenoteim.exe - \outlook.exe - \powerpnt.exe - \winword.exe ImageLoaded|startswith: C:\Windows\Microsoft.NET\assembly\GAC_MSIL condition: selection falsepositives: - Legitimate macro usage. Add the appropriate filter according to your environment level: high
Query: SIEM correlation: stealth activity consistent with VDSO Hijacking
Matching passage: T1055.014 VDSO Hijacking. Tactics: stealth, privilege escalation. Description: Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process-based defenses as well as possibly elevate privileges. Virtual dynamic shared object (vdso) hijacking is a method of executing arbitrary code in the address space of a separate live process. VDSO hijacking involves redirecting calls to dynamically linked shared libraries. Memory protections may prevent writing executable code to a process via [Ptrace System Calls](https://attack.mitre.org/techniques/T1055/008). However, an adversary may hijack the syscall interface code stubs mapped into a process from the vdso shared object to execute syscalls to open and map a malicious shared object. This code can then be invoked by redirecting the execution flow of the process via patched memory address references stored in a process' global offset table (which store absolute addresses of mapped library functions).(Citation: ELF Injection May 2009)(Citation: Backtrace VDSO)(Citation: VDSO Aug 2005)(Citation: Syscall 2014) Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via VDSO hijacking may also evade detection from security products since the execution is masked under a legitimate process.
Near-miss passage: T1055.004 Asynchronous Procedure Call. Tactics: stealth, privilege escalation. Description: Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges. APC injection is a method of executing arbitrary code in the address space of a separate live process. APC injection is commonly performed by attaching malicious code to the APC Queue (Citation: Microsoft APC) of a process's thread. Queued APC functions are executed when the thread enters an alterable state.(Citation: Microsoft APC) A handle to an existing victim process is first created with native Windows API calls such as <code>OpenThread</code>. At this point <code>QueueUserAPC</code> can be used to invoke a function (such as <code>LoadLibrayA</code> pointing to a malicious DLL). A variation of APC injection, dubbed "Early Bird injection", involves creating a suspended process in which malicious code can be written and executed before the process' entry point (and potentially subsequent anti-malware hooks) via an APC. (Citation: CyberBit Early Bird Apr 2018) AtomBombing (Citation: ENSIL AtomBombing Oct 2016) is another variation that utilizes APCs to invoke malicious code previously written to the global atom table.(Citation: Microsoft Atom Table) Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via APC injection may also evade detection from security products since the execution is masked under a legitimate process.
Query: vulnerability: The Endpoint Manager for Remote Control component in IBM Tivoli Endpoint Manager for Lifecycle Management 9.0.1 before IF6 and 9.1.0 before IF6 does not set the secure flag for the
Matching passage: CVE-2015-1915. CWE: CWE-200. CVSS: 4.300000190734863. The Endpoint Manager for Remote Control component in IBM Tivoli Endpoint Manager for Lifecycle Management 9.0.1 before IF6 and 9.1.0 before IF6 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Near-miss passage: CVE-2015-1765. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to read the browser history via a crafted web site.
Query: exploit Cross-site request forgery (CSRF) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0
Matching passage: CVE-2015-5050. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Near-miss passage: CVE-2015-10001. CWE: CWE-352. CVSS: 4.300000190734863. The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads
Query: vulnerability: Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, and Office for Mac 2011 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memo
Matching passage: CVE-2015-2469. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, and Office for Mac 2011 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-7096. CWE: CWE-119. CVSS: 6.800000190734863. WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.
Query: CVE similar to CVE-2015-0151
Matching passage: CVE-2015-0151. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in D-Link DIR-815 devices with firmware before 2.07.B01 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Near-miss passage: CVE-2015-1581. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Mobile Domain plugin 1.5.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2) domain, (3) text, (4) font, (5) fontcolor, (6) color, or (7) padding parameter in an add-domain action in the mobile-domain page to wp-admin/options-general.php.
Query: rule covering Detects potential JNDI Injection exploitation. Often coupled with Log4Shell exploitation.
Matching passage: Sigma rule: Detects potential JNDI Injection exploitation. Often coupled with Log4Shell exploitation.. Logsource: jvm / application. Rule: title: Potential JNDI Injection Exploitation In JVM Based Application id: bb0e9cec-d4da-46f5-997f-22efc59f3dca status: test description: Detects potential JNDI Injection exploitation. Often coupled with Log4Shell exploitation. references: - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs - https://secariolabs.com/research/analysing-and-reproducing-poc-for-log4j-2-15-0 author: Moti Harmats date: 2023-02-11 tags: - attack.initial-access - attack.t1190 logsource: category: application product: jvm definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)' detection: keywords: - com.sun.jndi.ldap. - org.apache.logging.log4j.core.net.JndiManager condition: keywords falsepositives: - Application bugs level: high
Near-miss passage: Sigma rule: Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature t. Logsource: windows / network_connection. Rule: title: Network Connection Initiated To DevTunnels Domain id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4 related: - id: 4b657234-038e-4ad5-997c-4be42340bce4 type: similar - id: b3e6418f-7c7a-4fad-993a-93b65027a9f1 type: similar - id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b type: similar status: test description: 'Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. ' references: - https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2 - https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security - https://cydefops.com/devtunnels-unleashed author: Kamran Saifullah date: 2023-11-20 tags: - attack.exfiltration - attack.command-and-control - attack.t1567.001 - attack.t1572 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationHostname|endswith: .devtunnels.ms condition: selection falsepositives: - Legitimate use of Devtunnels will also trigger this. level: medium