alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: campaign using NTDS
Matching passage: T1003.003 NTDS. Tactics: credential access. Description: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.(Citation: Wikipedia Active Directory) In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that contain the same or similar information.(Citation: Metcalf 2015) The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes. * Volume Shadow Copy * secretsdump.py * Using the in-built Windows tool, ntdsutil.exe * Invoke-NinjaCopy
Near-miss passage: T1003 OS Credential Dumping. Tactics: credential access. Description: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures.(Citation: Brining MimiKatz to Unix) Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.
Query: intelligence brief on T1037.004
Matching passage: T1037.004 RC Scripts. Tactics: persistence, privilege escalation. Description: Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify. Adversaries may establish persistence by adding a malicious binary path or shell commands to <code>rc.local</code>, <code>rc.common</code>, and other RC scripts specific to the Unix-like distribution.(Citation: IranThreats Kittens Dec 2017)(Citation: Intezer HiddenWasp Map 2019) Upon reboot, the system executes the script's contents as root, resulting in persistence. Adversary abuse of RC scripts is especially effective for lightweight Unix-like distributions using the root user as default, such as ESXi hypervisors, IoT, or embedded systems.(Citation: intezer-kaiji-malware) As ESXi servers store most system files in memory and therefore discard changes on shutdown, leveraging `/etc/rc.local.d/local.sh` is one of the few mechanisms for enabling persistence across reboots.(Citation: Juniper Networks ESXi Backdoor 2022) Several Unix-like systems have moved to Systemd and deprecated the use of RC scripts. This is now a deprecated mechanism in macOS in favor of Launchd.(Citation: Apple Developer Doco Archive Launchd)(Citation: Startup Items) This technique can be used on Mac OS X Panther v10.3 and earlier versions which still execute the RC scripts.(Citation: Methods of Mac Malware Persistence) To maintain backwards compatibility some systems, such as Ubuntu, will execute the RC scripts if they exist with the correct file permissions.(Citation: Ubuntu Manpage systemd rc)
Near-miss passage: T1037.003 Network Logon Script. Tactics: persistence, privilege escalation. Description: Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence. Network logon scripts can be assigned using Active Directory or Group Policy Objects.(Citation: Petri Logon Script AD) These logon scripts run with the privileges of the user they are assigned to. Depending on the systems within the network, initializing one of these scripts could apply to more than one or potentially all systems. Adversaries may use these scripts to maintain persistence on a network. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
Query: CVE similar to CVE-2015-8999
Matching passage: CVE-2015-8999. CWE: CWE-119. CVSS: 7.800000190734863. In TrustZone a buffer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel while loading an ELF file.
Near-miss passage: CVE-2015-7089. CWE: CWE-119. CVSS: 6.599999904632568. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
Query: describe CVE-2015-5188
Matching passage: CVE-2015-5188. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitrary changes to an instance via vectors involving a file upload using a multipart/form-data submission.
Near-miss passage: CVE-2015-8814. CWE: CWE-352. CVSS: 8.800000190734863. Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks as demonstrated by editing user account information in the templates.asmx.cs file.
Query: write Sigma for Detect file time attribute change to hide new or changes to existing files
Matching passage: Sigma rule: Detect file time attribute change to hide new or changes to existing files. Logsource: macos / process_creation. Rule: title: File Time Attribute Change id: 88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0 status: test description: Detect file time attribute change to hide new or changes to existing files references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md author: Igor Fits, Mikhail Larin, oscd.community date: 2020-10-19 modified: 2022-01-12 tags: - attack.stealth - attack.t1070.006 logsource: product: macos category: process_creation detection: selection: Image|endswith: /touch CommandLine|contains: - -t - -acmr - -d - -r condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the creation of files that look like exports of the local SAM (Security Account Manager). Logsource: windows / file_event. Rule: title: Potential SAM Database Dump id: 4e87b8e2-2ee9-4b2a-a715-4727d297ece0 status: test description: Detects the creation of files that look like exports of the local SAM (Security Account Manager) references: - https://github.com/search?q=CVE-2021-36934 - https://web.archive.org/web/20210725081645/https://github.com/cube0x0/CVE-2021-36934 - https://www.google.com/search?q=%22reg.exe+save%22+sam - https://github.com/HuskyHacks/ShadowSteal - https://github.com/FireFart/hivenightmare author: Florian Roth (Nextron Systems) date: 2022-02-11 modified: 2023-01-05 tags: - attack.credential-access - attack.t1003.002 logsource: product: windows category: file_event detection: selection: - TargetFilename|endswith: - \Temp\sam - \sam.sav - \Intel\sam - \sam.hive - \Perflogs\sam - \ProgramData\sam - \Users\Public\sam - \AppData\Local\sam - \AppData\Roaming\sam - _ShadowSteal.zip - \Documents\SAM.export - :\sam - TargetFilename|contains: - \hive_sam_ - \sam.save - \sam.export - \~reg_sam.save - \sam_backup - \sam.bck - \sam.backup condition: selection falsepositives: - Rare cases of administrative activity level: high
