alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage sta
Matching passage: Sigma rule: Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage sta. Logsource: linux / process_creation. Rule: title: ESXi Storage Information Discovery Via ESXCLI id: f41dada5-3f56-4232-8503-3fb7f9cf2d60 status: test description: Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit. references: - https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html - https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_storage.html author: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon date: 2023-09-04 tags: - attack.discovery - attack.execution - attack.t1033 - attack.t1007 - attack.t1059.012 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /esxcli CommandLine|contains: storage selection_cli: CommandLine|contains: - ' get' - ' list' condition: all of selection_* falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects failed Kerberos TGT issue operation. This can be a sign of manipulations of TGT messages by an attacker.. Logsource: windows / security. Rule: title: Kerberos Manipulation id: f7644214-0eb0-4ace-9455-331ec4c09253 status: test description: Detects failed Kerberos TGT issue operation. This can be a sign of manipulations of TGT messages by an attacker. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4771 author: Florian Roth (Nextron Systems) date: 2017-02-10 modified: 2024-01-16 tags: - attack.credential-access - attack.t1212 logsource: product: windows service: security detection: selection: EventID: - 675 - 4768 - 4769 - 4771 Status: - '0x9' - '0xA' - '0xB' - '0xF' - '0x10' - '0x11' - '0x13' - '0x14' - '0x1A' - '0x1F' - '0x21' - '0x22' - '0x23' - '0x24' - '0x26' - '0x27' - '0x28' - '0x29' - '0x2C' - '0x2D' - '0x2E' - '0x2F' - '0x31' - '0x32' - '0x3E' - '0x3F' - '0x40' - '0x41' - '0x43' - '0x44' condition: selection falsepositives: - Faulty legacy applications level: high
Query: describe CVE-2015-5365
Matching passage: CVE-2015-5365. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in Zurmo CRM 3.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "What's going on?" profile field.
Near-miss passage: CVE-2015-0553. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in admin/pages/modify.php in WebsiteBaker 2.8.3 SP3 allows remote attackers to inject arbitrary web script or HTML via the page_id parameter.
Query: detect Detects potentially suspicious child processes of "aspnet_compiler.exe". in logs
Matching passage: Sigma rule: Detects potentially suspicious child processes of "aspnet_compiler.exe".. Logsource: windows / process_creation. Rule: title: Suspicious Child Process of AspNetCompiler id: 9ccba514-7cb6-4c5c-b377-700758f2f120 related: - id: 4c7f49ee-2638-43bb-b85b-ce676c30b260 type: similar - id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622 type: similar - id: a01b8329-5953-4f73-ae2d-aa01e1f35f00 type: similar status: test description: Detects potentially suspicious child processes of "aspnet_compiler.exe". references: - https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/ - https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-14 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \aspnet_compiler.exe selection_child: - Image|endswith: - \calc.exe - \notepad.exe - Image|contains: - \Users\Public\ - \AppData\Local\Temp\ - \AppData\Local\Roaming\ - :\Temp\ - :\Windows\Temp\ - :\Windows\System32\Tasks\ - :\Windows\Tasks\ condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects "read access" requests on the services registry key. Adversaries may execute their own malicious payloads by hij. Logsource: windows / security. Rule: title: Service Registry Key Read Access Request id: 11d00fff-5dc3-428c-8184-801f292faec0 status: test description: 'Detects "read access" requests on the services registry key. Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts. ' references: - https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/service_registry_permissions_weakness_check/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness author: Center for Threat Informed Defense (CTID) Summiting the Pyramid Team date: 2023-09-28 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.011 logsource: product: windows service: security definition: 'Requirements: SACLs must be enabled for "READ_CONTROL" on the registry keys used in this rule' detection: selection: EventID: 4663 ObjectName|contains|all: - \SYSTEM\ - ControlSet\Services\ AccessList|contains: '%%1538' condition: selection falsepositives: - Likely from legitimate applications reading their key. Requires heavy tuning level: low
Query: Lateral movement indicators for Business Relationships
Matching passage: T1591.002 Business Relationships. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's business relationships that can be used during targeting. Information about an organization’s business relationships may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. This information may also reveal supply chains and shipment paths for the victim’s hardware and software resources. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about business relationships may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195), [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Near-miss passage: T1591.004 Identify Roles. Tactics: reconnaissance. Description: Adversaries may gather information about identities and roles within the victim organization that can be used during targeting. Information about business roles may reveal a variety of targetable details, including identifiable information for key personnel as well as what data/resources they have access to. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about business roles may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).
Query: telemetry for T1542
Matching passage: T1542 Pre-OS Boot. Tactics: stealth, persistence. Description: Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting) Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.
