alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: EDR alert: possible Communication Through Removable Media (T1092)
Matching passage: T1092 Communication Through Removable Media. Tactics: command and control. Description: Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.(Citation: ESET Sednit USBStealer 2014) Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091). Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.
Near-miss passage: T1071.004 DNS. Tactics: command and control. Description: Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. The DNS protocol serves an administrative function in computer networking and thus may be very common in environments. DNS traffic may also be allowed even before network authentication is completed. DNS packets contain many fields and headers in which data can be concealed. Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: PAN DNS Tunneling)(Citation: Medium DnsTunneling) DNS beaconing may be used to send commands to remote systems via DNS queries. A DNS beacon is created by tunneling DNS traffic (i.e. [Protocol Tunneling](https://attack.mitre.org/techniques/T1572)). The commands may be embedded into different DNS records, for example, TXT or A records.(Citation: OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government) DNS beacons may be difficult to detect because the beacons infrequently communicate with infected devices.(Citation: DNS Beacons) Infrequent communication conceals the malicious DNS traffic with normal DNS traffic.
Query: explain CWE-385
Matching passage: CWE-385 Covert Timing Channel. Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.
Near-miss passage: CWE-233 Improper Handling of Parameters. The product does not properly handle when the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined.
Query: adversary uses Runtime Data Manipulation
Matching passage: T1565.003 Runtime Data Manipulation. Tactics: impact. Description: Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating runtime data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Adversaries may alter application binaries used to display data in order to cause runtime manipulations. Adversaries may also conduct [Change Default File Association](https://attack.mitre.org/techniques/T1546/001) and [Masquerading](https://attack.mitre.org/techniques/T1036) to cause a similar effect. The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Near-miss passage: T1565.001 Stored Data Manipulation. Tactics: impact. Description: Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Query: write Sigma for Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud
Matching passage: Sigma rule: Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud. Logsource: windows / process_creation. Rule: title: Node Process Executions id: df1f26d3-bea7-4700-9ea2-ad3e990cf90e status: test description: Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud references: - https://twitter.com/mttaggart/status/1511804863293784064 author: Max Altgelt (Nextron Systems) date: 2022-04-06 tags: - attack.execution - attack.stealth - attack.t1127 - attack.t1059.007 logsource: category: process_creation product: windows detection: selection: Image|endswith: \Adobe Creative Cloud Experience\libs\node.exe filter: CommandLine|contains: Adobe Creative Cloud Experience\js condition: selection and not filter falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects PowerShell script execution via input stream redirect. Logsource: windows / process_creation. Rule: title: Run PowerShell Script from Redirected Input Stream id: c83bf4b5-cdf0-437c-90fa-43d734f7c476 status: test description: Detects PowerShell script execution via input stream redirect references: - https://github.com/LOLBAS-Project/LOLBAS/blob/4db780e0f0b2e2bb8cb1fa13e09196da9b9f1834/yml/LOLUtilz/OSBinaries/Powershell.yml - https://twitter.com/Moriarty_Meng/status/984380793383370752 author: Moriarty Meng (idea), Anton Kutepov (rule), oscd.community date: 2020-10-17 modified: 2021-11-27 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|re: \s-\s*< condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-0974
Matching passage: CVE-2015-0974. CWE: CWE-426. CVSS: 7.800000190734863. Untrusted search path vulnerability in ZTE Datacard MF19 0V1.0.0B04 allows local users to gain privilege by modifying the 'Ucell Internet' directory to reference a malicious mms_dll_r.dll or mediaplayerdll.dll.
Near-miss passage: CVE-2015-3887. CWE: CWE-426. CVSS: 7.800000190734863. Untrusted search path vulnerability in ProxyChains-NG before 4.9 allows local users to gain privileges via a Trojan horse libproxychains4.so library in the current working directory, which is referenced in the LD_PRELOAD path.
