alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects when the 'AllowMultipleTSSessions' value is enabled. Which allows for multiple Remote Desktop connection session
Matching passage: Sigma rule: Detects when the 'AllowMultipleTSSessions' value is enabled. Which allows for multiple Remote Desktop connection session. Logsource: windows / registry_set. Rule: title: Winlogon AllowMultipleTSSessions Enable id: f7997770-92c3-4ec9-b112-774c4ef96f96 status: test description: 'Detects when the ''AllowMultipleTSSessions'' value is enabled. Which allows for multiple Remote Desktop connection sessions to be opened at once. This is often used by attacker as a way to connect to an RDP session without disconnecting the other users ' references: - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-09 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions Details|endswith: DWORD (0x00000001) condition: selection falsepositives: - Legitimate use of the multi session functionality level: medium
Near-miss passage: Sigma rule: Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting. Logsource: windows / registry_delete. Rule: title: Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted id: 5dfc1465-8f65-4fde-8eb5-6194380c6a62 related: - id: 75180c5f-4ea1-461a-a4f6-6e4700c065d4 type: similar - id: 817f252c-5143-4dae-b418-48c3e9f63728 type: similar status: test description: 'Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" registry value. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary. ' references: - https://learn.microsoft.com/en-us/windows/client-management/manage-recall - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis author: Sajid Nawaz Khan date: 2024-06-02 tags: - attack.collection - attack.t1113 logsource: category: registry_delete product: windows detection: selection: EventType: DeleteValue TargetObject|endswith: \Microsoft\Windows\WindowsAI\DisableAIDataAnalysis condition: selection falsepositives: - Legitimate use/activation of Windows Recall level: medium
Query: CVE similar to CVE-2015-3968
Matching passage: CVE-2015-3968. CWE: CWE-255. CVSS: 7.5. The FTP service on Janitza UMG 508, 509, 511, 604, and 605 devices has a default password, which makes it easier for remote attackers to read or write to files via a session on TCP port 21.
Near-miss passage: CVE-2015-1320. CWE: CWE-255. CVSS: 9.800000190734863. The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects Ubuntu MAAS versions prior to 1.9.2.
Query: patch priority for CVE-2015-0638
Matching passage: CVE-2015-0638. CWE: CWE-20. CVSS: 7.099999904632568. Cisco IOS 12.2, 12.4, 15.0, 15.2, and 15.3, when a VRF interface is configured, allows remote attackers to cause a denial of service (interface queue wedge) via crafted ICMPv4 packets, aka Bug ID CSCsi02145.
Near-miss passage: CVE-2015-2754. CWE: CWE-20. CVSS: 6.800000190734863. FreeXL before 1.0.0i allows remote attackers to cause a denial of service (stack corruption) and possibly execute arbitrary code via a crafted workbook, related to a "premature EOF."
Query: Sigma rule for Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. I
Matching passage: Sigma rule: Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. I. Logsource: windows / dns_query. Rule: title: AppX Package Installation Attempts Via AppInstaller.EXE id: 7cff77e1-9663-46a3-8260-17f2e1aa9d0a related: - id: 180c7c5c-d64b-4a63-86e9-68910451bc8b type: derived status: test description: 'Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. It attempts to load/install a package from the referenced URL ' references: - https://twitter.com/notwhickey/status/1333900137232523264 - https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/ author: frack113 date: 2021-11-24 modified: 2023-11-09 tags: - attack.command-and-control - attack.t1105 logsource: product: windows category: dns_query detection: selection: Image|startswith: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_ Image|endswith: \AppInstaller.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the use of grep to discover specific files created by the GobRAT malware. Logsource: linux / process_creation. Rule: title: Potential GobRAT File Discovery Via Grep id: e34cfa0c-0a50-4210-9cb3-5632d08eb041 status: test description: Detects the use of grep to discover specific files created by the GobRAT malware references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.discovery - attack.t1082 logsource: category: process_creation product: linux detection: selection: Image|endswith: /grep CommandLine|contains: - apached - frpc - sshd.sh - zone.arm condition: selection falsepositives: - Unknown level: high
Query: weakness Incorrect Control Flow Scoping
Matching passage: CWE-705 Incorrect Control Flow Scoping. The product does not properly return control flow to the proper location after it has completed a task or detected an unusual condition.
Near-miss passage: CWE-112 Missing XML Validation. The product accepts XML from an untrusted source but does not validate the XML against the proper schema.
