alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Outbound C2 pattern associated with Mail Protocols
Matching passage: T1071.003 Mail Protocols. Tactics: command and control. Description: Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as SMTP/S, POP3/S, and IMAP that carry electronic mail may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the email messages themselves. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: FireEye APT28)
Near-miss passage: T1071 Application Layer Protocol. Tactics: command and control. Description: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.(Citation: Mandiant APT29 Eye Spy Email Nov 22)
Query: CWE for Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution
Matching passage: CWE-1422 Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution. A processor event or prediction may allow incorrect or stale data to be forwarded to transient operations, potentially exposing data over a covert channel.
Near-miss passage: CWE-392 Missing Report of Error Condition. The product encounters an error but does not provide a status code or return value to indicate that an error has occurred.
Query: threat report mentioning Multi-hop Proxy
Matching passage: T1090.003 Multi-hop Proxy. Tactics: command and control. Description: Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source. For example, adversaries may construct or use onion routing networks – such as the publicly available [Tor](https://attack.mitre.org/software/S0183) network – to transport encrypted C2 traffic through a compromised population, allowing communication with any device within the network.(Citation: Onion Routing) Adversaries may also use operational relay box (ORB) networks composed of virtual private servers (VPS), Internet of Things (IoT) devices, smart devices, and end-of-life routers to obfuscate their operations.(Citation: ORB Mandiant) In the case of network infrastructure, it is possible for an adversary to leverage multiple compromised devices to create a multi-hop proxy chain (i.e., [Network Devices](https://attack.mitre.org/techniques/T1584/008)). By leveraging [Patch System Image](https://attack.mitre.org/techniques/T1601/001) on routers, adversaries can add custom code to the affected network devices that will implement onion routing between those nodes. This method is dependent upon the [Network Boundary Bridging](https://attack.mitre.org/techniques/T1599) method allowing the adversaries to cross the protected network boundary of the Internet perimeter and into the organization’s Wide-Area Network (WAN). Protocols such as ICMP may be used as a transport. Similarly, adversaries may abuse peer-to-peer (P2P) and blockchain-oriented infrastructure to implement routing between a decentralized network of peers.(Citation: NGLite Trojan)
Near-miss passage: T1090 Proxy. Tactics: command and control. Description: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.
Query: alert when Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping
Matching passage: Sigma rule: Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping. Logsource: zeek / dce_rpc. Rule: title: MITRE BZAR Indicators for Persistence id: 53389db6-ba46-48e3-a94c-e0f2cefe1583 status: test description: Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE. references: - https://github.com/mitre-attack/bzar#indicators-for-attck-persistence author: '@neu5ron, SOC Prime' date: 2020-03-19 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.004 logsource: product: zeek service: dce_rpc detection: op1: endpoint: spoolss operation: RpcAddMonitor op2: endpoint: spoolss operation: RpcAddPrintProcessor op3: endpoint: IRemoteWinspool operation: RpcAsyncAddMonitor op4: endpoint: IRemoteWinspool operation: RpcAsyncAddPrintProcessor op5: endpoint: ISecLogon operation: SeclCreateProcessWithLogonW op6: endpoint: ISecLogon operation: SeclCreateProcessWithLogonExW condition: 1 of op* falsepositives: - Windows administrator tasks or troubleshooting - Windows management scripts or software level: medium
Near-miss passage: Sigma rule: Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. It was seen used by BlackCat. Logsource: windows / process_creation. Rule: title: DirLister Execution id: b4dc61f5-6cce-468e-a608-b48b469feaa2 status: test description: Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. It was seen used by BlackCat ransomware to create a list of accessible directories and files. references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1083/T1083.md - https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/ author: frack113 date: 2022-08-20 modified: 2023-02-04 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: DirLister.exe - Image|endswith: \DirLister.exe condition: selection falsepositives: - Legitimate use by users level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_dirlister_execution/info.yml simulation: - type: atomic-red-team name: Launch DirLister Executable technique: T1083 atomic_guid: c5bec457-43c9-4a18-9a24-fe151d8971b7
Query: exploit Cross-site scripting (XSS) vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to inj
Matching passage: CVE-2015-4065. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the post parameter to wp-admin/post-new.php.
