alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: adversary uses Subvert Trust Controls
Matching passage: T1553 Subvert Trust Controls. Tactics: defense impairment. Description: Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site. Adversaries may attempt to subvert these trust mechanisms. The method adversaries use will depend on the specific mechanism they seek to subvert. Adversaries may conduct [File and Directory Permissions Modification](https://attack.mitre.org/techniques/T1222) or [Modify Registry](https://attack.mitre.org/techniques/T1112) in support of subverting these controls.(Citation: SpectorOps Subverting Trust Sept 2017) Adversaries may also create or steal code signing certificates to acquire trust on target systems.(Citation: Securelist Digital Certificates)(Citation: Symantec Digital Certificates)
Near-miss passage: T1553.005 Mark-of-the-Web Bypass. Tactics: defense impairment. Description: Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, when files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named <code>Zone.Identifier</code> with a specific value known as the MOTW.(Citation: Microsoft Zone.Identifier 2020) Files that are tagged with MOTW are protected and cannot perform certain actions. For example, starting in MS Office 10, if a MS Office file has the MOTW, it will open in Protected View. Executables tagged with the MOTW will be processed by Windows Defender SmartScreen that compares files with an allowlist of well-known executables. If the file is not known/trusted, SmartScreen will prevent the execution and warn the user not to run it.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)(Citation: Intezer Russian APT Dec 2020) Adversaries may abuse container files such as compressed/archive (.arj, .gzip) and/or disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW. Container files downloaded from the Internet will be marked with MOTW but the files within may not inherit the MOTW after the container files are extracted and/or mounted. MOTW is a NTFS feature and many container files do not support NTFS alternative data streams. After a container file is extracted and/or mounted, the files contained within them may be treated as local files on disk and run without protections.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)
Query: risk of Cross-site scripting (XSS) vulnerability in user creation in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users t
Matching passage: CVE-2015-7728. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in user creation in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to inject arbitrary web script or HTML via the username, aka SAP Security Note 2153898.
Near-miss passage: CVE-2015-9103. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in Synology Note Station 1.1-0212 and earlier allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) note title or (2) file name of attachments.
Query: patch priority for CVE-2015-0560
Matching passage: CVE-2015-0560. CWE: CWE-19. CVSS: 5.0. The dissect_wccp2r1_address_table_info function in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 does not initialize certain data structures, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Near-miss passage: CVE-2015-0613. CWE: CWE-19. CVSS: 7.099999904632568. The Connection Conversation Manager (aka CuCsMgr) process in Cisco Unity Connection 8.5 before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, 9.x before 9.1(2)SU2, and 10.0 before 10.0(1)SU1, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (core dump and restart) via crafted SIP INVITE messages, aka Bug ID CSCul20444.
Query: threat report mentioning Peripheral Device Discovery
Matching passage: T1120 Peripheral Device Discovery. Tactics: discovery. Description: Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.(Citation: Peripheral Discovery Linux)(Citation: Peripheral Discovery macOS) Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Near-miss passage: T1069.001 Local Groups. Tactics: discovery. Description: Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group. Commands such as <code>net localgroup</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscl . -list /Groups</code> on macOS, and <code>groups</code> on Linux can list local groups.
Query: common weakness: Use of Same Variable for Multiple Purposes
Matching passage: CWE-1109 Use of Same Variable for Multiple Purposes. The code contains a callable, block, or other code element in which the same variable is used to control more than one unique task or store more than one instance of data.
Near-miss passage: CWE-1122 Excessive Halstead Complexity. The code is structured in a way that a Halstead complexity measure exceeds a desirable maximum.
Query: detect Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL. in logs
Matching passage: Sigma rule: Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL.. Logsource: windows / process_creation. Rule: title: C# IL Code Compilation Via Ilasm.EXE id: 850d55f9-6eeb-4492-ad69-a72338f65ba4 status: test description: Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL. references: - https://lolbas-project.github.io/lolbas/Binaries/Ilasm/ - https://www.echotrail.io/insights/search/ilasm.exe author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-05-07 modified: 2022-05-16 tags: - attack.execution - attack.stealth - attack.t1127 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \ilasm.exe - OriginalFileName: ilasm.exe selection_cli: CommandLine|contains: - ' /dll' - ' /exe' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects user agent and URI paths used by empire agents. Logsource: proxy. Rule: title: HackTool - Empire UserAgent URI Combo id: b923f7d6-ac89-4a50-a71a-89fb846b4aa8 status: test description: Detects user agent and URI paths used by empire agents references: - https://github.com/BC-SECURITY/Empire author: Florian Roth (Nextron Systems) date: 2020-07-13 modified: 2024-02-26 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko cs-uri: - /admin/get.php - /news.php - /login/process.php cs-method: POST condition: selection falsepositives: - Valid requests with this exact user agent to server scripts of the defined names level: high
Query: detect Detects potentially suspicious child processes of a ClickOnce deployment application in logs
Matching passage: Sigma rule: Detects potentially suspicious child processes of a ClickOnce deployment application. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Child Process Of ClickOnce Application id: 67bc0e75-c0a9-4cfc-8754-84a505b63c04 status: test description: Detects potentially suspicious child processes of a ClickOnce deployment application references: - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-12 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection: ParentImage|contains: \AppData\Local\Apps\2.0\ Image|endswith: - \calc.exe - \cmd.exe - \cscript.exe - \explorer.exe - \mshta.exe - \net.exe - \net1.exe - \nltest.exe - \notepad.exe - \powershell.exe - \pwsh.exe - \reg.exe - \regsvr32.exe - \rundll32.exe - \schtasks.exe - \werfault.exe - \wscript.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new. Logsource: windows / security. Rule: title: Add or Remove Computer from DC id: 20d96d95-5a20-4cf1-a483-f3bda8a7c037 status: test description: Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new SPN. references: - https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4741 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4743 author: frack113 date: 2022-10-14 tags: - attack.defense-impairment - attack.t1207 logsource: service: security product: windows detection: selection: EventID: - 4741 - 4743 condition: selection falsepositives: - Unknown level: low
Query: risk of WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application cras
Matching passage: CVE-2015-5801. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-8893. CWE: CWE-119. CVSS: 5.5. app/aboot/aboot.c in the Qualcomm bootloader in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices allows attackers to cause a denial of service (OS outage or buffer over-read) via a crafted application, aka Android internal bug 28822690 and Qualcomm internal bug CR822275.
