alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Outbound C2 pattern associated with Patch System Image
Matching passage: T1601.001 Patch System Image. Tactics: defense impairment. Description: Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses.(Citation: Killing the myth of Cisco IOS rootkits) (Citation: Killing IOS diversity myth) (Citation: Cisco IOS Shellcode) (Citation: Cisco IOS Forensics Developments) (Citation: Juniper Netscreen of the Dead) Some network devices are built with a monolithic architecture, where the entire operating system and most of the functionality of the device is contained within a single file. Adversaries may change this file in storage, to be loaded in a future boot, or in memory during runtime. To change the operating system in storage, the adversary will typically use the standard procedures available to device operators. This may involve downloading a new file via typical protocols used on network devices, such as TFTP, FTP, SCP, or a console connection. The original file may be overwritten, or a new file may be written alongside of it and the device reconfigured to boot to the compromised image. To change the operating system in memory, the adversary typically can use one of two methods. In the first, the adversary would make use of native debug commands in the original, unaltered running operating system that allow them to directly modify the relevant memory addresses containing the running operating system. This method typically requires administrative level access to the device. In the second method for changing the operating system in memory, the adversary would make use of the boot loader. The boot loader is the first piece of software that loads when the device starts that, in turn, will launch the operating system. Adversaries may use malicious code previously implanted in the boot loader, such as through the [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) method, to directly manipulate running operating system code in memory. This malicious code in the bootloader provides the capability of direct memory manipulation to the adversary,
Near-miss passage: T1601 Modify System Image. Tactics: defense impairment. Description: Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves. On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file. To change the operating system, the adversary typically only needs to affect this one file, replacing or modifying it. This can either be done live in memory during system runtime for immediate effect, or in storage to implement the change on the next boot of the network device.
Query: how to detect Automated Exfiltration
Matching passage: T1020 Automated Exfiltration. Tactics: exfiltration. Description: Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.(Citation: ESET Gamaredon June 2020) When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).
Near-miss passage: T1020.001 Traffic Duplication. Tactics: exfiltration. Description: Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis. For example, devices may be configured to forward network traffic to one or more destinations for analysis by a network analyzer or other monitoring device. (Citation: Cisco Traffic Mirroring)(Citation: Juniper Traffic Mirroring) Adversaries may abuse traffic mirroring to mirror or redirect network traffic through other infrastructure they control. Malicious modifications to network devices to enable traffic redirection may be possible through [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) or [Patch System Image](https://attack.mitre.org/techniques/T1601/001).(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks) Many cloud-based environments also support traffic mirroring. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to.(Citation: AWS Traffic Mirroring)(Citation: GCP Packet Mirroring)(Citation: Azure Virtual Network TAP) Adversaries may use traffic duplication in conjunction with [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Input Capture](https://attack.mitre.org/techniques/T1056), or [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) depending on the goals and objectives of the adversary.
Query: Sigma rule for Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live
Matching passage: Sigma rule: Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live. Logsource: windows / process_creation. Rule: title: Ruby Inline Command Execution id: 20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8 status: test description: Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code. references: - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet - https://www.revshells.com/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-02 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \ruby.exe - OriginalFileName: ruby.exe selection_cli: CommandLine|contains: ' -e' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash. Logsource: windows / create_stream_hash. Rule: title: Hidden Executable In NTFS Alternate Data Stream id: b69888d4-380c-45ce-9cf9-d9ce46e67821 status: test description: Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash references: - https://twitter.com/0xrawsec/status/1002478725605273600?s=21 author: Florian Roth (Nextron Systems), @0xrawsec date: 2018-06-03 modified: 2023-02-10 tags: - attack.stealth - attack.s0139 - attack.t1564.004 logsource: product: windows category: create_stream_hash definition: 'Requirements: Sysmon or equivalent configured with Imphash logging' detection: selection: Hash|contains: IMPHASH= filter_main_null: Hash|contains: IMPHASH=00000000000000000000000000000000 condition: selection and not 1 of filter_main_* falsepositives: - This rule isn't looking for any particular binary characteristics. As legitimate installers and programs were seen embedding hidden binaries in their ADS. Some false positives are expected from browser processes and similar. level: medium
Query: weakness Only Filtering Special Elements Relative to a Marker
Matching passage: CWE-796 Only Filtering Special Elements Relative to a Marker. The product receives data from an upstream component, but only accounts for special elements positioned relative to a marker (e.g. at the beginning/end of a string; the second argument), thereby missing remaining special elements that may exist before sending it to a downstream component.
Near-miss passage: CWE-638 Not Using Complete Mediation. The product does not perform access checks on a resource every time the resource is accessed by an entity, which can create resultant weaknesses if that entity's rights or privileges change over time.
Query: rule covering Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".
