alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: playbook for alert: Suspicious Stage Capabilities execution detected on endpoint
Matching passage: Playbook for T1608 Stage Capabilities. 1) Validate alert telemetry against T1608. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: resource development. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed ([Develop Capabilities](https://attack.mitre.org/techniques/T1587)) or obtained ([Obtain Capabilities](https://attack.mitre.org/techniques/T1588)) and stage them on infrastructure under their control. These capab
Near-miss passage: Playbook for T1608.002 Upload Tool. Different response path focused on resource development.
Query: Sigma rule for Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image based detection
Matching passage: Sigma rule: Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image based detection. Logsource: windows / process_creation. Rule: title: Use NTFS Short Name in Image id: 3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b related: - id: dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795 type: similar status: test description: Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image based detection references: - https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/ - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10) - https://twitter.com/jonasLyk/status/1555914501802921984 author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-08-06 modified: 2023-07-20 tags: - attack.stealth - attack.t1564.004 logsource: category: process_creation product: windows detection: selection: Image|contains: - ~1.bat - ~1.dll - ~1.exe - ~1.hta - ~1.js - ~1.msi - ~1.ps1 - ~1.tmp - ~1.vbe - ~1.vbs - ~2.bat - ~2.dll - ~2.exe - ~2.hta - ~2.js - ~2.msi - ~2.ps1 - ~2.tmp - ~2.vbe - ~2.vbs filter_main_generic_parent: ParentImage: C:\Windows\explorer.exe filter_optional_webex: ParentImage|endswith: \WebEx\WebexHost.exe filter_optional_thor: ParentImage|endswith: \thor\thor64.exe filter_optional_winzip: Image: C:\PROGRA~1\WinZip\WZPREL~1.EXE filter_optional_vcred: Image|endswith: \VCREDI~1.EXE condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Software Installers level: medium
Near-miss passage: Sigma rule: Detects when there is a interruption in the authentication process.. Logsource: azure / signinlogs. Rule: title: Azure Unusual Authentication Interruption id: 8366030e-7216-476b-9927-271d79f13cf3 status: test description: Detects when there is a interruption in the authentication process. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts author: Austin Songer @austinsonger date: 2021-11-26 modified: 2022-12-18 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 logsource: product: azure service: signinlogs detection: selection_50097: ResultType: 50097 ResultDescription: Device authentication is required selection_50155: ResultType: 50155 ResultDescription: DeviceAuthenticationFailed selection_50158: ResultType: 50158 ResultDescription: ExternalSecurityChallenge - External security challenge was not satisfied condition: 1 of selection_* falsepositives: - Unknown level: medium
Query: exploit The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files.
Matching passage: CVE-2015-9338. CWE: CWE-434. CVSS: 7.5. The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files.
Near-miss passage: CVE-2015-9228. CWE: CWE-434. CVSS: 8.800000190734863. In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php.
Query: exploit Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to execute arbitrary code via a crafted Enhanced 
Matching passage: CVE-2015-1645. CWE: CWE-94. CVSS: 9.300000190734863. Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to execute arbitrary code via a crafted Enhanced Metafile (EMF) image, aka "EMF Processing Remote Code Execution Vulnerability."
Near-miss passage: CVE-2015-8351. CWE: CWE-94. CVSS: 9.0. PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_include is enabled, allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to frontend/captcha/ajaxresponse.php. NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences regardless of whether allow_url_include is enabled.
Query: explain CWE-788
Matching passage: CWE-788 Access of Memory Location After End of Buffer. The product reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer.
Near-miss passage: CWE-1293 Missing Source Correlation of Multiple Independent Data. The product relies on one source of data, preventing the ability to detect if an adversary has compromised a data source.
Query: CVE similar to CVE-2015-8531
Matching passage: CVE-2015-8531. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in IBM Security Access Manager for Web 8.0 before 8.0.1.3 IF4 and 9.0 before 9.0.0.1 IF1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-1866. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Ember.js 1.10.x before 1.10.1 and 1.11.x before 1.11.2.
Query: risk of The integrated management service on Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware before SS4.4.4624.35, WIN70xx devices with 
Matching passage: CVE-2015-1448. CWE: CWE-264. CVSS: 10.0. The integrated management service on Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware before SS4.4.4624.35, WIN70xx devices with firmware before BS4.4.4621.32, and WIN72xx devices with firmware before BS4.4.4621.32 allows remote attackers to bypass authentication and perform administrative actions via unspecified vectors.
Near-miss passage: CVE-2015-4161. CWE: CWE-264. CVSS: 7.5. SAP Afaria does not properly restrict access to unspecified functionality, which allows remote attackers to obtain sensitive information, gain privileges, or have other unspecified impact via unknown vectors, SAP Security Note 2155690.