Query: stealth using Asynchronous Procedure Call
Matching passage: T1055.004 Asynchronous Procedure Call. Tactics: stealth, privilege escalation. Description: Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges. APC injection is a method of executing arbitrary code in the address space of a separate live process. APC injection is commonly performed by attaching malicious code to the APC Queue (Citation: Microsoft APC) of a process's thread. Queued APC functions are executed when the thread enters an alterable state.(Citation: Microsoft APC) A handle to an existing victim process is first created with native Windows API calls such as <code>OpenThread</code>. At this point <code>QueueUserAPC</code> can be used to invoke a function (such as <code>LoadLibrayA</code> pointing to a malicious DLL). A variation of APC injection, dubbed "Early Bird injection", involves creating a suspended process in which malicious code can be written and executed before the process' entry point (and potentially subsequent anti-malware hooks) via an APC. (Citation: CyberBit Early Bird Apr 2018) AtomBombing (Citation: ENSIL AtomBombing Oct 2016) is another variation that utilizes APCs to invoke malicious code previously written to the global atom table.(Citation: Microsoft Atom Table) Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via APC injection may also evade detection from security products since the execution is masked under a legitimate process.
Near-miss passage: T1055.014 VDSO Hijacking. Tactics: stealth, privilege escalation. Description: Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process-based defenses as well as possibly elevate privileges. Virtual dynamic shared object (vdso) hijacking is a method of executing arbitrary code in the address space of a separate live process. VDSO hijacking involves redirecting calls to dynamically linked shared libraries. Memory protections may prevent writing executable code to a process via [Ptrace System Calls](https://attack.mitre.org/techniques/T1055/008). However, an adversary may hijack the syscall interface code stubs mapped into a process from the vdso shared object to execute syscalls to open and map a malicious shared object. This code can then be invoked by redirecting the execution flow of the process via patched memory address references stored in a process' global offset table (which store absolute addresses of mapped library functions).(Citation: ELF Injection May 2009)(Citation: Backtrace VDSO)(Citation: VDSO Aug 2005)(Citation: Syscall 2014) Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via VDSO hijacking may also evade detection from security products since the execution is masked under a legitimate process.
Query: vulnerability: The ae_strtofflags function in archive_entry.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file.
Matching passage: CVE-2015-8921. CWE: CWE-125. CVSS: 7.5. The ae_strtofflags function in archive_entry.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file.
Near-miss passage: CVE-2015-8817. CWE: CWE-125. CVSS: 5.5. QEMU (aka Quick Emulator) built to use 'address_space_translate' to map an address to a MemoryRegionSection is vulnerable to an OOB r/w access issue. It could occur while doing pci_dma_read/write calls. Affects QEMU versions >= 1.6.0 and <= 2.3.1. A privileged user inside guest could use this flaw to crash the guest instance resulting in DoS.
Query: exploit In Docker Notary before 0.1, the checkRoot function in gotuf/client/client.go does not check expiry of root.json files, despite a comment stating that it does. Even if a user creat
Matching passage: CVE-2015-9259. CWE: CWE-434. CVSS: 9.800000190734863. In Docker Notary before 0.1, the checkRoot function in gotuf/client/client.go does not check expiry of root.json files, despite a comment stating that it does. Even if a user creates a new root.json file after a key compromise, an attacker can produce update files referring to an old root.json file.
Near-miss passage: CVE-2015-4463. CWE: CWE-434. CVSS: 6.5. The file_manager component in eFront CMS before 3.6.15.5 allows remote authenticated users to bypass intended file-upload restrictions by appending a crafted parameter to the file URL.
Query: CVE similar to CVE-2015-6169
Matching passage: CVE-2015-6169. CWE: CWE-20. CVSS: 4.300000190734863. Microsoft Edge misparses HTTP responses, which allows remote attackers to redirect users to arbitrary web sites via unspecified vectors, aka "Microsoft Edge Spoofing Vulnerability."
