alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: hunt for Clear Persistence activity
Matching passage: T1070.009 Clear Persistence. Tactics: stealth. Description: Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, [Modify Registry](https://attack.mitre.org/techniques/T1112), [Plist File Modification](https://attack.mitre.org/techniques/T1647), or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence.(Citation: Cylance Dust Storm) Adversaries may also delete accounts previously created to maintain persistence (i.e. [Create Account](https://attack.mitre.org/techniques/T1136)).(Citation: Talos - Cisco Attack 2022) In some instances, artifacts of persistence may also be removed once an adversary’s persistence is executed in order to prevent errors with the new instance of the malware.(Citation: NCC Group Team9 June 2020)
Near-miss passage: T1070.003 Clear Command History. Tactics: stealth. Description: In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done. On Linux and macOS, these command histories can be accessed in a few different ways. While logged in, this command history is tracked in a file pointed to by the environment variable <code>HISTFILE</code>. When a user logs off a system, this information is flushed to a file in the user's home directory called <code>~/.bash_history</code>. The benefit of this is that it allows users to go back to commands they've used before in different sessions. Adversaries may delete their commands from these logs by manually clearing the history (<code>history -c</code>) or deleting the bash history file <code>rm ~/.bash_history</code>. Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to clear command history data (<code>clear logging</code> and/or <code>clear history</code>).(Citation: US-CERT-TA18-106A) On ESXi servers, command history may be manually removed from the `/var/log/shell.log` file.(Citation: Broadcom ESXi Shell Audit) On Windows hosts, PowerShell has two different command history providers: the built-in history and the command history managed by the <code>PSReadLine</code> module. The built-in history only tracks the commands used in the current session. This command history is not available to other sessions and is deleted when the session ends. The <code>PSReadLine</code> command history tracks the commands used in all PowerShell sessions and writes them to a file (<code>$env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt</code> by default). This history file is available to all sessions and contains all past history since the file is not deleted when the session ends.(Citation: Micros
Query: Sigma rule for Identifies when a service account is modified or deleted.
Matching passage: Sigma rule: Identifies when a service account is modified or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes Service Account Modified or Deleted id: 12d027c3-b48c-4d9d-8bb6-a732200034b2 status: test description: Identifies when a service account is modified or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1 author: Austin Songer @austinsonger date: 2021-08-07 modified: 2022-08-23 tags: - attack.impact - attack.t1531 - attack.t1485 - attack.t1496 - attack.t1489 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SERVICEACCOUNTS/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SERVICEACCOUNTS/DELETE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SERVICEACCOUNTS/IMPERSONATE/ACTION condition: selection falsepositives: - Service account being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Service account modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects attempts of decoding a base64 Gzip archive in a PowerShell script. This technique is often used as a method to l. Logsource: windows / ps_script. Rule: title: Suspicious FromBase64String Usage On Gzip Archive - Ps Script id: df69cb1d-b891-4cd9-90c7-d617d90100ce related: - id: d75d6b6b-adb9-48f7-824b-ac2e786efe1f type: similar status: test description: Detects attempts of decoding a base64 Gzip archive in a PowerShell script. This technique is often used as a method to load malicious content into memory afterward. references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=43 author: frack113 date: 2022-12-23 tags: - attack.command-and-control - attack.t1132.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - FromBase64String - MemoryStream - H4sI condition: selection falsepositives: - Legitimate administrative script level: medium
Query: Sigma rule for Detects the restoration of files from the defender quarantine
Matching passage: Sigma rule: Detects the restoration of files from the defender quarantine. Logsource: windows / windefend. Rule: title: Win Defender Restored Quarantine File id: bc92ca75-cd42-4d61-9a37-9d5aa259c88b status: test description: Detects the restoration of files from the defender quarantine references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-06 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: 1009 condition: selection falsepositives: - Legitimate administrator activity restoring a file level: high
Near-miss passage: Sigma rule: Detects command lines that contain the 'accepteula' flag which could be a sign of execution of one of the Sysinternals t. Logsource: windows / process_creation. Rule: title: Potential Execution of Sysinternals Tools id: 7cccd811-7ae9-4ebe-9afd-cb5c406b824b related: - id: 25ffa65d-76d8-4da5-a832-3f2b0136e133 type: derived status: test description: Detects command lines that contain the 'accepteula' flag which could be a sign of execution of one of the Sysinternals tools references: - https://twitter.com/Moti_B/status/1008587936735035392 author: Markus Neis date: 2017-08-28 modified: 2024-03-13 tags: - attack.resource-development - attack.t1588.002 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|windash: ' -accepteula' condition: selection falsepositives: - Legitimate use of SysInternals tools - Programs that use the same command line flag level: low
Query: risk of The Landing Pages plugin before 1.9.2 for WordPress allows remote attackers to execute arbitrary code via the url parameter.