Query: SIEM correlation: stealth activity consistent with Delay Execution
Matching passage: T1678 Delay Execution. Tactics: stealth. Description: Adversaries may employ various time-based methods to evade detection and analysis. These techniques often exploit system clocks, delays, or timing mechanisms to obscure malicious activity, blend in with benign activity, and avoid scrutiny. Adversaries can perform this behavior within virtualization/sandbox environments or natively on host systems. Adversaries may utilize programmatic `sleep` commands or native system scheduling functionality, for example [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053). Benign commands or other operations may also be used to delay malware execution or ensure prior commands have had time to execute properly. Loops or otherwise needless repetitions of commands, such as `ping`, may be used to delay malware execution and potentially exceed time thresholds of automated analysis environments.(Citation: Revil Independence Day)(Citation: Netskope Nitol) Another variation, commonly referred to as API hammering, involves making various calls to Native API functions in order to delay execution (while also potentially overloading analysis environments with junk data).(Citation: Joe Sec Nymaim)(Citation: Joe Sec Trickbot)
Near-miss passage: T1564 Hide Artifacts. Tactics: stealth. Description: Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.(Citation: Sofacy Komplex Trojan)(Citation: Cybereason OSX Pirrit)(Citation: MalwareBytes ADS July 2015) Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation, such as through the use of virtualization technology.(Citation: Sophos Ragnar May 2020)
Query: Sigma rule for Detects renamed vmnat.exe or portable version that can be used for DLL side-loading
Matching passage: Sigma rule: Detects renamed vmnat.exe or portable version that can be used for DLL side-loading. Logsource: windows / process_creation. Rule: title: Renamed Vmnat.exe Execution id: 7b4f794b-590a-4ad4-ba18-7964a2832205 status: test description: Detects renamed vmnat.exe or portable version that can be used for DLL side-loading references: - https://twitter.com/malmoeb/status/1525901219247845376 author: elhoim date: 2022-09-09 modified: 2023-02-03 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: category: process_creation product: windows detection: selection: OriginalFileName: vmnat.exe filter_rename: Image|endswith: vmnat.exe condition: selection and not 1 of filter_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line i. Logsource: windows / ps_script. Rule: title: Powershell MsXml COM Object id: 78aa1347-1517-4454-9982-b338d6df8343 status: test description: 'Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-7---powershell-msxml-com-object---with-prompt - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ms766431(v=vs.85) - https://www.trendmicro.com/en_id/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html author: frack113, MatilJ date: 2022-01-19 modified: 2022-05-19 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - New-Object - -ComObject - MsXml2. - XmlHttp condition: selection falsepositives: - Legitimate administrative script level: medium
Query: mitigate Search Open Technical Databases
Matching passage: T1596 Search Open Technical Databases. Tactics: reconnaissance. Description: Adversaries may search freely available technical databases for information about victims that can be used during targeting. Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans.(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS)(Citation: Medium SSL Cert)(Citation: SSLShopper Lookup)(Citation: DigitalShadows CDN)(Citation: Shodan) Adversaries may search in different open databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Near-miss passage: T1596.002 WHOIS. Tactics: reconnaissance. Description: Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers.(Citation: WHOIS) Adversaries may search WHOIS data to gather actionable information. Threat actors can use online resources or command-line utilities to pillage through WHOIS data for information about potential victims. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Query: CVE similar to CVE-2015-0928
Matching passage: CVE-2015-0928. CWE: CWE-476. CVSS: 7.5. libhtp 0.5.15 allows remote attackers to cause a denial of service (NULL pointer dereference).
Near-miss passage: CVE-2015-9124. CWE: CWE-476. CVSS: 9.100000381469727. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, MDM9640, MDM9645, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 800, SD 808, and SD 810, the device may crash while accessing an invalid pointer or expose otherwise inaccessible memory contents.