Near-miss passage: CVE-2015-5520. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Users module in Orchard 1.7.3 through 1.8.2 and 1.9.x before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the username when creating a new user account, which is not properly handled when deleting an account.
Query: Sigma rule for Use of reg to get MachineGuid information
Matching passage: Sigma rule: Use of reg to get MachineGuid information. Logsource: windows / process_creation. Rule: title: Suspicious Query of MachineGUID id: f5240972-3938-4e56-8e4b-e33893176c1f status: test description: Use of reg to get MachineGuid information references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-8---windows-machineguid-discovery author: frack113 date: 2022-01-01 tags: - attack.discovery - attack.t1082 logsource: category: process_creation product: windows detection: selection: Image|endswith: \reg.exe CommandLine|contains|all: - SOFTWARE\Microsoft\Cryptography - '/v ' - MachineGuid condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects suspicious user agent strings user by hack tools in proxy logs. Logsource: proxy. Rule: title: Hack Tool User Agent id: c42a3073-30fb-48ae-8c99-c23ada84b103 status: test description: Detects suspicious user agent strings user by hack tools in proxy logs references: - https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb - http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules author: Florian Roth (Nextron Systems) date: 2017-07-08 modified: 2022-07-07 tags: - attack.initial-access - attack.t1190 - attack.credential-access - attack.t1110 logsource: category: proxy detection: selection: c-useragent|contains: - (hydra) - ' arachni/' - ' BFAC ' - ' brutus ' - ' cgichk ' - core-project/1.0 - ' crimscanner/' - datacha0s - dirbuster - domino hunter - dotdotpwn - FHScan Core - floodgate - get-minimal - gootkit auto-rooter scanner - grendel-scan - ' inspath ' - internet ninja - jaascois - ' zmeu ' - masscan - ' metis ' - morfeus fucking scanner - n-stealth - nsauditor - pmafind - security scan - springenwerk - teh forest lobster - toata dragostea - ' vega/' - voideye - webshag - webvulnscan - ' whcc/' - ' Havij' - absinthe - bsqlbf - mysqloit - pangolin - sql power injector - sqlmap - sqlninja - uil2pn - ruler - Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-PT; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729) condition: selection falsepositives: - Unknown level: high
Query: write Sigma for Aversaries may use to interact with a remote network share using Server Message Block (SMB). This technique is used by p
Matching passage: Sigma rule: Aversaries may use to interact with a remote network share using Server Message Block (SMB). This technique is used by p. Logsource: windows / file_event. Rule: title: Writing Local Admin Share id: 4aafb0fa-bff5-4b9d-b99e-8093e659c65f status: test description: 'Aversaries may use to interact with a remote network share using Server Message Block (SMB). This technique is used by post-exploitation frameworks. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.002/T1021.002.md#atomic-test-4---execute-command-writing-output-to-local-admin-share author: frack113 date: 2022-01-01 modified: 2022-08-13 tags: - attack.privilege-escalation - attack.persistence - attack.lateral-movement - attack.t1546.002 logsource: product: windows category: file_event detection: selection: TargetFilename|contains|all: - \\\\127.0.0 - \ADMIN$\ condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects calls to "Add-Content" cmdlet in order to modify the content of the user profile and potentially adding suspicio. Logsource: windows / ps_script. Rule: title: Potential Persistence Via PowerShell User Profile Using Add-Content id: 05b3e303-faf0-4f4a-9b30-46cc13e69152 status: test description: Detects calls to "Add-Content" cmdlet in order to modify the content of the user profile and potentially adding suspicious commands for persistence references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.013/T1546.013.md author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-08-18 modified: 2023-05-04 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.013 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_add: ScriptBlockText|contains: Add-Content $profile selection_options: ScriptBlockText|contains: - '-Value "IEX ' - -Value "Invoke-Expression - -Value "Invoke-WebRequest - -Value "Start-Process - '-Value ''IEX ' - -Value 'Invoke-Expression - -Value 'Invoke-WebRequest - -Value 'Start-Process condition: all of selection_* falsepositives: - Legitimate administration and tuning scripts that aim to add functionality to a user PowerShell session level: medium
Query: risk of Cross-site scripting (XSS) vulnerability in the Content Analysis module before 6.x-1.7 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vec
Matching passage: CVE-2015-3364. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Content Analysis module before 6.x-1.7 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a log message.