Matching passage: CVE-2015-5227. CWE: CWE-74. CVSS: 8.800000190734863. The Landing Pages plugin before 1.9.2 for WordPress allows remote attackers to execute arbitrary code via the url parameter.
Near-miss passage: CVE-2015-3154. CWE: CWE-74. CVSS: 6.099999904632568. CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
Query: threat report mentioning Junk Code Insertion
Matching passage: T1027.016 Junk Code Insertion. Tactics: stealth. Description: Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code that either does not execute, or if it does execute, does not change the functionality of the code. Junk code makes analysis more difficult and time-consuming, as the analyst steps through non-functional code instead of analyzing the main code. It also may hinder detections that rely on static code analysis due to the use of benign functionality, especially when combined with [Compression](https://attack.mitre.org/techniques/T1027/015) or [Software Packing](https://attack.mitre.org/techniques/T1027/002).(Citation: ReasonLabs)(Citation: ReasonLabs Cyberpedia Junk Code) No-Operation (NOP) instructions are an example of dead code commonly used in x86 assembly language. They are commonly used as the 0x90 opcode. When NOPs are added to malware, the disassembler may show the NOP instructions, leading to the analyst needing to step through them.(Citation: ReasonLabs) The use of junk / dead code insertion is distinct from [Binary Padding](https://attack.mitre.org/techniques/T1027/001) because the purpose is to obfuscate the functionality of the code, rather than simply to change the malware’s signature.
Near-miss passage: T1027.003 Steganography. Tactics: stealth. Description: Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files. [Duqu](https://attack.mitre.org/software/S0038) was an early example of malware that used steganography. It encrypted the gathered information from a victim's system and hid it within an image before exfiltrating the image to a C2 server.(Citation: Wikipedia Duqu) By the end of 2017, a threat group used <code>Invoke-PSImage</code> to hide [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands in an image file (.png) and execute the code on a victim's system. In this particular case the [PowerShell](https://attack.mitre.org/techniques/T1059/001) code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary.(Citation: McAfee Malicious Doc Targets Pyeongchang Olympics)
Query: detect Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in com in logs
Matching passage: Sigma rule: Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in com. Logsource: windows / image_load. Rule: title: DLL Sideloading Of ShellChromeAPI.DLL id: ee4c5d06-3abc-48cc-8885-77f1c20f4451 related: - id: e173ad47-4388-4012-ae62-bd13f71c18a8 type: similar status: test description: 'Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter ' references: - https://mobile.twitter.com/0gtweet/status/1564131230941122561 - https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-01 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \ShellChromeAPI.dll condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects calls to "SyncInvoke" that is part of the "CL_Invocation.ps1" script to proxy execution using "System.Diagnostic. Logsource: windows / process_creation. Rule: title: Potential Process Execution Proxy Via CL_Invocation.ps1 id: a0459f02-ac51-4c09-b511-b8c9203fc429 status: test description: Detects calls to "SyncInvoke" that is part of the "CL_Invocation.ps1" script to proxy execution using "System.Diagnostics.Process" references: - https://lolbas-project.github.io/lolbas/Scripts/Cl_invocation/ - https://twitter.com/bohops/status/948061991012327424 author: Nasreddine Bencherchali (Nextron Systems), oscd.community, Natalia Shornikova date: 2020-10-14 modified: 2023-08-17 tags: - attack.stealth - attack.t1216 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: 'SyncInvoke ' condition: selection falsepositives: - Unknown level: medium
Query: hunt for Bind Mounts activity
