alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: ATT&CK technique for Outlook Home Page
Matching passage: T1137.004 Outlook Home Page. Tactics: persistence. Description: Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system. Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders. This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened. A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page.(Citation: SensePost Outlook Home Page) Once malicious home pages have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious Home Pages will execute when the right Outlook folder is loaded/reloaded.(Citation: SensePost Outlook Home Page)
Near-miss passage: T1137 Office Application Startup. Tactics: persistence. Description: Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins. A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: SensePost Ruler GitHub) These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: TechNet O365 Outlook Rules)
Query: actor TTPs: Ccache Files
Matching passage: T1558.005 Ccache Files. Tactics: credential access. Description: Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having to re-enter credentials. The <code>/etc/krb5.conf</code> configuration file and the <code>KRB5CCNAME</code> environment variable are used to set the storage location for ccache entries. On Linux, credentials are typically stored in the `/tmp` directory with a naming format of `krb5cc_%UID%` or `krb5.ccache`. On macOS, ccache entries are stored by default in memory with an `API:{uuid}` naming scheme. Typically, users interact with ticket storage using <code>kinit</code>, which obtains a Ticket-Granting-Ticket (TGT) for the principal; <code>klist</code>, which lists obtained tickets currently held in the credentials cache; and other built-in binaries.(Citation: Kerberos GNU/Linux)(Citation: Binary Defense Kerberos Linux) Adversaries can collect tickets from ccache files stored on disk and authenticate as the current user without their password to perform [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003) attacks. Adversaries can also use these tickets to impersonate legitimate users with elevated privileges to perform [Privilege Escalation](https://attack.mitre.org/tactics/TA0004). Tools like Kekeo can also be used by adversaries to convert ccache files to Windows format for further [Lateral Movement](https://attack.mitre.org/tactics/TA0008). On macOS, adversaries may use open-source tools or the Kerberos framework to interact with ccache files and extract TGTs or Service Tickets via lower-level APIs.(Citation: SpectorOps Bifrost Kerberos macOS 2019)(Citation: Linux Kerberos Tickets)(Citation: Brining MimiKatz to Unix)(Citation: Kekeo)
Near-miss passage: T1558.001 Golden Ticket. Tactics: credential access. Description: Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TGT), also known as a golden ticket.(Citation: AdSecurity Kerberos GT Aug 2015) Golden tickets enable adversaries to generate authentication material for any account in Active Directory.(Citation: CERT-EU Golden Ticket Protection) Using a golden ticket, adversaries are then able to request ticket granting service (TGS) tickets, which enable access to specific resources. Golden tickets require adversaries to interact with the Key Distribution Center (KDC) in order to obtain TGS.(Citation: ADSecurity Detecting Forged Tickets) The KDC service runs all on domain controllers that are part of an Active Directory domain. KRBTGT is the Kerberos Key Distribution Center (KDC) service account and is responsible for encrypting and signing all Kerberos tickets.(Citation: ADSecurity Kerberos and KRBTGT) The KRBTGT password hash may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) and privileged access to a domain controller.
Query: Sigma rule for This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder
Matching passage: Sigma rule: This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder. Logsource: windows / process_creation. Rule: title: Execution of Powershell Script in Public Folder id: fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4 status: test description: This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder references: - https://www.mandiant.com/resources/evolution-of-fin7 author: Max Altgelt (Nextron Systems) date: 2022-04-06 modified: 2022-07-14 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - -f C:\Users\Public - -f "C:\Users\Public - -f %Public% - -fi C:\Users\Public - -fi "C:\Users\Public - -fi %Public% - -fil C:\Users\Public - -fil "C:\Users\Public - -fil %Public% - -file C:\Users\Public - -file "C:\Users\Public - -file %Public% condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects usage of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process. Logsource: windows / process_creation. Rule: title: HackTool - HollowReaper Execution id: 85d23b42-9a9d-4f8f-b3d7-d2733c1d58f5 status: experimental description: 'Detects usage of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process hollowing. It replaces the memory of a legitimate process with custom shellcode, allowing the attacker to execute payloads under the guise of trusted binaries. ' references: - https://github.com/vari-sh/RedTeamGrimoire/tree/b5e7635d34db6e1f0398d8847e8f293186e947c5/HollowReaper author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-07-01 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.012 logsource: category: process_creation product: windows detection: selection: Image|endswith: \HollowReaper.exe condition: selection falsepositives: - Unknown level: high
Query: CWE for Use of Obsolete Function
Matching passage: CWE-477 Use of Obsolete Function. The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
Near-miss passage: CWE-1434 Insecure Setting of Generative AI/ML Model Inference Parameters. The product has a component that relies on a generative AI/ML model configured with inference parameters that produce an unacceptably high rate of erroneous or unexpected outputs.
