alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: SIEM correlation: execution activity consistent with Container Administration Command
Matching passage: T1609 Container Administration Command. Tactics: execution. Description: Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.(Citation: Docker Daemon CLI)(Citation: Kubernetes API)(Citation: Kubernetes Kubelet) In Docker, adversaries may specify an entrypoint during container deployment that executes a script or command, or they may use a command such as <code>docker exec</code> to execute a command within a running container.(Citation: Docker Entrypoint)(Citation: Docker Exec) In Kubernetes, if an adversary has sufficient permissions, they may gain remote execution in a container in the cluster via interaction with the Kubernetes API server, the kubelet, or by running a command such as <code>kubectl exec</code>.(Citation: Kubectl Exec Get Shell)
Near-miss passage: T1574.006 Dynamic Linker Hijacking. Tactics: stealth, execution. Description: Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from various environment variables and files, such as <code>LD_PRELOAD</code> on Linux or <code>DYLD_INSERT_LIBRARIES</code> on macOS.(Citation: TheEvilBit DYLD_INSERT_LIBRARIES)(Citation: Timac DYLD_INSERT_LIBRARIES)(Citation: Gabilondo DYLD_INSERT_LIBRARIES Catalina Bypass) Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name.(Citation: Man LD.SO)(Citation: TLDP Shared Libraries)(Citation: Apple Doco Archive Dynamic Libraries) Each platform's linker uses an extensive list of environment variables at different points in execution. These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions in the original library.(Citation: Baeldung LD_PRELOAD) Hijacking dynamic linker variables may grant access to the victim process's memory, system/network resources, and possibly elevated privileges. On Linux, adversaries may set <code>LD_PRELOAD</code> to point to malicious libraries that match the name of legitimate libraries which are requested by a victim program, causing the operating system to load the adversary's malicious code upon execution of the victim program. For example, adversaries have used `LD_PRELOAD` to inject a malicious library into every descendant process of the `sshd` daemon, resulting in execution under a legitimate process. When the executing sub-process calls the `execve` function, for example, the malicious library’s `execve` function is executed rather than the system function `execve` contained in the system library on disk. This allows adversaries to [Hide Artifacts](https://attack.mitre.org/techniques/T1564) from detection, as
Query: common weakness: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Matching passage: CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection'). The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
Near-miss passage: CWE-1229 Creation of Emergent Resource. The product manages resources or behaves in a way that indirectly creates a new, distinct resource that can be used by attackers in violation of the intended policy.
Query: alert when Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)
Matching passage: Sigma rule: Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32). Logsource: windows / registry_set. Rule: title: UAC Bypass Using Windows Media Player - Registry id: 5f9db380-ea57-4d1e-beab-8a2d33397e93 status: test description: Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-23 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\Program Files\Windows Media Player\osk.exe Details: Binary Data condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects download of certain file types from hosts with dynamic DNS names (selected list). Logsource: proxy. Rule: title: Download from Suspicious Dyndns Hosts id: 195c1119-ef07-4909-bb12-e66f5e07bf3c status: test description: Detects download of certain file types from hosts with dynamic DNS names (selected list) references: - https://www.alienvault.com/blogs/security-essentials/dynamic-dns-security-and-potential-threats author: Florian Roth (Nextron Systems) date: 2017-11-08 modified: 2023-05-18 tags: - attack.command-and-control - attack.t1105 - attack.t1568 logsource: category: proxy detection: selection: