alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: actor TTPs: Ingress Tool Transfer
Matching passage: T1105 Ingress Tool Transfer. Tactics: command and control. Description: Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as [ftp](https://attack.mitre.org/software/S0095). Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570)). On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, [certutil](https://attack.mitre.org/software/S0160), and [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands such as <code>IEX(New-Object Net.WebClient).downloadString()</code> and <code>Invoke-WebRequest</code>. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`.(Citation: t1105_lolbas) A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`).(Citation: Google Cloud Threat Intelligence COSCMICENERGY 2023) Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by [User Execution](https://attack.mitre.org/techniques/T1204) (typically after interacting with [Phishing](https://attack.mitre.org/techniques/T1566) lures).(Citation: T1105: Trellix_search-ms) Files can also be transferred using various [Web Service](https://attack.mitre.org/techniques/T1102)s as well as native or otherwise present tools on the victim system.(Citation: PTSecurity Cobalt Dec 2016) In some cases, adve
Near-miss passage: T1568.003 DNS Calculation. Tactics: command and control. Description: Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address. A IP and/or port number calculation can be used to bypass egress filtering on a C2 channel.(Citation: Meyers Numbered Panda) One implementation of [DNS Calculation](https://attack.mitre.org/techniques/T1568/003) is to take the first three octets of an IP address in a DNS response and use those values to calculate the port for command and control traffic.(Citation: Meyers Numbered Panda)(Citation: Moran 2014)(Citation: Rapid7G20Espionage)
Query: Multiple failed authentications followed by Archive via Utility
Matching passage: T1560.001 Archive via Utility. Tactics: collection. Description: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport. Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as <code>tar</code> on Linux and macOS or <code>zip</code> on Windows systems. On Windows, <code>diantz</code> or <code> makecab</code> may be used to package collected files into a cabinet (.cab) file. <code>diantz</code> may also be used to download and compress files from remote locations (i.e. [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002)).(Citation: diantz.exe_lolbas) <code>xcopy</code> on Windows can copy files and directories with a variety of options. Additionally, adversaries may use [certutil](https://attack.mitre.org/software/S0160) to Base64 encode collected data before exfiltration. Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.(Citation: 7zip Homepage)(Citation: WinRAR Homepage)(Citation: WinZip Homepage)
Near-miss passage: T1560.003 Archive via Custom Method. Tactics: collection. Description: An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.(Citation: ESET Sednit Part 2)
Query: exploit Multiple cross-site scripting (XSS) vulnerabilities in includes/metaboxes.php in the Gallery - Photo Albums - Portfolio plugin 1.3.47 for WordPress allow remote authenticated users
Matching passage: CVE-2015-7386. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in includes/metaboxes.php in the Gallery - Photo Albums - Portfolio plugin 1.3.47 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) Media Title or (2) Media Subtitle fields.
Near-miss passage: CVE-2015-3365. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the nodeauthor module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a Profile2 field in a provided block.
Query: vulnerability: ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01_R05 allows remote authenticated users to execute arbitrary commands via shel
Matching passage: CVE-2015-6024. CWE: CWE-77. CVSS: 9.800000190734863. ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01_R05 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the DIA_IPADDRESS parameter.
Near-miss passage: CVE-2015-1949. CWE: CWE-77. CVSS: 10.0. The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to execute arbitrary commands with SYSTEM privileges via unspecified vectors.
Query: common weakness: J2EE Misconfiguration: Entity Bean Declared Remote
Matching passage: CWE-8 J2EE Misconfiguration: Entity Bean Declared Remote. When an application exposes a remote interface for an entity bean, it might also expose methods that get or set the bean's data. These methods could be leveraged to read sensitive information, or to change data in ways that violate the application's expectations, potentially leading to other vulnerabilities.
