alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: adversary uses Local Storage Discovery
Matching passage: T1680 Local Storage Discovery. Tactics: discovery. Description: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number. This can be done to prepare for ransomware-related encryption, to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0109), or as a precursor to [Direct Volume Access](https://attack.mitre.org/techniques/T1006). On ESXi systems, adversaries may use [Hypervisor CLI](https://attack.mitre.org/techniques/T1059/012) commands such as `esxcli` to list storage connected to the host as well as `.vmdk` files.(Citation: TrendMicro)(Citation: TrendMicro ESXI Ransomware) On Windows systems, adversaries can use `wmic logicaldisk get` to find information about local network drives. They can also use `Get-PSDrive` in PowerShell to retrieve drives and may additionally use Windows API functions such as `GetDriveType`.(Citation: Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024)(Citation: Volexity) Linux has commands such as `parted`, `lsblk`, `fdisk`, `lshw`, and `df` that can list information about disk partitions such as size, type, file system types, and free space. The command `diskutil` on MacOS can be used to list disks while `system_profiler SPStorageDataType` can additionally show information such as a volume’s mount path, file system, and the type of drive in the system. Infrastructure as a Service (IaaS) cloud providers also have commands for storage discovery such as `describe volume` in AWS, `gcloud compute disks list` in GCP, and `az disk list` in Azure.(Citation: AWS docs describe volumes)(Citation: GCP gcloud compute disks list)(Citation: azure az disk)
Near-miss passage: T1497 Virtualization/Sandbox Evasion. Tactics: stealth, discovery. Description: Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness) Adversaries may use several methods to accomplish [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) such as checking for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) or other system artifacts associated with analysis or virtualization. Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment. Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.(Citation: Unit 42 Pirpi July 2015)
Query: secure coding against Use of Weak Hash
Matching passage: CWE-328 Use of Weak Hash. The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).
Near-miss passage: CWE-312 Cleartext Storage of Sensitive Information. The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Query: risk of SQL injection vulnerability in ConnX ESP HR Management 4.4.0 allows remote attackers to execute arbitrary SQL commands via the ctl00$cphMainContent$txtUserName parameter to frmLogi
Matching passage: CVE-2015-4043. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in ConnX ESP HR Management 4.4.0 allows remote attackers to execute arbitrary SQL commands via the ctl00$cphMainContent$txtUserName parameter to frmLogin.aspx.
Near-miss passage: CVE-2015-6548. CWE: CWE-89. CVSS: 5.800000190734863. Multiple SQL injection vulnerabilities in a PHP script in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Query: exploit The VideoFramePool::PoolImpl::CreateFrame function in media/base/video_frame_pool.cc in Google Chrome before 47.0.2526.73 does not initialize memory for a video-frame data structur
Matching passage: CVE-2015-8480. CWE: CWE-119. CVSS: 10.0. The VideoFramePool::PoolImpl::CreateFrame function in media/base/video_frame_pool.cc in Google Chrome before 47.0.2526.73 does not initialize memory for a video-frame data structure, which might allow remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact by leveraging improper interaction with the vp3_h_loop_filter_c function in libavcodec/vp3dsp.c in FFmpeg.
Near-miss passage: CVE-2015-7005. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1.
Query: vulnerability: Qemu, when built with VNC display driver support, allows remote attackers to cause a denial of service (arithmetic exception and application crash) via crafted SetPixelFormat messa
Matching passage: CVE-2015-8504. CWE: CWE-369. CVSS: 6.5. Qemu, when built with VNC display driver support, allows remote attackers to cause a denial of service (arithmetic exception and application crash) via crafted SetPixelFormat messages from a client.
Near-miss passage: CVE-2015-7513. CWE: CWE-369. CVSS: 6.5. arch/x86/kvm/x86.c in the Linux kernel before 4.4 does not reset the PIT counter values during state restoration, which allows guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via a zero value, related to the kvm_vm_ioctl_set_pit and kvm_vm_ioctl_set_pit2 functions.
