alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection engineering for Establish Accounts
Matching passage: T1585 Establish Accounts. Tactics: resource development. Description: Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) For operations incorporating social engineering, the utilization of an online persona may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, GitHub, Docker Hub, etc.). Establishing a persona may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) Establishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) In addition, establishing accounts may allow adversaries to abuse free services, such as registering for trial periods to [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) for malicious purposes.(Citation: Free Trial PurpleUrchin)
Near-miss passage: T1585.002 Email Accounts. Tactics: resource development. Description: Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) Establishing email accounts may also allow adversaries to abuse free services – such as trial periods – to [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) for follow-on purposes.(Citation: Free Trial PurpleUrchin) Adversaries may also take steps to cultivate a persona around the email account, such as through use of [Social Media Accounts](https://attack.mitre.org/techniques/T1585/001), to increase the chance of success of follow-on behaviors. Created email accounts can also be used in the acquisition of infrastructure (ex: [Domains](https://attack.mitre.org/techniques/T1583/001)).(Citation: Mandiant APT1) To decrease the chance of physically tying back operations to themselves, adversaries may make use of disposable email services.(Citation: Trend Micro R980 2016)
Query: EDR alert: possible Account Discovery (T1087)
Matching passage: T1087 Account Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)). Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment. For examples, cloud environments typically provide easily accessible interfaces to obtain user lists.(Citation: AWS List Users)(Citation: Google Cloud - IAM Servie Accounts List API) On hosts, adversaries can use default [PowerShell](https://attack.mitre.org/techniques/T1059/001) and other command line functionality to identify accounts. Information about email addresses and accounts may also be extracted by searching an infected system’s files.
Near-miss passage: T1087.003 Email Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists) In on-premises Exchange and Exchange Online, the <code>Get-GlobalAddressList</code> PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016) In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List)
Query: describe CVE-2015-4213
Matching passage: CVE-2015-4213. CWE: CWE-200. CVSS: 4.0. Cisco NX-OS 1.1(1g) on Nexus 9000 devices allows remote authenticated users to discover cleartext passwords by leveraging the existence of a decryption mechanism, aka Bug ID CSCuu84391.
Near-miss passage: CVE-2015-7429. CWE: CWE-200. CVSS: 8.5. The Data Protection extension in the VMware GUI in IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual Environments) 7.1 before 7.1.4 and Tivoli Storage FlashCopy Manager for VMware (aka Spectrum Protect Snapshot) 4.1 before 4.1.4 allows remote authenticated users to restore arbitrary virtual machines and consequently obtain sensitive information by visiting the vSphere inventory.
Query: exploit Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks via a symlink attack in an ARJ archive.
Matching passage: CVE-2015-0556. CWE: CWE-59. CVSS: 5.800000190734863. Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks via a symlink attack in an ARJ archive.
Near-miss passage: CVE-2015-3629. CWE: CWE-59. CVSS: 7.800000190734863. Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container.
Query: detection rule: Detects potential DLL sideloading of "wwlib.dll"
Matching passage: Sigma rule: Detects potential DLL sideloading of "wwlib.dll". Logsource: windows / image_load. Rule: title: Potential WWlib.DLL Sideloading id: e2e01011-5910-4267-9c3b-4149ed5479cf status: test description: Detects potential DLL sideloading of "wwlib.dll" references: - https://twitter.com/WhichbufferArda/status/1658829954182774784 - https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/ - https://securelist.com/apt-luminousmoth/103332/ author: X__Junior (Nextron Systems) date: 2023-05-18 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \wwlib.dll filter_main_path: Image|startswith: - C:\Program Files (x86)\Microsoft Office\ - C:\Program Files\Microsoft Office\ Image|endswith: \winword.exe ImageLoaded|startswith: - C:\Program Files (x86)\Microsoft Office\ - C:\Program Files\Microsoft Office\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects remote RPC calls to read information about scheduled tasks. Logsource: rpc_firewall / application. Rule: title: Remote Schedule Task Recon via ITaskSchedulerService id: 7f7c49eb-2977-4ac8-8ab0-ab1bae14730e status: test description: Detects remote RPC calls to read information about scheduled tasks references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.discovery logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:86d35949-83c9-4044-b424-db363231fd0c"' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 86d35949-83c9-4044-b424-db363231fd0c filter: OpNum: - 1 - 3 - 4 - 10 - 11 - 12 - 13 - 14 - 15 condition: selection and not filter falsepositives: - Unknown level: high
Query: risk of Moodle 2.8.x before 2.8.6 does not consider the tool/monitor:subscribe capability before entering subscriptions to site-wide event-monitor rules, which allows remote authenticated 
Matching passage: CVE-2015-3177. CWE: CWE-17. CVSS: 3.5. Moodle 2.8.x before 2.8.6 does not consider the tool/monitor:subscribe capability before entering subscriptions to site-wide event-monitor rules, which allows remote authenticated users to obtain sensitive information via a subscription request.
