alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Persistence mechanism resembling Container CLI/API
Matching passage: T1059.013 Container CLI/API. Tactics: execution. Description: Adversaries may abuse built-in CLI tools or API calls to execute malicious commands in containerized environments. The Docker CLI is used for managing containers via an exposed API point from the `dockerd` daemon. Some common examples of Docker CLI include Docker Desktop CLI and Docker Compose, but users are also able to use SDKs to interact with the API. For example, Docker SDK for Python can be used to run commands within a Python application.(Citation: Docker Desktop CLI) Adversaries may leverage the Docker CLI, API, or SDK to pull or build Docker images (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105), [Build Image on Host](https://attack.mitre.org/techniques/T1612)), run containers (i.e., [Deploy Container](https://attack.mitre.org/techniques/T1610)), or execute commands inside running containers (i.e., [Container Administration Command](https://attack.mitre.org/techniques/T1609)). In some cases, threat actors may pull legitimate images that include scripts or tools that they can leverage - for example, using an image that includes the `curl` command to download payloads.(Citation: Intezer) Adversaries may also utilize `docker inspect` and `docker ps` to scan for cloud environment variables and other running containers (i.e., [Container and Resource Discovery](https://attack.mitre.org/techniques/T1613)).(Citation: Cisco Talos Blog)(Citation: aquasec) Kubernetes is responsible for the management and orchestration of containers across clusters. The Kubernetes control plane, which manages the state of the cluster and is responsible for scheduling, communication, and resource monitoring, can be invoked directly via the API or indirectly via CLI tools such as `kubectl`. It may also be accessed within client libraries such as Go or Python. By utilizing the API, administrators can interact with resources within the cluster such as listing or creating pods, which is a group of one or more containers. Adversaries call the API server via `curl` o
Near-miss passage: T1059.011 Lua. Tactics: execution. Description: Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line (through the stand-alone lua interpreter), via scripts (<code>.lua</code>), or from Lua-embedded programs (through the <code>struct lua_State</code>).(Citation: Lua main page)(Citation: Lua state) Lua scripts may be executed by adversaries for malicious purposes. Adversaries may incorporate, abuse, or replace existing Lua interpreters to allow for malicious Lua command execution at runtime.(Citation: PoetRat Lua)(Citation: Lua Proofpoint Sunseed)(Citation: Cyphort EvilBunny)(Citation: Kaspersky Lua)
Query: vulnerability: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect availability via vectors related to CORBA.
Matching passage: CVE-2015-4882. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect availability via vectors related to CORBA.
Near-miss passage: CVE-2015-3623. CWE: UNKNOWN. CVSS: 6.400000095367432. XML external entity (XXE) vulnerability in QlikTech Qlikview before 11.20 SR12 allows remote attackers to conduct server-side request forgery (SSRF) attacks and read arbitrary files via crafted XML data in a request to AccessPoint.aspx.
Query: how to detect Screensaver
Matching passage: T1546.002 Screensaver. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.(Citation: Wikipedia Screensaver) The Windows screensaver application scrnsave.scr is located in <code>C:\Windows\System32\</code>, and <code>C:\Windows\sysWOW64\</code> on 64-bit Windows systems, along with screensavers included with base Windows installations. The following screensaver settings are stored in the Registry (<code>HKCU\Control Panel\Desktop\</code>) and could be manipulated to achieve persistence: * <code>SCRNSAVE.exe</code> - set to malicious PE path * <code>ScreenSaveActive</code> - set to '1' to enable the screensaver * <code>ScreenSaverIsSecure</code> - set to '0' to not require a password to unlock * <code>ScreenSaveTimeout</code> - sets user inactivity timeout before screensaver is executed Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity.(Citation: ESET Gazer Aug 2017)
Near-miss passage: T1546.014 Emond. Tactics: privilege escalation, persistence. Description: Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon (emond). Emond is a [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) that accepts events from various services, runs them through a simple rules engine, and takes action. The emond binary at <code>/sbin/emond</code> will load any rules from the <code>/etc/emond.d/rules/</code> directory and take action once an explicitly defined event takes place. The rule files are in the plist format and define the name, event type, and action to take. Some examples of event types include system startup and user authentication. Examples of actions are to run a system command or send an email. The emond service will not launch if there is no file present in the QueueDirectories path <code>/private/var/db/emondClients</code>, specified in the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) configuration file at<code>/System/Library/LaunchDaemons/com.apple.emond.plist</code>.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019) Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019) Adversaries may also be able to escalate privileges from administrator to root as the emond service is executed with root privileges by the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) service.