Query: vulnerability: The Concurrent Data Management Replication process in Cisco IOS XR 5.3.0 on ASR 9000 devices allows remote attackers to cause a denial of service (BGP process reload) via malformed
Matching passage: CVE-2015-4284. CWE: CWE-20. CVSS: 5.0. The Concurrent Data Management Replication process in Cisco IOS XR 5.3.0 on ASR 9000 devices allows remote attackers to cause a denial of service (BGP process reload) via malformed BGPv4 packets, aka Bug ID CSCur70670.
Near-miss passage: CVE-2015-9039. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in eMBMS where an assertion can be reached by a sequence of downlink messages.
Query: execution using Malicious Copy and Paste
Matching passage: T1204.004 Malicious Copy and Paste. Tactics: execution. Description: An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). One such strategy is "ClickFix," in which adversaries present users with seemingly helpful solutions—such as prompts to fix errors or complete CAPTCHAs—that instead instruct the user to copy and paste malicious code. Malicious websites, such as those used in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), may present fake error messages or CAPTCHA prompts that instruct users to open a terminal or the Windows Run Dialog box and execute an arbitrary command. These commands may be obfuscated using encoding or other techniques to conceal malicious intent. Once executed, the adversary will typically be able to establish a foothold on the victim's machine.(Citation: CloudSEK Lumma Stealer 2024)(Citation: Sekoia ClickFake 2025)(Citation: Reliaquest CAPTCHA 2024)(Citation: AhnLab LummaC2 2025) Adversaries may also leverage phishing emails for this purpose. When a user attempts to open an attachment, they may be presented with a fake error and offered a malicious command to paste as a solution, consistent with the "ClickFix" strategy.(Citation: Proofpoint ClickFix 2024)(Citation: AhnLab Malicioys Copy Paste 2024) Tricking a user into executing a command themselves may help to bypass email filtering, browser sandboxing, or other mitigations designed to protect users against malicious downloaded files.
Near-miss passage: T1204.005 Malicious Library. Tactics: execution. Description: Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may [Upload Malware](https://attack.mitre.org/techniques/T1608/001) to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that establishes persistence, steals data, or mines cryptocurrency.(Citation: Datadog Security Labs Malicious PyPi Packages 2024)(Citation: Fortinet Malicious NPM Packages 2023) In some cases, threat actors may compromise and backdoor existing popular libraries (i.e., [Compromise Software Dependencies and Development Tools](https://attack.mitre.org/techniques/T1195/001)). Alternatively, they may create entirely new packages and leverage behaviors such as typosquatting to encourage users to install them.
Query: detection rule: Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location. These files are use
Matching passage: Sigma rule: Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location. These files are use. Logsource: windows / file_event. Rule: title: Self Extraction Directive File Created In Potentially Suspicious Location id: 760e75d8-c3b5-409b-a9bf-6130b4c4603f related: - id: ab90dab8-c7da-4010-9193-563528cfa347 type: derived status: test description: 'Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location. These files are used by the "iexpress.exe" utility in order to create self extracting packages. Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries. ' references: - https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html - https://en.wikipedia.org/wiki/IExpress - https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2024-02-05 tags: - attack.stealth - attack.t1218 logsource: category: file_event product: windows detection: selection: TargetFilename|contains: - :\ProgramData\ - :\Temp\ - :\Windows\System32\Tasks\ - :\Windows\Tasks\ - :\Windows\Temp\ - \AppData\Local\Temp\ TargetFilename|endswith: .sed condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of network scanning and reconnaisance tools. These tools can be used for the enumeration of local or r. Logsource: linux / process_creation. Rule: title: Linux Network Service Scanning Tools Execution id: 3e102cd9-a70d-4a7a-9508-403963092f31 status: test description: Detects execution of network scanning and reconnaisance tools. These tools can be used for the enumeration of local or remote network services for example. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md - https://github.com/projectdiscovery/naabu - https://github.com/Tib3rius/AutoRecon author: Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]) date: 2020-10-21 modified: 2024-09-19 tags: - attack.discovery - attack.t1046 logsource: category: process_creation product: linux detection: selection_netcat: Image|endswith: - /nc - /ncat - /netcat - /socat selection_network_scanning_tools: Image|endswith: - /autorecon - /hping - /hping2 - /hping3 - /naabu - /nmap - /nping - /telnet - /zenmap filter_main_netcat_listen_flag: CommandLine|contains: - ' --listen ' - ' -l ' condition: (selection_netcat and not filter_main_netcat_listen_flag) or selection_network_scanning_tools falsepositives: - Legitimate administration activities level: low
Query: rule covering Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.