Query: write Sigma for Detect use of the Windows 8.3 short name. Which could be used as a method to avoid command-line detection
Matching passage: Sigma rule: Detect use of the Windows 8.3 short name. Which could be used as a method to avoid command-line detection. Logsource: windows / process_creation. Rule: title: Use NTFS Short Name in Command Line id: dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795 related: - id: 3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b type: similar status: test description: Detect use of the Windows 8.3 short name. Which could be used as a method to avoid command-line detection references: - https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/ - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10) - https://twitter.com/jonasLyk/status/1555914501802921984 author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 modified: 2022-09-21 tags: - attack.stealth - attack.t1564.004 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - ~1.exe - ~1.bat - ~1.msi - ~1.vbe - ~1.vbs - ~1.dll - ~1.ps1 - ~1.js - ~1.hta - ~2.exe - ~2.bat - ~2.msi - ~2.vbe - ~2.vbs - ~2.dll - ~2.ps1 - ~2.js - ~2.hta filter: - ParentImage|endswith: - \WebEx\WebexHost.exe - \thor\thor64.exe - CommandLine|contains: C:\xampp\vcredist\VCREDI~1.EXE condition: selection and not filter falsepositives: - Applications could use this notation occasionally which might generate some false positives. In that case Investigate the parent and child process. level: medium
Near-miss passage: Sigma rule: Detects the change of database master password. It may be a part of data exfiltration.. Logsource: aws / cloudtrail. Rule: title: AWS RDS Master Password Change id: 8a63cdd4-6207-414a-85bc-7e032bd3c1a2 status: test description: Detects the change of database master password. It may be a part of data exfiltration. references: - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/rds__explore_snapshots/main.py author: faloker date: 2020-02-12 modified: 2022-10-05 tags: - attack.exfiltration - attack.t1020 logsource: product: aws service: cloudtrail detection: selection_source: eventSource: rds.amazonaws.com responseElements.pendingModifiedValues.masterUserPassword|contains: '*' eventName: ModifyDBInstance condition: selection_source falsepositives: - Benign changes to a db instance level: medium
Query: secure coding against Release of Invalid Pointer or Reference
Matching passage: CWE-763 Release of Invalid Pointer or Reference. The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.
Near-miss passage: CWE-186 Overly Restrictive Regular Expression. A regular expression is overly restrictive, which prevents dangerous values from being detected.
Query: CVE similar to CVE-2015-0137
Matching passage: CVE-2015-0137. CWE: CWE-20. CVSS: 4.300000190734863. IBM PowerVC Standard 1.2.0.x before 1.2.0.4 and 1.2.1.x before 1.2.2 validates Hardware Management Console (HMC) certificates only during the pre-login stage, which allows man-in-the-middle attackers to spoof devices via a crafted certificate.
Near-miss passage: CVE-2015-4992. CWE: CWE-20. CVSS: 3.5. IBM Sterling B2B Integrator 5.2 before 5020500_8 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors.