Query: Sigma rule for An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities
Matching passage: Sigma rule: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities. Logsource: windows / process_creation. Rule: title: Compress Data and Lock With Password for Exfiltration With 7-ZIP id: 9fbf5927-5261-4284-a71d-f681029ea574 status: test description: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md author: frack113 date: 2021-07-27 modified: 2026-06-05 tags: - attack.collection - attack.t1560.001 logsource: category: process_creation product: windows detection: selection_img: - Description|contains: 7-Zip - Image|endswith: - \7z.exe - \7zr.exe - \7za.exe - OriginalFileName: - 7z.exe - 7za.exe - 7zr.exe selection_password: CommandLine|contains: ' -p' selection_action: CommandLine|contains: - ' a ' - ' u ' condition: all of selection_* falsepositives: - Legitimate activity is expected since compressing files with a password is common. level: medium
Near-miss passage: Sigma rule: Detects potential suspicious applet or osascript executing "osacompile".. Logsource: macos / process_creation. Rule: title: Osacompile Execution By Potentially Suspicious Applet/Osascript id: a753a6af-3126-426d-8bd0-26ebbcb92254 status: test description: Detects potential suspicious applet or osascript executing "osacompile". references: - https://redcanary.com/blog/mac-application-bundles/ author: Sohan G (D4rkCiph3r), Red Canary (Idea) date: 2023-04-03 tags: - attack.execution - attack.t1059.002 logsource: category: process_creation product: macos detection: selection: ParentImage|endswith: - /applet - /osascript CommandLine|contains: osacompile condition: selection falsepositives: - Unknown level: medium
Query: risk of Cross-site request forgery (CSRF) vulnerability in Cisco FireSIGHT System Software 5.4.1.2 and 6.0.0 in FireSIGHT Management Center allows remote attackers to hijack the authentica
Matching passage: CVE-2015-4242. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco FireSIGHT System Software 5.4.1.2 and 6.0.0 in FireSIGHT Management Center allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu94721.
Near-miss passage: CVE-2015-7610. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF token.
Query: risk of The bsdinstall installer in FreeBSD 10.x before 10.1 p9, when configuring full disk encrypted ZFS, uses world-readable permissions for the GELI keyfile (/boot/encryption.key), whic
Matching passage: CVE-2015-1415. CWE: CWE-200. CVSS: 2.0999999046325684. The bsdinstall installer in FreeBSD 10.x before 10.1 p9, when configuring full disk encrypted ZFS, uses world-readable permissions for the GELI keyfile (/boot/encryption.key), which allows local users to obtain sensitive key information by reading the file.
Near-miss passage: CVE-2015-6706. CWE: CWE-200. CVSS: 5.0. Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2015-5583, CVE-2015-6705, and CVE-2015-7624.
Query: vulnerability: Multiple insecure Temporary File vulnerabilities in 389 Administration Server before 1.1.38.
Matching passage: CVE-2015-0233. CWE: CWE-254. CVSS: 4.199999809265137. Multiple insecure Temporary File vulnerabilities in 389 Administration Server before 1.1.38.
Near-miss passage: CVE-2015-6498. CWE: CWE-254. CVSS: 7.5. Alcatel-Lucent Home Device Manager before 4.1.10, 4.2.x before 4.2.2 allows remote attackers to spoof and make calls as target devices.
Query: Sigma rule for Detects disabling of Multi Factor Authentication.
Matching passage: Sigma rule: Detects disabling of Multi Factor Authentication.. Logsource: m365 / audit. Rule: title: Disabling Multi Factor Authentication id: 60de9b57-dc4d-48b9-a6a0-b39e0469f876 status: test description: Detects disabling of Multi Factor Authentication. references: - https://research.splunk.com/cloud/c783dd98-c703-4252-9e8a-f19d9f5c949e/ author: Splunk Threat Research Team (original rule), Harjot Singh @cyb3rjy0t (sigma rule) date: 2023-09-18 tags: - attack.persistence - attack.credential-access - attack.defense-impairment - attack.t1556.006 logsource: service: audit product: m365 detection: selection: Operation|contains: Disable Strong Authentication. condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.. Logsource: windows / registry_set. Rule: title: PowerShell Script Execution Policy Enabled id: 8218c875-90b9-42e2-b60d-0b0069816d10 related: - id: fad91067-08c5-4d1a-8d8c-d96a21b37814 type: derived status: test description: Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed. references: - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.PowerShell::EnableScripts author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo date: 2023-10-18 tags: - attack.execution logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Policies\Microsoft\Windows\PowerShell\EnableScripts Details: DWORD (0x00000001) condition: selection falsepositives: - Likely level: low
Query: Multiple failed authentications followed by Local Groups
Matching passage: T1069.001 Local Groups. Tactics: discovery. Description: Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group. Commands such as <code>net localgroup</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscl . -list /Groups</code> on macOS, and <code>groups</code> on Linux can list local groups.
