alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects instances where a REDIS service on an OpenCanary node has had an action command attempted. in logs
Matching passage: Sigma rule: Detects instances where a REDIS service on an OpenCanary node has had an action command attempted.. Logsource: opencanary / application. Rule: title: OpenCanary - REDIS Action Command Attempt id: 547dfc53-ebf6-4afe-8d2e-793d9574975d status: test description: Detects instances where a REDIS service on an OpenCanary node has had an action command attempted. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.credential-access - attack.collection - attack.t1003 - attack.t1213 logsource: category: application product: opencanary detection: selection: logtype: 17001 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32). Logsource: windows / file_event. Rule: title: UAC Bypass Using Windows Media Player - File id: 68578b43-65df-4f81-9a9b-92f32711a951 status: test description: Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-23 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: file_event product: windows detection: selection1: TargetFilename|startswith: C:\Users\ TargetFilename|endswith: \AppData\Local\Temp\OskSupport.dll selection2: Image: C:\Windows\system32\DllHost.exe TargetFilename: C:\Program Files\Windows Media Player\osk.exe condition: 1 of selection* falsepositives: - Unknown level: high
Query: Sigma YAML for dns
Matching passage: Sigma rule: Detects wannacry killswitch domain dns queries. Logsource: dns. Rule: title: Wannacry Killswitch Domain id: 3eaf6218-3bed-4d8a-8707-274096f12a18 status: test description: Detects wannacry killswitch domain dns queries references: - https://www.mandiant.com/resources/blog/wannacry-ransomware-campaign author: Mike Wade date: 2020-09-16 modified: 2022-03-24 tags: - attack.command-and-control - attack.t1071.001 logsource: category: dns detection: selection: query: - ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.testing - ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.test - ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.com - ayylmaotjhsstasdfasdfasdfasdfasdfasdfasdf.com - iuqssfsodp9ifjaposdfjhgosurijfaewrwergwea.com condition: selection falsepositives: - Analyst testing level: high
Near-miss passage: Sigma rule: Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected host. Logsource: windows / ps_classic_start. Rule: title: Netcat The Powershell Version id: c5b20776-639a-49bf-94c7-84f912b91c15 related: - id: bf7286e7-c0be-460b-a7e8-5b2e07ecc2f2 type: derived status: test description: Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network references: - https://nmap.org/ncat/ - https://github.com/besimorhino/powercat - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1095/T1095.md author: frack113 date: 2021-07-21 modified: 2023-10-27 tags: - attack.command-and-control - attack.execution - attack.t1095 - attack.t1059.001 logsource: product: windows category: ps_classic_start detection: selection: Data|contains: - 'powercat ' - powercat.ps1 condition: selection falsepositives: - Unknown level: medium
Query: explain CWE-192
Matching passage: CWE-192 Integer Coercion Error. Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types.
Near-miss passage: CWE-244 Improper Clearing of Heap Memory Before Release ('Heap Inspection'). Using realloc() to resize buffers that store sensitive information can leave the sensitive information exposed to attack, because it is not removed from memory.
Query: alert when Detects creation of a file named "ntds.dit" (Active Directory Database)
Matching passage: Sigma rule: Detects creation of a file named "ntds.dit" (Active Directory Database). Logsource: windows / file_event. Rule: title: NTDS.DIT Created id: 0b8baa3f-575c-46ee-8715-d6f28cc7d33c status: test description: Detects creation of a file named "ntds.dit" (Active Directory Database) references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-05 tags: - attack.credential-access - attack.t1003.003 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: ntds.dit condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Identifies when a device in azure is no longer managed or compliant. Logsource: azure / auditlogs. Rule: title: Azure Device No Longer Managed or Compliant id: 542b9912-c01f-4e3f-89a8-014c48cdca7d status: test description: Identifies when a device in azure is no longer managed or compliant references: - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory author: Austin Songer @austinsonger date: 2021-09-03 modified: 2026-04-30 tags: - attack.impact logsource: product: azure service: auditlogs detection: selection: operationName: - Device no longer compliant - Device no longer managed condition: selection falsepositives: - Administrator may have forgotten to review the device. level: medium
Query: Outbound C2 pattern associated with Local Accounts
Matching passage: T1078.003 Local Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. Local Accounts may also be abused to elevate privileges and harvest credentials through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement.
Near-miss passage: T1078 Valid Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.(Citation: volexity_0day_sophos_FW) Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence. In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account.(Citation: CISA MFA PrintNightmare) The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.(Citation: TechNet Credential Theft)
Query: Suspicious Vulnerability Scanning execution detected on endpoint
Matching passage: T1595.002 Vulnerability Scanning. Tactics: reconnaissance. Description: Adversaries may scan victims for vulnerabilities that can be used during targeting. Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit the adversary may seek to use. These scans may also include more broad attempts to [Gather Victim Host Information](https://attack.mitre.org/techniques/T1592) that can be used to identify more commonly known, exploitable vulnerabilities. Vulnerability scans typically harvest running software and version numbers via server banners, listening ports, or other network artifacts.(Citation: OWASP Vuln Scanning) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).