Query: Sigma rule for Detects a suspicious execution of a Microsoft HTML Help (HH.exe)
Matching passage: Sigma rule: Detects a suspicious execution of a Microsoft HTML Help (HH.exe). Logsource: windows / process_creation. Rule: title: Suspicious HH.EXE Execution id: e8a95b5e-c891-46e2-b33a-93937d3abc31 status: test description: Detects a suspicious execution of a Microsoft HTML Help (HH.exe) references: - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/ - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7 - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/ - https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37 author: Maxim Pavlunin date: 2020-04-01 modified: 2023-04-12 tags: - attack.execution - attack.initial-access - attack.stealth - attack.t1047 - attack.t1059.001 - attack.t1059.003 - attack.t1059.005 - attack.t1059.007 - attack.t1218 - attack.t1218.001 - attack.t1218.010 - attack.t1218.011 - attack.t1566 - attack.t1566.001 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: HH.exe - Image|endswith: \hh.exe selection_paths: CommandLine|contains: - .application - \AppData\Local\Temp\ - \Content.Outlook\ - \Downloads\ - \Users\Public\ - \Windows\Temp\ condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a suspicious child process of a Microsoft HTML Help (HH.exe). Logsource: windows / process_creation. Rule: title: HTML Help HH.EXE Suspicious Child Process id: 52cad028-0ff0-4854-8f67-d25dfcbc78b4 status: test description: Detects a suspicious child process of a Microsoft HTML Help (HH.exe) references: - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/ - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7 - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/ - https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37 author: Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems) date: 2020-04-01 modified: 2023-04-12 tags: - attack.execution - attack.initial-access - attack.stealth - attack.t1047 - attack.t1059.001 - attack.t1059.003 - attack.t1059.005 - attack.t1059.007 - attack.t1218 - attack.t1218.001 - attack.t1218.010 - attack.t1218.011 - attack.t1566 - attack.t1566.001 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \hh.exe Image|endswith: - \CertReq.exe - \CertUtil.exe - \cmd.exe - \cscript.exe - \installutil.exe - \MSbuild.exe - \MSHTA.EXE - \msiexec.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \schtasks.exe - \wmic.exe - \wscript.exe condition: selection falsepositives: - Unknown level: high
Query: detect Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or u in logs
Matching passage: Sigma rule: Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or u. Logsource: windows / security. Rule: title: Group Policy Abuse for Privilege Addition id: 1c480e10-7ee1-46d4-8ed2-85f9789e3ce4 status: test description: 'Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins. ' author: Elastic, Josh Nickels, Marius Rothenbücher references: - https://www.elastic.co/guide/en/security/current/group-policy-abuse-for-privilege-addition.html#_setup_275 date: 2024-09-04 tags: - attack.privilege-escalation - attack.defense-impairment - attack.t1484.001 logsource: product: windows service: security definition: 'Requirements: The "Audit Directory Service Changes" logging policy must be configured in order to receive events.' detection: selection: EventID: 5136 AttributeLDAPDisplayName: gPCMachineExtensionNames AttributeValue|contains: - 827D319E-6EAC-11D2-A4EA-00C04F79F83A - 803E14A0-B4FB-11D0-A0D0-00A0C90F574B condition: selection falsepositives: - Users allowed to perform these modifications (user found in field SubjectUserName) level: medium
Near-miss passage: Sigma rule: Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs. Logsource: windows / image_load. Rule: title: HackTool - SharpEvtMute DLL Load id: 49329257-089d-46e6-af37-4afce4290685 related: - id: bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c type: similar status: test description: Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs references: - https://github.com/bats3c/EvtMute author: Florian Roth (Nextron Systems) date: 2022-09-07 modified: 2024-11-23 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: image_load product: windows detection: selection: Hashes|contains: IMPHASH=330768A4F172E10ACB6287B87289D83B condition: selection falsepositives: - Other DLLs with the same Imphash level: high
Query: EDR alert: possible Application Exhaustion Flood (T1499.003)
Matching passage: T1499.003 Application Exhaustion Flood. Tactics: impact. Description: Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications. For example, specific features in web applications may be highly resource intensive. Repeated requests to those features may be able to exhaust system resources and deny access to the application or the server itself.(Citation: Arbor AnnualDoSreport Jan 2018)
Near-miss passage: T1499 Endpoint Denial of Service. Tactics: impact. Description: Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014) An Endpoint DoS denies the availability of a service without saturating the network used to provide access to the service. Adversaries can target various layers of the application stack that is hosted on the system used to provide the service. These layers include the Operating Systems (OS), server applications such as web servers, DNS servers, databases, and the (typically web-based) applications that sit on top of them. Attacking each layer requires different techniques that take advantage of bottlenecks that are unique to the respective components. A DoS attack may be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS). To perform DoS attacks against endpoint resources, several aspects apply to multiple methods, including IP address spoofing and botnets. Adversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection. This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices. Botnets are commonly used to conduct DDoS attacks against networks and services. Large
Query: patch priority for CVE-2015-8763
Matching passage: CVE-2015-8763. CWE: CWE-125. CVSS: 8.100000381469727. The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to have unspecified impact via a crafted (1) commit or (2) confirm message, which triggers an out-of-bounds read.