c-uri-extension: - exe - vbs - bat - rar - ps1 - doc - docm - xls - xlsm - pptm - rtf - hta - dll - ws - wsf - sct - zip cs-host|endswith: - .hopto.org - .no-ip.org - .no-ip.info - .no-ip.biz - .no-ip.com - .noip.com - .ddns.name - .myftp.org - .myftp.biz - .serveblog.net - .servebeer.com - .servemp3.com - .serveftp.com - .servequake.com - .servehalflife.com - .servehttp.com - .servegame.com - .servepics.com - .myvnc.com - .ignorelist.com - .jkub.com - .dlinkddns.com - .jumpingcrab.com - .ddns.info - .mooo.com - .dns-dns.com - .strangled.net - .adultdns.net - .craftx.biz - .ddns01.com - .dns53.biz - .dnsapi.info - .dnsd.info - .dnsdynamic.com - .dnsdynamic.net - .dnsget.org - .fe100.net - .flashserv.net - .ftp21.net - .http01.com - .http80.info - .https443.com - .imap01.com - .kadm5.com - .mysq1.net - .ns360.info - .ntdll.net - .ole32.com - .proxy8080.com - .sql01.com - .ssh01.com - .ssh22.net - .tempors.com - .tftpd.net - .ttl60.com - .ttl60.org - .user32.com - .voip01.com - .wow64.net - .x64.me - .xns01.com - .dyndns.org - .dyndns.info - .dyndns.tv - .dyndns-at-home.com - .dnsomatic.com - .zapto.org - .webhop.net - .25u.com - .slyip.net condition: selection falsepositives: - Software downloads level: medium
Query: patch priority for CVE-2015-6380
Matching passage: CVE-2015-6380. CWE: CWE-78. CVSS: 6.5. An unspecified script in the web interface in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows remote authenticated users to execute arbitrary OS commands via crafted parameters, aka Bug ID CSCux10622.
Near-miss passage: CVE-2015-3611. CWE: CWE-78. CVSS: 8.800000190734863. A Command Injection vulnerability exists in FortiManager 5.2.1 and earlier and FortiManager 5.0.10 and earlier via unspecified vectors, which could let a malicious user run systems commands when executing a report.
Query: actor TTPs: Electron Applications
Matching passage: T1218.015 Electron Applications. Tactics: stealth. Description: Adversaries may abuse components of the Electron framework to execute malicious code. The Electron framework hosts many common applications such as Signal, Slack, and Microsoft Teams.(Citation: Electron 2) Originally developed by GitHub, Electron is a cross-platform desktop application development framework that employs web technologies like JavaScript, HTML, and CSS.(Citation: Electron 3) The Chromium engine is used to display web content and Node.js runs the backend code.(Citation: Electron 1) Due to the functional mechanics of Electron (such as allowing apps to run arbitrary commands), adversaries may also be able to perform malicious functions in the background potentially disguised as legitimate tools within the framework.(Citation: Electron 1) For example, the abuse of `teams.exe` and `chrome.exe` may allow adversaries to execute malicious commands as child processes of the legitimate application (e.g., `chrome.exe --disable-gpu-sandbox --gpu-launcher="C:\Windows\system32\cmd.exe /c calc.exe`).(Citation: Electron 6-8) Adversaries may also execute malicious content by planting malicious [JavaScript](https://attack.mitre.org/techniques/T1059/007) within Electron applications.(Citation: Electron Security)
Near-miss passage: T1218.004 InstallUtil. Tactics: stealth. Description: Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: <code>C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe</code> and <code>C:\Windows\Microsoft.NET\Framework64\v<version>\InstallUtil.exe</code>. InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute <code>[System.ComponentModel.RunInstaller(true)]</code>. (Citation: LOLBAS Installutil)
Query: vulnerability: daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local users to write to arbitrary files or poss
Matching passage: CVE-2015-3147. CWE: CWE-59. CVSS: 6.5. daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local users to write to arbitrary files or possibly have other unspecified impact via a symlink attack on (1) /var/spool/abrt or (2) /var/tmp/abrt.
Near-miss passage: CVE-2015-1335. CWE: CWE-59. CVSS: 7.199999809265137. lxc-start in lxc before 1.0.8 and 1.1.x before 1.1.4 allows local container administrators to escape AppArmor confinement via a symlink attack on a (1) mount target or (2) bind mount source.