Query: describe CVE-2015-4505
Matching passage: CVE-2015-4505. CWE: CWE-264. CVSS: 6.599999904632568. updater.exe in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows allows local users to write to arbitrary files by conducting a junction attack and waiting for an update operation by the Mozilla Maintenance Service.
Near-miss passage: CVE-2015-7875. CWE: CWE-264. CVSS: 7.5. ctools 6.x-1.x before 6.x-1.14 and 7.x-1.x before 7.x-1.8 in Drupal does not verify the "edit" permission for the "content type" plugins that are used on Panels and similar systems to place content and functionality on a page.
Query: patch priority for CVE-2015-4553
Matching passage: CVE-2015-4553. CWE: CWE-434. CVSS: 8.800000190734863. A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell.
Near-miss passage: CVE-2015-9341. CWE: CWE-434. CVSS: 7.5. The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files.
Query: exploit IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to obtain sensitive information by reading
Matching passage: CVE-2015-0143. CWE: CWE-200. CVSS: 4.0. IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to obtain sensitive information by reading error messages.
Near-miss passage: CVE-2015-4295. CWE: CWE-200. CVSS: 4.0. The Prime Collaboration Deployment component in Cisco Unified Communications Manager 10.5(3.10000.9) allows remote authenticated users to discover root credentials via a direct request to an unspecified URL, aka Bug ID CSCuv21819.
Query: Sigma rule for Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool
Matching passage: Sigma rule: Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool. Logsource: windows / security. Rule: title: Win Susp Computer Name Containing Samtheadmin id: 39698b3f-da92-4bc6-bfb5-645a98386e45 status: test description: Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool references: - https://twitter.com/malmoeb/status/1511760068743766026 - https://github.com/helloexp/0day/blob/614227a7b9beb0e91e7e2c6a5e532e6f7a8e883c/00-CVE_EXP/CVE-2021-42287/sam-the-admin/sam_the_admin.py author: elhoim date: 2022-09-09 modified: 2023-01-04 tags: - attack.initial-access - cve.2021-42278 - cve.2021-42287 - attack.persistence - attack.privilege-escalation - attack.stealth - attack.t1078 logsource: service: security product: windows detection: selection1: SamAccountName|startswith: SAMTHEADMIN- SamAccountName|endswith: $ selection2: TargetUserName|startswith: SAMTHEADMIN- TargetUserName|endswith: $ condition: 1 of selection* falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects the use of various CLI utilities exfiltrating data via web requests. Logsource: windows / process_creation. Rule: title: Potential Data Exfiltration Activity Via CommandLine Tools id: 7d1aaf3d-4304-425c-b7c3-162055e0b3ab status: test description: Detects the use of various CLI utilities exfiltrating data via web requests references: - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-02 modified: 2025-10-19 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_iwr: Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - \cmd.exe CommandLine|contains: - 'curl ' - Invoke-RestMethod - Invoke-WebRequest - 'irm ' - 'iwr ' - 'wget ' CommandLine|contains|all: - ' -ur' - ' -me' - ' -b' - ' POST ' selection_curl: Image|endswith: \curl.exe CommandLine|contains: --ur selection_curl_data: CommandLine|contains: - ' -d ' - ' --data ' selection_wget: Image|endswith: \wget.exe CommandLine|contains: - --post-data - --post-file payloads: - CommandLine|re: - net\s+view - sc\s+query - CommandLine|contains: - Get-Content - GetBytes - hostname - ifconfig - ipconfig - netstat - nltest - qprocess - systeminfo - tasklist - ToBase64String - whoami - CommandLine|contains|all: - 'type ' - ' > ' - ' C:\' condition: (selection_iwr or all of selection_curl* or selection_wget) and payloads falsepositives: - Unlikely level: high
Query: secure coding against Buffer Over-read
Matching passage: CWE-126 Buffer Over-read. The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
Near-miss passage: CWE-1177 Use of Prohibited Code. The product uses a function, library, or third party component that has been explicitly prohibited, whether by the developer or the customer.
