alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: SOC alert related to Abuse Elevation Control Mechanism
Matching passage: T1548 Abuse Elevation Control Mechanism. Tactics: privilege escalation. Description: Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.(Citation: TechNet How UAC Works)(Citation: sudo man page 2018) An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.(Citation: OSX Keydnap malware)(Citation: Fortinet Fareit)
Near-miss passage: T1548.003 Sudo and Sudo Caching. Tactics: privilege escalation. Description: Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges. Within Linux and MacOS systems, sudo (sometimes referred to as "superuser do") allows users to perform commands from terminals with elevated privileges and to control who can perform these commands on the system. The <code>sudo</code> command "allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments."(Citation: sudo man page 2018) Since sudo was made for the system administrator, it has some useful configuration features such as a <code>timestamp_timeout</code>, which is the amount of time in minutes between instances of <code>sudo</code> before it will re-prompt for a password. This is because <code>sudo</code> has the ability to cache credentials for a period of time. Sudo creates (or touches) a file at <code>/var/db/sudo</code> with a timestamp of when sudo was last run to determine this timeout. Additionally, there is a <code>tty_tickets</code> variable that treats each new tty (terminal session) in isolation. This means that, for example, the sudo timeout of one tty will not affect another tty (you will have to type the password again). The sudoers file, <code>/etc/sudoers</code>, describes which users can run which commands and from which terminals. This also describes which commands users can run as other users or groups. This provides the principle of least privilege such that users are running in their lowest possible permissions for most of the time and only elevate to other users or permissions as needed, typically by prompting for a password. However, the sudoers file can also specify when to not prompt users for passwords with a line like <code>user1 ALL=(ALL) NOPASSWD: ALL</code>.(Citation: OSX.Dok
Query: risk of Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a di
Matching passage: CVE-2015-1812. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1813.
Near-miss passage: CVE-2015-0128. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix4, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-0124.
Query: vulnerability: Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 allows remote authenticated users to affect integrity via unknown vectors re
Matching passage: CVE-2015-4917. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 allows remote authenticated users to affect integrity via unknown vectors related to Security, a different vulnerability than CVE-2015-4892.
Near-miss passage: CVE-2015-0417. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Portal Framework, a different vulnerability than CVE-2015-0388.
Query: exploit In all Android releases from CAF using the Linux kernel, time-of-check Time-of-use (TOCTOU) Race Conditions exist in several TZ APIs.
Matching passage: CVE-2015-9022. CWE: CWE-362. CVSS: 7.0. In all Android releases from CAF using the Linux kernel, time-of-check Time-of-use (TOCTOU) Race Conditions exist in several TZ APIs.
Near-miss passage: CVE-2015-4481. CWE: CWE-362. CVSS: 3.299999952316284. Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file during an update.
Query: vulnerability: The ff_mpv_common_init function in libavcodec/mpegvideo.c in FFmpeg before 2.7.2 does not properly maintain the encoding context, which allows remote attackers to cause a denial of
Matching passage: CVE-2015-6821. CWE: CWE-20. CVSS: 7.5. The ff_mpv_common_init function in libavcodec/mpegvideo.c in FFmpeg before 2.7.2 does not properly maintain the encoding context, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted MPEG data.
Near-miss passage: CVE-2015-9052. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached while processing a downlink message.
Query: vulnerability: AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. NOTE: This vulnerability exists due to an incomplete fix for CVE-2015-7723.
Matching passage: CVE-2015-7724. CWE: CWE-59. CVSS: 7.800000190734863. AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. NOTE: This vulnerability exists due to an incomplete fix for CVE-2015-7723.
Near-miss passage: CVE-2015-5705. CWE: CWE-59. CVSS: 7.5. Argument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to arbitrary files via a crafted symlink and crafted filename.