Near-miss passage: CVE-2015-9383. CWE: CWE-125. CVSS: 6.5. FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.
Query: actor TTPs: Stripped Payloads
Matching passage: T1027.008 Stripped Payloads. Tactics: stealth. Description: Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information. Scripts and executables may contain variables names and other strings that help developers document code functionality. Symbols are often created by an operating system’s `linker` when executable payloads are compiled. Reverse engineers use these symbols and strings to analyze code and to identify functionality in payloads.(Citation: Mandiant golang stripped binaries explanation)(Citation: intezer stripped binaries elf files 2018) Adversaries may use stripped payloads in order to make malware analysis more difficult. For example, compilers and other tools may provide features to remove or obfuscate strings and symbols. Adversaries have also used stripped payload formats, such as run-only AppleScripts, a compiled and stripped version of [AppleScript](https://attack.mitre.org/techniques/T1059/002), to evade detection and analysis. The lack of human-readable information may directly hinder detection and analysis of payloads.(Citation: SentinelLabs reversing run-only applescripts 2021)
Near-miss passage: T1027.016 Junk Code Insertion. Tactics: stealth. Description: Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code that either does not execute, or if it does execute, does not change the functionality of the code. Junk code makes analysis more difficult and time-consuming, as the analyst steps through non-functional code instead of analyzing the main code. It also may hinder detections that rely on static code analysis due to the use of benign functionality, especially when combined with [Compression](https://attack.mitre.org/techniques/T1027/015) or [Software Packing](https://attack.mitre.org/techniques/T1027/002).(Citation: ReasonLabs)(Citation: ReasonLabs Cyberpedia Junk Code) No-Operation (NOP) instructions are an example of dead code commonly used in x86 assembly language. They are commonly used as the 0x90 opcode. When NOPs are added to malware, the disassembler may show the NOP instructions, leading to the analyst needing to step through them.(Citation: ReasonLabs) The use of junk / dead code insertion is distinct from [Binary Padding](https://attack.mitre.org/techniques/T1027/001) because the purpose is to obfuscate the functionality of the code, rather than simply to change the malware’s signature.
Query: write Sigma for Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be instal
Matching passage: Sigma rule: Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be instal. Logsource: linux / auditd. Rule: title: Clipboard Collection with Xclip Tool - Auditd id: 214e7e6c-f21b-47ff-bb6f-551b2d143fcf status: test description: 'Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations. ' references: - https://linux.die.net/man/1/xclip - https://www.cyberciti.biz/faq/xclip-linux-insert-files-command-output-intoclipboard/ author: Pawel Mazur date: 2021-09-24 modified: 2022-11-26 tags: - attack.collection - attack.t1115 logsource: product: linux service: auditd detection: selection: type: EXECVE a0: xclip a1: - -selection - -sel a2: - clipboard - clip a3: -o condition: selection falsepositives: - Legitimate usage of xclip tools level: low
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "7za.dll". Logsource: windows / image_load. Rule: title: Potential 7za.DLL Sideloading id: 4f6edb78-5c21-42ab-a558-fd2a6fc1fd57 status: test description: Detects potential DLL sideloading of "7za.dll" references: - https://www.gov.pl/attachment/ee91f24d-3e67-436d-aa50-7fa56acf789d author: X__Junior date: 2023-06-09 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \7za.dll filter_main_legit_path: Image|startswith: - C:\Program Files (x86)\ - C:\Program Files\ ImageLoaded|startswith: - C:\Program Files (x86)\ - C:\Program Files\ condition: selection and not 1 of filter_main_* falsepositives: - Legitimate third party application located in "AppData" may leverage this DLL to offer 7z compression functionality and may generate false positives. Apply additional filters as needed. level: low