Near-miss passage: CWE-306 Missing Authentication for Critical Function. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Query: detect Rootkit
Matching passage: T1014 Rootkit. Tactics: stealth. Description: Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits) Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or [System Firmware](https://attack.mitre.org/techniques/T1542/001). (Citation: Wikipedia Rootkit) Rootkits have been seen for Windows, Linux, and Mac OS X systems. (Citation: CrowdStrike Linux Rootkit) (Citation: BlackHat Mac OSX Rootkit) Rootkits that reside or modify boot sectors are known as [Bootkit](https://attack.mitre.org/techniques/T1542/003)s and specifically target the boot process of the operating system.
Near-miss passage: T1149 LC_MAIN Hijacking. Tactics: stealth. Description: **This technique has been deprecated and should no longer be used.** As of OS X 10.8, mach-O binaries introduced a new header called LC_MAIN that points to the binary’s entry point for execution. Previously, there were two headers to achieve this same effect: LC_THREAD and LC_UNIXTHREAD (Citation: Prolific OSX Malware History). The entry point for a binary can be hijacked so that initial execution flows to a malicious addition (either another section or a code cave) and then goes back to the initial entry point so that the victim doesn’t know anything was different (Citation: Methods of Mac Malware Persistence). By modifying a binary in this way, application whitelisting can be bypassed because the file name or application path is still the same.
Query: describe CVE-2015-4367
Matching passage: CVE-2015-4367. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Simple Subscription module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer blocks" permission to inject arbitrary web script or HTML via vectors related to block content.
Near-miss passage: CVE-2015-1864. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in the administration pages in Kallithea before 0.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) first name or (2) last name user details, or the (3) repository, (4) repository group, or (5) user group description.
Query: CVE similar to CVE-2015-9437
Matching passage: CVE-2015-9437. CWE: CWE-352. CVSS: 6.5. The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit parameter.
Near-miss passage: CVE-2015-5534. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Oxwall before 1.8 allow remote attackers to hijack the authentication of administrators for requests that (1) put the website under maintenance via the maintenance_enable parameter or (2) conduct cross-site scripting (XSS) attacks via the maintenance_text parameter to admin/pages/maintenance.
Query: risk of Directory traversal vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with certain permissions to read arbitrary files via a symlink, r
Matching passage: CVE-2015-1807. CWE: CWE-22. CVSS: 3.5. Directory traversal vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with certain permissions to read arbitrary files via a symlink, related to building artifacts.
Near-miss passage: CVE-2015-2995. CWE: CWE-22. CVSS: 6.800000190734863. The RdsLogsEntry servlet in SysAid Help Desk before 15.2 does not properly check file extensions, which allows remote attackers to upload and execute arbitrary files via a NULL byte after the extension, as demonstrated by a .war%00 file.
Query: detection rule: Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated
Matching passage: Sigma rule: Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated. Logsource: azure / auditlogs. Rule: title: Temporary Access Pass Added To An Account id: fa84aaf5-8142-43cd-9ec2-78cfebf878ce status: test description: Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#changes-to-privileged-accounts author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H' date: 2022-08-10 tags: - attack.privilege-escalation - attack.initial-access - attack.persistence - attack.stealth - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: properties.message: Admin registered security info Status: Admin registered temporary access pass method for user condition: selection falsepositives: - Administrator adding a legitimate temporary access pass level: high