Query: Lateral movement indicators for Scheduled Task
Matching passage: T1053.005 Scheduled Task. Tactics: execution, persistence, privilege escalation. Description: Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The [schtasks](https://attack.mitre.org/software/S0111) utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel.(Citation: Stack Overflow) In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.(Citation: Red Canary - Atomic Red Team) An adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence. The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and/or to run a process under the context of a specified account (such as SYSTEM). Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused the Windows Task Scheduler to potentially mask one-time execution under signed/trusted system processes.(Citation: ProofPoint Serpent) Adversaries may also create "hidden" scheduled tasks (i.e. [Hide Artifacts](https://attack.mitre.org/techniques/T1564)) that may not be visible to defender tools and manual queries used to enumerate tasks. Specifically, an adversary may hide a task from `schtasks /query` and the Task Scheduler by deleting the associated Security Descriptor (SD) registry value (where deletion of this value must be completed using SYSTEM permissions).(Citation: SigmaHQ)(Citation: Tarrask scheduled task) Adversaries may also employ alternate me
Near-miss passage: T1053.007 Container Orchestration Job. Tactics: execution, persistence, privilege escalation. Description: Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster. In Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks.(Citation: Kubernetes Jobs)(Citation: Kubernetes CronJob) An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in various nodes within a cluster.(Citation: Threat Matrix for Kubernetes)
Query: patch priority for CVE-2015-8106
Matching passage: CVE-2015-8106. CWE: CWE-134. CVSS: 7.800000190734863. Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10 allows remote attackers to execute arbitrary code via format string specifiers in the \keywords command in a crafted TeX file.
Near-miss passage: CVE-2015-8107. CWE: CWE-134. CVSS: 7.800000190734863. Format string vulnerability in GNU a2ps 4.14 allows remote attackers to execute arbitrary code.
Query: risk of Unquoted Windows search path vulnerability in Toshiba Bluetooth Stack for Windows before 9.10.32(T) and Service Station before 2.2.14 allows local users to gain privileges via a Tr
Matching passage: CVE-2015-0884. CWE: UNKNOWN. CVSS: 6.900000095367432. Unquoted Windows search path vulnerability in Toshiba Bluetooth Stack for Windows before 9.10.32(T) and Service Station before 2.2.14 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character.
Near-miss passage: CVE-2015-2096. CWE: UNKNOWN. CVSS: 6.800000190734863. Use-after-free vulnerability in the Connect function in the WESPMonitor.WESPMonitorCtrl.1 ActiveX control in WebGate eDVR Manager allows remote attackers to execute arbitrary code via an invalid IP address and a page reload.
Query: describe CVE-2015-5360
Matching passage: CVE-2015-5360. CWE: CWE-399. CVSS: 5.0. IPv6 sendd in Juniper Junos 12.1X44 before 12.1X44-D51, 12.1X46 before 12.1X46-D36, 12.1X46 before 12.1X46-D40, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D20, 13.2 before 13.2R8, 13.3 before 13.3R6, 14.1 before 14.1R5, 14.2 before 14.2R3, 15.1 before 15.1R1, and 15.1X49 before 15.1X49-D20, when the "set protocols neighbor-discovery secure security-level default" option is configured, allows remote attackers to cause a denial of service (CPU consumption) via a crafted Secure Neighbor Discovery (SEND) Protocol packet.
Near-miss passage: CVE-2015-1069. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Query: exploit Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before
Matching passage: CVE-2015-5723. CWE: CWE-264. CVSS: 7.800000190734863. Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.
Near-miss passage: CVE-2015-1673. CWE: CWE-264. CVSS: 9.300000190734863. The Windows Forms (aka WinForms) libraries in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allow user-assisted remote attackers to execute arbitrary code via a crafted partial-trust application, aka "Windows Forms Elevation of Privilege Vulnerability."