Matching passage: Sigma rule: Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.. Logsource: aws / cloudtrail. Rule: title: AWS Suspicious SAML Activity id: f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e status: test description: Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML. references: - https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateSAMLProvider.html - https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html author: Austin Songer date: 2021-09-22 modified: 2022-12-18 tags: - attack.initial-access - attack.lateral-movement - attack.persistence - attack.privilege-escalation - attack.stealth - attack.t1078 - attack.t1548 - attack.t1550 - attack.t1550.001 logsource: product: aws service: cloudtrail detection: selection_sts: eventSource: sts.amazonaws.com eventName: AssumeRoleWithSAML selection_iam: eventSource: iam.amazonaws.com eventName: UpdateSAMLProvider condition: 1 of selection_* falsepositives: - Automated processes that uses Terraform may lead to false positives. - SAML Provider could be updated by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - SAML Provider being updated from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity. Logsource: windows / create_remote_thread. Rule: title: Remote Thread Created In KeePass.EXE id: 77564cc2-7382-438b-a7f6-395c2ae53b9a status: test description: Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity references: - https://www.cisa.gov/uscert/ncas/alerts/aa20-259a - https://github.com/denandz/KeeFarce - https://github.com/GhostPack/KeeThief author: Timon Hackenjos date: 2022-04-22 modified: 2023-05-05 tags: - attack.credential-access - attack.t1555.005 logsource: product: windows category: create_remote_thread detection: selection: TargetImage|endswith: \KeePass.exe condition: selection falsepositives: - Unknown level: high
Query: detect Detects potential attempts made to set the Directory Services Restore Mode administrator password. The Directory Service in logs
Matching passage: Sigma rule: Detects potential attempts made to set the Directory Services Restore Mode administrator password. The Directory Service. Logsource: windows / security. Rule: title: Password Change on Directory Service Restore Mode (DSRM) Account id: 53ad8e36-f573-46bf-97e4-15ba5bf4bb51 related: - id: b61e87c0-50db-4b2e-8986-6a2be94b33b0 type: similar status: stable description: 'Detects potential attempts made to set the Directory Services Restore Mode administrator password. The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers. Attackers may change the password in order to obtain persistence. ' references: - https://adsecurity.org/?p=1714 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4794 author: Thomas Patzke date: 2017-02-19 modified: 2020-08-23 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: windows service: security detection: selection: EventID: 4794 condition: selection falsepositives: - Initial installation of a domain controller. level: high
Near-miss passage: Sigma rule: Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These. Logsource: windows / process_creation. Rule: title: XBAP Execution From Uncommon Locations Via PresentationHost.EXE id: d22e2925-cfd8-463f-96f6-89cec9d9bc5f status: test description: 'Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These files can be abused to run malicious ".xbap" files any bypass AWL ' references: - https://lolbas-project.github.io/lolbas/Binaries/Presentationhost/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-01 modified: 2023-11-09 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \presentationhost.exe - OriginalFileName: PresentationHost.exe selection_cli: CommandLine|contains: .xbap filter_main_generic: CommandLine|contains: - ' C:\Windows\' - ' C:\Program Files' condition: all of selection* and not 1 of filter_main_* falsepositives: - Legitimate ".xbap" being executed via "PresentationHost" level: medium
Query: patch priority for CVE-2015-7112
Matching passage: CVE-2015-7112. CWE: CWE-119. CVSS: 9.300000190734863. The IOHIDFamily API in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-7111.