Near-miss passage: CVE-2015-4955. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 before 8.5.6.0 CF1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: describe CVE-2015-9395
Matching passage: CVE-2015-9395. CWE: CWE-89. CVSS: 8.800000190734863. The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action.
Near-miss passage: CVE-2015-7682. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allow remote administrators to execute arbitrary SQL commands via the (1) select_invitaion_code_bulk_option or (2) invi_del_id parameter in the pie-invitation-codes page to wp-admin/admin.php.
Query: adversary uses Input Capture
Matching passage: T1056 Input Capture. Tactics: collection, credential access. Description: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004)) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. [Web Portal Capture](https://attack.mitre.org/techniques/T1056/003)).
Near-miss passage: T1056.003 Web Portal Capture. Tactics: collection, credential access. Description: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through [External Remote Services](https://attack.mitre.org/techniques/T1133) and [Valid Accounts](https://attack.mitre.org/techniques/T1078) or as part of the initial compromise by exploitation of the externally facing web service.(Citation: Volexity Virtual Private Keylogging)
Query: exploit Cisco DTA Control System (DTACS) 4.0.0.9 and Cisco Headend System Release allow remote attackers to cause a denial of service (CPU and memory consumption, and TCP service outage) v
Matching passage: CVE-2015-0744. CWE: CWE-399. CVSS: 7.800000190734863. Cisco DTA Control System (DTACS) 4.0.0.9 and Cisco Headend System Release allow remote attackers to cause a denial of service (CPU and memory consumption, and TCP service outage) via (1) a SYN flood or (2) another type of TCP traffic flood, aka Bug IDs CSCus50642, CSCus50662, CSCus50625, CSCus50657, and CSCus68315.
Near-miss passage: CVE-2015-3280. CWE: CWE-399. CVSS: 6.800000190734863. OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service (disk consumption) by deleting instances while in the resize state.
Query: risk of ganglia-web before 3.7.1 allows remote attackers to bypass authentication.
Matching passage: CVE-2015-6816. CWE: CWE-287. CVSS: 9.800000190734863. ganglia-web before 3.7.1 allows remote attackers to bypass authentication.
Near-miss passage: CVE-2015-6280. CWE: CWE-287. CVSS: 9.300000190734863. The SSHv2 functionality in Cisco IOS 15.2, 15.3, 15.4, and 15.5 and IOS XE 3.6E before 3.6.3E, 3.7E before 3.7.1E, 3.10S before 3.10.6S, 3.11S before 3.11.4S, 3.12S before 3.12.3S, 3.13S before 3.13.3S, and 3.14S before 3.14.1S does not properly implement RSA authentication, which allows remote attackers to obtain login access by leveraging knowledge of a username and the associated public key, aka Bug ID CSCus73013.
Query: risk of Safari in Apple iOS before 9 allows remote attackers to spoof the relationship between URLs and web content via a crafted window opener on a web site.
Matching passage: CVE-2015-5905. CWE: CWE-254. CVSS: 5.0. Safari in Apple iOS before 9 allows remote attackers to spoof the relationship between URLs and web content via a crafted window opener on a web site.