Near-miss passage: T1542.005 TFTP Boot. Tactics: stealth, persistence. Description: Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images. Adversaries may manipulate the configuration on the network device specifying use of a malicious TFTP server, which may be used in conjunction with [Modify System Image](https://attack.mitre.org/techniques/T1601) to load a modified image on device startup or reset. The unauthorized image allows adversaries to modify device configuration, add malicious capabilities to the device, and introduce backdoors to maintain control of the network device while minimizing detection through use of a standard functionality. This technique is similar to [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) and may result in the network device running a modified image. (Citation: Cisco Blog Legacy Device Attacks)
Query: describe CVE-2015-7020
Matching passage: CVE-2015-7020. CWE: CWE-119. CVSS: 5.599999904632568. The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via unspecified vectors, a different vulnerability than CVE-2015-7019.
Near-miss passage: CVE-2015-7065. CWE: CWE-119. CVSS: 6.800000190734863. OpenGL in Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Query: describe CVE-2015-4901
Matching passage: CVE-2015-4901. CWE: UNKNOWN. CVSS: 9.300000190734863. Unspecified vulnerability in Oracle Java SE 8u60 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX.
Near-miss passage: CVE-2015-4730. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL 5.6.20 and earlier allows remote authenticated users to affect availability via unknown vectors related to Types.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Executes arbitrary PowerShell code using SyncAppvPublishingServer.vbs. Logsource: windows / process_creation. Rule: title: SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code id: 36475a7d-0f6d-4dce-9b01-6aeb473bbaf1 status: test description: Executes arbitrary PowerShell code using SyncAppvPublishingServer.vbs references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1216/T1216.md - https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/ author: frack113 date: 2021-07-16 modified: 2022-06-22 tags: - attack.stealth - attack.t1218 - attack.t1216 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - \SyncAppvPublishingServer.vbs - ; condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the use of rar.exe, on the command line, to create an archive with password protection or with a specific compre. Logsource: windows / process_creation. Rule: title: Rar Usage with Password and Compression Level id: faa48cae-6b25-4f00-a094-08947fef582f status: test description: Detects the use of rar.exe, on the command line, to create an archive with password protection or with a specific compression level. This is pretty indicative of malicious actions. references: - https://labs.sentinelone.com/the-anatomy-of-an-apt-attack-and-cobaltstrike-beacons-encoded-configuration/ - https://ss64.com/bash/rar.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md author: '@ROxPinTeddy' date: 2020-05-12 modified: 2022-03-16 tags: - attack.collection - attack.t1560.001 logsource: category: process_creation product: windows detection: selection_password: CommandLine|contains: ' -hp' selection_other: CommandLine|contains: - ' -m' - ' a ' condition: selection_password and selection_other falsepositives: - Legitimate use of Winrar command line version - Other command line tools, that use these flags level: high
Query: write Sigma for Detect malicious GPO modifications can be used to implement many other malicious behaviors.
Matching passage: Sigma rule: Detect malicious GPO modifications can be used to implement many other malicious behaviors.. Logsource: windows / process_creation. Rule: title: Modify Group Policy Settings id: ada4b0c4-758b-46ac-9033-9004613a150d related: - id: b7216a7d-687e-4c8d-82b1-3080b2ad961f type: similar status: test description: Detect malicious GPO modifications can be used to implement many other malicious behaviors. references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1484.001/T1484.001.md author: frack113 date: 2022-08-19 tags: - attack.privilege-escalation - attack.defense-impairment - attack.t1484.001 logsource: category: process_creation product: windows detection: selection_reg: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_path: CommandLine|contains: \SOFTWARE\Policies\Microsoft\Windows\System selection_key: CommandLine|contains: - GroupPolicyRefreshTimeDC - GroupPolicyRefreshTimeOffsetDC - GroupPolicyRefreshTime - GroupPolicyRefreshTimeOffset - EnableSmartScreen - ShellSmartScreenLevel condition: all of selection_* falsepositives: - Legitimate use level: medium
Near-miss passage: Sigma rule: Detects the creation of a schtask that executes a file from C:\Users\<USER>\AppData\Local. Logsource: windows / process_creation. Rule: title: Suspicious Schtasks Execution AppData Folder id: c5c00f49-b3f9-45a6-997e-cfdecc6e1967 status: test description: Detects the creation of a schtask that executes a file from C:\Users\<USER>\AppData\Local references: - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/ author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-03-15 modified: 2022-07-28 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.005 - attack.t1059.001 logsource: product: windows category: process_creation detection: selection: Image|endswith: \schtasks.exe CommandLine|contains|all: - /Create - /RU - /TR - C:\Users\ - \AppData\Local\ CommandLine|contains: - NT AUT - ' SYSTEM ' filter: ParentImage|contains|all: - \AppData\Local\Temp\ - TeamViewer_.exe Image|endswith: \schtasks.exe CommandLine|contains: /TN TVInstallRestore condition: selection and not filter falsepositives: - Unknown level: high
Query: detection rule: Detects suspicious PowerShell invocation command parameters
