alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: SOC runbook when seeing EDR alert: possible Brute Force (T1110)
Matching passage: Playbook for T1110 Brute Force. 1) Validate alert telemetry against T1110. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: credential access. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.(Citation: Dragos Crashoverride 2018) Brute forcing passwords
Near-miss passage: Playbook for T1110.001 Password Guessing. Different response path focused on credential access.
Query: common weakness: Incomplete Documentation of Program Execution
Matching passage: CWE-1112 Incomplete Documentation of Program Execution. The document does not fully define all mechanisms that are used to control or influence how product-specific programs are executed.
Near-miss passage: CWE-449 The UI Performs the Wrong Action. The UI performs the wrong action with respect to the user's request.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects a potential command line flag anomaly related to "regsvr32" in which the "/i" flag is used without the "/n" whic. Logsource: windows / process_creation. Rule: title: Potential Regsvr32 Commandline Flag Anomaly id: b236190c-1c61-41e9-84b3-3fe03f6d76b0 status: test description: Detects a potential command line flag anomaly related to "regsvr32" in which the "/i" flag is used without the "/n" which should be uncommon. references: - https://twitter.com/sbousseaden/status/1282441816986484737?s=12 author: Florian Roth (Nextron Systems) date: 2019-07-13 modified: 2024-03-13 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection: Image|endswith: \regsvr32.exe CommandLine|contains|windash: ' -i:' filter_main_flag: CommandLine|contains|windash: ' -n ' condition: selection and not 1 of filter_main_* falsepositives: - Administrator typo might cause some false positives level: medium
Near-miss passage: Sigma rule: This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder. Logsource: windows / process_creation. Rule: title: Execution of Powershell Script in Public Folder id: fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4 status: test description: This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder references: - https://www.mandiant.com/resources/evolution-of-fin7 author: Max Altgelt (Nextron Systems) date: 2022-04-06 modified: 2022-07-14 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - -f C:\Users\Public - -f "C:\Users\Public - -f %Public% - -fi C:\Users\Public - -fi "C:\Users\Public - -fi %Public% - -fil C:\Users\Public - -fil "C:\Users\Public - -fil %Public% - -file C:\Users\Public - -file "C:\Users\Public - -file %Public% condition: selection falsepositives: - Unlikely level: high
Query: patch priority for CVE-2015-5332
Matching passage: CVE-2015-5332. CWE: CWE-399. CVSS: 6.800000190734863. Atto in Moodle 2.8.x before 2.8.9 and 2.9.x before 2.9.3 allows remote attackers to cause a denial of service (disk consumption) by leveraging the guest role and entering drafts with the editor-autosave feature.
Near-miss passage: CVE-2015-1227. CWE: CWE-399. CVSS: 7.5. The DragImage::create function in platform/DragImage.cpp in Blink, as used in Google Chrome before 41.0.2272.76, does not initialize memory for image drawing, which allows remote attackers to have an unspecified impact by triggering a failed image decoding, as demonstrated by an image for which the default orientation cannot be used.
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects the presence of an LSASS dump file in the "CrashDumps" folder. This could be a sign of LSASS credential dumping.. Logsource: windows / file_event. Rule: title: LSASS Process Dump Artefact In CrashDumps Folder id: 6902955a-01b7-432c-b32a-6f5f81d8f625 status: test description: Detects the presence of an LSASS dump file in the "CrashDumps" folder. This could be a sign of LSASS credential dumping. Techniques such as the LSASS Shtinkering have been seen abusing the Windows Error Reporting to dump said process. references: - https://github.com/deepinstinct/Lsass-Shtinkering - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf author: '@pbssubhash' date: 2022-12-08 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: file_event detection: selection: TargetFilename|startswith: C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\ TargetFilename|contains: lsass.exe. TargetFilename|endswith: .dmp condition: selection falsepositives: - Rare legitimate dump of the process by the operating system due to a crash of lsass level: high
Near-miss passage: Sigma rule: Detects when a Azure Kubernetes Cluster is created or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes Cluster Created or Deleted id: 9541f321-7cba-4b43-80fc-fbd1fb922808 status: test description: Detects when a Azure Kubernetes Cluster is created or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1 author: Austin Songer @austinsonger date: 2021-08-07 modified: 2022-08-23 tags: - attack.impact - attack.t1485 - attack.t1496 - attack.t1489 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/DELETE condition: selection falsepositives: - Kubernetes cluster being created or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Kubernetes cluster created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Query: exploit The process_envvars function in elf/rtld.c in the GNU C Library (aka glibc or libc6) before 2.23 allows local users to bypass a pointer-guarding protection mechanism via a zero val
Matching passage: CVE-2015-8777. CWE: CWE-254. CVSS: 5.5. The process_envvars function in elf/rtld.c in the GNU C Library (aka glibc or libc6) before 2.23 allows local users to bypass a pointer-guarding protection mechanism via a zero value of the LD_POINTER_GUARD environment variable.
