alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Lateral movement indicators for Make and Impersonate Token
Matching passage: T1134.003 Make and Impersonate Token. Tactics: stealth, privilege escalation. Description: Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function.(Citation: LogonUserW function) The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread. This behavior is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) in that this refers to creating a new user token instead of stealing or duplicating an existing one.
Near-miss passage: T1134 Access Token Manipulation. Tactics: stealth, privilege escalation. Description: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token. An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. These token can then be applied to an existing process (i.e. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001)) or used to spawn a new process (i.e. [Create Process with Token](https://attack.mitre.org/techniques/T1134/002)). An adversary must already be in a privileged user context (i.e. administrator) to steal a token. However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.(Citation: Pentestlab Token Manipulation) Any standard user can use the <code>runas</code> command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account. There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows remote att
Matching passage: CVE-2015-6372. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka Bug ID CSCux10614.
Near-miss passage: CVE-2015-2359. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the web applications in Microsoft Exchange Server 2013 Cumulative Update 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Exchange HTML Injection Vulnerability."
Query: Sigma rule for Detects the creation of tasks from processes executed from suspicious locations
Matching passage: Sigma rule: Detects the creation of tasks from processes executed from suspicious locations. Logsource: windows / file_event. Rule: title: Suspicious Scheduled Task Write to System32 Tasks id: 80e1f67a-4596-4351-98f5-a9c3efabac95 status: test description: Detects the creation of tasks from processes executed from suspicious locations references: - Internal Research author: Florian Roth (Nextron Systems) date: 2021-11-16 modified: 2022-01-12 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \Windows\System32\Tasks Image|contains: - \AppData\ - C:\PerfLogs - \Windows\System32\config\systemprofile condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind. Logsource: dns. Rule: title: Telegram Bot API Request id: c64c5175-5189-431b-a55e-6d9882158251 status: test description: Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind references: - https://core.telegram.org/bots/faq - https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/ - https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/ - https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/ author: Florian Roth (Nextron Systems) date: 2018-06-05 modified: 2022-10-09 tags: - attack.command-and-control - attack.t1102.002 logsource: category: dns detection: selection: query: api.telegram.org condition: selection falsepositives: - Legitimate use of Telegram bots in the company level: medium
Query: ATT&CK technique for System Firmware
Matching passage: T1542.001 System Firmware. Tactics: stealth, persistence. Description: Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer.(Citation: Wikipedia BIOS)(Citation: Wikipedia UEFI)(Citation: About UEFI) System firmware like BIOS and (U)EFI underly the functionality of a computer and may be modified by an adversary to perform or assist in malicious activity. Capabilities exist to overwrite the system firmware, which may give sophisticated adversaries a means to install malicious firmware updates as a means of persistence on a system that may be difficult to detect.
Near-miss passage: T1542.003 Bootkit. Tactics: stealth, persistence. Description: Adversaries may use bootkits to persist on systems. A bootkit is a malware variant that modifies the boot sectors of a hard drive, allowing malicious code to execute before a computer's operating system has loaded. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly. In BIOS systems, a bootkit may modify the Master Boot Record (MBR) and/or Volume Boot Record (VBR).(Citation: Mandiant M Trends 2016) The MBR is the section of disk that is first loaded after completing hardware initialization by the BIOS. It is the location of the boot loader. An adversary who has raw access to the boot drive may overwrite this area, diverting execution during startup from the normal boot loader to adversary code.(Citation: Lau 2011) The MBR passes control of the boot process to the VBR. Similar to the case of MBR, an adversary who has raw access to the boot drive may overwrite the VBR to divert execution during startup to adversary code. In UEFI (Unified Extensible Firmware Interface) systems, a bootkit may instead create or modify files in the EFI system partition (ESP). The ESP is a partition on data storage used by devices containing UEFI that allows the system to boot the OS and other utilities used by the system. An adversary can use the newly created or patched files in the ESP to run malicious kernel code.(Citation: Microsoft Security)(Citation: welivesecurity)
Query: Sigma rule for Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys.