Near-miss passage: Sigma rule: Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated. Logsource: windows / network_connection. Rule: title: Uncommon Connection to Active Directory Web Services id: b3ad3c0f-c949-47a1-a30e-b0491ccae876 status: test description: 'Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management. ' references: - https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c - https://github.com/FalconForceTeam/FalconFriday/blob/a9219dfcfd89836f34660223f47d766982bdce46/Discovery/ADWS_Connection_from_Unexpected_Binary-Win.md author: '@kostastsale' date: 2024-01-26 tags: - attack.discovery - attack.t1087 logsource: category: network_connection product: windows detection: selection: Initiated: true DestinationPort: 9389 filter_main_dsac: Image: C:\Windows\system32\dsac.exe filter_main_ms_monitoring_agent: Image: C:\Program Files\Microsoft Monitoring Agent\ filter_main_powershell: Image|startswith: - C:\Program Files\PowerShell\7\pwsh.exe - C:\Program Files\PowerShell\7-preview\pwsh.ex - C:\Windows\System32\WindowsPowerShell\ - C:\Windows\SysWOW64\WindowsPowerShell\ condition: selection and not 1 of filter_main_* falsepositives: - ADWS is used by a number of legitimate applications that need to interact with Active Directory. These applications should be added to the allow-listing to avoid false positives. level: medium
Query: Sigma YAML for windows / system
Matching passage: Sigma rule: Detects RemCom service installation and execution events. Logsource: windows / system. Rule: title: RemCom Service Installation id: 9e36ed87-4986-482e-8e3b-5c23ffff11bf status: test description: Detects RemCom service installation and execution events references: - https://github.com/kavika13/RemCom/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-07 tags: - attack.execution - attack.t1569.002 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ServiceName: RemComSvc - ImagePath|endswith: \RemComSvc.exe condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety controls and allow un. Logsource: aws / cloudtrail. Rule: title: AWS Bedrock Guardrail Updated id: 1c722651-254a-4b04-a9f4-99b62a2d0a1f status: experimental description: 'Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety controls and allow unsafe or unauthorized model responses. ' references: - https://docs.aws.amazon.com/bedrock/latest/APIReference/API_UpdateGuardrail.html author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2026-07-10 tags: - attack.defense-impairment - attack.t1685 logsource: product: aws service: cloudtrail detection: selection: eventName: UpdateGuardrail eventSource: bedrock.amazonaws.com condition: selection falsepositives: - Legitimate guardrail updates by authorized identities. level: medium
Query: vulnerability: IBM WebSphere Commerce Enterprise 7.0.0.9 and 8.x before Feature Pack 8 allows remote attackers to obtain sensitive information via a crafted REST URL.
Matching passage: CVE-2015-5015. CWE: CWE-200. CVSS: 5.0. IBM WebSphere Commerce Enterprise 7.0.0.9 and 8.x before Feature Pack 8 allows remote attackers to obtain sensitive information via a crafted REST URL.
Near-miss passage: CVE-2015-6344. CWE: CWE-200. CVSS: 4.0. The web-based GUI in Cisco Adaptive Security Appliance (ASA) CX Context-Aware Security 9.3(4.1.11) allows remote authenticated users to bypass intended access restrictions and obtain sensitive user information via an unspecified HTTP request, aka Bug ID CSCuv74105.
Query: EDR alert: possible Data from Configuration Repository (T1602)
Matching passage: T1602 Data from Configuration Repository. Tactics: collection. Description: Adversaries may collect data related to managed devices from configuration repositories. Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems. Configuration repositories may also facilitate remote access and administration of devices. Adversaries may target these repositories in order to collect large quantities of sensitive system administration data. Data from configuration repositories may be exposed by various protocols and software and can store a wide variety of data, much of which may align with adversary Discovery objectives.(Citation: US-CERT-TA18-106A)(Citation: US-CERT TA17-156A SNMP Abuse 2017)
Near-miss passage: T1602.001 SNMP (MIB Dump). Tactics: collection. Description: Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP). The MIB is a configuration repository that stores variable information accessible via SNMP in the form of object identifiers (OID). Each OID identifies a variable that can be read or set and permits active management tasks, such as configuration changes, through remote modification of these variables. SNMP can give administrators great insight in their systems, such as, system information, description of hardware, physical location, and software packages(Citation: SANS Information Security Reading Room Securing SNMP Securing SNMP). The MIB may also contain device operational information, including running configuration, routing table, and interface details. Adversaries may use SNMP queries to collect MIB content directly from SNMP-managed devices in order to collect network information that allows the adversary to build network maps and facilitate future targeted exploitation.(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks)
Query: alert when Alerts on Metasploit host's authentications on the domain.