Near-miss passage: CVE-2015-3729. CWE: CWE-254. CVSS: 4.300000190734863. Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not indicate what web site originated an input prompt, which allows remote attackers to conduct spoofing attacks via a crafted site.
Query: patch priority for CVE-2015-5334
Matching passage: CVE-2015-5334. CWE: CWE-787. CVSS: 9.800000190734863. Off-by-one error in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (program crash) or possible execute arbitrary code via a crafted X.509 certificate, which triggers a stack-based buffer overflow. Note: this vulnerability exists because of an incorrect fix for CVE-2014-3508.
Near-miss passage: CVE-2015-2419. CWE: CWE-787. CVSS: 8.800000190734863. JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "JScript9 Memory Corruption Vulnerability."
Query: patch priority for CVE-2015-6032
Matching passage: CVE-2015-6032. CWE: CWE-255. CVSS: 9.300000190734863. Qolsys IQ Panel (aka QOL) before 1.5.1 has hardcoded cryptographic keys, which allows remote attackers to create digital signatures for code by leveraging knowledge of a key from a different installation.
Near-miss passage: CVE-2015-6472. CWE: CWE-255. CVSS: 9.800000190734863. WAGO IO 750-849 01.01.27 and 01.02.05, WAGO IO 750-881, and WAGO IO 758-870 have weak credential management.
Query: vulnerability: A vulnerability, which was classified as problematic, was found in tinymighty WikiSEO 1.2.1 on MediaWiki. This affects the function modifyHTML of the file WikiSEO.body.php of the c
Matching passage: CVE-2015-10073. CWE: CWE-79. CVSS: 9.600000381469727. A vulnerability, which was classified as problematic, was found in tinymighty WikiSEO 1.2.1 on MediaWiki. This affects the function modifyHTML of the file WikiSEO.body.php of the component Meta Property Tag Handler. The manipulation of the argument content leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.2.2 is able to address this issue. The patch is named 089a5797be612b18a820f9f1e6593ad9a91b1dba. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220215.
Near-miss passage: CVE-2015-4376. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Profile2 Privacy module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with the "Administer Profile2 Privacy Levels" permission to inject arbitrary web script or HTML via unspecified vectors.
Query: patch priority for CVE-2015-5795
Matching passage: CVE-2015-5795. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-7939. CWE: CWE-119. CVSS: 9.600000381469727. Heap-based buffer overflow in Unitronics VisiLogic OPLC IDE before 9.8.09 allows remote attackers to execute arbitrary code via a long vlp filename.
Query: detection rule: Detects password change for the logged-on user's via "ksetup.exe"
Matching passage: Sigma rule: Detects password change for the logged-on user's via "ksetup.exe". Logsource: windows / process_creation. Rule: title: Logged-On User Password Change Via Ksetup.EXE id: c9783e20-4793-4164-ba96-d9ee483992c4 status: test description: Detects password change for the logged-on user's via "ksetup.exe" references: - https://learn.microsoft.com/en-gb/windows-server/administration/windows-commands/ksetup author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-06 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \ksetup.exe - OriginalFileName: ksetup.exe selection_cli: CommandLine|contains: ' /ChangePassword ' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects activity when a member is removed from a security-enabled global group. Logsource: windows / security. Rule: title: A Member Was Removed From a Security-Enabled Global Group id: 02c39d30-02b5-45d2-b435-8aebfe5a8629 related: - id: 9cf01b6c-e723-4841-a868-6d7f8245ca6e type: obsolete status: stable description: Detects activity when a member is removed from a security-enabled global group references: - https://www.cisecurity.org/controls/cis-controls-list/ - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4729 - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=633 author: Alexandr Yampolskyi, SOC Prime date: 2023-04-26 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: windows service: security detection: selection: EventID: - 633 - 4729 condition: selection falsepositives: - Unknown level: low