Query: rule covering Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)
Matching passage: Sigma rule: Detects code execution via Pester.bat (Pester - Powershell Modulte for testing). Logsource: windows / process_creation. Rule: title: Execute Code with Pester.bat as Parent id: 18988e1b-9087-4f8a-82fe-0414dce49878 related: - id: 59e938ff-0d6d-4dc3-b13f-36cc28734d4e type: similar status: test description: Detects code execution via Pester.bat (Pester - Powershell Modulte for testing) references: - https://twitter.com/Oddvarmoe/status/993383596244258816 - https://twitter.com/_st0pp3r_/status/1560072680887525378 author: frack113, Nasreddine Bencherchali date: 2022-08-20 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1216 logsource: category: process_creation product: windows detection: selection_module: ParentImage|endswith: - \powershell.exe - \pwsh.exe ParentCommandLine|contains: \WindowsPowerShell\Modules\Pester\ selection_cli: ParentCommandLine|contains: - '{ Invoke-Pester -EnableExit ;' - '{ Get-Help "' condition: all of selection_* falsepositives: - Legitimate use of Pester for writing tests for Powershell scripts and modules level: medium
Near-miss passage: Sigma rule: Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidum. Logsource: windows / process_creation. Rule: title: Process Memory Dump Via Comsvcs.DLL id: 646ea171-dded-4578-8a4d-65e9822892e3 related: - id: 09e6d5c0-05b8-4ff8-9eeb-043046ec774c type: obsolete status: test description: Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.) references: - https://twitter.com/shantanukhande/status/1229348874298388484 - https://twitter.com/pythonresponder/status/1385064506049630211?s=21 - https://twitter.com/Hexacorn/status/1224848930795552769 - https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/ - https://twitter.com/SBousseaden/status/1167417096374050817 - https://twitter.com/Wietze/status/1542107456507203586 - https://github.com/Hackndo/lsassy/blob/14d8f8ae596ecf22b449bfe919829173b8a07635/lsassy/dumpmethod/comsvcs.py - https://www.youtube.com/watch?v=52tAmVLg1KM&t=2070s author: Florian Roth (Nextron Systems), Modexp, Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2020-02-18 modified: 2025-02-23 tags: - attack.credential-access - attack.stealth - attack.t1036 - attack.t1003.001 - car.2013-05-009 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE - CommandLine|contains: rundll32 selection_cli_1: CommandLine|contains|all: - comsvcs - full CommandLine|contains: - '#-' - '#+' - '#24' - '24 ' - MiniDump - '#65560' selection_generic: CommandLine|contains|all: - '24' - comsvcs - full CommandLine|contains: - ' #' - ',#' - ', #' - '"#' condition: (selection_img and 1 of selection_cli_*) or selection_generic falsepositives: - Unlikely level: high
Query: common weakness: Struts: Non-private Field in ActionForm Class
Matching passage: CWE-608 Struts: Non-private Field in ActionForm Class. An ActionForm class contains a field that has not been declared private, which can be accessed without using a setter or getter.