Near-miss passage: T1595.001 Scanning IP Blocks. Tactics: reconnaissance. Description: Adversaries may scan victim IP blocks to gather information that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses. Adversaries may scan IP blocks in order to [Gather Victim Network Information](https://attack.mitre.org/techniques/T1590), such as which IP addresses are actively in use as well as more detailed information about hosts assigned these addresses. Scans may range from simple pings (ICMP requests and responses) to more nuanced scans that may reveal host software/versions via server banners or other network artifacts.(Citation: Botnet Scan) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Query: risk of Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the file parameter to a web
Matching passage: CVE-2015-1503. CWE: CWE-22. CVSS: 7.5. Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the file parameter to a webmail/client/skins/default/css/css.php page or .../. (dot dot dot slash dot) in the (2) script or (3) style parameter to webmail/old/calendar/minimizer/index.php.
Near-miss passage: CVE-2015-4704. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in the Download Zip Attachments plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the File parameter to download.php.
Query: CVE similar to CVE-2015-2330
Matching passage: CVE-2015-2330. CWE: CWE-295. CVSS: 7.5. Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies.
Near-miss passage: CVE-2015-1777. CWE: CWE-295. CVSS: 5.900000095367432. rhnreg_ks in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Gluster Storage 2.1 and Enterprise Linux (RHEL) 5, 6, and 7 does not properly validate hostnames in X.509 certificates from SSL servers, which allows remote attackers to prevent system registration via a man-in-the-middle attack.
Query: Sigma rule for Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic
Matching passage: Sigma rule: Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic. Logsource: linux / process_creation. Rule: title: Flush Iptables Ufw Chain id: 3be619f4-d9ec-4ea8-a173-18fdd01996ab status: test description: Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic references: - https://blogs.blackberry.com/ - https://www.cyberciti.biz/tips/linux-iptables-how-to-flush-all-rules.html - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144 author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-01-18 tags: - attack.defense-impairment - attack.t1686 logsource: product: linux category: process_creation detection: selection_img: Image|endswith: - /iptables - /xtables-legacy-multi - /iptables-legacy-multi - /ip6tables - /ip6tables-legacy-multi selection_params: CommandLine|contains: - -F - -Z - -X selection_ufw: CommandLine|contains: - ufw-logging-deny - ufw-logging-allow - ufw6-logging-deny - ufw6-logging-allow condition: all of selection_* falsepositives: - Network administrators level: medium
Near-miss passage: Sigma rule: When configured with suitable command line arguments, w32tm can act as a delay mechanism. Logsource: windows / process_creation. Rule: title: Use of W32tm as Timer id: 6da2c9f5-7c53-401b-aacb-92c040ce1215 status: test description: When configured with suitable command line arguments, w32tm can act as a delay mechanism references: - https://github.com/redcanaryco/atomic-red-team/blob/d0dad62dbcae9c60c519368e82c196a3db577055/atomics/T1124/T1124.md - https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains author: frack113 date: 2022-09-25 tags: - attack.discovery - attack.t1124 logsource: category: process_creation product: windows detection: selection_w32tm: - Image|endswith: \w32tm.exe - OriginalFileName: w32time.dll selection_cmd: CommandLine|contains|all: - /stripchart - '/computer:' - '/period:' - /dataonly - '/samples:' condition: all of selection_* falsepositives: - Legitimate use level: high
Query: risk of IOHIDFamily in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to obtain sensitive information about kernel memory via a crafted app.
Matching passage: CVE-2015-1096. CWE: CWE-200. CVSS: 1.899999976158142. IOHIDFamily in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to obtain sensitive information about kernel memory via a crafted app.
Near-miss passage: CVE-2015-0800. CWE: CWE-200. CVSS: 5.0. The PRNG implementation in the DNS resolver in Mozilla Firefox (aka Fennec) before 37.0 on Android does not properly generate random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a related issue to CVE-2012-2808.
Query: Suspicious Drive-by Compromise execution detected on endpoint
Matching passage: T1189 Drive-by Compromise. Tactics: initial access. Description: Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., [Drive-by Target](https://attack.mitre.org/techniques/T1608/004)), including: * A legitimate website is compromised, allowing adversaries to inject malicious code * Script files served to a legitimate website from a publicly writeable cloud storage bucket are modified by an adversary * Malicious ads are paid for and served through legitimate ad providers (i.e., [Malvertising](https://attack.mitre.org/techniques/T1583/008)) * Built-in web application interfaces that allow user-controllable content are leveraged for the insertion of malicious scripts or iFrames (e.g., cross-site scripting) Browser push notifications may also be abused by adversaries and leveraged for malicious code injection via [User Execution](https://attack.mitre.org/techniques/T1204). By clicking "allow" on browser push notifications, users may be granting a website permission to run JavaScript code on their browser.(Citation: Push notifications - viruspositive)(Citation: push notification -mcafee)(Citation: push notifications - malwarebytes) Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or a particular region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is often referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring.(Citation: Shadowserver Strategic Web Compromise) Typical drive-by compromise process: 1. A user visits a website that is used to host the adversary controlled content. 2. Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version. The user may be required to assist in this process by enabling scripting, notifications, or active website
Near-miss passage: T1078.003 Local Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. Local Accounts may also be abused to elevate privileges and harvest credentials through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement.