Query: ATT&CK technique for Cloud Account
Matching passage: T1136.003 Cloud Account. Tactics: persistence. Description: Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.(Citation: Microsoft O365 Admin Roles)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: AWS Create IAM User)(Citation: GCP Create Cloud Identity Users)(Citation: Microsoft Azure AD Users) In addition to user accounts, cloud accounts may be associated with services. Cloud providers handle the concept of service accounts in different ways. In Azure, service accounts include service principals and managed identities, which can be linked to various resources such as OAuth applications, serverless functions, and virtual machines in order to grant those resources permissions to perform various activities in the environment.(Citation: Microsoft Entra ID Service Principals) In GCP, service accounts can also be linked to specific resources, as well as be impersonated by other accounts for [Temporary Elevated Cloud Access](https://attack.mitre.org/techniques/T1548/005).(Citation: GCP Service Accounts) While AWS has no specific concept of service accounts, resources can be directly granted permission to assume roles.(Citation: AWS Instance Profiles)(Citation: AWS Lambda Execution Role) Adversaries may create accounts that only have access to specific cloud services, which can reduce the chance of detection. Once an adversary has created a cloud account, they can then manipulate that account to ensure persistence and allow access to additional resources - for example, by adding [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) or assigning [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003).
Near-miss passage: T1136.002 Domain Account. Tactics: persistence. Description: Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the <code>net user /add /domain</code> command can be used to create a domain account.(Citation: Savill 1999) Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Query: SOC alert related to Local Account
Matching passage: T1087.001 Local Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. Commands such as <code>net user</code> and <code>net localgroup</code> of the [Net](https://attack.mitre.org/software/S0039) utility and <code>id</code> and <code>groups</code> on macOS and Linux can list local users and groups.(Citation: Mandiant APT1)(Citation: id man page)(Citation: groups man page) On Linux, local users can also be enumerated through the use of the <code>/etc/passwd</code> file. On macOS, the <code>dscl . list /Users</code> command can be used to enumerate local accounts. On ESXi servers, the `esxcli system account list` command can list local user accounts.(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)
Near-miss passage: T1087.004 Cloud Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. With authenticated access there are several tools that can be used to find accounts. The <code>Get-MsolRoleMember</code> PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365.(Citation: Microsoft msolrolemember)(Citation: GitHub Raindance) The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command <code>az ad user list</code> will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018) The AWS command <code>aws iam list-users</code> may be used to obtain a list of users in the current account while <code>aws iam list-roles</code> can obtain IAM roles that have a specified path prefix.(Citation: AWS List Roles)(Citation: AWS List Users) In GCP, <code>gcloud iam service-accounts list</code> and <code>gcloud projects get-iam-policy</code> may be used to obtain a listing of service accounts and users in a project.(Citation: Google Cloud - IAM Servie Accounts List API)
Query: exploit Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified
Matching passage: CVE-2015-3071. CWE: CWE-284. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3062, CVE-2015-3063, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3072, CVE-2015-3073, and CVE-2015-3074.