Matching passage: Sigma rule: Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys.. Logsource: windows / process_creation. Rule: title: Suspicious Registry Modification From ADS Via Regini.EXE id: 77946e79-97f1-45a2-84b4-f37b5c0d8682 related: - id: 5f60740a-f57b-4e76-82a1-15b6ff2cb134 type: derived status: test description: Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys. references: - https://lolbas-project.github.io/lolbas/Binaries/Regini/ - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regini author: Eli Salem, Sander Wiebing, oscd.community date: 2020-10-12 modified: 2023-02-08 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regini.exe - OriginalFileName: REGINI.EXE selection_re: CommandLine|re: :[^ \\] condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs. Logsource: windows / security. Rule: title: AD Privileged Users or Groups Reconnaissance id: 35ba1d85-724d-42a3-889f-2e2362bcaf23 status: test description: Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs references: - https://web.archive.org/web/20230329163438/https://blog.menasec.net/2019/02/threat-hunting-5-detecting-enumeration.html author: Samir Bousseaden date: 2019-04-03 modified: 2022-07-13 tags: - attack.discovery - attack.t1087.002 logsource: product: windows service: security definition: 'Requirements: enable Object Access SAM on your Domain Controllers' detection: selection: EventID: 4661 ObjectType: - SAM_USER - SAM_GROUP selection_object: - ObjectName|endswith: - '-512' - '-502' - '-500' - '-505' - '-519' - '-520' - '-544' - '-551' - '-555' - ObjectName|contains: admin filter: SubjectUserName|endswith: $ condition: selection and selection_object and not filter falsepositives: - If source account name is not an admin then its super suspicious level: high
Query: Sigma rule for Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a
Matching passage: Sigma rule: Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a. Logsource: windows / process_creation. Rule: title: Kavremover Dropped Binary LOLBIN Usage id: d047726b-c71c-4048-a99b-2e2f50dc107d status: test description: Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a LOLBIN to execute arbitrary commands and binaries. references: - https://nasbench.medium.com/lolbined-using-kaspersky-endpoint-security-kes-installer-to-execute-arbitrary-commands-1c999f1b7fea author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-01 tags: - attack.execution - attack.stealth - attack.t1127 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: ' run run-cmd ' filter_main_legit_parents: ParentImage|endswith: - \cleanapi.exe - \kavremover.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the attempt to create a process via "wmic" with the "process call create" flag, which might indicate an attempt. Logsource: windows / process_creation. Rule: title: Process Creation Attempt via Wmic.EXE id: 526be59f-a573-4eea-b5f7-f0973207634d related: - id: 3c89a1e8-0fba-449e-8f1b-8409d6267ec8 type: derived status: test description: 'Detects the attempt to create a process via "wmic" with the "process call create" flag, which might indicate an attempt to execute a malicious process on the compromised host. Adversaries may use wmic to execute a process on the compromised host as part of their attack. This event is triggered on on attempt and process creation can be either successful or unsuccessful. ' references: - https://www.sans.org/blog/wmic-for-incident-response/ - https://github.com/redcanaryco/atomic-red-team/blob/84215139ee5127f8e3a117e063b604812bd71928/atomics/T1047/T1047.md#atomic-test-5---wmi-execute-local-process author: Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community date: 2019-01-16 modified: 2023-02-14 tags: - attack.execution - attack.t1047 - car.2016-03-002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains|all: - process - call - create condition: all of selection_* falsepositives: - Unknown level: medium simulation: - type: atomic red team name: WMI Execute Local Process technique: T1047 atomic_guid: b3bdfc91-b33e-4c6d-a5c8-d64bee0276b3 regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_process_creation/info.yml
