alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: how to detect Gather Victim Org Information
Matching passage: T1591 Gather Victim Org Information. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's organization that can be used during targeting. Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about an organization may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak)(Citation: SEC EDGAR Search) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Near-miss passage: T1591.001 Determine Physical Locations. Tactics: reconnaissance. Description: Adversaries may gather the victim's physical location(s) that can be used during targeting. Information about physical locations of a target organization may include a variety of details, including where key resources and infrastructure are housed. Physical locations may also indicate what legal jurisdiction and/or authorities the victim operates within. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Physical locations of a target organization may also be exposed to adversaries via online or other accessible data sets (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594) or [Social Media](https://attack.mitre.org/techniques/T1593/001)).(Citation: ThreatPost Broadvoice Leak)(Citation: SEC EDGAR Search) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Hardware Additions](https://attack.mitre.org/techniques/T1200)).
Query: exploit In TrustZone a cryptographic issue can potentially occur in all Android releases from CAF using the Linux kernel.
Matching passage: CVE-2015-9003. CWE: CWE-310. CVSS: 7.800000190734863. In TrustZone a cryptographic issue can potentially occur in all Android releases from CAF using the Linux kernel.
Near-miss passage: CVE-2015-4550. CWE: CWE-310. CVSS: 4.300000190734863. The Cavium cryptographic-module firmware on Cisco Adaptive Security Appliance (ASA) devices with software 9.3(3) and 9.4(1.1) does not verify the AES-GCM Integrity Check Value (ICV) octets, which makes it easier for man-in-the-middle attackers to spoof IPSec and IKEv2 traffic by modifying packet data, aka Bug ID CSCuu66218.
Query: rule covering Detects when a new admin is created.
Matching passage: Sigma rule: Detects when a new admin is created.. Logsource: azure / auditlogs. Rule: title: Privileged Account Creation id: f7b5b004-dece-46e4-a4a5-f6fd0e1c6947 status: test description: Detects when a new admin is created. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#changes-to-privileged-accounts author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Tim Shelton date: 2022-08-11 modified: 2022-08-16 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.stealth - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: properties.message|contains|all: - Add user - Add member to role Status: Success condition: selection falsepositives: - A legitimate new admin account being created level: medium
Near-miss passage: Sigma rule: Monitor and alert on conditional access changes where non approved actor removed CA Policy.. Logsource: azure / auditlogs. Rule: title: CA Policy Removed by Non Approved Actor id: 26e7c5e2-6545-481e-b7e6-050143459635 status: test description: Monitor and alert on conditional access changes where non approved actor removed CA Policy. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access author: Corissa Koopmans, '@corissalea' date: 2022-07-19 tags: - attack.privilege-escalation - attack.credential-access - attack.persistence - attack.defense-impairment - attack.t1548 - attack.t1556 logsource: product: azure service: auditlogs detection: selection: properties.message: Delete conditional access policy condition: selection falsepositives: - Misconfigured role permissions - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. level: medium
Query: describe CVE-2015-1956
Matching passage: CVE-2015-1956. CWE: CWE-399. CVSS: 7.800000190734863. IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (disk consumption) via a crafted byte sequence in authentication data, a different vulnerability than CVE-2015-1958 and CVE-2015-1987.
Near-miss passage: CVE-2015-1068. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Query: ATT&CK technique for Token Impersonation/Theft
Matching passage: T1134.001 Token Impersonation/Theft. Tactics: stealth, privilege escalation. Description: Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`.(Citation: DuplicateToken function) The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread. An adversary may perform [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) when they have a specific, existing process they want to assign the duplicated token to. For example, this may be useful for when the target user has a non-network logon session on the system. When an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally [Create Process with Token](https://attack.mitre.org/techniques/T1134/002) using `CreateProcessWithTokenW` or `CreateProcessAsUserW`. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) is also distinct from [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) in that it refers to duplicating an existing token, rather than creating a new one.
Near-miss passage: T1134.003 Make and Impersonate Token. Tactics: stealth, privilege escalation. Description: Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function.(Citation: LogonUserW function) The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread. This behavior is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) in that this refers to creating a new user token instead of stealing or duplicating an existing one.