Near-miss passage: CVE-2015-3654. CWE: CWE-284. CVSS: 7.199999809265137. Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to gain root privileges via unspecified vectors, a different vulnerability than CVE-2015-4649.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service. Logsource: windows / process_creation. Rule: title: Suspicious NTLM Authentication on the Printer Spooler Service id: bb76d96b-821c-47cf-944b-7ce377864492 status: test description: Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service references: - https://twitter.com/med0x2e/status/1520402518685200384 - https://github.com/elastic/detection-rules/blob/dd224fb3f81d0b4bf8593c5f02a029d647ba2b2d/rules/windows/credential_access_relay_ntlm_auth_via_http_spoolss.toml author: Elastic (idea), Tobias Michalski (Nextron Systems) date: 2022-05-04 modified: 2023-02-09 tags: - attack.privilege-escalation - attack.credential-access - attack.t1212 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|contains|all: - C:\windows\system32\davclnt.dll,DavSetCookie - http CommandLine|contains: - spoolss - srvsvc - /print/pipe/ condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of a process via the Windows task manager. This might be an attempt to bypass UAC. Logsource: windows / process_creation. Rule: title: New Process Created Via Taskmgr.EXE id: 3d7679bd-0c00-440c-97b0-3f204273e6c7 status: test description: Detects the creation of a process via the Windows task manager. This might be an attempt to bypass UAC references: - https://twitter.com/ReneFreingruber/status/1172244989335810049 author: Florian Roth (Nextron Systems) date: 2018-03-13 modified: 2024-01-18 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \taskmgr.exe filter_main_generic: Image|endswith: - :\Windows\System32\mmc.exe - :\Windows\System32\resmon.exe - :\Windows\System32\Taskmgr.exe condition: selection and not 1 of filter_main_* falsepositives: - Administrative activity level: low
Query: Suspicious JamPlus execution detected on endpoint
Matching passage: T1127.003 JamPlus. Tactics: stealth, execution. Description: Adversaries may use `JamPlus` to proxy the execution of a malicious script. `JamPlus` is a build utility tool for code and data build systems. It works with several popular compilers and can be used for generating workspaces in code editors such as Visual Studio.(Citation: JamPlus manual) Adversaries may abuse the `JamPlus` build utility to execute malicious scripts via a `.jam` file, which describes the build process and required dependencies. Because the malicious script is executed from a reputable developer tool, it may subvert application control security systems such as Smart App Control.(Citation: Cyble)(Citation: Elastic Security Labs)
Near-miss passage: T1127 Trusted Developer Utilities Proxy Execution. Tactics: stealth, execution. Description: Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering.(Citation: engima0x3 DNX Bypass)(Citation: engima0x3 RCSI Bypass)(Citation: Exploit Monday WinDbg)(Citation: LOLBAS Tracker) These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions. Smart App Control is a feature of Windows that blocks applications it considers potentially malicious from running by verifying unsigned applications against a known safe list from a Microsoft cloud service before executing them.(Citation: Microsoft Smart App Control) However, adversaries may leverage "reputation hijacking" to abuse an operating system’s trust of safe, signed applications that support the execution of arbitrary code. By leveraging [Trusted Developer Utilities Proxy Execution](https://attack.mitre.org/techniques/T1127) to run their malicious code, adversaries may bypass Smart App Control protections.(Citation: Elastic Security Labs)
Query: detection rule: Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool. Xclip has to be
Matching passage: Sigma rule: Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool. Xclip has to be. Logsource: linux / auditd. Rule: title: Clipboard Collection of Image Data with Xclip Tool id: f200dc3f-b219-425d-a17e-c38467364816 status: test description: 'Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations. ' references: - https://linux.die.net/man/1/xclip author: Pawel Mazur date: 2021-10-01 modified: 2022-10-09 tags: - attack.collection - attack.t1115 logsource: product: linux service: auditd detection: selection: type: EXECVE a0: xclip a1: - -selection - -sel a2: - clipboard - clip a3: -t a4|startswith: image/ a5: -o condition: selection falsepositives: - Legitimate usage of xclip tools level: low
Near-miss passage: Sigma rule: Detects "read access" requests on the services registry key. Adversaries may execute their own malicious payloads by hij. Logsource: windows / security. Rule: title: Service Registry Key Read Access Request id: 11d00fff-5dc3-428c-8184-801f292faec0 status: test description: 'Detects "read access" requests on the services registry key. Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts. ' references: - https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/service_registry_permissions_weakness_check/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness author: Center for Threat Informed Defense (CTID) Summiting the Pyramid Team date: 2023-09-28 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.011 logsource: product: windows service: security definition: 'Requirements: SACLs must be enabled for "READ_CONTROL" on the registry keys used in this rule' detection: selection: EventID: 4663 ObjectName|contains|all: - \SYSTEM\ - ControlSet\Services\ AccessList|contains: '%%1538' condition: selection falsepositives: - Likely from legitimate applications reading their key. Requires heavy tuning level: low
Query: patch priority for CVE-2015-5948
Matching passage: CVE-2015-5948. CWE: CWE-362. CVSS: 8.100000381469727. Race condition in SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5947.
