alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: how to detect Traffic Duplication
Matching passage: T1020.001 Traffic Duplication. Tactics: exfiltration. Description: Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis. For example, devices may be configured to forward network traffic to one or more destinations for analysis by a network analyzer or other monitoring device. (Citation: Cisco Traffic Mirroring)(Citation: Juniper Traffic Mirroring) Adversaries may abuse traffic mirroring to mirror or redirect network traffic through other infrastructure they control. Malicious modifications to network devices to enable traffic redirection may be possible through [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) or [Patch System Image](https://attack.mitre.org/techniques/T1601/001).(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks) Many cloud-based environments also support traffic mirroring. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to.(Citation: AWS Traffic Mirroring)(Citation: GCP Packet Mirroring)(Citation: Azure Virtual Network TAP) Adversaries may use traffic duplication in conjunction with [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Input Capture](https://attack.mitre.org/techniques/T1056), or [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) depending on the goals and objectives of the adversary.
Near-miss passage: T1020 Automated Exfiltration. Tactics: exfiltration. Description: Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.(Citation: ESET Gamaredon June 2020) When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).
Query: write Sigma for Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel
Matching passage: Sigma rule: Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel. Logsource: windows / registry_set. Rule: title: Disable Windows Event Logging Via Registry id: 2f78da12-f7c7-430b-8b19-a28f269b77a3 status: test description: Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel references: - https://twitter.com/WhichbufferArda/status/1543900539280293889 - https://github.com/DebugPrivilege/CPP/blob/c39d365617dbfbcb01fffad200d52b6239b2918c/Windows%20Defender/RestoreDefenderConfig.cpp author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-07-04 modified: 2024-03-25 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Windows\CurrentVersion\WINEVT\Channels\ TargetObject|endswith: \Enabled Details: DWORD (0x00000000) filter_main_wevutil: Image: C:\Windows\system32\wevtutil.exe filter_main_iis: Image|startswith: C:\Windows\winsxs\ Image|endswith: \TiWorker.exe filter_main_svchost: Image: C:\Windows\System32\svchost.exe TargetObject|contains: - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-FileInfoMinifilter - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ASN1\ - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-AppCompat\ - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Runtime\Error\ - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-CAPI2/Operational\ filter_main_trusted_installer: Image: C:\Windows\servicing\TrustedInstaller.exe TargetObject|contains: \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Compat-Appraiser filter_optional_empty: Image: '' filter_optional_null: Image: null condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Rare falsepositives may occur from legitimate administrators disabling specific event log for troubleshooting level: high
Near-miss passage: Sigma rule: Detects the use of Windows Credential Editor (WCE). Logsource: windows / registry_event. Rule: title: Windows Credential Editor Registry id: a6b33c02-8305-488f-8585-03cb2a7763f2 status: test description: Detects the use of Windows Credential Editor (WCE) references: - https://www.ampliasecurity.com/research/windows-credentials-editor/ author: Florian Roth (Nextron Systems) date: 2019-12-31 modified: 2021-11-27 tags: - attack.credential-access - attack.t1003.001 - attack.s0005 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: Services\WCESERVICE\Start condition: selection falsepositives: - Unknown level: critical
Query: write Sigma for Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-
Matching passage: Sigma rule: Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-. Logsource: windows / process_creation. Rule: title: MMC Executing Files with Reversed Extensions Using RTLO Abuse id: 9cfe4b27-1e56-48b4-b7a8-d46851c91a44 status: experimental description: Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-Left Override (RLO) abuse, disguising them as document formats. references: - https://www.unicode.org/versions/Unicode5.2.0/ch02.pdf - https://en.wikipedia.org/wiki/Right-to-left_override - https://tria.ge/241015-l98snsyeje/behavioral2 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-05 tags: - attack.execution - attack.stealth - attack.t1204.002 - attack.t1218.014 - attack.t1036.002 logsource: category: process_creation product: windows detection: selection_image: - Image|endswith: \mmc.exe - OriginalFileName: MMC.exe selection_commandline: CommandLine|contains: - cod.msc - fdp.msc - ftr.msc - lmth.msc - slx.msc - tdo.msc - xcod.msc - xslx.msc - xtpp.msc condition: all of selection_* falsepositives: - Legitimate administrative actions using MMC to execute misnamed `.msc` files. - Unconventional but non-malicious usage of RLO or reversed extensions. level: high