Near-miss passage: CVE-2015-2923. CWE: CWE-20. CVSS: 6.5. The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in FreeBSD through 10.1 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message.
Query: patch priority for CVE-2015-7510
Matching passage: CVE-2015-7510. CWE: CWE-119. CVSS: 9.800000190734863. Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.
Near-miss passage: CVE-2015-1257. CWE: CWE-119. CVSS: 7.5. platform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, does not properly handle an insufficient number of values in an feColorMatrix filter, which allows remote attackers to cause a denial of service (container overflow) or possibly have unspecified other impact via a crafted document.
Query: vulnerability: In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in a GERAN API.
Matching passage: CVE-2015-9040. CWE: CWE-284. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in a GERAN API.
Near-miss passage: CVE-2015-3691. CWE: CWE-284. CVSS: 9.300000190734863. The Monitor Control Command Set kernel extension in the Display Drivers subsystem in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages control of a function pointer.
Query: rule covering Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may
Matching passage: Sigma rule: Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may. Logsource: windows / process_creation. Rule: title: Changing Existing Service ImagePath Value Via Reg.EXE id: 9b0b7ac3-6223-47aa-a3fd-e8f211e637db status: test description: 'Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-2---service-imagepath-change-with-regexe author: frack113 date: 2021-12-30 modified: 2024-03-13 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.011 logsource: category: process_creation product: windows detection: selection: Image|endswith: \reg.exe CommandLine|contains|all: - 'add ' - SYSTEM\CurrentControlSet\Services\ - ' ImagePath ' selection_value: CommandLine|contains|windash: ' -d ' condition: all of selection* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit. Logsource: windows / msexchange-management. Rule: title: Remove Exported Mailbox from Exchange Webserver id: 09570ae5-889e-43ea-aac0-0e1221fb3d95 status: test description: Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit references: - https://github.com/rapid7/metasploit-framework/blob/1416b5776d963f21b7b5b45d19f3e961201e0aed/modules/exploits/windows/http/exchange_proxyshell_rce.rb#L430 author: Christian Burkard (Nextron Systems) date: 2021-08-27 modified: 2023-01-23 tags: - attack.stealth - attack.t1070 logsource: service: msexchange-management product: windows detection: keywords: '|all': - Remove-MailboxExportRequest - ' -Identity ' - ' -Confirm "False"' condition: keywords falsepositives: - Unknown level: high
Query: execution using JavaScript
Matching passage: T1059.007 JavaScript. Tactics: execution. Description: Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.(Citation: NodeJS) JScript is the Microsoft implementation of the same scripting standard. JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and Internet Explorer HTML Application (HTA) pages.(Citation: JScrip May 2018)(Citation: Microsoft JScript 2007)(Citation: Microsoft Windows Scripts) JavaScript for Automation (JXA) is a macOS scripting language based on JavaScript, included as part of Apple’s Open Scripting Architecture (OSA), that was introduced in OSX 10.10. Apple’s OSA provides scripting capabilities to control applications, interface with the operating system, and bridge access into the rest of Apple’s internal APIs. As of OSX 10.10, OSA only supports two languages, JXA and [AppleScript](https://attack.mitre.org/techniques/T1059/002). Scripts can be executed via the command line utility <code>osascript</code>, they can be compiled into applications or script files via <code>osacompile</code>, and they can be compiled and executed in memory of other programs by leveraging the OSAKit Framework.(Citation: Apple About Mac Scripting 2016)(Citation: SpecterOps JXA 2020)(Citation: SentinelOne macOS Red Team)(Citation: Red Canary Silver Sparrow Feb2021)(Citation: MDSec macOS JXA and VSCode) Adversaries may abuse various implementations of JavaScript to execute various behaviors. Common uses include hosting malicious scripts on websites as part of a [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) or downloading and executing these script files as secondary payloads. Since these payloads are text-based, it is also very common for a
Near-miss passage: T1059.010 AutoHotKey & AutoIT. Tactics: execution. Description: Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages that enable users to automate Windows tasks. These automation scripts can be used to perform a wide variety of actions, such as clicking on buttons, entering text, and opening and closing programs.(Citation: AutoIT)(Citation: AutoHotKey) Adversaries may use AHK (`.ahk`) and AutoIT (`.au3`) scripts to execute malicious code on a victim's system. For example, adversaries have used for AHK to execute payloads and other modular malware such as keyloggers. Adversaries have also used custom AHK files containing embedded malware as [Phishing](https://attack.mitre.org/techniques/T1566) payloads.(Citation: Splunk DarkGate) These scripts may also be compiled into self-contained executable payloads (`.exe`).(Citation: AutoIT)(Citation: AutoHotKey)
Query: vulnerability: PDFium, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
Matching passage: CVE-2015-1225. CWE: CWE-119. CVSS: 5.0. PDFium, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
Near-miss passage: CVE-2015-1859. CWE: CWE-119. CVSS: 6.800000190734863. Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted ICO image.