Matching passage: Sigma rule: Detects suspicious PowerShell invocation command parameters. Logsource: windows / ps_module. Rule: title: Suspicious PowerShell Invocations - Generic - PowerShell Module id: bbb80e91-5746-4fbe-8898-122e2cafdbf4 related: - id: 3d304fda-78aa-43ed-975c-d740798a49c1 type: derived - id: ed965133-513f-41d9-a441-e38076a0798f type: similar status: test description: Detects suspicious PowerShell invocation command parameters references: - Internal Research author: Florian Roth (Nextron Systems) date: 2017-03-12 modified: 2023-01-03 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_encoded: ContextInfo|contains: - ' -enc ' - ' -EncodedCommand ' - ' -ec ' selection_hidden: ContextInfo|contains: - ' -w hidden ' - ' -window hidden ' - ' -windowstyle hidden ' - ' -w 1 ' selection_noninteractive: ContextInfo|contains: - ' -noni ' - ' -noninteractive ' condition: all of selection* falsepositives: - Very special / sneaky PowerShell scripts level: high
Near-miss passage: Sigma rule: Windows Defender logs when the history of detected infections is deleted.. Logsource: windows / windefend. Rule: title: Windows Defender Malware Detection History Deletion id: 2afe6582-e149-11ea-87d0-0242ac130003 status: test description: Windows Defender logs when the history of detected infections is deleted. references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus - https://web.archive.org/web/20160727113019/https://answers.microsoft.com/en-us/protect/forum/mse-protect_scanning/microsoft-antimalware-has-removed-history-of/f15af6c9-01a9-4065-8c6c-3f2bdc7de45e author: Cian Heasley date: 2020-08-13 modified: 2023-11-24 tags: - attack.defense-impairment logsource: product: windows service: windefend detection: selection: EventID: 1013 condition: selection falsepositives: - Deletion of Defender malware detections history for legitimate reasons level: informational
Query: write Sigma for Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration
Matching passage: Sigma rule: Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration. Logsource: windows / dns_query. Rule: title: DNS Query To Ufile.io id: 1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b related: - id: 090ffaad-c01a-4879-850c-6d57da98452d type: similar status: test description: Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration references: - https://thedfirreport.com/2021/12/13/diavol-ransomware/ author: yatinwad, TheDFIRReport date: 2022-06-23 modified: 2023-09-18 tags: - attack.exfiltration - attack.t1567.002 logsource: product: windows category: dns_query detection: selection: QueryName|contains: ufile.io condition: selection falsepositives: - DNS queries for "ufile" are not malicious by nature necessarily. Investigate the source to determine the necessary actions to take level: low
Near-miss passage: Sigma rule: Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with suspicious Addinroot or Pipeliner. Logsource: windows / process_creation. Rule: title: Suspicious AddinUtil.EXE CommandLine Execution id: 631b22a4-70f4-4e2f-9ea8-42f84d9df6d8 status: test description: 'Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with suspicious Addinroot or Pipelineroot paths. An adversary may execute AddinUtil.exe with uncommon Addinroot/Pipelineroot paths that point to the adversaries Addins.Store payload. ' references: - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html author: Nasreddine Bencherchali (Nextron Systems), Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri) date: 2023-09-18 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \addinutil.exe - OriginalFileName: AddInUtil.exe selection_susp_1_flags: CommandLine|contains: - '-AddInRoot:' - '-PipelineRoot:' selection_susp_1_paths: CommandLine|contains: - \AppData\Local\Temp\ - \Desktop\ - \Downloads\ - \Users\Public\ - \Windows\Temp\ selection_susp_2: CommandLine|contains: - -AddInRoot:. - -AddInRoot:"." - -PipelineRoot:. - -PipelineRoot:"." CurrentDirectory|contains: - \AppData\Local\Temp\ - \Desktop\ - \Downloads\ - \Users\Public\ - \Windows\Temp\ condition: selection_img and (all of selection_susp_1_* or selection_susp_2) falsepositives: - Unknown level: high
Query: actor TTPs: Server
Matching passage: T1584.004 Server. Tactics: resource development. Description: Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control.(Citation: TrendMicro EarthLusca 2022) Instead of purchasing a [Server](https://attack.mitre.org/techniques/T1583/004) or [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may compromise third-party servers in support of operations. Adversaries may also compromise web servers to support watering hole operations, as in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), or email servers to support [Phishing](https://attack.mitre.org/techniques/T1566) operations.
Near-miss passage: T1584.005 Botnet. Tactics: resource development. Description: Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.(Citation: Norton Botnet) Instead of purchasing/renting a botnet from a booter/stresser service, adversaries may build their own botnet by compromising numerous third-party systems.(Citation: Imperva DDoS for Hire) Adversaries may also conduct a takeover of an existing botnet, such as redirecting bots to adversary-controlled C2 servers.(Citation: Dell Dridex Oct 2015) With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale [Phishing](https://attack.mitre.org/techniques/T1566) or Distributed Denial of Service (DDoS).
Query: exploit The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.
Matching passage: CVE-2015-9307. CWE: CWE-352. CVSS: 8.800000190734863. The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.
Near-miss passage: CVE-2015-3350. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Todo Filter module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that toggle a task via unspecified vectors.