Near-miss passage: Sigma rule: Detects DNS queries to a TeamViewer domain only resolved by a TeamViewer client by an image that isn't named TeamViewer. Logsource: windows / dns_query. Rule: title: TeamViewer Domain Query By Non-TeamViewer Application id: 778ba9a8-45e4-4b80-8e3e-34a419f0b85e status: test description: Detects DNS queries to a TeamViewer domain only resolved by a TeamViewer client by an image that isn't named TeamViewer (sometimes used by threat actors for obfuscation) references: - https://www.teamviewer.com/en-us/ author: Florian Roth (Nextron Systems) date: 2022-01-30 modified: 2023-09-18 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows category: dns_query detection: selection: QueryName: - taf.teamviewer.com - udp.ping.teamviewer.com filter_main_teamviewer: Image|contains: TeamViewer condition: selection and not 1 of filter_main_* falsepositives: - Unknown binary names of TeamViewer - Depending on the environment the rule might require some initial tuning before usage to avoid FP with third party applications level: medium
Query: Outbound C2 pattern associated with Code Signing Certificates
Matching passage: T1587.002 Code Signing Certificates. Tactics: resource development. Description: Adversaries may create self-signed code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is. Prior to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may develop self-signed code signing certificates for use in operations.
Near-miss passage: T1587.003 Digital Certificates. Tactics: resource development. Description: Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA). Adversaries may create self-signed SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) if added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)). After creating a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control.
Query: describe CVE-2015-4513
Matching passage: CVE-2015-4513. CWE: CWE-119. CVSS: 7.5. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Near-miss passage: CVE-2015-6118. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Office 2007 SP3 and Office 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: weakness Improper Authorization
Matching passage: CWE-285 Improper Authorization. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Near-miss passage: CWE-1259 Improper Restriction of Security Token Assignment. The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected.
Query: alert when Detects Obfuscated Powershell via Stdin in Scripts
Matching passage: Sigma rule: Detects Obfuscated Powershell via Stdin in Scripts. Logsource: windows / system. Rule: title: Invoke-Obfuscation Via Stdin - System id: 487c7524-f892-4054-b263-8a0ace63fc25 status: test description: Detects Obfuscated Powershell via Stdin in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-12 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains|all: - set - '&&' ImagePath|contains: - environment - invoke - input condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to pers. Logsource: windows / bits-client. Rule: title: BITS Transfer Job With Uncommon Or Suspicious Remote TLD id: 6d44fb93-e7d2-475c-9d3d-54c9c1e33427 status: test description: Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md - https://twitter.com/malmoeb/status/1535142803075960832 author: Florian Roth (Nextron Systems) date: 2022-06-10 modified: 2025-02-28 tags: - attack.persistence - attack.execution - attack.stealth - attack.t1197 logsource: product: windows service: bits-client detection: selection: EventID: 16403 filter_main_generic: RemoteName|contains: - .azureedge.net/ - .com/ - .sfx.ms/ - download.mozilla.org/ - cdn.onenote.net/ - cdn.office.net/ - tscdn.m365.static.microsoft/ condition: selection and not 1 of filter_main_* falsepositives: - This rule doesn't exclude other known TLDs such as ".org" or ".net". It's recommended to apply additional filters for software and scripts that leverage the BITS service level: medium
Query: patch priority for CVE-2015-1874
Matching passage: CVE-2015-1874. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.32 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete all plugin records via a request in the CF7DBPluginSubmissions page to wp-admin/admin.php.
Near-miss passage: CVE-2015-0735. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco Unified Customer Voice Portal (CVP) 10.5(1) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut93970.
