alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: EDR alert: possible HTML Smuggling (T1027.006)
Matching passage: T1027.006 HTML Smuggling. Tactics: stealth. Description: Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. HTML documents can store large binary objects known as JavaScript Blobs (immutable data that represents raw bytes) that can later be constructed into file-like objects. Data may also be stored in Data URLs, which enable embedding media type or MIME files inline of HTML documents. HTML5 also introduced a download attribute that may be used to initiate file downloads.(Citation: HTML Smuggling Menlo Security 2020)(Citation: Outlflank HTML Smuggling 2018) Adversaries may deliver payloads to victims that bypass security controls through HTML Smuggling by abusing JavaScript Blobs and/or HTML5 download attributes. Security controls such as web content filters may not identify smuggled malicious files inside of HTML/JS files, as the content may be based on typically benign MIME types such as <code>text/plain</code> and/or <code>text/html</code>. Malicious files or data can be obfuscated and hidden inside of HTML files through Data URLs and/or JavaScript Blobs and can be deobfuscated when they reach the victim (i.e. [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140)), potentially bypassing content filters. For example, JavaScript Blobs can be abused to dynamically generate malicious files in the victim machine and may be dropped to disk by abusing JavaScript functions such as <code>msSaveBlob</code>.(Citation: HTML Smuggling Menlo Security 2020)(Citation: MSTIC NOBELIUM May 2021)(Citation: Outlflank HTML Smuggling 2018)(Citation: nccgroup Smuggling HTA 2017)
Near-miss passage: T1027.014 Polymorphic Code. Tactics: stealth. Description: Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection. Polymorphic code is a type of software capable of changing its runtime footprint during code execution.(Citation: polymorphic-blackberry) With each execution of the software, the code is mutated into a different version of itself that achieves the same purpose or objective as the original. This functionality enables the malware to evade traditional signature-based defenses, such as antivirus and antimalware tools.(Citation: polymorphic-sentinelone) Other obfuscation techniques can be used in conjunction with polymorphic code to accomplish the intended effects, including using mutation engines to conduct actions such as [Software Packing](https://attack.mitre.org/techniques/T1027/002), [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010), or [Encrypted/Encoded File](https://attack.mitre.org/techniques/T1027/013).(Citation: polymorphic-linkedin)(Citation: polymorphic-medium)
Query: SOC alert related to Exfiltration Over Alternative Protocol
Matching passage: T1048 Exfiltration Over Alternative Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and/or obfuscate these alternate channels. [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048) can be done using various common operating system utilities such as [Net](https://attack.mitre.org/software/S0039)/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016) On macOS and Linux <code>curl</code> may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.(Citation: 20 macOS Common Tools and Techniques) Many IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or [Cloud API](https://attack.mitre.org/techniques/T1059/009).
Near-miss passage: T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.(Citation: copy_cmd_cisco) Adversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted (such as HTTP, FTP, or DNS). This may include custom or publicly available encoding/compression algorithms (such as base64) as well as embedding data within protocol headers and fields.
Query: rule covering Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted en
Matching passage: Sigma rule: Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted en. Logsource: linux / process_creation. Rule: title: Nohup Execution id: e4ffe466-6ff8-48d4-94bd-e32d1a6061e2 status: test description: Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments references: - https://gtfobins.github.io/gtfobins/nohup/ - https://en.wikipedia.org/wiki/Nohup - https://www.computerhope.com/unix/unohup.htm author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io date: 2022-06-06 tags: - attack.execution - attack.t1059.004 logsource: product: linux category: process_creation detection: selection: Image|endswith: /nohup condition: selection falsepositives: - Administrators or installed processes that leverage nohup level: medium
Near-miss passage: Sigma rule: Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. Thes. Logsource: windows / process_creation. Rule: title: Msxsl.EXE Execution id: 9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0 status: test description: 'Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. These files are commonly used to describe the processing and rendering of data within XML files. Adversaries can abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/ author: Timur Zinniatullin, oscd.community date: 2019-10-21 modified: 2023-11-09 tags: - attack.stealth - attack.t1220 logsource: category: process_creation product: windows detection: selection: Image|endswith: \msxsl.exe condition: selection falsepositives: - Msxsl is not installed by default and is deprecated, so unlikely on most systems. level: medium
Query: patch priority for CVE-2015-0426
Matching passage: CVE-2015-0426. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 12.1.0.3 and 12.1.0.4 allows remote attackers to affect confidentiality via unknown vectors related to UI Framework.
Near-miss passage: CVE-2015-0508. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB, a different vulnerability than CVE-2015-0506.