Matching passage: T1564.013 Bind Mounts. Tactics: stealth. Description: Adversaries may abuse bind mounts on file structures to hide their activity and artifacts from native utilities. A bind mount maps a directory or file from one location on the filesystem to another, similar to a shortcut on Windows. It’s commonly used to provide access to specific files or directories across different environments, such as inside containers or chroot environments, and requires sudo access. Adversaries may use bind mounts to map either an empty directory or a benign `/proc` directory to a malicious process’s `/proc` directory. Using the commands `mount –o bind /proc/benign-process /proc/malicious-process` (or `mount –B`), the malicious process's `/proc` directory is overlayed with the contents of a benign process's `/proc` directory. When system utilities query process activity, such as `ps` and `top`, the kernel follows the bind mount and presents the benign directory’s contents instead of the malicious process's actual `/proc` directory. As a result, these utilities display information that appears to come from the benign process, effectively hiding the malicious process's metadata, executable, or other artifacts from detection.(Citation: Cado Security Commando Cat 2024)(Citation: Ahn Lab CoinMiner 2023)
Near-miss passage: T1564.007 VBA Stomping. Tactics: stealth. Description: Adversaries may hide malicious Visual Basic for Applications (VBA) payloads embedded within MS Office documents by replacing the VBA source code with benign data.(Citation: FireEye VBA stomp Feb 2020) MS Office documents with embedded VBA content store source code inside of module streams. Each module stream has a <code>PerformanceCache</code> that stores a separate compiled version of the VBA source code known as p-code. The p-code is executed when the MS Office version specified in the <code>_VBA_PROJECT</code> stream (which contains the version-dependent description of the VBA project) matches the version of the host MS Office application.(Citation: Evil Clippy May 2019)(Citation: Microsoft _VBA_PROJECT Stream) An adversary may hide malicious VBA code by overwriting the VBA source code location with zero’s, benign code, or random bytes while leaving the previously compiled malicious p-code. Tools that scan for malicious VBA source code may be bypassed as the unwanted code is hidden in the compiled p-code. If the VBA source code is removed, some tools might even think that there are no macros present. If there is a version match between the <code>_VBA_PROJECT</code> stream and host MS Office application, the p-code will be executed, otherwise the benign VBA source code will be decompressed and recompiled to p-code, thus removing malicious p-code and potentially bypassing dynamic analysis.(Citation: Walmart Roberts Oct 2018)(Citation: FireEye VBA stomp Feb 2020)(Citation: pcodedmp Bontchev)
Query: risk of Race condition in the nsThreadManager::RegisterCurrentThread function in Mozilla Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a denial of service 
Matching passage: CVE-2015-2715. CWE: CWE-362. CVSS: 6.800000190734863. Race condition in the nsThreadManager::RegisterCurrentThread function in Mozilla Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) by leveraging improper Media Decoder Thread creation at the time of a shutdown.
Near-miss passage: CVE-2015-0654. CWE: CWE-362. CVSS: 7.099999904632568. Race condition in the TLS implementation in MainApp in the management interface in Cisco Intrusion Prevention System (IPS) Software before 7.3(3)E4 allows remote attackers to cause a denial of service (process hang) by establishing many HTTPS sessions, aka Bug ID CSCuq40652.
Query: patch priority for CVE-2015-4731
Matching passage: CVE-2015-4731. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; Java SE Embedded 7u75; and Java SE Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
Near-miss passage: CVE-2015-8746. CWE: UNKNOWN. CVSS: 7.5. fs/nfs/nfs4proc.c in the NFS client in the Linux kernel before 4.2.2 does not properly initialize memory for migration recovery operations, which allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) via crafted network traffic.