Query: Lateral movement indicators for Bypass User Account Control
Matching passage: T1548.002 Bypass User Account Control. Tactics: privilege escalation. Description: Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.(Citation: TechNet How UAC Works) If the UAC protection level of a computer is set to anything but the highest level, certain Windows programs can elevate privileges or execute some elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) objects without prompting the user through the UAC notification box.(Citation: TechNet Inside UAC)(Citation: MSDN COM Elevation) An example of this is use of [Rundll32](https://attack.mitre.org/techniques/T1218/011) to load a specifically crafted DLL which loads an auto-elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) object and performs a file operation in a protected directory which would typically require elevated access. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user.(Citation: Davidson Windows) Many methods have been discovered to bypass UAC. The Github readme page for UACME contains an extensive list of methods(Citation: Github UACMe) that have been discovered and implemented, but may not be a comprehensive list of bypasses. Additional bypass methods are regularly discovered and some used in the wild, such as: * <code>eventvwr.exe</code> can auto-elevate and execute a specified binary or script.(Citation: enigma0x3 Fileless UAC Bypass)(Citation: Fortinet Fareit) Another bypass is possible through some lateral movement techn
Near-miss passage: T1548 Abuse Elevation Control Mechanism. Tactics: privilege escalation. Description: Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.(Citation: TechNet How UAC Works)(Citation: sudo man page 2018) An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.(Citation: OSX Keydnap malware)(Citation: Fortinet Fareit)
Query: Persistence mechanism resembling Digital Certificates
Matching passage: T1596.003 Digital Certificates. Tactics: reconnaissance. Description: Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content. These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location. Adversaries may search digital certificate data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about certificates.(Citation: SSLShopper Lookup) Digital certificate data may also be available from artifacts signed by the organization (ex: certificates used from encrypted web traffic are served with content).(Citation: Medium SSL Cert) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Near-miss passage: T1596.004 CDNs. Tactics: reconnaissance. Description: Adversaries may search content delivery network (CDN) data about victims that can be used during targeting. CDNs allow an organization to host content from a distributed, load balanced array of servers. CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region. Adversaries may search CDN data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about content servers within a CDN. Adversaries may also seek and target CDN misconfigurations that leak sensitive information not intended to be hosted and/or do not have the same protection mechanisms (ex: login portals) as the content hosted on the organization’s website.(Citation: DigitalShadows CDN) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)).
Query: Sigma YAML for windows / ntlm
Matching passage: Sigma rule: Detects logons using NTLM, which could be caused by a legacy source or attackers. Logsource: windows / ntlm. Rule: title: NTLM Logon id: 98c3bcf1-56f2-49dc-9d8d-c66cf190238b status: test description: Detects logons using NTLM, which could be caused by a legacy source or attackers references: - https://twitter.com/JohnLaTwC/status/1004895028995477505 author: Florian Roth (Nextron Systems) date: 2018-06-08 modified: 2024-07-22 tags: - attack.lateral-movement - attack.t1550.002 logsource: product: windows service: ntlm definition: Requires events from Microsoft-Windows-NTLM/Operational detection: selection: EventID: 8002 condition: selection falsepositives: - Legacy hosts level: low
Near-miss passage: Sigma rule: Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious. Logsource: windows / file_event. Rule: title: Suspicious Deno File Written from Remote Source id: 6c0ce3b6-85e2-49d4-9c3f-6e008ce9796e status: experimental description: 'Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it''s own malicious DLL. This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno. ' references: - https://taggart-tech.com/evildeno/ author: Josh Nickels, Michael Taggart date: 2025-05-22 tags: - attack.execution - attack.t1204 - attack.t1059.007 - attack.command-and-control - attack.t1105 logsource: category: file_event product: windows detection: selection_path: TargetFilename|contains: - \deno\gen\ - \deno\remote\https\ TargetFilename|contains|all: - :\Users\ - \AppData\ condition: selection_path falsepositives: - Legitimate usage of deno to request a file or bring a DLL to a host level: low
Query: Sigma rule for Detects the execution of the LOLBIN gpscript, which executes logon or startup scripts configured in Group Policy
Matching passage: Sigma rule: Detects the execution of the LOLBIN gpscript, which executes logon or startup scripts configured in Group Policy. Logsource: windows / process_creation. Rule: title: Gpscript Execution id: 1e59c230-6670-45bf-83b0-98903780607e status: test description: Detects the execution of the LOLBIN gpscript, which executes logon or startup scripts configured in Group Policy references: - https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/ - https://lolbas-project.github.io/lolbas/Binaries/Gpscript/ author: frack113 date: 2022-05-16 modified: 2023-06-14 tags: - attack.stealth - attack.t1218 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \gpscript.exe - OriginalFileName: GPSCRIPT.EXE selection_cli: CommandLine|contains: - ' /logon' - ' /startup' filter_main_svchost: ParentCommandLine: C:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc condition: all of selection_* and not 1 of filter_main_* falsepositives: - Legitimate uses of logon scripts distributed via group policy level: medium
Near-miss passage: Sigma rule: Detects source code enumeration that use GET requests by keyword searches in URL strings. Logsource: webserver. Rule: title: Source Code Enumeration Detection by Keyword id: 953d460b-f810-420a-97a2-cfca4c98e602 status: test description: Detects source code enumeration that use GET requests by keyword searches in URL strings references: - https://pentester.land/tutorials/2018/10/25/source-code-disclosure-via-exposed-git-folder.html - https://medium.com/@logicbomb_1/bugbounty-how-i-was-able-to-download-the-source-code-of-indias-largest-telecom-service-52cf5c5640a1 author: James Ahearn date: 2019-06-08 modified: 2022-10-05 tags: - attack.discovery - attack.t1083 logsource: category: webserver detection: keywords: - .git/ condition: keywords falsepositives: - Unknown level: medium