Query: write Sigma for Detects suspicious UTF16 and base64 encoded and often obfuscated PowerShell code often used in command lines
Matching passage: Sigma rule: Detects suspicious UTF16 and base64 encoded and often obfuscated PowerShell code often used in command lines. Logsource: windows / process_creation. Rule: title: Suspicious Obfuscated PowerShell Code id: 8d01b53f-456f-48ee-90f6-bc28e67d4e35 status: test description: Detects suspicious UTF16 and base64 encoded and often obfuscated PowerShell code often used in command lines references: - https://app.any.run/tasks/fcadca91-3580-4ede-aff4-4d2bf809bf99/ author: Florian Roth (Nextron Systems) date: 2022-07-11 modified: 2023-02-14 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - IAAtAGIAeABvAHIAIAAwAHgA - AALQBiAHgAbwByACAAMAB4A - gAC0AYgB4AG8AcgAgADAAeA - AC4ASQBuAHYAbwBrAGUAKAApACAAfAAg - AuAEkAbgB2AG8AawBlACgAKQAgAHwAI - ALgBJAG4AdgBvAGsAZQAoACkAIAB8AC - AHsAMQB9AHsAMAB9ACIAIAAtAGYAI - B7ADEAfQB7ADAAfQAiACAALQBmAC - AewAxAH0AewAwAH0AIgAgAC0AZgAg - AHsAMAB9AHsAMwB9ACIAIAAtAGYAI - B7ADAAfQB7ADMAfQAiACAALQBmAC - AewAwAH0AewAzAH0AIgAgAC0AZgAg - AHsAMgB9AHsAMAB9ACIAIAAtAGYAI - B7ADIAfQB7ADAAfQAiACAALQBmAC - AewAyAH0AewAwAH0AIgAgAC0AZgAg - AHsAMQB9AHsAMAB9ACcAIAAtAGYAI - B7ADEAfQB7ADAAfQAnACAALQBmAC - AewAxAH0AewAwAH0AJwAgAC0AZgAg - AHsAMAB9AHsAMwB9ACcAIAAtAGYAI - B7ADAAfQB7ADMAfQAnACAALQBmAC - AewAwAH0AewAzAH0AJwAgAC0AZgAg - AHsAMgB9AHsAMAB9ACcAIAAtAGYAI - B7ADIAfQB7ADAAfQAnACAALQBmAC - AewAyAH0AewAwAH0AJwAgAC0AZgAg condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".. Logsource: windows / registry_set. Rule: title: Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG id: 7021255e-5db3-4946-a8b9-0ba7a4644a69 related: - id: 7f5d1c9a-3e83-48df-95a7-2b98aae6c13c type: similar - id: f9999590-1f94-4a34-a91e-951e47bedefd type: similar - id: 2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25 type: similar status: test description: Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe". references: - https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/ - https://twitter.com/0gtweet/status/1674399582162153472 author: Swachchhanda Shrawan Poudel date: 2023-08-02 modified: 2023-08-17 tags: - attack.stealth - attack.t1218 logsource: category: registry_set product: windows definition: 'Requirements: The registry key "\SOFTWARE\Microsoft\Provisioning\Commands\" and its subkey must be monitored' detection: selection: TargetObject|contains: \SOFTWARE\Microsoft\Provisioning\Commands\ condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-2374
Matching passage: CVE-2015-2374. CWE: CWE-200. CVSS: 3.299999952316284. The Netlogon service in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2 does not properly implement domain-controller communication, which allows remote attackers to discover credentials by leveraging certain PDC access and spoofing the BDC role in a PDC communication channel, aka "Elevation of Privilege Vulnerability in Netlogon."
Near-miss passage: CVE-2015-7399. CWE: CWE-200. CVSS: 5.300000190734863. IBM WebSphere Message Broker 7 before 7.0.0.8 and 8 before 8.0.0.6 and IBM Integration Bus 9 before 9.0.0.3 and 10 before 10.0.0.0 allow remote attackers to obtain sensitive information about the HTTP server via unspecified vectors.