Query: alert when detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is us
Matching passage: Sigma rule: detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is us. Logsource: windows / security. Rule: title: Suspicious PsExec Execution id: c462f537-a1e3-41a6-b5fc-b2c2cef9bf82 status: test description: detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one references: - https://web.archive.org/web/20230329171218/https://blog.menasec.net/2019/02/threat-hunting-3-detecting-psexec.html author: Samir Bousseaden date: 2019-04-03 modified: 2022-08-11 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure detection: selection1: EventID: 5145 ShareName: \\\\\*\\IPC$ RelativeTargetName|endswith: - -stdin - -stdout - -stderr filter: RelativeTargetName|startswith: PSEXESVC condition: selection1 and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of "findstr" with the argument "385201". Which could indicate potential discovery of an installed Sysinter. Logsource: windows / process_creation. Rule: title: Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE id: 37db85d1-b089-490a-a59a-c7b6f984f480 status: test description: Detects usage of "findstr" with the argument "385201". Which could indicate potential discovery of an installed Sysinternals Sysmon service using the default driver altitude (even if the name is changed). references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md#atomic-test-5---security-software-discovery---sysmon-service author: frack113 date: 2021-12-16 modified: 2023-11-14 tags: - attack.discovery - attack.t1518.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \find.exe - \findstr.exe - OriginalFileName: - FIND.EXE - FINDSTR.EXE selection_cli: CommandLine|contains: ' 385201' condition: all of selection_* falsepositives: - Unknown level: high
Query: describe CVE-2015-0292
Matching passage: CVE-2015-0292. CWE: CWE-119. CVSS: 7.5. Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow.
Near-miss passage: CVE-2015-1362. CWE: CWE-119. CVSS: 7.5. Buffer overflow in the Customize 35mm tab in Two Pilots Exif Pilot 4.7.2 allows remote attackers to execute arbitrary code via a long string in the maker element in an XML file.
Query: exploit The get_user_grouplist function in the extdom plug-in in FreeIPA before 4.1.4 does not properly reallocate memory when processing user accounts, which allows remote attackers to ca
Matching passage: CVE-2015-1827. CWE: CWE-19. CVSS: 5.0. The get_user_grouplist function in the extdom plug-in in FreeIPA before 4.1.4 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (crash) via a group list request for a user that belongs to a large number of groups.
Near-miss passage: CVE-2015-5344. CWE: CWE-19. CVSS: 9.800000190734863. The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
Query: risk of SQL injection vulnerability in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote attackers to execute arbitrary SQL commands via the catId parameter to cm/blogrss/feed.
Matching passage: CVE-2015-2070. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote attackers to execute arbitrary SQL commands via the catId parameter to cm/blogrss/feed.
Near-miss passage: CVE-2015-9399. CWE: CWE-89. CVSS: 7.199999809265137. The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection.
Query: patch priority for CVE-2015-7611
Matching passage: CVE-2015-7611. CWE: CWE-78. CVSS: 8.100000381469727. Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.
Near-miss passage: CVE-2015-2980. CWE: CWE-78. CVSS: 6.800000190734863. The Yodobashi application 1.2.1.0 and earlier for Android allows remote attackers to execute arbitrary Java methods, and consequently obtain sensitive information or execute OS commands, via a crafted HTML document.
Query: write Sigma for Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool.
Matching passage: Sigma rule: Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool.. Logsource: windows / file_event. Rule: title: ADSI-Cache File Creation By Uncommon Tool id: 75bf09fa-1dd7-4d18-9af9-dd9e492562eb status: test description: Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool. references: - https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961 - https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/ - https://github.com/fox-it/LDAPFragger author: xknow @xknow_infosec, Tim Shelton date: 2019-03-24 modified: 2023-10-18 tags: - attack.t1001.003 - attack.command-and-control logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \Local\Microsoft\Windows\SchCache\ TargetFilename|endswith: .sch filter_main_generic: - Image|endswith: - :\Program Files\Cylance\Desktop\CylanceSvc.exe - :\Windows\CCM\CcmExec.exe - :\windows\system32\dllhost.exe - :\Windows\system32\dsac.exe - :\Windows\system32\efsui.exe - :\windows\system32\mmc.exe - :\windows\system32\svchost.exe - :\Windows\System32\wbem\WmiPrvSE.exe - :\windows\system32\WindowsPowerShell\v1.0\powershell.exe - Image|contains: - :\Windows\ccmsetup\autoupgrade\ccmsetup - :\Program Files\SentinelOne\Sentinel Agent filter_main_office: Image|contains|all: - :\Program Files\ - \Microsoft Office Image|endswith: \OUTLOOK.EXE filter_optional_ldapwhoami: Image|endswith: \LANDesk\LDCLient\ldapwhoami.exe filter_optional_citrix: Image|endswith: :\Program Files\Citrix\Receiver StoreFront\Services\DefaultDomainServices\Citrix.DeliveryServices.DomainServices.ServiceHost.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Other legimate tools, which do ADSI (LDAP) operations, e.g. any remoting activity by MMC, Powershell, Windows etc. level: medium
Near-miss passage: Sigma rule: Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN. Logsource: windows / security. Rule: title: Password Dumper Activity on LSASS id: aa1697b7-d611-4f9a-9cb2-5125b4ccfd5c status: test description: Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN references: - https://twitter.com/jackcr/status/807385668833968128 author: sigma date: 2017-02-12 modified: 2022-10-09 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows service: security detection: selection: EventID: 4656 ProcessName|endswith: \lsass.exe AccessMask: '0x705' ObjectType: SAM_DOMAIN condition: selection falsepositives: - Unknown level: high
Query: exploit Mozilla Firefox before 41.0, when reader mode is enabled, allows remote attackers to spoof the relationship between address-bar URLs and web content via a crafted web site.