Query: exploit Dell SonicWall TotalSecure TZ 100 devices with firmware before 5.9.1.0-22o allow remote attackers to cause a denial of service via a crafted packet.
Matching passage: CVE-2015-7770. CWE: CWE-20. CVSS: 5.0. Dell SonicWall TotalSecure TZ 100 devices with firmware before 5.9.1.0-22o allow remote attackers to cause a denial of service via a crafted packet.
Near-miss passage: CVE-2015-5144. CWE: CWE-20. CVSS: 4.300000190734863. Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator.
Query: Outbound C2 pattern associated with Security Account Manager
Matching passage: T1003.002 Security Account Manager. Tactics: credential access. Description: Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the <code>net user</code> command. Enumerating the SAM database requires SYSTEM level access. A number of tools can be used to retrieve the SAM file through in-memory techniques: * pwdumpx.exe * [gsecdump](https://attack.mitre.org/software/S0008) * [Mimikatz](https://attack.mitre.org/software/S0002) * secretsdump.py Alternatively, the SAM can be extracted from the Registry with Reg: * <code>reg save HKLM\sam sam</code> * <code>reg save HKLM\system system</code> Creddump7 can then be used to process the SAM database locally to retrieve hashes.(Citation: GitHub Creddump7) Notes: * RID 500 account is the local, built-in administrator. * RID 501 is the guest account. * User accounts start with a RID of 1,000+.
Near-miss passage: T1003.008 /etc/passwd and /etc/shadow. Tactics: credential access. Description: Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable offline password cracking. Most modern Linux operating systems use a combination of <code>/etc/passwd</code> and <code>/etc/shadow</code> to store user account information, including password hashes in <code>/etc/shadow</code>. By default, <code>/etc/shadow</code> is only readable by the root user.(Citation: Linux Password and Shadow File Formats) Linux stores user information such as user ID, group ID, home directory path, and login shell in <code>/etc/passwd</code>. A "user" on the system may belong to a person or a service. All password hashes are stored in <code>/etc/shadow</code> - including entries for users with no passwords and users with locked or disabled accounts.(Citation: Linux Password and Shadow File Formats) Adversaries may attempt to read or dump the <code>/etc/passwd</code> and <code>/etc/shadow</code> files on Linux systems via command line utilities such as the <code>cat</code> command.(Citation: Arctic Wolf) Additionally, the Linux utility <code>unshadow</code> can be used to combine the two files in a format suited for password cracking utilities such as John the Ripper - for example, via the command <code>/usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.password.db</code>(Citation: nixCraft - John the Ripper). Since the user information stored in <code>/etc/passwd</code> are linked to the password hashes in <code>/etc/shadow</code>, an adversary would need to have access to both.
Query: detect Detects path traversal exploitation attempts in logs
Matching passage: Sigma rule: Detects path traversal exploitation attempts. Logsource: webserver. Rule: title: Path Traversal Exploitation Attempts id: 7745c2ea-24a5-4290-b680-04359cb84b35 status: test description: Detects path traversal exploitation attempts references: - https://github.com/projectdiscovery/nuclei-templates - https://book.hacktricks.xyz/pentesting-web/file-inclusion author: Subhash Popuri (@pbssubhash), Florian Roth (Nextron Systems), Thurein Oo, Nasreddine Bencherchali (Nextron Systems) date: 2021-09-25 modified: 2023-08-31 tags: - attack.initial-access - attack.t1190 logsource: category: webserver detection: selection: cs-uri-query|contains: - ../../../../../lib/password - ../../../../windows/ - ../../../etc/ - ..%252f..%252f..%252fetc%252f - ..%c0%af..%c0%af..%c0%afetc%c0%af - '%252e%252e%252fetc%252f' condition: selection falsepositives: - Expected to be continuously seen on systems exposed to the Internet - Internal vulnerability scanners level: medium
Near-miss passage: Sigma rule: Detects files dropped by Winnti as described in RedMimicry Winnti playbook. Logsource: windows / file_event. Rule: title: Potential Winnti Dropper Activity id: 130c9e58-28ac-4f83-8574-0a4cc913b97e status: test description: Detects files dropped by Winnti as described in RedMimicry Winnti playbook references: - https://redmimicry.com/posts/redmimicry-winnti/#dropper author: Alexander Rausch date: 2020-06-24 modified: 2023-01-05 tags: - attack.stealth - attack.t1027 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \gthread-3.6.dll - \sigcmm-2.4.dll - \Windows\Temp\tmp.bat condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-5986
Matching passage: CVE-2015-5986. CWE: CWE-20. CVSS: 7.099999904632568. openpgpkey_61.c in named in ISC BIND 9.9.7 before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a crafted DNS response.
Near-miss passage: CVE-2015-8726. CWE: CWE-20. CVSS: 5.5. wiretap/vwr.c in the VeriWave file parser in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate certain signature and Modulation and Coding Scheme (MCS) data, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file.