alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects keywords that could indicate clearing PowerShell history
Matching passage: Sigma rule: Detects keywords that could indicate clearing PowerShell history. Logsource: windows / ps_script. Rule: title: Clear PowerShell History - PowerShell id: 26b692dc-1722-49b2-b496-a8258aa6371d related: - id: dfba4ce1-e0ea-495f-986e-97140f31af2d type: derived status: test description: Detects keywords that could indicate clearing PowerShell history references: - https://gist.github.com/hook-s3c/7363a856c3cdbadeb71085147f042c1a author: Ilyas Ochkov, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community date: 2022-01-25 modified: 2022-12-02 tags: - attack.stealth - attack.t1070.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection1a: ScriptBlockText|contains: - del - Remove-Item - rm selection1b: ScriptBlockText|contains: (Get-PSReadlineOption).HistorySavePath selection_2: ScriptBlockText|contains|all: - Set-PSReadlineOption - –HistorySaveStyle - SaveNothing selection_3: ScriptBlockText|contains|all: - Set-PSReadlineOption - -HistorySaveStyle - SaveNothing condition: 1 of selection_* or all of selection1* falsepositives: - Legitimate PowerShell scripts level: medium
Near-miss passage: Sigma rule: Detects enumeration of local network configuration. Logsource: linux / process_creation. Rule: title: System Network Discovery - Linux id: e7bd1cfa-b446-4c88-8afb-403bcd79e3fa status: test description: Detects enumeration of local network configuration references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md author: Ömer Günal and remotephone, oscd.community date: 2020-10-06 modified: 2022-09-15 tags: - attack.discovery - attack.t1016 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: - /firewall-cmd - /ufw - /iptables - /netstat - /ss - /ip - /ifconfig - /systemd-resolve - /route selection_cli: CommandLine|contains: /etc/resolv.conf condition: 1 of selection_* falsepositives: - Legitimate administration activities level: informational
Query: Encoded PowerShell / command-line abuse matching Exploitation for Stealth
Matching passage: T1211 Exploitation for Stealth. Tactics: stealth. Description: Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components. Adversaries may exploit a system or application vulnerability to avoid detection while maintaining access within an environment. Exploitation occurs when an adversary leverages a programming flaw to execute code in a manner that minimizes visibility or blends in with legitimate activity. Rather than directly disabling defenses, adversaries may use exploitation to circumvent monitoring and logging mechanisms. This can include abusing vulnerabilities in logging pipelines, security tools, or cloud infrastructure to evade audit trails, suppress alerts, or operate without generating telemetry. Adversaries may identify these opportunities through prior reconnaissance or by performing discovery of security controls after initial access. In some cases, vulnerabilities in SaaS or public cloud environments may be exploited to evade logging, obscure activity, or deploy infrastructure that remains hidden from standard monitoring tools.(Citation: Bypassing CloudTrail in AWS Service Catalog)(Citation: GhostToken GCP flaw)
Near-miss passage: T1542.002 Component Firmware. Tactics: stealth, persistence. Description: Adversaries may modify component firmware to persist on systems. Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. This technique may be similar to [System Firmware](https://attack.mitre.org/techniques/T1542/001) but conducted upon other system components/devices that may not have the same capability or level of integrity checking. Malicious component firmware could provide both a persistent level of access to systems despite potential typical failures to maintain access and hard disk re-images, as well as a way to evade host software-based defenses and integrity checks.
Query: Lateral movement indicators for Patch System Image
Matching passage: T1601.001 Patch System Image. Tactics: defense impairment. Description: Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses.(Citation: Killing the myth of Cisco IOS rootkits) (Citation: Killing IOS diversity myth) (Citation: Cisco IOS Shellcode) (Citation: Cisco IOS Forensics Developments) (Citation: Juniper Netscreen of the Dead) Some network devices are built with a monolithic architecture, where the entire operating system and most of the functionality of the device is contained within a single file. Adversaries may change this file in storage, to be loaded in a future boot, or in memory during runtime. To change the operating system in storage, the adversary will typically use the standard procedures available to device operators. This may involve downloading a new file via typical protocols used on network devices, such as TFTP, FTP, SCP, or a console connection. The original file may be overwritten, or a new file may be written alongside of it and the device reconfigured to boot to the compromised image. To change the operating system in memory, the adversary typically can use one of two methods. In the first, the adversary would make use of native debug commands in the original, unaltered running operating system that allow them to directly modify the relevant memory addresses containing the running operating system. This method typically requires administrative level access to the device. In the second method for changing the operating system in memory, the adversary would make use of the boot loader. The boot loader is the first piece of software that loads when the device starts that, in turn, will launch the operating system. Adversaries may use malicious code previously implanted in the boot loader, such as through the [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) method, to directly manipulate running operating system code in memory. This malicious code in the bootloader provides the capability of direct memory manipulation to the adversary,
Near-miss passage: T1601 Modify System Image. Tactics: defense impairment. Description: Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves. On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file. To change the operating system, the adversary typically only needs to affect this one file, replacing or modifying it. This can either be done live in memory during system runtime for immediate effect, or in storage to implement the change on the next boot of the network device.