Near-miss passage: CVE-2015-5189. CWE: CWE-362. CVSS: 4.900000095367432. Race condition in pcsd in PCS 0.9.139 and earlier uses a global variable to validate usernames, which allows remote authenticated users to gain privileges by sending a command that is checked for security after another user is authenticated.
Query: risk of The odbc_bindcols function in ext/odbc/php_odbc.c in PHP before 5.6.12 mishandles driver behavior for SQL_WVARCHAR columns, which allows remote attackers to cause a denial of servi
Matching passage: CVE-2015-8879. CWE: CWE-20. CVSS: 7.5. The odbc_bindcols function in ext/odbc/php_odbc.c in PHP before 5.6.12 mishandles driver behavior for SQL_WVARCHAR columns, which allows remote attackers to cause a denial of service (application crash) in opportunistic circumstances by leveraging use of the odbc_fetch_array function to access a certain type of Microsoft SQL Server table.
Near-miss passage: CVE-2015-1103. CWE: CWE-20. CVSS: 7.5. The kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 makes routing changes in response to ICMP_REDIRECT messages, which allows remote attackers to cause a denial of service (network outage) or obtain sensitive packet-content information via a crafted ICMP packet.
Query: risk of Race condition in the Measurement, Aggregation, and Correlation Engine (MACE) implementation in Cisco IOS 15.4(2)T3 and earlier allows remote attackers to cause a denial of service
Matching passage: CVE-2015-0608. CWE: CWE-362. CVSS: 7.099999904632568. Race condition in the Measurement, Aggregation, and Correlation Engine (MACE) implementation in Cisco IOS 15.4(2)T3 and earlier allows remote attackers to cause a denial of service (device reload) via crafted network traffic that triggers improper handling of the timing of process switching and Cisco Express Forwarding (CEF) switching, aka Bug ID CSCul48736.
Near-miss passage: CVE-2015-1862. CWE: CWE-362. CVSS: 7.0. The crash reporting feature in Abrt allows local users to gain privileges by leveraging an execve by root after a chroot into a user-specified directory in a namedspaced environment.
Query: alert when Detect when users are authenticating without MFA being required.
Matching passage: Sigma rule: Detect when users are authenticating without MFA being required.. Logsource: azure / signinlogs. Rule: title: Azure AD Only Single Factor Authentication Required id: 28eea407-28d7-4e42-b0be-575d5ba60b2c status: test description: Detect when users are authenticating without MFA being required. references: - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts author: MikeDuddington, '@dudders1' date: 2022-07-27 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.credential-access - attack.stealth - attack.defense-impairment - attack.t1078.004 - attack.t1556.006 logsource: product: azure service: signinlogs detection: selection: Status: Success AuthenticationRequirement: singleFactorAuthentication condition: selection falsepositives: - If this was approved by System Administrator. level: low
Near-miss passage: Sigma rule: Detects a Windows command line executable started from MMC. Logsource: windows / process_creation. Rule: title: MMC Spawning Windows Shell id: 05a2ab7e-ce11-4b63-86db-ab32e763e11d status: test description: Detects a Windows command line executable started from MMC references: - https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/ author: Karneades, Swisscom CSIRT date: 2019-08-05 modified: 2022-07-14 tags: - attack.lateral-movement - attack.t1021.003 logsource: category: process_creation product: windows detection: selection1: ParentImage|endswith: \mmc.exe selection2: - Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - \wscript.exe - \cscript.exe - \sh.exe - \bash.exe - \reg.exe - \regsvr32.exe - Image|contains: \BITSADMIN condition: all of selection* level: high