Near-miss passage: T1069.003 Cloud Groups. Tactics: discovery. Description: Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group. With authenticated access there are several tools that can be used to find permissions groups. The <code>Get-MsolRole</code> PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts (Citation: Microsoft Msolrole)(Citation: GitHub Raindance). Azure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups. The command <code>az ad user get-member-groups</code> will list groups associated to a user account for Azure while the API endpoint <code>GET https://cloudidentity.googleapis.com/v1/groups</code> lists group resources available to a user for Google.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: Google Cloud Identity API Documentation) In AWS, the commands `ListRolePolicies` and `ListAttachedRolePolicies` allow users to enumerate the policies attached to a role.(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022) Adversaries may attempt to list ACLs for objects to determine the owner and other accounts with access to the object, for example, via the AWS <code>GetBucketAcl</code> API (Citation: AWS Get Bucket ACL). Using this information an adversary can target accounts with permissions to a given object or leverage accounts they have already compromised to access the object.
Query: CVE similar to CVE-2015-2000
Matching passage: CVE-2015-2000. CWE: CWE-118. CVSS: 9.800000190734863. The Jumio SDK before 1.5.0 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
Near-miss passage: CVE-2015-2003. CWE: CWE-118. CVSS: 9.800000190734863. The PJSIP PJSUA2 SDK before SVN Changeset 51322 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
Query: vulnerability: Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2, when using the ML2 plugin or the security groups AMQP API, allows remote authenticated users to bypa
Matching passage: CVE-2015-5240. CWE: CWE-362. CVSS: 3.5. Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2, when using the ML2 plugin or the security groups AMQP API, allows remote authenticated users to bypass IP anti-spoofing controls by changing the device owner of a port to start with network: before the security group rules are applied.
Near-miss passage: CVE-2015-7613. CWE: CWE-362. CVSS: 6.900000095367432. Race condition in the IPC object implementation in the Linux kernel through 4.2.3 allows local users to gain privileges by triggering an ipc_addid call that leads to uid and gid comparisons against uninitialized data, related to msg.c, shm.c, and util.c.
Query: actor TTPs: Domain Fronting
Matching passage: T1090.004 Domain Fronting. Tactics: command and control. Description: Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. (Citation: Fifield Blocking Resistent Communication through domain fronting 2015) Domain fronting involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation of the the technique, "domainless" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored). For example, if domain-x and domain-y are customers of the same CDN, it is possible to place domain-x in the TLS header and domain-y in the HTTP header. Traffic will appear to be going to domain-x, however the CDN may route it to domain-y.
Near-miss passage: T1090 Proxy. Tactics: command and control. Description: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.
Query: telemetry for T1553.006
Matching passage: T1553.006 Code Signing Policy Modification. Tactics: defense impairment. Description: Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. Code signing provides a level of authenticity on a program from a developer and a guarantee that the program has not been tampered with. Security controls can include enforcement mechanisms to ensure that only valid, signed code can be run on an operating system. Some of these security controls may be enabled by default, such as Driver Signature Enforcement (DSE) on Windows or System Integrity Protection (SIP) on macOS.(Citation: Microsoft DSE June 2017)(Citation: Apple Disable SIP) Other such controls may be disabled by default but are configurable through application controls, such as only allowing signed Dynamic-Link Libraries (DLLs) to execute on a system. Since it can be useful for developers to modify default signature enforcement policies during the development and testing of applications, disabling of these features may be possible with elevated permissions.(Citation: Microsoft Unsigned Driver Apr 2017)(Citation: Apple Disable SIP) Adversaries may modify code signing policies in a number of ways, including through use of command-line or GUI utilities, [Modify Registry](https://attack.mitre.org/techniques/T1112), rebooting the computer in a debug/recovery mode, or by altering the value of variables in kernel memory.(Citation: Microsoft TESTSIGNING Feb 2021)(Citation: Apple Disable SIP)(Citation: FireEye HIKIT Rootkit Part 2)(Citation: GitHub Turla Driver Loader) Examples of commands that can modify the code signing policy of a system include <code>bcdedit.exe -set TESTSIGNING ON</code> on Windows and <code>csrutil disable</code> on macOS.(Citation: Microsoft TESTSIGNING Feb 2021)(Citation: Apple Disable SIP) Depending on the implementation, successful modification of a signing policy may require reboot of the compromised system. Additionally, some implementations can introduce visible artifacts for the user (ex: a watermark in the corner of the screen stating the
Near-miss passage: T1553.002 Code Signing. Tactics: defense impairment. Description: Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. (Citation: Wikipedia Code Signing) The certificates used during an operation may be created, acquired, or stolen by the adversary. (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates) Unlike [Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001), this activity will result in a valid signature. Code signing to verify software on first run can be used on modern Windows and macOS systems. It is not used on Linux due to the decentralized nature of the platform. (Citation: Wikipedia Code Signing)(Citation: EclecticLightChecksonEXECodeSigning) Code signing certificates may be used to bypass security policies that require signed code to execute on a system.
Query: exploit Heap-based buffer overflow in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image.
Matching passage: CVE-2015-0848. CWE: CWE-119. CVSS: 6.800000190734863. Heap-based buffer overflow in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image.
Near-miss passage: CVE-2015-3828. CWE: CWE-119. CVSS: 10.0. The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM), which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted 3GPP metadata, aka internal bug 20923261, a related issue to CVE-2015-3826.