Query: vulnerability: ntopng (aka ntop) before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and username parameter to admin/password_reset.lu
Matching passage: CVE-2015-8368. CWE: CWE-254. CVSS: 6.0. ntopng (aka ntop) before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and username parameter to admin/password_reset.lua.
Near-miss passage: CVE-2015-5246. CWE: CWE-254. CVSS: 8.100000381469727. The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors involving the password lifetime period in Active Directory.
Query: CVE similar to CVE-2015-4913
Matching passage: CVE-2015-4913. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML, a different vulnerability than CVE-2015-4858.
Near-miss passage: CVE-2015-1121. CWE: UNKNOWN. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE-SA-2015-04-08-4.
Query: risk of The sys_amd64 IRET Handler in the kernel in FreeBSD 9.3 and 10.1 allows local users to gain privileges or cause a denial of service (kernel panic).
Matching passage: CVE-2015-5675. CWE: CWE-264. CVSS: 7.800000190734863. The sys_amd64 IRET Handler in the kernel in FreeBSD 9.3 and 10.1 allows local users to gain privileges or cause a denial of service (kernel panic).
Near-miss passage: CVE-2015-0006. CWE: CWE-264. CVSS: 6.099999904632568. The Network Location Awareness (NLA) service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not perform mutual authentication to determine a domain connection, which allows remote attackers to trigger an unintended permissive configuration by spoofing DNS and LDAP responses on a local network, aka "NLA Security Feature Bypass Vulnerability."
Query: Sigma rule for Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j)
Matching passage: Sigma rule: Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j). Logsource: windows / process_creation. Rule: title: Suspicious Processes Spawned by Java.EXE id: 0d34ed8b-1c12-4ff2-828c-16fc860b766d related: - id: dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0 type: similar status: test description: Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j) references: - https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/ author: Andreas Hunkeler (@Karneades), Florian Roth date: 2021-12-17 modified: 2024-01-18 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \java.exe Image|endswith: - \AppVLP.exe - \bitsadmin.exe - \certutil.exe - \cscript.exe - \curl.exe - \forfiles.exe - \hh.exe - \mftrace.exe - \mshta.exe - \net.exe - \net1.exe - \query.exe - \reg.exe - \regsvr32.exe - \rundll32.exe - \schtasks.exe - \scrcons.exe - \scriptrunner.exe - \sh.exe - \systeminfo.exe - \whoami.exe - \wmic.exe - \wscript.exe condition: selection falsepositives: - Legitimate calls to system binaries - Company specific internal usage level: high
Near-miss passage: Sigma rule: Detects powershell scripts that import modules from suspicious directories. Logsource: windows / process_creation. Rule: title: Import PowerShell Modules From Suspicious Directories - ProcCreation id: c31364f7-8be6-4b77-8483-dd2b5a7b69a3 related: - id: 21f9162c-5f5d-4b01-89a8-b705bd7d10ab type: similar status: test description: Detects powershell scripts that import modules from suspicious directories references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-10 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - Import-Module "$Env:Temp\ - Import-Module '$Env:Temp\ - Import-Module $Env:Temp\ - Import-Module "$Env:Appdata\ - Import-Module '$Env:Appdata\ - Import-Module $Env:Appdata\ - Import-Module C:\Users\Public\ - ipmo "$Env:Temp\ - ipmo '$Env:Temp\ - ipmo $Env:Temp\ - ipmo "$Env:Appdata\ - ipmo '$Env:Appdata\ - ipmo $Env:Appdata\ - ipmo C:\Users\Public\ condition: selection falsepositives: - Unknown level: medium
Query: describe CVE-2015-4925
Matching passage: CVE-2015-4925. CWE: UNKNOWN. CVSS: 6.5. Unspecified vulnerability in the Workspace Manager component in Oracle Database Server 11.2.0.4 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
Near-miss passage: CVE-2015-4297. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in Cisco WebEx Node for Media Convergence Server (MCS) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted HTTP request parameters, aka Bug ID CSCuv32136.