Query: Sigma YAML for windows / system
Matching passage: Sigma rule: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the c. Logsource: windows / system. Rule: title: Invoke-Obfuscation Obfuscated IEX Invocation - System id: 51aa9387-1c53-4153-91cc-d73c59ae1ca9 status: test description: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references references: - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888 author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community date: 2019-11-08 modified: 2022-11-27 tags: - attack.stealth - attack.t1027 logsource: product: windows service: system detection: selection_eid: EventID: 7045 selection_imagepath: - ImagePath|re: \$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\[ - ImagePath|re: \$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\[ - ImagePath|re: \$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\[ - ImagePath|re: \$env:ComSpec\[(\s*\d{1,3}\s*,){2} - ImagePath|re: \\*mdr\*\W\s*\)\.Name - ImagePath|re: \$VerbosePreference\.ToString\( - ImagePath|re: \String\]\s*\$VerbosePreference condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are leg. Logsource: zeek / dns. Rule: title: New Kind of Network (NKN) Detection id: fa7703d6-0ee8-4949-889c-48c84bc15b6f status: test description: NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma> references: - https://github.com/nknorg/nkn-sdk-go - https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/ - https://github.com/Maka8ka/NGLite author: Michael Portera (@mportatoes) date: 2022-04-21 tags: - attack.command-and-control logsource: product: zeek service: dns detection: selection: query|contains|all: - seed - .nkn.org condition: selection falsepositives: - Unknown level: low
Query: patch priority for CVE-2015-4658
Matching passage: CVE-2015-4658. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in admin/login.php in Milw0rm Clone Script 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) usr or (2) pwd parameter.
Near-miss passage: CVE-2015-10066. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in tynx wuersch and classified as critical. Affected by this issue is the function packValue/getByCustomQuery of the file backend/base/Store.class.php. The manipulation leads to sql injection. The patch is identified as 66d4718750a741d1053d327a79e285fd50372519. It is recommended to apply a patch to fix this issue. VDB-218462 is the identifier assigned to this vulnerability.
Query: vulnerability: The shadow_copy2_get_shadow_copy_data function in modules/vfs_shadow_copy2.c in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not verify that the
Matching passage: CVE-2015-5299. CWE: CWE-200. CVSS: 5.300000190734863. The shadow_copy2_get_shadow_copy_data function in modules/vfs_shadow_copy2.c in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not verify that the DIRECTORY_LIST access right has been granted, which allows remote attackers to access snapshots by visiting a shadow copy directory.
Near-miss passage: CVE-2015-4314. CWE: CWE-200. CVSS: 4.0. The System Snapshot feature in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.1 allows remote authenticated users to obtain sensitive password-hash information by reading the snapshot file, aka Bug ID CSCuv40422.
Query: exploit The _mediaLibraryPlayCb function in mainwindow.py in pitivi before 0.95 allows attackers to execute arbitrary code via shell metacharacters in a file path.
Matching passage: CVE-2015-0855. CWE: CWE-94. CVSS: 9.800000190734863. The _mediaLibraryPlayCb function in mainwindow.py in pitivi before 0.95 allows attackers to execute arbitrary code via shell metacharacters in a file path.
Near-miss passage: CVE-2015-8761. CWE: CWE-94. CVSS: 9.0. The Values module 7.x-1.x before 7.x-1.2 for Drupal does not properly check permissions, which allows remote administrators with the "Import value sets" permission to execute arbitrary PHP code via the exported values list in a ctools import.
Query: detect Detects possible payload obfuscation via the commandline in logs
Matching passage: Sigma rule: Detects possible payload obfuscation via the commandline. Logsource: windows / process_creation. Rule: title: Potential Dosfuscation Activity id: a77c1610-fc73-4019-8e29-0f51efc04a51 status: test description: Detects possible payload obfuscation via the commandline references: - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf - https://github.com/danielbohannon/Invoke-DOSfuscation author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-02-15 modified: 2023-03-06 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - ^^ - ^|^ - ',;,' - ;;;; - ;; ;; - (,(, - '%COMSPEC:~' - ' c^m^d' - ^c^m^d - ' c^md' - ' cm^d' - ^cm^d - ' s^et ' - ' s^e^t ' - ' se^t ' condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with S. Logsource: windows / process_creation. Rule: title: Potential Privilege Escalation To LOCAL SYSTEM id: 207b0396-3689-42d9-8399-4222658efc99 related: - id: 8834e2f7-6b4b-4f09-8906-d2276470ee23 type: similar status: test description: Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with SYSTEM Privileges references: - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec - https://www.poweradmin.com/paexec/ - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-05-22 modified: 2024-03-05 tags: - attack.resource-development - attack.t1587.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|windash: - ' -s cmd' - ' -s -i cmd' - ' -i -s cmd' - ' -s pwsh' - ' -s -i pwsh' - ' -i -s pwsh' - ' -s powershell' - ' -s -i powershell' - ' -i -s powershell' filter_main_exclude_coverage: CommandLine|contains: - paexec - PsExec - accepteula condition: selection and not 1 of filter_main_* falsepositives: - Weird admins that rename their tools - Software companies that bundle PsExec/PAExec with their software and rename it, so that it is less embarrassing level: high
Query: vulnerability: SQL injection vulnerability in Cisco Prime Collaboration Provisioning 10.6 and 11.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka
Matching passage: CVE-2015-6329. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in Cisco Prime Collaboration Provisioning 10.6 and 11.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCut64074.