Query: describe CVE-2015-8051
Matching passage: CVE-2015-8051. CWE: UNKNOWN. CVSS: 10.0. The Adobe Premiere Clip app before 1.2.1 for iOS mishandles unspecified input, which has unknown impact and attack vectors.
Near-miss passage: CVE-2015-2135. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in HP Intelligent Provisioning 1.00 through 1.62(a), 2.00, and 2.10 allows remote attackers to execute arbitrary code via unknown vectors.
Query: exploit XML external entity (XXE) vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote authenticated users to read arbitrary files via the req parameter.
Matching passage: CVE-2015-2346. CWE: UNKNOWN. CVSS: 4.0. XML external entity (XXE) vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote authenticated users to read arbitrary files via the req parameter.
Near-miss passage: CVE-2015-0912. CWE: UNKNOWN. CVSS: 6.5. EasyCTF before 1.4 allows remote authenticated users to write executable content to files via unspecified vectors.
Query: Multiple failed authentications followed by Remote Access Hardware
Matching passage: T1219.003 Remote Access Hardware. Tactics: command and control. Description: An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks. These services, including IP-based keyboard, video, or mouse (KVM) devices such as TinyPilot and PiKVM, are commonly used as legitimate tools and may be allowed by peripheral device policies within a target environment. Remote access hardware may be physically installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote session with the target system. Using hardware-based remote access tools may allow threat actors to bypass software security solutions and gain more control over the compromised device(s).(Citation: Palo Alto Unit 42 North Korean IT Workers 2024)(Citation: Google Cloud Threat Intelligence DPRK IT Workers 2024)
Near-miss passage: T1219.001 IDE Tunneling. Tactics: command and control. Description: Adversaries may abuse Integrated Development Environment (IDE) software with remote development features to establish an interactive command and control channel on target systems within a network. IDE tunneling combines SSH, port forwarding, file sharing, and debugging into a single secure connection, letting developers work on remote systems as if they were local. Unlike SSH and port forwarding, IDE tunneling encapsulates an entire session and may use proprietary tunneling protocols alongside SSH, allowing adversaries to blend in with legitimate development workflows. Some IDEs, like Visual Studio Code, also provide CLI tools (e.g., `code tunnel`) that adversaries may use to programmatically establish tunnels and generate web-accessible URLs for remote access. These tunnels can be authenticated through accounts such as GitHub, enabling the adversary to control the compromised system via a legitimate developer portal.(Citation: sentinelone operationDigitalEye Dec 2024)(Citation: Unit42 Chinese VSCode 06 September 2024)(Citation: Thornton tutorial VSCode shell September 2023) Additionally, adversaries may use IDE tunneling for persistence. Some IDEs, such as Visual Studio Code and JetBrains, support automatic reconnection. Adversaries may configure the IDE to auto-launch at startup, re-establishing the tunnel upon execution. Compromised developer machines may also be exploited as jump hosts to move further into the network. IDE tunneling tools may be built-in or installed as [IDE Extensions](https://attack.mitre.org/techniques/T1176/002).
Query: Sigma rule for Detects value modification of registry key containing path to binary used as screensaver.
Matching passage: Sigma rule: Detects value modification of registry key containing path to binary used as screensaver.. Logsource: windows / registry_event. Rule: title: Path To Screensaver Binary Modified id: 67a6c006-3fbe-46a7-9074-2ba3b82c3000 status: test description: Detects value modification of registry key containing path to binary used as screensaver. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.002/T1546.002.md - https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf author: Bartlomiej Czyz @bczyz1, oscd.community date: 2020-10-11 modified: 2021-11-27 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.002 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: \Control Panel\Desktop\SCRNSAVE.EXE filter: Image|endswith: - \rundll32.exe - \explorer.exe condition: selection and not filter falsepositives: - Legitimate modification of screensaver level: medium
Near-miss passage: Sigma rule: Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build. Logsource: windows / process_creation. Rule: title: Curl Download And Execute Combination id: 21dd6d38-2b18-4453-9404-a0fe4a0cc288 status: test description: Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later. references: - https://medium.com/@reegun/curl-exe-is-the-new-rundll32-exe-lolbin-3f79c5f35983 author: Sreeman, Nasreddine Bencherchali (Nextron Systems) date: 2020-01-13 modified: 2024-03-05 tags: - attack.stealth - attack.t1218 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|windash: ' -c ' CommandLine|contains|all: - 'curl ' - http - -o - '&' condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-2765
Matching passage: CVE-2015-2765. CWE: CWE-20. CVSS: 4.300000190734863. The Email Security Gateway in Websense TRITON AP-EMAIL before 8.0.0 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
Near-miss passage: CVE-2015-0726. CWE: CWE-20. CVSS: 6.800000190734863. The web administration interface on Cisco Wireless LAN Controller (WLC) devices before 7.0.241, 7.1.x through 7.4.x before 7.4.122, and 7.5.x and 7.6.x before 7.6.120 allows remote authenticated users to cause a denial of service (device crash) via unspecified parameters, aka Bug IDs CSCum65159 and CSCum65252.