Matching passage: CVE-2015-4508. CWE: CWE-254. CVSS: 2.5999999046325684. Mozilla Firefox before 41.0, when reader mode is enabled, allows remote attackers to spoof the relationship between address-bar URLs and web content via a crafted web site.
Near-miss passage: CVE-2015-1278. CWE: CWE-254. CVSS: 4.300000190734863. content/browser/web_contents/web_contents_impl.cc in Google Chrome before 44.0.2403.89 does not ensure that a PDF document's modal dialog is closed upon navigation to an interstitial page, which allows remote attackers to spoof URLs via a crafted document, as demonstrated by the alert_dialog.pdf document.
Query: describe CVE-2015-0443
Matching passage: CVE-2015-0443. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality based on Trillium, a different vulnerability than CVE-2015-0444, CVE-2015-0445, CVE-2015-0446, CVE-2015-2634, CVE-2015-2635, CVE-2015-2636, CVE-2015-4758, and CVE-2015-4759.
Near-miss passage: CVE-2015-0453. CWE: UNKNOWN. CVSS: 3.299999952316284. Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote attackers to affect confidentiality via vectors related to PORTAL.
Query: risk of Cisco IOS XR 5.3.1 on ASR 9000 devices allows remote attackers to cause a denial of service (NPU chip reset or line-card reload) by sending crafted IEEE 802.3x flow-control PAUSE f
Matching passage: CVE-2015-4205. CWE: CWE-399. CVSS: 5.699999809265137. Cisco IOS XR 5.3.1 on ASR 9000 devices allows remote attackers to cause a denial of service (NPU chip reset or line-card reload) by sending crafted IEEE 802.3x flow-control PAUSE frames on the local network, aka Bug ID CSCut19959.
Near-miss passage: CVE-2015-0056. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1623 and CVE-2015-1626.
Query: risk of Smartphone Passbook 1.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information from encrypted communication
Matching passage: CVE-2015-0874. CWE: CWE-295. CVSS: 5.900000095367432. Smartphone Passbook 1.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information from encrypted communications via a crafted certificate.
Near-miss passage: CVE-2015-6358. CWE: CWE-295. CVSS: 5.900000095367432. Multiple Cisco embedded devices use hardcoded X.509 certificates and SSH host keys embedded in the firmware, which allows remote attackers to defeat cryptographic protection mechanisms and conduct man-in-the-middle attacks by leveraging knowledge of these certificates and keys from another installation, aka Bug IDs CSCuw46610, CSCuw46620, CSCuw46637, CSCuw46654, CSCuw46665, CSCuw46672, CSCuw46677, CSCuw46682, CSCuw46705, CSCuw46716, CSCuw46979, CSCuw47005, CSCuw47028, CSCuw47040, CSCuw47048, CSCuw47061, CSCuw90860, CSCuw90869, CSCuw90875, CSCuw90881, CSCuw90899, and CSCuw90913.
Query: vulnerability: Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a denia
Matching passage: CVE-2015-3165. CWE: UNKNOWN. CVSS: 4.300000190734863. Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a denial of service (crash) by closing an SSL session at a time when the authentication timeout will expire during the session shutdown sequence.
Near-miss passage: CVE-2015-7078. CWE: UNKNOWN. CVSS: 7.199999809265137. Use-after-free vulnerability in Hypervisor in Apple OS X before 10.11.2 allows local users to gain privileges via vectors involving VM objects.
Query: hunt for Security Software Discovery activity
Matching passage: T1518.001 Security Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Example commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), <code>reg query</code> with [Reg](https://attack.mitre.org/software/S0075), <code>dir</code> with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software. Adversaries may also utilize the [Cloud API](https://attack.mitre.org/techniques/T1059/009) to discover cloud-native security software installed on compute infrastructure, such as the AWS CloudWatch agent, Azure VM Agent, and Google Cloud Monitor agent. These agents may collect metrics and logs from the VM, which may be centrally aggregated in a cloud-based monitoring platform.
Near-miss passage: T1518.002 Backup Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of backup software or configurations that are installed on a system. Adversaries may use this information to shape follow-on behaviors, such as [Data Destruction](https://attack.mitre.org/techniques/T1485), [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486). Commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), `reg query` with [Reg](https://attack.mitre.org/software/S0075), `dir` with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for, such as Veeam, Acronis, Dropbox, or Paragon.(Citation: Symantec Play Ransomware 2023)