Matching passage: Sigma rule: Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".. Logsource: windows / process_creation. Rule: title: User Added to Local Administrators Group id: ad720b90-25ad-43ff-9b5e-5c841facc8e5 related: - id: ffa28e60-bdb1-46e0-9f82-05f7a61cc06e type: similar - id: 10fb649c-3600-4d37-b1e6-56ea90bb7e09 type: similar status: test description: Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember". references: - https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-08-12 modified: 2023-03-02 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: category: process_creation product: windows detection: selection_main: - CommandLine|contains|all: - 'localgroup ' - ' /add' - CommandLine|contains|all: - 'Add-LocalGroupMember ' - ' -Group ' selection_group: CommandLine|contains: - ' administrators ' - ' administrateur' condition: all of selection_* falsepositives: - Administrative activity level: medium
Near-miss passage: Sigma rule: Detects PowerShell download and execution cradles.. Logsource: windows / process_creation. Rule: title: PowerShell Download and Execution Cradles id: 85b0b087-eddf-4a2b-b033-d771fa2b9775 status: test description: Detects PowerShell download and execution cradles. references: - https://github.com/VirtualAlllocEx/Payload-Download-Cradles/blob/88e8eca34464a547c90d9140d70e9866dcbc6a12/Download-Cradles.cmd - https://labs.withsecure.com/publications/fin7-target-veeam-servers author: Florian Roth (Nextron Systems) date: 2022-03-24 modified: 2025-07-18 tags: - attack.execution - attack.t1059 logsource: product: windows category: process_creation detection: selection_download: CommandLine|contains: - .DownloadString( - .DownloadFile( - 'Invoke-WebRequest ' - 'iwr ' - 'Invoke-RestMethod ' - 'irm ' selection_iex: CommandLine|contains: - ;iex $ - '| IEX' - '|IEX ' - I`E`X - I`EX - IE`X - 'iex ' - IEX ( - IEX( - Invoke-Expression condition: all of selection_* falsepositives: - Some PowerShell installers were seen using similar combinations. Apply filters accordingly level: high
Query: patch priority for CVE-2015-1245
Matching passage: CVE-2015-1245. CWE: UNKNOWN. CVSS: 6.800000190734863. Use-after-free vulnerability in the OpenPDFInReaderView::Update function in browser/ui/views/location_bar/open_pdf_in_reader_view.cc in Google Chrome before 41.0.2272.76 might allow user-assisted remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by triggering interaction with a PDFium "Open PDF in Reader" button that has an invalid tab association.
Near-miss passage: CVE-2015-8320. CWE: UNKNOWN. CVSS: 5.0. Apache Cordova-Android before 3.7.0 improperly generates random values for BridgeSecret data, which makes it easier for attackers to conduct bridge hijacking attacks by predicting a value.
Query: detect Detects default RemCom pipe creation in logs
Matching passage: Sigma rule: Detects default RemCom pipe creation. Logsource: windows / pipe_created. Rule: title: PUA - RemCom Default Named Pipe id: d36f87ea-c403-44d2-aa79-1a0ac7c24456 related: - id: 9e77ed63-2ecf-4c7b-b09d-640834882028 type: obsolete status: test description: Detects default RemCom pipe creation references: - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view - https://github.com/kavika13/RemCom author: Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2023-08-07 modified: 2023-11-30 tags: - attack.lateral-movement - attack.t1021.002 - attack.execution - attack.t1569.002 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName|contains: \RemCom condition: selection falsepositives: - Legitimate Administrator activity level: medium
Near-miss passage: Sigma rule: Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as thre. Logsource: windows / process_creation. Rule: title: Phishing Pattern ISO in Archive id: fcdf69e5-a3d3-452a-9724-26f2308bf2b1 status: test description: Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web) references: - https://twitter.com/1ZRR4H/status/1534259727059787783 - https://app.any.run/tasks/e1fe6a62-bce8-4323-a49a-63795d9afd5d/ author: Florian Roth (Nextron Systems) date: 2022-06-07 tags: - attack.initial-access - attack.t1566 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \Winrar.exe - \7zFM.exe - \peazip.exe Image|endswith: - \isoburn.exe - \PowerISO.exe - \ImgBurn.exe condition: selection falsepositives: - Legitimate cases in which archives contain ISO or IMG files and the user opens the archive and the image via clicking and not extraction level: high
Query: rule covering Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and es
Matching passage: Sigma rule: Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and es. Logsource: aws / cloudtrail. Rule: title: AWS STS GetSessionToken Misuse id: b45ab1d2-712f-4f01-a751-df3826969807 status: test description: Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges. references: - https://github.com/elastic/detection-rules/pull/1213 - https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html author: Austin Songer @austinsonger date: 2021-07-24 modified: 2022-10-09 tags: - attack.lateral-movement - attack.privilege-escalation - attack.t1548 - attack.t1550 - attack.t1550.001 logsource: product: aws service: cloudtrail detection: selection: eventSource: sts.amazonaws.com eventName: GetSessionToken userIdentity.type: IAMUser condition: selection falsepositives: - GetSessionToken may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. GetSessionToken from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Near-miss passage: Sigma rule: Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID. Logsource: azure / signinlogs. Rule: title: Account Lockout id: 2b7d6fc0-71ac-4cf7-8ed1-b5788ee5257a status: test description: Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts author: AlertIQ date: 2021-10-10 modified: 2022-12-25 tags: - attack.credential-access - attack.t1110 logsource: product: azure service: signinlogs detection: selection: ResultType: 50053 condition: selection falsepositives: - Unknown level: medium