Near-miss passage: CVE-2015-0540. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the xAdmin interface in EMC Document Sciences xPression 4.2 before P44 and 4.5 SP1 before P03 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Query: describe CVE-2015-8952
Matching passage: CVE-2015-8952. CWE: CWE-19. CVSS: 5.5. The mbcache feature in the ext2 and ext4 filesystem implementations in the Linux kernel before 4.6 mishandles xattr block caching, which allows local users to cause a denial of service (soft lockup) via filesystem operations in environments that use many attributes, as demonstrated by Ceph and Samba.
Near-miss passage: CVE-2015-1687. CWE: CWE-19. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Query: describe CVE-2015-8510
Matching passage: CVE-2015-8510. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the internationalization feature in the default homescreen app in Mozilla Firefox OS before 2.5 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted web site that is mishandled during "Add to home screen" bookmarking.
Near-miss passage: CVE-2015-4660. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Enhanced SQL Portal 5.0.7961 allows remote attackers to inject arbitrary web script or HTML via the id parameter to iframe.php.
Query: Sigma rule for Detects scheduled task creation events that include suspicious actions, and is run once at 00:00
Matching passage: Sigma rule: Detects scheduled task creation events that include suspicious actions, and is run once at 00:00. Logsource: windows / process_creation. Rule: title: Uncommon One Time Only Scheduled Task At 00:00 id: 970823b7-273b-460a-8afc-3a6811998529 status: test description: Detects scheduled task creation events that include suspicious actions, and is run once at 00:00 references: - https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte author: pH-T (Nextron Systems) date: 2022-07-15 modified: 2023-02-03 tags: - attack.execution - attack.persistence - attack.privilege-escalation - attack.t1053.005 logsource: category: process_creation product: windows detection: selection_img: - Image|contains: \schtasks.exe - OriginalFileName: schtasks.exe selection_cli: CommandLine|contains: - wscript - vbscript - cscript - 'wmic ' - wmic.exe - regsvr32.exe - powershell - \AppData\ selection_time: CommandLine|contains|all: - once - 00:00 condition: all of selection_* falsepositives: - Software installation level: high
Near-miss passage: Sigma rule: Detects suspicious sub processes of web server processes. Logsource: linux / process_creation. Rule: title: Linux Webshell Indicators id: 818f7b24-0fba-4c49-a073-8b755573b9c7 status: test description: Detects suspicious sub processes of web server processes references: - https://www.acunetix.com/blog/articles/web-shells-101-using-php-introduction-web-shells-part-2/ - https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-10-15 modified: 2022-12-28 tags: - attack.persistence - attack.t1505.003 logsource: product: linux category: process_creation detection: selection_general: ParentImage|endswith: - /httpd - /lighttpd - /nginx - /apache2 - /node - /caddy selection_tomcat: ParentCommandLine|contains|all: - /bin/java - tomcat selection_websphere: ParentCommandLine|contains|all: - /bin/java - websphere sub_processes: Image|endswith: - /whoami - /ifconfig - /ip - /bin/uname - /bin/cat - /bin/crontab - /hostname - /iptables - /netstat - /pwd - /route condition: 1 of selection_* and sub_processes falsepositives: - Web applications that invoke Linux command line tools level: high
Query: detection rule: Adversaries may use to interact with a remote network share using Server Message Block (SMB). The adversary may then per
Matching passage: Sigma rule: Adversaries may use to interact with a remote network share using Server Message Block (SMB). The adversary may then per. Logsource: windows / ps_script. Rule: title: Suspicious New-PSDrive to Admin Share id: 1c563233-030e-4a07-af8c-ee0490a66d3a status: test description: Adversaries may use to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.002/T1021.002.md#atomic-test-2---map-admin-share-powershell - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/new-psdrive?view=powershell-7.2 author: frack113 date: 2022-08-13 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - New-PSDrive - '-psprovider ' - filesystem - '-root ' - \\\\ - $ condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of rundll32 where the DLL being called is stored in an Alternate Data Stream (ADS).. Logsource: windows / process_creation. Rule: title: Potential Rundll32 Execution With DLL Stored In ADS id: 9248c7e1-2bf3-4661-a22c-600a8040b446 status: test description: Detects execution of rundll32 where the DLL being called is stored in an Alternate Data Stream (ADS). references: - https://lolbas-project.github.io/lolbas/Binaries/Rundll32 author: Harjot Singh, '@cyb3rjy0t' date: 2023-01-21 modified: 2026-03-16 tags: - attack.stealth - attack.t1564.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|re: '[Rr][Uu][Nn][Dd][Ll][Ll]32(?:\.[Ee][Xx][Ee])? \S+?\w:\S+?:' condition: all of selection_* falsepositives: - Unknown level: high