Query: rule covering Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190)
Matching passage: Sigma rule: Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190). Logsource: windows / process_creation. Rule: title: Sdiagnhost Calling Suspicious Child Process id: f3d39c45-de1a-4486-a687-ab126124f744 status: test description: Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190) references: - https://twitter.com/nao_sec/status/1530196847679401984 - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ - https://app.any.run/tasks/f420d295-0457-4e9b-9b9e-6732be227583/ - https://app.any.run/tasks/c4117d9a-f463-461a-b90f-4cd258746798/ author: Nextron Systems, @Kostastsale date: 2022-06-01 modified: 2024-08-23 tags: - attack.stealth - attack.t1036 - attack.t1218 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \sdiagnhost.exe Image|endswith: - \powershell.exe - \pwsh.exe - \cmd.exe - \mshta.exe - \cscript.exe - \wscript.exe - \taskkill.exe - \regsvr32.exe - \rundll32.exe - \calc.exe filter_main_cmd_bits: Image|endswith: \cmd.exe CommandLine|contains: bits filter_main_powershell_noprofile: Image|endswith: \powershell.exe CommandLine|endswith: - -noprofile - - -noprofile condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when a user is removed from a privileged role. Bulk changes should be investigated.. Logsource: azure / auditlogs. Rule: title: Bulk Deletion Changes To Privileged Account Permissions id: 102e11e3-2db5-4c9e-bc26-357d42585d21 status: test description: Detects when a user is removed from a privileged role. Bulk changes should be investigated. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H' date: 2022-08-05 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: azure service: auditlogs detection: selection: properties.message: - Remove eligible member (permanent) - Remove eligible member (eligible) condition: selection falsepositives: - Legtimate administrator actions of removing members from a role level: high
Query: rule covering Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, msh
Matching passage: Sigma rule: Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, msh. Logsource: windows / process_creation. Rule: title: Windows Shell/Scripting Processes Spawning Suspicious Programs id: 3a6586ad-127a-4d3b-a677-1e6eacdf8fde status: test description: Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc. references: - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html author: Florian Roth (Nextron Systems), Tim Shelton date: 2018-04-06 modified: 2023-05-23 tags: - attack.execution - attack.stealth - attack.t1059.005 - attack.t1059.001 - attack.t1218 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \mshta.exe - \powershell.exe - \pwsh.exe - \rundll32.exe - \cscript.exe - \wscript.exe - \wmiprvse.exe - \regsvr32.exe Image|endswith: - \schtasks.exe - \nslookup.exe - \certutil.exe - \bitsadmin.exe - \mshta.exe filter_ccmcache: CurrentDirectory|contains: \ccmcache\ filter_amazon: ParentCommandLine|contains: - \Program Files\Amazon\WorkSpacesConfig\Scripts\setup-scheduledtask.ps1 - \Program Files\Amazon\WorkSpacesConfig\Scripts\set-selfhealing.ps1 - \Program Files\Amazon\WorkSpacesConfig\Scripts\check-workspacehealth.ps1 - \nessus_ filter_nessus: CommandLine|contains: \nessus_ filter_sccm_install: ParentImage|endswith: \mshta.exe Image|endswith: \mshta.exe ParentCommandLine|contains|all: - C:\MEM_Configmgr_ - \splash.hta - '{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}' CommandLine|contains|all: - C:\MEM_Configmgr_ - \SMSSETUP\BIN\ - \autorun.hta - '{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}' condition: selection and not 1 of filter_* falsepositives: - Administrative scripts - Microsoft SCCM level: high
Near-miss passage: Sigma rule: Detect when a Cloud SQL DB has been modified or deleted.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud SQL Database Modified or Deleted id: f346bbd5-2c4e-4789-a221-72de7685090d status: test description: Detect when a Cloud SQL DB has been modified or deleted. references: - https://cloud.google.com/sql/docs/mysql/admin-api/rest/v1beta4/users/update author: Austin Songer @austinsonger date: 2021-10-15 modified: 2022-12-25 tags: - attack.impact logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name: - cloudsql.instances.create - cloudsql.instances.delete - cloudsql.users.update - cloudsql.users.delete condition: selection falsepositives: - SQL Database being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - SQL Database modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: vulnerability: FontParser in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font fil
Matching passage: CVE-2015-3694. CWE: CWE-119. CVSS: 6.800000190734863. FontParser in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-3719.
Near-miss passage: CVE-2015-6156. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6148.
Query: CVE similar to CVE-2015-1235
Matching passage: CVE-2015-1235. CWE: CWE-264. CVSS: 5.0. The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in the HTML parser in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy via a crafted HTML document with an IFRAME element.
Near-miss passage: CVE-2015-3628. CWE: CWE-264. CVSS: 9.0. The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP AAM 11.4.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.3.0, BIG-IP GTM 11.3.0 before 11.6.0 HF6, BIG-IP PSM 11.3.0 through 11.4.1, Enterprise Manager 3.1.0 through 3.1.1, BIG-IQ Cloud and Security 4.0.0 through 4.5.0, BIG-IQ Device 4.2.0 through 4.5.0, and BIG-IQ ADC 4.5.0 allows remote authenticated users with the "Resource Administrator" role to gain privileges via an iCall (1) script or (2) handler in a SOAP request to iControl/iControlPortal.cgi.