Query: SIEM correlation: discovery activity consistent with Peripheral Device Discovery
Matching passage: T1120 Peripheral Device Discovery. Tactics: discovery. Description: Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.(Citation: Peripheral Discovery Linux)(Citation: Peripheral Discovery macOS) Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Near-miss passage: T1087.002 Domain Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges. Commands such as <code>net user /domain</code> and <code>net group /domain</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscacheutil -q group</code> on macOS, and <code>ldapsearch</code> on Linux can list domain users and groups. [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets including <code>Get-ADUser</code> and <code>Get-ADGroupMember</code> may enumerate members of Active Directory groups.(Citation: CrowdStrike StellarParticle January 2022)
Query: detect Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltrati in logs
Matching passage: Sigma rule: Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltrati. Logsource: windows / file_event. Rule: title: NTDS Exfiltration Filename Patterns id: 3a8da4e0-36c1-40d2-8b29-b3e890d5172a status: test description: Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltration. references: - https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/post/windows/gather/ntds_grabber.rb - https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/data/post/powershell/NTDSgrab.ps1 - https://github.com/SecureAuthCorp/impacket/blob/7d2991d78836b376452ca58b3d14daa61b67cb40/impacket/examples/secretsdump.py#L2405 author: Florian Roth (Nextron Systems) date: 2022-03-11 modified: 2023-05-05 tags: - attack.credential-access - attack.t1003.003 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \All.cab - .ntds.cleartext condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of Rundll32.exe with DLL files masquerading as image files. Logsource: windows / process_creation. Rule: title: Suspicious Rundll32 Execution With Image Extension id: 4aa6040b-3f28-44e3-a769-9208e5feb5ec related: - id: 089fc3d2-71e8-4763-a8a5-c97fbb0a403e type: similar status: test description: Detects the execution of Rundll32.exe with DLL files masquerading as image files references: - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution author: Hieu Tran date: 2023-03-13 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.exe selection_cli: CommandLine|contains: - .bmp - .cr2 - .eps - .gif - .ico - .jpeg - .jpg - .nef - .orf - .png - .raw - .sr2 - .tif - .tiff condition: all of selection_* falsepositives: - Unknown level: high
Query: weakness Files or Directories Accessible to External Parties
Matching passage: CWE-552 Files or Directories Accessible to External Parties. The product makes files or directories accessible to unauthorized actors, even though they should not be.
Near-miss passage: CWE-460 Improper Cleanup on Thrown Exception. The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.
Query: CVE similar to CVE-2015-0574
Matching passage: CVE-2015-0574. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, the validation of filesystem access was insufficient.
Near-miss passage: CVE-2015-1492. CWE: CWE-20. CVSS: 8.5. Untrusted search path vulnerability in the client in Symantec Endpoint Protection 12.1 before 12.1-RU6-MP1 allows local users to gain privileges via a Trojan horse DLL in a client install package.
Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery. Logsource: linux / process_creation. Rule: title: Docker Container Discovery Via Dockerenv Listing id: 11701de9-d5a5-44aa-8238-84252f131895 status: test description: Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery references: - https://blog.skyplabs.net/posts/container-detection/ - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker tags: - attack.discovery - attack.t1082 author: Seth Hanford date: 2023-08-23 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /cat - /dir - /find - /ls - /stat - /test - grep CommandLine|endswith: .dockerenv condition: selection falsepositives: - Legitimate system administrator usage of these commands - Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered level: low
Near-miss passage: Sigma rule: Detects usage of the 'chattr' utility to remove immutable file attribute.. Logsource: linux / process_creation. Rule: title: Remove Immutable File Attribute id: 34979410-e4b5-4e5d-8cfb-389fdff05c12 related: - id: a5b977d6-8a81-4475-91b9-49dbfcd941f7 type: derived status: test description: Detects usage of the 'chattr' utility to remove immutable file attribute. references: - https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-15 tags: - attack.defense-impairment - attack.t1222.002 logsource: product: linux category: process_creation detection: selection: Image|endswith: /chattr CommandLine|contains: ' -i ' condition: selection falsepositives: - Administrator interacting with immutable files (e.g. for instance backups). level: medium
Query: CVE similar to CVE-2015-5503
Matching passage: CVE-2015-5503. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the Chamilo integration module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified parameters.
Near-miss passage: CVE-2015-4823. CWE: UNKNOWN. CVSS: 1.2000000476837158. Unspecified vulnerability in the Hyperion Installation Technology component in Oracle Hyperion 11.1.2.3 allows local users to affect confidentiality via unknown vectors related to Essbase Rapid Deploy.