Query: detect Indicates that there are anomalous patterns of behavior like suspicious changes to the directory. in logs
Matching passage: Sigma rule: Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.. Logsource: azure / riskdetection. Rule: title: Anomalous User Activity id: 258b6593-215d-4a26-a141-c8e31c1299a6 status: test description: Indicates that there are anomalous patterns of behavior like suspicious changes to the directory. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#anomalous-user-activity - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.privilege-escalation - attack.t1098 - attack.persistence logsource: product: azure service: riskdetection detection: selection: riskEventType: anomalousUserActivity condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Near-miss passage: Sigma rule: Detects usage of attrib.exe to hide files from users.. Logsource: windows / process_creation. Rule: title: Hiding Files with Attrib.exe id: 4281cb20-2994-4580-aa63-c8b86d019934 status: test description: Detects usage of attrib.exe to hide files from users. references: - https://unit42.paloaltonetworks.com/unit42-sure-ill-take-new-combojack-malware-alters-clipboards-steal-cryptocurrency/ - https://www.uptycs.com/blog/lolbins-are-no-laughing-matter author: Sami Ruohonen date: 2019-01-16 modified: 2023-03-14 tags: - attack.stealth - attack.t1564.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \attrib.exe - OriginalFileName: ATTRIB.EXE selection_cli: CommandLine|contains: ' +h ' filter_main_msiexec: CommandLine|contains: '\desktop.ini ' filter_optional_intel: ParentImage|endswith: \cmd.exe CommandLine: +R +H +S +A \\\*.cui ParentCommandLine: C:\\WINDOWS\\system32\\\*.bat condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - IgfxCUIService.exe hiding *.cui files via .bat script (attrib.exe a child of cmd.exe and igfxCUIService.exe is the parent of the cmd.exe) - Msiexec.exe hiding desktop.ini level: medium
Query: describe CVE-2015-0581
Matching passage: CVE-2015-0581. CWE: UNKNOWN. CVSS: 7.5. The XML parser in Cisco Prime Service Catalog before 10.1 allows remote authenticated users to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity declaration in conjunction with an entity reference, as demonstrated by reading private keys, related to an XML External Entity (XXE) issue, aka Bug ID CSCup92880.
Near-miss passage: CVE-2015-8402. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: alert when Detects installation of new shim databases that try to patch sections of known processes for potential process injection
Matching passage: Sigma rule: Detects installation of new shim databases that try to patch sections of known processes for potential process injection. Logsource: windows / registry_set. Rule: title: Suspicious Shim Database Patching Activity id: bf344fea-d947-4ef4-9192-34d008315d3a status: test description: Detects installation of new shim databases that try to patch sections of known processes for potential process injection or persistence. references: - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/ - https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-01 modified: 2023-12-06 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.011 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\ TargetObject|endswith: - \csrss.exe - \dllhost.exe - \explorer.exe - \RuntimeBroker.exe - \services.exe - \sihost.exe - \svchost.exe - \taskhostw.exe - \winlogon.exe - \WmiPrvSe.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently acc. Logsource: windows / process_creation. Rule: title: System Network Connections Discovery Via Net.EXE id: 1c67a717-32ba-409b-a45d-0fb704a73a81 status: test description: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-1---system-network-connections-discovery author: frack113 date: 2021-12-10 modified: 2023-02-21 tags: - attack.discovery - attack.t1049 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: - CommandLine|endswith: - ' use' - ' sessions' - CommandLine|contains: - ' use ' - ' sessions ' condition: all of selection_* falsepositives: - Unknown level: low
Query: mitigate Exfiltration Over Other Network Medium
Matching passage: T1011 Exfiltration Over Other Network Medium. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel. Adversaries may choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Near-miss passage: T1011.001 Exfiltration Over Bluetooth. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel. Adversaries may choose to do this if they have sufficient access and proximity. Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Query: patch priority for CVE-2015-9346
Matching passage: CVE-2015-9346. CWE: CWE-79. CVSS: 6.099999904632568. The cp-polls plugin before 1.0.5 for WordPress has XSS.
Near-miss passage: CVE-2015-3362. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Video module before 7.x-2.11 for Drupal, when using the video WYSIWYG plugin, allows remote authenticated users to inject arbitrary web script or HTML via a node title.
Query: Suspicious Email Account execution detected on endpoint
Matching passage: T1087.003 Email Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists) In on-premises Exchange and Exchange Online, the <code>Get-GlobalAddressList</code> PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016) In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List)
Near-miss passage: T1087.004 Cloud Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. With authenticated access there are several tools that can be used to find accounts. The <code>Get-MsolRoleMember</code> PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365.(Citation: Microsoft msolrolemember)(Citation: GitHub Raindance) The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command <code>az ad user list</code> will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018) The AWS command <code>aws iam list-users</code> may be used to obtain a list of users in the current account while <code>aws iam list-roles</code> can obtain IAM roles that have a specified path prefix.(Citation: AWS List Roles)(Citation: AWS List Users) In GCP, <code>gcloud iam service-accounts list</code> and <code>gcloud projects get-iam-policy</code> may be used to obtain a listing of service accounts and users in a project.(Citation: Google Cloud - IAM Servie Accounts List API)