Near-miss passage: CWE-639 Authorization Bypass Through User-Controlled Key. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Query: detect Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer sec in logs
Matching passage: Sigma rule: Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer sec. Logsource: windows / process_creation. Rule: title: Disabled IE Security Features id: fb50eb7a-5ab1-43ae-bcc9-091818cb8424 status: test description: Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features references: - https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/ author: Florian Roth (Nextron Systems) date: 2020-06-19 modified: 2021-11-27 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection1: CommandLine|contains|all: - ' -name IEHarden ' - ' -value 0 ' selection2: CommandLine|contains|all: - ' -name DEPOff ' - ' -value 1 ' selection3: CommandLine|contains|all: - ' -name DisableFirstRunCustomize ' - ' -value 2 ' condition: 1 of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: This the exploitation of a NTFS vulnerability as reported without many details via Twitter. Logsource: windows / system. Rule: title: NTFS Vulnerability Exploitation id: f14719ce-d3ab-4e25-9ce6-2899092260b0 status: test description: This the exploitation of a NTFS vulnerability as reported without many details via Twitter references: - https://twitter.com/jonasLyk/status/1347900440000811010 - https://twitter.com/wdormann/status/1347958161609809921 - https://www.bleepingcomputer.com/news/security/windows-10-bug-corrupts-your-hard-drive-on-seeing-this-files-icon/ author: Florian Roth (Nextron Systems) date: 2021-01-11 modified: 2022-12-25 tags: - attack.impact - attack.t1499.001 logsource: product: windows service: system detection: selection: Provider_Name: Ntfs EventID: 55 Origin: File System Driver Description|contains|all: - contains a corrupted file record - The name of the file is "\" condition: selection falsepositives: - Unlikely level: high
Query: exploit Advantech EKI-132x devices with firmware before 2015-12-31 allow remote attackers to bypass authentication via unspecified vectors.
Matching passage: CVE-2015-7938. CWE: CWE-287. CVSS: 9.800000190734863. Advantech EKI-132x devices with firmware before 2015-12-31 allow remote attackers to bypass authentication via unspecified vectors.
Near-miss passage: CVE-2015-1778. CWE: CWE-287. CVSS: 9.800000190734863. The custom authentication realm used by karaf-tomcat's "opendaylight" realm in Opendaylight before Helium SR3 will authenticate any username and password combination.
Query: CVE similar to CVE-2015-4794
Matching passage: CVE-2015-4794. CWE: UNKNOWN. CVSS: 9.0. Unspecified vulnerability in the Java VM component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
Near-miss passage: CVE-2015-4871. CWE: UNKNOWN. CVSS: 5.800000190734863. Unspecified vulnerability in Oracle Java SE 7u85 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.
Query: vulnerability: strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server 
Matching passage: CVE-2015-4171. CWE: CWE-200. CVSS: 2.5999999046325684. strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.
Near-miss passage: CVE-2015-8749. CWE: CWE-200. CVSS: 5.900000095367432. The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.
Query: detect Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\SYSTEM\CurrentControlSet in logs
Matching passage: Sigma rule: Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\SYSTEM\CurrentControlSet. Logsource: windows / registry_set. Rule: title: Wdigest Enable UseLogonCredential id: d6a9b252-c666-4de6-8806-5561bbbd3bdc status: test description: Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to enable clear-text credentials references: - https://threathunterplaybook.com/hunts/windows/190510-RegModWDigestDowngrade/notebook.html - https://support.microsoft.com/en-us/topic/microsoft-security-advisory-update-to-improve-credentials-protection-and-management-may-13-2014-93434251-04ac-b7f3-52aa-9f951c14b649 - https://github.com/redcanaryco/atomic-red-team/blob/73fcfa1d4863f6a4e17f90e54401de6e30a312bb/atomics/T1112/T1112.md#atomic-test-3---modify-registry-to-store-logon-credentials author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2019-09-12 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: WDigest\UseLogonCredential Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects possible payload obfuscation via the commandline. Logsource: windows / process_creation. Rule: title: Potential Dosfuscation Activity id: a77c1610-fc73-4019-8e29-0f51efc04a51 status: test description: Detects possible payload obfuscation via the commandline references: - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf - https://github.com/danielbohannon/Invoke-DOSfuscation author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-02-15 modified: 2023-03-06 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - ^^ - ^|^ - ',;,' - ;;;; - ;; ;; - (,(, - '%COMSPEC:~' - ' c^m^d' - ^c^m^d - ' c^md' - ' cm^d' - ^cm^d - ' s^et ' - ' s^e^t ' - ' se^t ' condition: selection falsepositives: - Unknown level: medium