Near-miss passage: CVE-2015-1334. CWE: CWE-17. CVSS: 4.599999904632568. attach.c in LXC 1.1.2 and earlier uses the proc filesystem in a container, which allows local container users to escape AppArmor or SELinux confinement by mounting a proc filesystem with a crafted (1) AppArmor profile or (2) SELinux label.
Query: vulnerability: The LDAP service in Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote attackers to obtain sensitive information about administrator accounts via a modifi
Matching passage: CVE-2015-8148. CWE: CWE-200. CVSS: 7.5. The LDAP service in Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote attackers to obtain sensitive information about administrator accounts via a modified request.
Near-miss passage: CVE-2015-1967. CWE: CWE-200. CVSS: 4.300000190734863. MQ Explorer in IBM WebSphere MQ before 8.0.0.3 does not recognize the absence of the compatibility-mode option, which allows remote attackers to obtain sensitive information by sniffing the network for a session in which TLS is not used.
Query: Multiple failed authentications followed by Mail Protocols
Matching passage: T1071.003 Mail Protocols. Tactics: command and control. Description: Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as SMTP/S, POP3/S, and IMAP that carry electronic mail may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the email messages themselves. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: FireEye APT28)
Near-miss passage: T1071 Application Layer Protocol. Tactics: command and control. Description: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.(Citation: Mandiant APT29 Eye Spy Email Nov 22)
Query: detection rule: Once established within a system or network, an adversary may use automated techniques for collecting internal data
Matching passage: Sigma rule: Once established within a system or network, an adversary may use automated techniques for collecting internal data. Logsource: windows / ps_script. Rule: title: Recon Information for Export with PowerShell id: a9723fcc-881c-424c-8709-fd61442ab3c3 status: test description: Once established within a system or network, an adversary may use automated techniques for collecting internal data references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1119/T1119.md author: frack113 date: 2021-07-30 modified: 2022-12-25 tags: - attack.collection - attack.t1119 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_action: ScriptBlockText|contains: - 'Get-Service ' - 'Get-ChildItem ' - 'Get-Process ' selection_redirect: ScriptBlockText|contains: '> $env:TEMP\' condition: all of selection* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet). Logsource: windows / process_creation. Rule: title: Suspicious Encoded PowerShell Command Line id: ca2092a1-c273-4878-9b4b-0d60115bf5ea status: test description: Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet) references: - https://app.any.run/tasks/6217d77d-3189-4db2-a957-8ab239f3e01e author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community date: 2018-09-03 modified: 2023-04-06 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli_enc: CommandLine|contains: ' -e' selection_cli_content: CommandLine|contains: - ' JAB' - ' SUVYI' - ' SQBFAFgA' - ' aQBlAHgA' - ' aWV4I' - ' IAA' - ' IAB' - ' UwB' - ' cwB' selection_standalone: CommandLine|contains: - '.exe -ENCOD ' - ' BA^J e-' filter_optional_remote_signed: CommandLine|contains: ' -ExecutionPolicy remotesigned ' condition: selection_img and (all of selection_cli_* or selection_standalone) and not 1 of filter_optional_* level: high
Query: Encoded PowerShell / command-line abuse matching Cloud Administration Command
Matching passage: T1651 Cloud Administration Command. Tactics: execution. Description: Adversaries may abuse cloud management services to execute commands within virtual machines. Resources such as AWS Systems Manager, Azure RunCommand, and Runbooks allow users to remotely run scripts in virtual machines by leveraging installed virtual machine agents. (Citation: AWS Systems Manager Run Command)(Citation: Microsoft Run Command) If an adversary gains administrative access to a cloud environment, they may be able to abuse cloud management services to execute commands in the environment’s virtual machines. Additionally, an adversary that compromises a service provider or delegated administrator account may similarly be able to leverage a [Trusted Relationship](https://attack.mitre.org/techniques/T1199) to execute commands in connected virtual machines.(Citation: MSTIC Nobelium Oct 2021)
Near-miss passage: T1569.001 Launchctl. Tactics: execution. Description: Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.(Citation: Launchctl Man) Adversaries use launchctl to execute commands and programs as [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s. Common subcommands include: <code>launchctl load</code>,<code>launchctl unload</code>, and <code>launchctl start</code>. Adversaries can use scripts or manually run the commands <code>launchctl load -w "%s/Library/LaunchAgents/%s"</code> or <code>/bin/launchctl load</code> to execute [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s.(Citation: Sofacy Komplex Trojan)(Citation: 20 macOS Common Tools and Techniques)
Query: CVE similar to CVE-2015-1735
Matching passage: CVE-2015-1735. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1740, CVE-2015-1744, CVE-2015-1745, and CVE-2015-1766.