Query: rule covering Detects the creation of a office macro file from a a suspicious process
Matching passage: Sigma rule: Detects the creation of a office macro file from a a suspicious process. Logsource: windows / file_event. Rule: title: Office Macro File Creation From Suspicious Process id: b1c50487-1967-4315-a026-6491686d860e status: test description: Detects the creation of a office macro file from a a suspicious process references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-01-23 modified: 2023-02-22 tags: - attack.initial-access - attack.t1566.001 logsource: category: file_event product: windows definition: 'Requirements: The "ParentImage" field is not available by default on EID 11 of Sysmon logs. To be able to use this rule to the full extent you need to enriche the log with additional ParentImage data' detection: selection_cmd: - Image|endswith: - \cscript.exe - \mshta.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - ParentImage|endswith: - \cscript.exe - \mshta.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe selection_ext: TargetFilename|endswith: - .docm - .dotm - .xlsm - .xltm - .potm - .pptm condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.. Logsource: windows / process_creation. Rule: title: Cloudflared Tunnel Connections Cleanup id: 7050bba1-1aed-454e-8f73-3f46f09ce56a status: test description: Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections. references: - https://github.com/cloudflare/cloudflared - https://developers.cloudflare.com/cloudflare-one/connections/connect-apps author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-17 modified: 2023-12-21 tags: - attack.command-and-control - attack.t1102 - attack.t1090 - attack.t1572 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - ' tunnel ' - 'cleanup ' CommandLine|contains: - '-config ' - '-connector-id ' condition: selection falsepositives: - Legitimate usage of Cloudflared. level: medium
Query: CVE similar to CVE-2015-1596
Matching passage: CVE-2015-1596. CWE: CWE-310. CVSS: 5.800000190734863. The Siemens SPCanywhere application for Android and iOS does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Near-miss passage: CVE-2015-8329. CWE: CWE-310. CVSS: 5.0. SAP Manufacturing Integration and Intelligence (aka MII, formerly xMII) uses weak encryption (Base64 and DES), which allows attackers to conduct downgrade attacks and decrypt passwords via unspecified vectors, aka SAP Security Note 2240274.
Query: Suspicious Outlook Home Page execution detected on endpoint
Matching passage: T1137.004 Outlook Home Page. Tactics: persistence. Description: Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system. Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders. This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened. A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page.(Citation: SensePost Outlook Home Page) Once malicious home pages have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious Home Pages will execute when the right Outlook folder is loaded/reloaded.(Citation: SensePost Outlook Home Page)
Near-miss passage: T1137.001 Office Template Macros. Tactics: persistence. Description: Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Microsoft Office contains templates that are part of common Office applications and are used to customize styles. The base templates within the application are used each time an application starts. (Citation: Microsoft Change Normal Template) Office Visual Basic for Applications (VBA) macros (Citation: MSDN VBA in Office) can be inserted into the base template and used to execute code when the respective Office application starts in order to obtain persistence. Examples for both Word and Excel have been discovered and published. By default, Word has a Normal.dotm template created that can be modified to include a malicious macro. Excel does not have a template file created by default, but one can be added that will automatically be loaded.(Citation: enigma0x3 normal.dotm)(Citation: Hexacorn Office Template Macros) Shared templates may also be stored and pulled from remote locations.(Citation: GlobalDotName Jun 2019) Word Normal.dotm location:<br> <code>C:\Users\&lt;username&gt;\AppData\Roaming\Microsoft\Templates\Normal.dotm</code> Excel Personal.xlsb location:<br> <code>C:\Users\&lt;username&gt;\AppData\Roaming\Microsoft\Excel\XLSTART\PERSONAL.XLSB</code> Adversaries may also change the location of the base template to point to their own by hijacking the application's search order, e.g. Word 2016 will first look for Normal.dotm under <code>C:\Program Files (x86)\Microsoft Office\root\Office16\</code>, or by modifying the GlobalDotName registry key. By modifying the GlobalDotName registry key an adversary can specify an arbitrary location, file name, and file extension to use for the template that will be loaded on application startup. To abuse GlobalDotName, adversaries may first need to register the template as a trusted document or place it in a trusted location.(Citation: GlobalDotName Jun 2019) An adversary may need to enable macros to execute unrestricted depending