Query: mitigate Systemd Timers
Matching passage: T1053.006 Systemd Timers. Tactics: execution, persistence, privilege escalation. Description: Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. Systemd timers are unit files with file extension <code>.timer</code> that control services. Timers can be set to run on a calendar event or after a time span relative to a starting point. They can be used as an alternative to [Cron](https://attack.mitre.org/techniques/T1053/003) in Linux environments.(Citation: archlinux Systemd Timers Aug 2020) Systemd timers may be activated remotely via the <code>systemctl</code> command line utility, which operates over [SSH](https://attack.mitre.org/techniques/T1021/004).(Citation: Systemd Remote Control) Each <code>.timer</code> file must have a corresponding <code>.service</code> file with the same name, e.g., <code>example.timer</code> and <code>example.service</code>. <code>.service</code> files are [Systemd Service](https://attack.mitre.org/techniques/T1543/002) unit files that are managed by the systemd system and service manager.(Citation: Linux man-pages: systemd January 2014) Privileged timers are written to <code>/etc/systemd/system/</code> and <code>/usr/lib/systemd/system</code> while user level are written to <code>~/.config/systemd/user/</code>. An adversary may use systemd timers to execute malicious code at system startup or on a scheduled basis for persistence.(Citation: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018)(Citation: gist Arch package compromise 10JUL2018)(Citation: acroread package compromised Arch Linux Mail 8JUL2018) Timers installed using privileged paths may be used to maintain root level persistence. Adversaries may also install user level timers to achieve user level persistence.(Citation: Falcon Sandbox smp: 28553b3a9d)
Near-miss passage: T1053.007 Container Orchestration Job. Tactics: execution, persistence, privilege escalation. Description: Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster. In Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks.(Citation: Kubernetes Jobs)(Citation: Kubernetes CronJob) An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in various nodes within a cluster.(Citation: Threat Matrix for Kubernetes)
Query: CVE similar to CVE-2015-2338
Matching passage: CVE-2015-2338. CWE: CWE-399. CVSS: 6.099999904632568. TPview.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory, which allows guest OS users to cause a host OS denial of service via unspecified vectors, a different vulnerability than CVE-2015-2339.
Near-miss passage: CVE-2015-4145. CWE: CWE-399. CVSS: 5.0. The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate a fragment is already being processed, which allows remote attackers to cause a denial of service (memory leak) via a crafted message.
Query: patch priority for CVE-2015-3083
Matching passage: CVE-2015-3083. CWE: CWE-264. CVSS: 6.400000095367432. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow remote attackers to bypass intended restrictions on filesystem write operations via unspecified vectors, a different vulnerability than CVE-2015-3082 and CVE-2015-3085.
Near-miss passage: CVE-2015-7062. CWE: CWE-264. CVSS: 4.599999904632568. Apple OS X before 10.11.2 and tvOS before 9.1 allow local users to bypass intended configuration-profile installation restrictions via unspecified vectors.
Query: vulnerability: The Newphoria Koritore application before 1.1 for Android and before 1.1 for iOS allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecifi
Matching passage: CVE-2015-5635. CWE: CWE-264. CVSS: 6.800000190734863. The Newphoria Koritore application before 1.1 for Android and before 1.1 for iOS allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
Near-miss passage: CVE-2015-3083. CWE: CWE-264. CVSS: 6.400000095367432. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow remote attackers to bypass intended restrictions on filesystem write operations via unspecified vectors, a different vulnerability than CVE-2015-3082 and CVE-2015-3085.
Query: vulnerability: Skia, as used in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a cra
Matching passage: CVE-2015-6617. CWE: CWE-119. CVSS: 9.300000190734863. Skia, as used in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23648740.
Near-miss passage: CVE-2015-3868. CWE: CWE-119. CVSS: 10.0. libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23270724.
Query: alert when Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell.
Matching passage: Sigma rule: Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell.. Logsource: linux / process_creation. Rule: title: OMIGOD SCX RunAsProvider ExecuteScript id: 6eea1bf6-f8d2-488a-a742-e6ef6c1b67db status: test description: 'Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite. ' references: - https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure - https://github.com/Azure/Azure-Sentinel/pull/3059 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC date: 2021-10-15 modified: 2022-10-05 tags: - attack.privilege-escalation - attack.initial-access - attack.execution - attack.t1068 - attack.t1190 - attack.t1203 logsource: product: linux category: process_creation detection: selection: User: root LogonId: 0 CurrentDirectory: /var/opt/microsoft/scx/tmp CommandLine|contains: /etc/opt/microsoft/scx/conf/tmpdir/scx condition: selection falsepositives: - Legitimate use of SCX RunAsProvider ExecuteScript. level: high
Near-miss passage: Sigma rule: Detects loaded kernel modules that did not meet the WHQL signing requirements.. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Unmet WHQL Requirements For Loaded Kernel Module id: 2f8cd7a0-9d5a-4f62-9f8b-2c951aa0dd1f status: test description: Detects loaded kernel modules that did not meet the WHQL signing requirements. references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-06 modified: 2023-06-14 tags: - attack.privilege-escalation logsource: product: windows service: codeintegrity-operational detection: selection: EventID: - 3082 - 3083 filter_optional_vmware: FileNameBuffer: - system32\drivers\vsock.sys - System32\drivers\vmci.sys condition: selection and not 1 of filter_optional_* falsepositives: - Unlikely level: high