Near-miss passage: CVE-2015-4588. CWE: CWE-119. CVSS: 6.800000190734863. Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted "run-length count" in an image in a WMF file.
Query: explain T1110 Brute Force
Matching passage: T1110 Brute Force. Tactics: credential access. Description: Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.(Citation: Dragos Crashoverride 2018) Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), [Account Discovery](https://attack.mitre.org/techniques/T1087), or [Password Policy Discovery](https://attack.mitre.org/techniques/T1201). Adversaries may also combine brute forcing activity with behaviors such as [External Remote Services](https://attack.mitre.org/techniques/T1133) as part of Initial Access. If an adversary guesses the correct password but fails to login to a compromised account due to location-based conditional access policies, they may change their infrastructure until they match the victim’s location and therefore bypass those policies.(Citation: ReliaQuest Health Care Social Engineering Campaign 2024)
Near-miss passage: T1110.004 Credential Stuffing. Tactics: credential access. Description: Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed. The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts. Credential stuffing is a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies. Typically, management services over commonly used ports are used when stuffing credentials. Commonly targeted services include the following: * SSH (22/TCP) * Telnet (23/TCP) * FTP (21/TCP) * NetBIOS / SMB / Samba (139/TCP & 445/TCP) * LDAP (389/TCP) * Kerberos (88/TCP) * RDP / Terminal Services (3389/TCP) * HTTP/HTTP Management Services (80/TCP & 443/TCP) * MSSQL (1433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP) * VNC (5900/TCP) In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018)
Query: write Sigma for Detects potential overwriting and deletion of a file using DD.
Matching passage: Sigma rule: Detects potential overwriting and deletion of a file using DD.. Logsource: linux / process_creation. Rule: title: DD File Overwrite id: 2953194b-e33c-4859-b9e8-05948c167447 status: test description: Detects potential overwriting and deletion of a file using DD. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md#atomic-test-2---macoslinux---overwrite-file-with-dd author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC date: 2021-10-15 modified: 2022-07-07 tags: - attack.impact - attack.t1485 logsource: product: linux category: process_creation detection: selection1: Image: - /bin/dd - /usr/bin/dd selection2: CommandLine|contains: of= selection3: CommandLine|contains: - if=/dev/zero - if=/dev/null condition: all of selection* falsepositives: - Any user deleting files that way. level: low
Near-miss passage: Sigma rule: Detects Access to LSASS Process. Logsource: windows / windefend. Rule: title: LSASS Access Detected via Attack Surface Reduction id: a0a278fe-2c0e-4de2-ac3c-c68b08a9ba98 status: test description: Detects Access to LSASS Process references: - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction author: Markus Neis date: 2018-08-26 modified: 2022-08-13 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows service: windefend definition: 'Requirements:Enabled Block credential stealing from the Windows local security authority subsystem (lsass.exe) from Attack Surface Reduction (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2)' detection: selection: EventID: 1121 Path|endswith: \lsass.exe filter_thor: ProcessName|startswith: C:\Windows\Temp\asgard2-agent\ ProcessName|endswith: - \thor64.exe - \thor.exe filter_exact: ProcessName: - C:\Windows\System32\atiesrxx.exe - C:\Windows\System32\CompatTelRunner.exe - C:\Windows\System32\msiexec.exe - C:\Windows\System32\nvwmi64.exe - C:\Windows\System32\svchost.exe - C:\Windows\System32\Taskmgr.exe - C:\Windows\System32\wbem\WmiPrvSE.exe - C:\Windows\SysWOW64\msiexec.exe filter_begins: ProcessName|startswith: - C:\Windows\System32\DriverStore\ - C:\WINDOWS\Installer\ - C:\Program Files\ - C:\Program Files (x86)\ condition: selection and not 1 of filter_* falsepositives: - Google Chrome GoogleUpdate.exe - Some Taskmgr.exe related activity level: high