Near-miss passage: CVE-2015-5905. CWE: CWE-254. CVSS: 5.0. Safari in Apple iOS before 9 allows remote attackers to spoof the relationship between URLs and web content via a crafted window opener on a web site.
Query: detection rule: Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS
Matching passage: Sigma rule: Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS. Logsource: windows / process_creation. Rule: title: Dropping Of Password Filter DLL id: b7966f4a-b333-455b-8370-8ca53c229762 status: test description: Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS references: - https://pentestlab.blog/2020/02/10/credential-access-password-filter-dll/ - https://github.com/3gstudent/PasswordFilter/tree/master/PasswordFilter author: Sreeman date: 2020-10-29 modified: 2022-10-09 tags: - attack.persistence - attack.credential-access - attack.defense-impairment - attack.t1556.002 logsource: category: process_creation product: windows detection: selection_cmdline: CommandLine|contains|all: - HKLM\SYSTEM\CurrentControlSet\Control\Lsa - scecli\0* - reg add condition: selection_cmdline falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the start, reload or restart of a service.. Logsource: linux / auditd. Rule: title: Service Reload or Start - Linux id: 2625cc59-0634-40d0-821e-cb67382a3dd7 status: test description: Detects the start, reload or restart of a service. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.002/T1543.002.md author: Jakob Weinzettl, oscd.community, CheraghiMilad date: 2019-09-23 modified: 2025-03-03 tags: - attack.privilege-escalation - attack.persistence - attack.t1543.002 logsource: product: linux service: auditd detection: selection: type: EXECVE a0|contains: - systemctl - service a1|contains: - reload - start condition: selection falsepositives: - Installation of legitimate service. - Legitimate reconfiguration of service. - Command line contains daemon-reload. level: low
Query: patch priority for CVE-2015-8631
Matching passage: CVE-2015-8631. CWE: CWE-772. CVSS: 6.5. Multiple memory leaks in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (memory consumption) via a request specifying a NULL principal name.
Near-miss passage: CVE-2015-7701. CWE: CWE-772. CVSS: 7.5. Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (memory consumption).
Query: CVE similar to CVE-2015-5335
Matching passage: CVE-2015-5335. CWE: CWE-200. CVSS: 4.300000190734863. Cross-site request forgery (CSRF) vulnerability in admin/registration/register.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote attackers to hijack the authentication of administrators for requests that send statistics to an arbitrary hub URL.
Near-miss passage: CVE-2015-5825. CWE: CWE-200. CVSS: 4.300000190734863. WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive information about the browser history, mouse movement, or network traffic via crafted JavaScript code.
Query: Suspicious Cloud API execution detected on endpoint
Matching passage: T1059.009 Cloud API. Tactics: execution. Description: Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant. These APIs may be utilized through various methods such as command line interpreters (CLIs), in-browser Cloud Shells, [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules like Azure for PowerShell(Citation: Microsoft - Azure PowerShell), or software developer kits (SDKs) available for languages such as [Python](https://attack.mitre.org/techniques/T1059/006). Cloud API functionality may allow for administrative access across all major services in a tenant such as compute, storage, identity and access management (IAM), networking, and security policies. With proper permissions (often via use of credentials such as [Application Access Token](https://attack.mitre.org/techniques/T1550/001) and [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004)), adversaries may abuse cloud APIs to invoke various functions that execute malicious actions. For example, CLI and PowerShell functionality may be accessed through binaries installed on cloud-hosted or on-premises hosts or accessed through a browser-based cloud shell offered by many cloud platforms (such as AWS, Azure, and GCP). These cloud shells are often a packaged unified environment to use CLI and/or scripting modules hosted as a container in the cloud environment.
Near-miss passage: T1059.003 Windows Command Shell. Tactics: execution. Description: Adversaries may abuse the Windows command shell for execution. The Windows command shell ([cmd](https://attack.mitre.org/software/S0106)) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via [Remote Services](https://attack.mitre.org/techniques/T1021) such as [SSH](https://attack.mitre.org/techniques/T1021/004).(Citation: SSH in Windows) Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems. Adversaries may leverage [cmd](https://attack.mitre.org/software/S0106) to execute various commands and payloads. Common uses include [cmd](https://attack.mitre.org/software/S0106) to execute a single command, or abusing [cmd](https://attack.mitre.org/software/S0106) interactively with input and output forwarded over a command and control channel.
Query: risk of Multiple SQL injection vulnerabilities in ICZ MATCHA INVOICE before 2.5.7 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Matching passage: CVE-2015-5642. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in ICZ MATCHA INVOICE before 2.5.7 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-4613. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the backend module in the Developer Log (devlog) extension before 2.11.4 for TYPO3 allows remote editors to execute arbitrary SQL commands via unspecified vectors.