Query: Suspicious Malicious Link execution detected on endpoint
Matching passage: T1204.001 Malicious Link. Tactics: execution. Description: An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002). Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203). Links may also lead users to download files that require execution via [Malicious File](https://attack.mitre.org/techniques/T1204/002).
Near-miss passage: T1204.002 Malicious File. Tactics: execution. Description: An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001). Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.(Citation: Mandiant Trojanized Windows 10) Adversaries may employ various forms of [Masquerading](https://attack.mitre.org/techniques/T1036) and [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it.(Citation: Password Protected Word Docs) While [Malicious File](https://attack.mitre.org/techniques/T1204/002) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534).
Query: patch priority for CVE-2015-4689
Matching passage: CVE-2015-4689. CWE: CWE-640. CVSS: 9.800000190734863. Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to reset arbitrary passwords via unspecified vectors, aka "Weak Password Reset."
Near-miss passage: CVE-2015-10071. CWE: CWE-640. CVSS: 7.5. A vulnerability was found in gitter-badger ezpublish-modern-legacy. It has been rated as problematic. This issue affects some unknown processing of the file kernel/user/forgotpassword.php. The manipulation leads to weak password recovery. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 1.0 is able to address this issue. The patch is named 5908d5ee65fec61ce0e321d586530461a210bf2a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218951.
Query: Sigma rule for Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe proces
Matching passage: Sigma rule: Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe proces. Logsource: windows / create_remote_thread. Rule: title: Password Dumper Remote Thread in LSASS id: f239b326-2f41-4d6b-9dfa-c846a60ef505 status: stable description: 'Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage. The process in field Process is the malicious program. A single execution can lead to hundreds of events. ' references: - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/WCE.htm author: Thomas Patzke date: 2017-02-19 modified: 2021-06-21 tags: - attack.credential-access - attack.s0005 - attack.t1003.001 logsource: product: windows category: create_remote_thread detection: selection: TargetImage|endswith: \lsass.exe StartModule: '' condition: selection falsepositives: - Antivirus products level: high
Near-miss passage: Sigma rule: Detects DLL sideloading of "dbgcore.dll". Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of DBGCORE.DLL id: 9ca2bf31-0570-44d8-a543-534c47c33ed7 status: test description: Detects DLL sideloading of "dbgcore.dll" references: - https://hijacklibs.net/ author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) date: 2022-10-25 modified: 2025-10-06 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \dbgcore.dll filter_main_generic: ImageLoaded|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SystemTemp\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_optional_steam: ImageLoaded|endswith: \Steam\bin\cef\cef.win7x64\dbgcore.dll filter_optional_opera: ImageLoaded|contains: opera\Opera Installer Temp\opera_package ImageLoaded|endswith: \assistant\dbgcore.dll condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate applications loading their own versions of the DLL mentioned in this rule level: medium
Query: ATT&CK technique for Archive via Utility
Matching passage: T1560.001 Archive via Utility. Tactics: collection. Description: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport. Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as <code>tar</code> on Linux and macOS or <code>zip</code> on Windows systems. On Windows, <code>diantz</code> or <code> makecab</code> may be used to package collected files into a cabinet (.cab) file. <code>diantz</code> may also be used to download and compress files from remote locations (i.e. [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002)).(Citation: diantz.exe_lolbas) <code>xcopy</code> on Windows can copy files and directories with a variety of options. Additionally, adversaries may use [certutil](https://attack.mitre.org/software/S0160) to Base64 encode collected data before exfiltration. Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.(Citation: 7zip Homepage)(Citation: WinRAR Homepage)(Citation: WinZip Homepage)
Near-miss passage: T1560.003 Archive via Custom Method. Tactics: collection. Description: An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.(Citation: ESET Sednit Part 2)
Query: risk of The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a proble
Matching passage: CVE-2015-8103. CWE: CWE-502. CVSS: 9.800000190734863. The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
Near-miss passage: CVE-2015-2020. CWE: CWE-502. CVSS: 9.800000190734863. The MyScript SDK before 1.3 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.