Near-miss passage: CVE-2015-5747. CWE: CWE-399. CVSS: 4.900000095367432. The fasttrap driver in the kernel in Apple OS X before 10.10.5 allows local users to cause a denial of service (resource consumption) via unspecified vectors.
Query: detection rule: Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering
Matching passage: Sigma rule: Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering. Logsource: windows / process_creation. Rule: title: Sysinternals PsService Execution id: 3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f status: test description: Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering references: - https://learn.microsoft.com/en-us/sysinternals/downloads/psservice author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-16 modified: 2026-06-29 tags: - attack.privilege-escalation - attack.discovery - attack.persistence - attack.t1543.003 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: psservice.exe - Image|endswith: - \PsService.exe - \PsService64.exe - \PsService64a.exe condition: selection falsepositives: - Legitimate use of PsService by an administrator level: medium
Near-miss passage: Sigma rule: Detect changes of syslog daemons configuration files. Logsource: linux / auditd. Rule: title: Logging Configuration Changes on Linux Host id: c830f15d-6f6e-430f-8074-6f73d6807841 status: test description: Detect changes of syslog daemons configuration files references: - self experience author: Mikhail Larin, oscd.community date: 2019-10-25 modified: 2021-11-27 tags: - attack.defense-impairment - attack.t1685 logsource: product: linux service: auditd detection: selection: type: PATH name: - /etc/syslog.conf - /etc/rsyslog.conf - /etc/syslog-ng/syslog-ng.conf condition: selection falsepositives: - Legitimate administrative activity level: high
Query: Multiple failed authentications followed by Electron Applications
Matching passage: T1218.015 Electron Applications. Tactics: stealth. Description: Adversaries may abuse components of the Electron framework to execute malicious code. The Electron framework hosts many common applications such as Signal, Slack, and Microsoft Teams.(Citation: Electron 2) Originally developed by GitHub, Electron is a cross-platform desktop application development framework that employs web technologies like JavaScript, HTML, and CSS.(Citation: Electron 3) The Chromium engine is used to display web content and Node.js runs the backend code.(Citation: Electron 1) Due to the functional mechanics of Electron (such as allowing apps to run arbitrary commands), adversaries may also be able to perform malicious functions in the background potentially disguised as legitimate tools within the framework.(Citation: Electron 1) For example, the abuse of `teams.exe` and `chrome.exe` may allow adversaries to execute malicious commands as child processes of the legitimate application (e.g., `chrome.exe --disable-gpu-sandbox --gpu-launcher="C:\Windows\system32\cmd.exe /c calc.exe`).(Citation: Electron 6-8) Adversaries may also execute malicious content by planting malicious [JavaScript](https://attack.mitre.org/techniques/T1059/007) within Electron applications.(Citation: Electron Security)
Near-miss passage: T1218.009 Regsvcs/Regasm. Tactics: stealth. Description: Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) assemblies. Both are binaries that may be digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm) Both utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: <code>[ComRegisterFunction]</code> or <code>[ComUnregisterFunction]</code> respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute. (Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm)
Query: Sigma rule for Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery
Matching passage: Sigma rule: Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery. Logsource: linux / process_creation. Rule: title: Docker Container Discovery Via Dockerenv Listing id: 11701de9-d5a5-44aa-8238-84252f131895 status: test description: Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery references: - https://blog.skyplabs.net/posts/container-detection/ - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker tags: - attack.discovery - attack.t1082 author: Seth Hanford date: 2023-08-23 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /cat - /dir - /find - /ls - /stat - /test - grep CommandLine|endswith: .dockerenv condition: selection falsepositives: - Legitimate system administrator usage of these commands - Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered level: low
Near-miss passage: Sigma rule: Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a UAC bypass attempt. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Event Viewer Child Process id: be344333-921d-4c4d-8bb8-e584cf584780 related: - id: 7c81fec3-1c1d-43b0-996a-46753041b1b6 type: derived status: test description: Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a UAC bypass attempt references: - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ - https://www.hybrid-analysis.com/sample/e122bc8bf291f15cab182a5d2d27b8db1e7019e4e96bb5cdbd1dfe7446f3f51f?environmentId=100 author: Florian Roth (Nextron Systems) date: 2017-03-19 modified: 2023-09-28 tags: - attack.privilege-escalation - attack.t1548.002 - car.2019-04-001 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \eventvwr.exe filter_main_generic: Image|endswith: - :\Windows\System32\mmc.exe - :\Windows\System32\WerFault.exe - :\Windows\SysWOW64\WerFault.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high