Query: Sigma rule for Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspici
Matching passage: Sigma rule: Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspici. Logsource: linux / process_creation. Rule: title: Suspicious Git Clone - Linux id: cfec9d29-64ec-4a0f-9ffe-0fdb856d5446 status: test description: Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious references: - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-03 modified: 2023-01-05 tags: - attack.reconnaissance - attack.t1593.003 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /git CommandLine|contains: ' clone ' selection_keyword: CommandLine|contains: - exploit - Vulns - vulnerability - RCE - RemoteCodeExecution - Invoke- - CVE- - poc- - ProofOfConcept - proxyshell - log4shell - eternalblue - eternal-blue - MS17- condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious command line reg.exe tool adding key to RUN key in Registry. Logsource: windows / process_creation. Rule: title: Potential Persistence Attempt Via Run Keys Using Reg.EXE id: de587dce-915e-4218-aac4-835ca6af6f70 status: test description: Detects suspicious command line reg.exe tool adding key to RUN key in Registry references: - https://app.any.run/tasks/9c0f37bc-867a-4314-b685-e101566766d7/ - https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2021-06-28 modified: 2025-02-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: \reg.exe CommandLine|contains|all: - reg - ' add ' CommandLine|contains: - Software\Microsoft\Windows\CurrentVersion\Run - \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run condition: selection falsepositives: - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reasons. - Legitimate administrator sets up autorun keys for legitimate reasons. - Discord level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_add_run_key/info.yml
Query: vulnerability: The Mail Drop feature in Mail in Apple OS X before 10.11 mishandles encryption parameters for attachments, which makes it easier for remote attackers to obtain sensitive informatio
Matching passage: CVE-2015-5884. CWE: CWE-200. CVSS: 3.299999952316284. The Mail Drop feature in Mail in Apple OS X before 10.11 mishandles encryption parameters for attachments, which makes it easier for remote attackers to obtain sensitive information by sniffing the network during transmission of an S/MIME e-mail message with a large attachment.
Near-miss passage: CVE-2015-3058. CWE: CWE-200. CVSS: 5.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to obtain sensitive information from process memory via unspecified vectors.
Query: risk of Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.
Matching passage: CVE-2015-8455. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, and CVE-2015-8451.
Near-miss passage: CVE-2015-6159. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6140, CVE-2015-6142, CVE-2015-6143, CVE-2015-6153, CVE-2015-6158, and CVE-2015-6160.
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects programs on a Windows system that should not write an archive to disk. Logsource: windows / file_event. Rule: title: Legitimate Application Dropped Archive id: 654fcc6d-840d-4844-9b07-2c3300e54a26 status: test description: Detects programs on a Windows system that should not write an archive to disk references: - https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326 author: frack113, Florian Roth date: 2022-08-21 tags: - attack.stealth - attack.t1218 logsource: product: windows category: file_event detection: selection: Image|endswith: - \winword.exe - \excel.exe - \powerpnt.exe - \msaccess.exe - \mspub.exe - \eqnedt32.exe - \visio.exe - \wordpad.exe - \wordview.exe - \certutil.exe - \certoc.exe - \CertReq.exe - \Desktopimgdownldr.exe - \esentutl.exe - \finger.exe - \notepad.exe - \AcroRd32.exe - \RdrCEF.exe - \mshta.exe - \hh.exe TargetFilename|endswith: - .zip - .rar - .7z - .diagcab - .appx condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects an uncommon parent process of "LINK.EXE". Link.EXE in Microsoft incremental linker. Its a utility usually bundle. Logsource: windows / process_creation. Rule: title: Uncommon Link.EXE Parent Process id: 6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6 status: test description: 'Detects an uncommon parent process of "LINK.EXE". Link.EXE in Microsoft incremental linker. Its a utility usually bundled with Visual Studio installation. Multiple utilities often found in the same folder (editbin.exe, dumpbin.exe, lib.exe, etc) have a hardcode call to the "LINK.EXE" binary without checking its validity. This would allow an attacker to sideload any binary with the name "link.exe" if one of the aforementioned tools get executed from a different location. By filtering the known locations of such utilities we can spot uncommon parent process of LINK.EXE that might be suspicious or malicious. ' references: - https://twitter.com/0gtweet/status/1560732860935729152 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-22 modified: 2024-06-27 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: Image|endswith: \link.exe CommandLine|contains: LINK / filter_main_visual_studio: ParentImage|startswith: - C:\Program Files\Microsoft Visual Studio\ - C:\Program Files (x86)\Microsoft Visual Studio\ ParentImage|contains: - \VC\bin\ - \VC\Tools\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium