alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Multiple failed authentications followed by Threat Intel Vendors
Matching passage: T1597.001 Threat Intel Vendors. Tactics: reconnaissance. Description: Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures.(Citation: D3Secutrity CTI Feeds) Adversaries may search in private threat intelligence vendor data to gather actionable information. If a threat actor is searching for information on their own activities, that falls under [Search Threat Vendor Data](https://attack.mitre.org/techniques/T1681). Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Near-miss passage: T1597.002 Purchase Technical Data. Tactics: reconnaissance. Description: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure.(Citation: ZDNET Selling Data) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
Query: risk of Race condition in resolver.c in named in ISC BIND 9.9.8 before 9.9.8-P2 and 9.10.3 before 9.10.3-P2 allows remote attackers to cause a denial of service (INSIST assertion failure a
Matching passage: CVE-2015-8461. CWE: CWE-362. CVSS: 7.099999904632568. Race condition in resolver.c in named in ISC BIND 9.9.8 before 9.9.8-P2 and 9.10.3 before 9.10.3-P2 allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via unspecified vectors.
Near-miss passage: CVE-2015-7553. CWE: CWE-362. CVSS: 4.699999809265137. Race condition in the kernel in Red Hat Enterprise Linux 7, kernel-rt and Red Hat Enterprise MRG 2, when the nfnetlink_log module is loaded, allows local users to cause a denial of service (panic) by creating netlink sockets.
Query: risk of Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Mem
Matching passage: CVE-2015-0025. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0023.
Near-miss passage: CVE-2015-1083. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Query: detection rule: Detects WmiPrvSE spawning a process
Matching passage: Sigma rule: Detects WmiPrvSE spawning a process. Logsource: windows / process_creation. Rule: title: WmiPrvSE Spawned A Process id: d21374ff-f574-44a7-9998-4a8c8bf33d7d related: - id: 8a582fe2-0882-4b89-a82a-da6b2dc32937 type: similar - id: 692f0bec-83ba-4d04-af7e-e884a96059b6 type: similar status: stable description: Detects WmiPrvSE spawning a process references: - https://threathunterplaybook.com/hunts/windows/190815-RemoteServiceInstallation/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-08-15 modified: 2023-03-23 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \WmiPrvSe.exe filter_logonid: LogonId: - '0x3e7' - 'null' filter_system_user: User|contains: - AUTHORI - AUTORI filter_wmiprvse: Image|endswith: \WmiPrvSE.exe filter_werfault: Image|endswith: \WerFault.exe filter_null: LogonId: null condition: selection and not 1 of filter_* falsepositives: - False positives are expected (e.g. in environments where WinRM is used legitimately) level: medium
Near-miss passage: Sigma rule: Attackers can use print.exe for remote file copy. Logsource: windows / process_creation. Rule: title: Abusing Print Executable id: bafac3d6-7de9-4dd9-8874-4a1194b493ed status: test description: Attackers can use print.exe for remote file copy references: - https://lolbas-project.github.io/lolbas/Binaries/Print/ - https://twitter.com/Oddvarmoe/status/985518877076541440 author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative date: 2020-10-05 modified: 2022-07-07 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: Image|endswith: \print.exe CommandLine|startswith: print CommandLine|contains|all: - /D - .exe filter_print: CommandLine|contains: print.exe condition: selection and not filter_print falsepositives: - Unknown level: medium
Query: risk of common/partial_circular_buffer.cc in Google Chrome before 43.0.2357.65 does not properly handle wraps, which allows remote attackers to bypass a sandbox protection mechanism or cau
Matching passage: CVE-2015-1252. CWE: CWE-119. CVSS: 7.5. common/partial_circular_buffer.cc in Google Chrome before 43.0.2357.65 does not properly handle wraps, which allows remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-of-bounds write) via vectors that trigger a write operation with a large amount of data, related to the PartialCircularBuffer::Write and PartialCircularBuffer::DoWrite functions.
Near-miss passage: CVE-2015-7086. CWE: CWE-119. CVSS: 6.599999904632568. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
Query: secure coding against Plaintext Storage of a Password
Matching passage: CWE-256 Plaintext Storage of a Password. The product stores a password in plaintext within resources such as memory or files.
Near-miss passage: CWE-23 Relative Path Traversal. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as .. that can resolve to a location that is outside of that directory.
Query: detect Detects when a new admin is created. in logs
Matching passage: Sigma rule: Detects when a new admin is created.. Logsource: azure / auditlogs. Rule: title: Privileged Account Creation id: f7b5b004-dece-46e4-a4a5-f6fd0e1c6947 status: test description: Detects when a new admin is created. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#changes-to-privileged-accounts author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Tim Shelton date: 2022-08-11 modified: 2022-08-16 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.stealth - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: properties.message|contains|all: - Add user - Add member to role Status: Success condition: selection falsepositives: - A legitimate new admin account being created level: medium
Near-miss passage: Sigma rule: Detects some Empire PowerShell UAC bypass methods. Logsource: windows / process_creation. Rule: title: HackTool - Empire PowerShell UAC Bypass id: 3268b746-88d8-4cd3-bffc-30077d02c787 status: stable description: Detects some Empire PowerShell UAC bypass methods references: - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-EventVwrBypass.ps1#L64 - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-FodHelperBypass.ps1#L64 author: Ecco date: 2019-08-30 modified: 2023-02-21 tags: - attack.privilege-escalation - attack.t1548.002 - car.2019-04-001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - ' -NoP -NonI -w Hidden -c $x=$((gp HKCU:Software\Microsoft\Windows Update).Update)' - ' -NoP -NonI -c $x=$((gp HKCU:Software\Microsoft\Windows Update).Update);' condition: selection falsepositives: - Unknown level: critical
Query: patch priority for CVE-2015-5674
Matching passage: CVE-2015-5674. CWE: CWE-20. CVSS: 6.5. The routed daemon in FreeBSD 9.3 before 9.3-RELEASE-p22, 10.2-RC2 before 10.2-RC2-p1, 10.2-RC1 before 10.2-RC1-p2, 10.2 before 10.2-BETA2-p3, and 10.1 before 10.1-RELEASE-p17 allows remote authenticated users to cause a denial of service (assertion failure and daemon exit) via a query from a network that is not directly connected.
Near-miss passage: CVE-2015-2514. CWE: CWE-20. CVSS: 9.300000190734863. Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted .jnt file, aka "Windows Journal RCE Vulnerability," a different vulnerability than CVE-2015-2513 and CVE-2015-2530.
Query: detection rule: Detects activity when a security-enabled global group is deleted
Matching passage: Sigma rule: Detects activity when a security-enabled global group is deleted. Logsource: windows / security. Rule: title: A Security-Enabled Global Group Was Deleted id: b237c54b-0f15-4612-a819-44b735e0de27 related: - id: 9cf01b6c-e723-4841-a868-6d7f8245ca6e type: obsolete status: stable description: Detects activity when a security-enabled global group is deleted references: - https://www.cisecurity.org/controls/cis-controls-list/ - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4730 - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=634 author: Alexandr Yampolskyi, SOC Prime date: 2023-04-26 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: windows service: security detection: selection: EventID: - 4730 - 634 condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects when PIM alerts are set to disabled.. Logsource: azure / auditlogs. Rule: title: PIM Alert Setting Changes To Disabled id: aeaef14c-e5bf-4690-a9c8-835caad458bd status: test description: Detects when PIM alerts are set to disabled. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H' date: 2022-08-09 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.stealth - attack.t1078 logsource: product: azure service: auditlogs detection: selection: properties.message: Disable PIM Alert condition: selection falsepositives: - Administrator disabling PIM alerts as an active choice. level: high
Query: rule covering Detects netsh commands that turns off the Windows firewall
Matching passage: Sigma rule: Detects netsh commands that turns off the Windows firewall. Logsource: windows / process_creation. Rule: title: Firewall Disabled via Netsh.EXE id: 57c4bf16-227f-4394-8ec7-1b745ee061c3 status: test description: Detects netsh commands that turns off the Windows firewall references: - https://www.winhelponline.com/blog/enable-and-disable-windows-firewall-quickly-using-command-line/ - https://app.any.run/tasks/210244b9-0b6b-4a2c-83a3-04bd3175d017/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md#atomic-test-1---disable-microsoft-defender-firewall author: Fatih Sirin date: 2019-11-01 modified: 2023-02-13 tags: - attack.defense-impairment - attack.t1686.003 - attack.s0108 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli_1: CommandLine|contains|all: - firewall - set - opmode - disable selection_cli_2: CommandLine|contains|all: - advfirewall - set - state - 'off' condition: selection_img and 1 of selection_cli_* falsepositives: - Legitimate administration activity level: medium
Near-miss passage: Sigma rule: Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SA. Logsource: windows / ps_script. Rule: title: Winlogon Helper DLL id: 851c506b-6b7c-4ce2-8802-c703009d03c0 status: test description: 'Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\Software[Wow6432Node]Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are used to manage additional helper programs and functionalities that support Winlogon. Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.004/T1547.004.md author: Timur Zinniatullin, oscd.community date: 2019-10-21 modified: 2022-07-07 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.004 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: CurrentVersion\Winlogon selection2: ScriptBlockText|contains: - Set-ItemProperty - New-Item condition: all of selection* falsepositives: - Unknown level: medium
Query: write Sigma for Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently acc
Matching passage: Sigma rule: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently acc. Logsource: windows / ps_module. Rule: title: Use Get-NetTCPConnection - PowerShell Module id: aff815cc-e400-4bf0-a47a-5d8a2407d4e1 status: test description: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-2---system-network-connections-discovery-with-powershell author: frack113 date: 2021-12-10 modified: 2022-12-02 tags: - attack.discovery - attack.t1049 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection: ContextInfo|contains: Get-NetTCPConnection condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to ena. Logsource: windows / process_creation. Rule: title: Potential Remote Desktop Tunneling id: 8a3038e8-9c9d-46f8-b184-66234a160f6f status: test description: Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination. references: - https://www.elastic.co/guide/en/security/current/potential-remote-desktop-tunneling-detected.html author: Tim Rauch, Elastic (idea) date: 2022-09-27 tags: - attack.lateral-movement - attack.t1021 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: :3389 selection_opt: CommandLine|contains: - ' -L ' - ' -P ' - ' -R ' - ' -pw ' - ' -ssh ' condition: all of selection* falsepositives: - Unknown level: medium
Query: risk of Gynoii has a password of guest for the backdoor guest account and a password of 12345 for the backdoor admin account.
Matching passage: CVE-2015-2881. CWE: CWE-798. CVSS: 9.800000190734863. Gynoii has a password of guest for the backdoor guest account and a password of 12345 for the backdoor admin account.
Near-miss passage: CVE-2015-2882. CWE: CWE-798. CVSS: 9.800000190734863. Philips In.Sight B120/37 has a password of b120root for the backdoor root account, a password of /ADMIN/ for the backdoor admin account, a password of merlin for the backdoor mg3500 account, a password of M100-4674448 for the backdoor user account, and a password of M100-4674448 for the backdoor admin account.
Query: detection engineering for Non-Application Layer Protocol
Matching passage: T1095 Non-Application Layer Protocol. Tactics: command and control. Description: Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.(Citation: Wikipedia OSI) Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL). ICMP communication between hosts is one example.(Citation: Cisco Synful Knock Evolution) Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts.(Citation: Microsoft ICMP) However, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications. In ESXi environments, adversaries may leverage the Virtual Machine Communication Interface (VMCI) for communication between guest virtual machines and the ESXi host. This traffic is similar to client-server communications on traditional network sockets but is localized to the physical machine running the ESXi host, meaning it does not traverse external networks (routers, switches). This results in communications that are invisible to external monitoring and standard networking tools like tcpdump, netstat, nmap, and Wireshark. By adding a VMCI backdoor to a compromised ESXi host, adversaries may persistently regain access from any guest VM to the compromised ESXi host’s backdoor, regardless of network segmentation or firewall rules in place.(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023)
Near-miss passage: T1219.002 Remote Desktop Software. Tactics: command and control. Description: An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) Remote access modules/features may also exist as part of otherwise existing software such as Zoom or Google Chrome’s Remote Desktop.(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)