Query: describe CVE-2015-2817
Matching passage: CVE-2015-2817. CWE: CWE-200. CVSS: 5.0. The SAP Management Console in SAP NetWeaver 7.40 allows remote attackers to obtain sensitive information via the ReadProfile parameters, aka SAP Security Note 2091768.
Near-miss passage: CVE-2015-7208. CWE: CWE-200. CVSS: 5.0. Mozilla Firefox before 43.0 stores cookies containing vertical tab characters, which allows remote attackers to obtain sensitive information by reading HTTP Cookie headers.
Query: Sigma rule for Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse that feature to establish a reverse shell or pe
Matching passage: Sigma rule: Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse that feature to establish a reverse shell or pe. Logsource: windows / dns_query. Rule: title: Cloudflared Tunnels Related DNS Requests id: a1d9eec5-33b2-4177-8d24-27fe754d0812 related: - id: 7cd1dcdc-6edf-4896-86dc-d1f19ad64903 type: similar status: test description: 'Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. ' references: - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/ - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-12-20 tags: - attack.command-and-control - attack.t1071.001 - attack.t1572 logsource: category: dns_query product: windows detection: selection: QueryName|endswith: - .v2.argotunnel.com - protocol-v2.argotunnel.com - trycloudflare.com - update.argotunnel.com condition: selection falsepositives: - Legitimate use of cloudflare tunnels will also trigger this. level: medium
Near-miss passage: Sigma rule: Detects the presence of an LSASS dump file in the "CrashDumps" folder. This could be a sign of LSASS credential dumping.. Logsource: windows / file_event. Rule: title: LSASS Process Dump Artefact In CrashDumps Folder id: 6902955a-01b7-432c-b32a-6f5f81d8f625 status: test description: Detects the presence of an LSASS dump file in the "CrashDumps" folder. This could be a sign of LSASS credential dumping. Techniques such as the LSASS Shtinkering have been seen abusing the Windows Error Reporting to dump said process. references: - https://github.com/deepinstinct/Lsass-Shtinkering - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf author: '@pbssubhash' date: 2022-12-08 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: file_event detection: selection: TargetFilename|startswith: C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\ TargetFilename|contains: lsass.exe. TargetFilename|endswith: .dmp condition: selection falsepositives: - Rare legitimate dump of the process by the operating system due to a crash of lsass level: high
Query: exploit Microsoft Internet Explorer 11 and Microsoft Edge mishandle content types, which allows remote attackers to execute arbitrary web script in a privileged context via a crafted web s
Matching passage: CVE-2015-6139. CWE: CWE-264. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 and Microsoft Edge mishandle content types, which allows remote attackers to execute arbitrary web script in a privileged context via a crafted web site, aka "Microsoft Browser Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-7266. CWE: CWE-264. CVSS: 7.5. The Interactive Advertising Bureau (IAB) OpenRTB 2.3 protocol implementation might allow remote attackers to conceal the status of ad transactions and potentially compromise bid integrity by leveraging failure to limit the time between bid responses and impression notifications, aka the Amnesia Bug.
Query: campaign using Inter-Process Communication
Matching passage: T1559 Inter-Process Communication. Tactics: execution. Description: Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern. Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002) or [Component Object Model](https://attack.mitre.org/techniques/T1559/001). Linux environments support several different IPC mechanisms, two of which being sockets and pipes.(Citation: Linux IPC) Higher level execution mediums, such as those of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s, may also leverage underlying IPC mechanisms. Adversaries may also use [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) to facilitate remote IPC execution.(Citation: Fireeye Hunting COM June 2019)
Near-miss passage: T1559.001 Component Object Model. Tactics: execution. Description: Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) Remote COM execution is facilitated by [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) (DCOM).(Citation: Fireeye Hunting COM June 2019) Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).(Citation: Microsoft COM) Specific COM objects also exist to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.(Citation: Fireeye Hunting COM June 2019)(Citation: ProjectZero File Write EoP Apr 2018)