Matching passage: Sigma rule: Alerts on Metasploit host's authentications on the domain.. Logsource: windows / security. Rule: title: Metasploit SMB Authentication id: 72124974-a68b-4366-b990-d30e0b2a190d status: test description: Alerts on Metasploit host's authentications on the domain. references: - https://github.com/rapid7/metasploit-framework/blob/1416b5776d963f21b7b5b45d19f3e961201e0aed/lib/rex/proto/smb/client.rb author: Chakib Gzenayi (@Chak092), Hosni Mribah date: 2020-05-06 modified: 2024-01-25 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: security detection: selection1: EventID: - 4625 - 4624 LogonType: 3 AuthenticationPackageName: NTLM WorkstationName|re: ^[A-Za-z0-9]{16}$ selection2: EventID: 4776 Workstation|re: ^[A-Za-z0-9]{16}$ condition: 1 of selection* falsepositives: - Linux hostnames composed of 16 characters. level: high
Near-miss passage: Sigma rule: Detects Bitsadmin connections to IP addresses instead of FQDN names. Logsource: proxy. Rule: title: Bitsadmin to Uncommon IP Server Address id: 8ccd35a2-1c7c-468b-b568-ac6cdf80eec3 status: test description: Detects Bitsadmin connections to IP addresses instead of FQDN names references: - https://isc.sans.edu/diary/Microsoft+BITS+Used+to+Download+Payloads/21027 author: Florian Roth (Nextron Systems) date: 2022-06-10 modified: 2022-08-24 tags: - attack.command-and-control - attack.execution - attack.stealth - attack.t1071.001 - attack.persistence - attack.t1197 - attack.s0190 logsource: category: proxy detection: selection: c-useragent|startswith: Microsoft BITS/ cs-host|endswith: - '1' - '2' - '3' - '4' - '5' - '6' - '7' - '8' - '9' condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-0501
Matching passage: CVE-2015-0501. CWE: UNKNOWN. CVSS: 5.699999809265137. Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Compiling.
Near-miss passage: CVE-2015-8474. CWE: UNKNOWN. CVSS: 7.400000095367432. Open redirect vulnerability in the valid_back_url function in app/controllers/application_controller.rb in Redmine before 2.6.7, 3.0.x before 3.0.5, and 3.1.x before 3.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted back_url parameter, as demonstrated by "@attacker.com," a different vulnerability than CVE-2014-1985.
Query: Sigma YAML for windows / firewall-as
Matching passage: Sigma rule: Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE). This can occur if an attacker lev. Logsource: windows / firewall-as. Rule: title: New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE id: eca81e8d-09e1-4d04-8614-c91f44fd0519 status: test description: 'Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE). This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule". ' references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule - https://malware.news/t/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/72170 - https://cybersecuritynews.com/rhysida-ransomware-attacking-windows/ author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2024-05-10 tags: - attack.defense-impairment - attack.t1686.003 logsource: product: windows service: firewall-as detection: selection: EventID: - 2004 - 2071 - 2097 Action: 3 ModifyingApplication|endswith: :\Windows\System32\wbem\WmiPrvSE.exe condition: selection falsepositives: - Administrator scripts or activity. level: medium
Near-miss passage: Sigma rule: Detects MSI package installation from suspicious locations. Logsource: windows / application. Rule: title: MSI Installation From Suspicious Locations id: c7c8aa1c-5aff-408e-828b-998e3620b341 status: test description: Detects MSI package installation from suspicious locations references: - https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-31 modified: 2023-10-23 tags: - attack.execution logsource: product: windows service: application detection: selection: Provider_Name: MsiInstaller EventID: - 1040 - 1042 Data|contains: - :\Windows\TEMP\ - \\\\ - \Desktop\ - \PerfLogs\ - \Users\Public\ filter_winget: Data|contains: \AppData\Local\Temp\WinGet\ filter_updhealthtools: Data|contains: C:\Windows\TEMP\UpdHealthTools.msi condition: selection and not 1 of filter_* falsepositives: - False positives may occur if you allow installation from folders such as the desktop, the public folder or remote shares. A baseline is required before production use. level: medium