Query: detection rule: Detects common commands used in Windows webshells
Matching passage: Sigma rule: Detects common commands used in Windows webshells. Logsource: webserver. Rule: title: Windows Webshell Strings id: 7ff9db12-1b94-4a79-ba68-a2402c5d6729 status: test description: Detects common commands used in Windows webshells references: - https://bad-jubies.github.io/RCE-NOW-WHAT/ - https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2017-02-19 modified: 2022-11-18 tags: - attack.persistence - attack.t1505.003 logsource: category: webserver detection: selection_method: cs-method: GET selection_keywords: - =whoami - =net%20user - =net+user - =net%2Buser - =cmd%20/c% - =cmd+/c+ - =cmd%2B/c% - =cmd%20/r% - =cmd+/r+ - =cmd%2B/r% - =cmd%20/k% - =cmd+/k+ - =cmd%2B/k% - =powershell% - =powershell+ - =tasklist% - =tasklist+ - =wmic% - =wmic+ - =ssh% - =ssh+ - =python% - =python+ - =python3% - =python3+ - =ipconfig - =wget% - =wget+ - =curl% - =curl+ - =certutil - =copy%20%5C%5C - =dsquery% - =dsquery+ - =nltest% - =nltest+ condition: all of selection_* falsepositives: - Web sites like wikis with articles on os commands and pages that include the os commands in the URLs - User searches in search boxes of the respective website level: high
Near-miss passage: Sigma rule: Detects execution of the "finger.exe" utility. Finger.EXE or "TCPIP Finger Command" is an old utility that is still pres. Logsource: windows / process_creation. Rule: title: Finger.EXE Execution id: af491bca-e752-4b44-9c86-df5680533dbc related: - id: c082c2b0-525b-4dbc-9a26-a57dc4692074 type: similar - id: 2fdaf50b-9fd5-449f-ba69-f17248119af6 type: similar status: test description: 'Detects execution of the "finger.exe" utility. Finger.EXE or "TCPIP Finger Command" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon. Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of "finger.exe" can be considered "suspicious" and worth investigating. ' references: - https://twitter.com/bigmacjpg/status/1349727699863011328?s=12 - https://app.any.run/tasks/40115012-a919-4208-bfed-41e82cb3dadf/ - http://hyp3rlinx.altervista.org/advisories/Windows_TCPIP_Finger_Command_C2_Channel_and_Bypassing_Security_Software.txt author: Florian Roth (Nextron Systems), omkar72, oscd.community date: 2021-02-24 modified: 2024-06-27 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: finger.exe - Image|endswith: \finger.exe condition: selection falsepositives: - Admin activity (unclear what they do nowadays with finger.exe) level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_finger_execution/info.yml
Query: describe CVE-2015-5498
Matching passage: CVE-2015-5498. CWE: CWE-264. CVSS: 5.0. The Shipwire API module 7.x-1.x before 7.x-1.03 for Drupal does not check the view permission for the shipments overview (admin/shipwire/shipments), which allows remote attackers to obtain sensitive information via a request to the page.
Near-miss passage: CVE-2015-9013. CWE: CWE-264. CVSS: 9.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393251.
Query: patch priority for CVE-2015-5910
Matching passage: CVE-2015-5910. CWE: CWE-200. CVSS: 3.299999952316284. IDE Xcode Server in Apple Xcode before 7.0 does not ensure that server traffic is encrypted, which allows remote attackers to obtain sensitive information by sniffing the network.
Near-miss passage: CVE-2015-3269. CWE: CWE-200. CVSS: 5.0. Apache Flex BlazeDS, as used in flex-messaging-core.jar in Adobe LiveCycle Data Services (LCDS) 3.0.x before 3.0.0.354170, 4.5 before 4.5.1.354169, 4.6.2 before 4.6.2.354169, and 4.7 before 4.7.0.354169 and other products, allows remote attackers to read arbitrary files via an AMF message containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Query: detect Detects execution of Sysinternals tools via an AppX package. Attackers could install the Sysinternals Suite to get acces in logs
Matching passage: Sigma rule: Detects execution of Sysinternals tools via an AppX package. Attackers could install the Sysinternals Suite to get acces. Logsource: windows / appmodel-runtime. Rule: title: Sysinternals Tools AppX Versions Execution id: d29a20b2-be4b-4827-81f2-3d8a59eab5fc status: test description: 'Detects execution of Sysinternals tools via an AppX package. Attackers could install the Sysinternals Suite to get access to tools such as psexec and procdump to avoid detection based on System paths. ' references: - https://learn.microsoft.com/en-us/sysinternals/downloads/microsoft-store author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-16 modified: 2023-09-12 tags: - attack.execution - attack.stealth logsource: product: windows service: appmodel-runtime detection: selection: EventID: 201 ImageName: - procdump.exe - psloglist.exe - psexec.exe - livekd.exe - ADExplorer.exe condition: selection falsepositives: - Legitimate usage of sysinternals applications from the Windows Store will trigger this. Apply exclusions as needed. level: low
Near-miss passage: Sigma rule: Detects the creation of tasks from processes executed from suspicious locations. Logsource: windows / file_event. Rule: title: Suspicious Scheduled Task Write to System32 Tasks id: 80e1f67a-4596-4351-98f5-a9c3efabac95 status: test description: Detects the creation of tasks from processes executed from suspicious locations references: - Internal Research author: Florian Roth (Nextron Systems) date: 2021-11-16 modified: 2022-01-12 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \Windows\System32\Tasks Image|contains: - \AppData\ - C:\PerfLogs - \Windows\System32\config\systemprofile condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-1914
Matching passage: CVE-2015-1914. CWE: CWE-200. CVSS: 5.0. IBM Java 7 R1 before SR3, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allows remote attackers to bypass "permission checks" and obtain sensitive information via vectors related to the Java Virtual Machine.
Near-miss passage: CVE-2015-3340. CWE: CWE-200. CVSS: 2.9000000953674316. Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.
Query: rule covering Detects potential abuse of ntdsutil to dump ntds.dit database to a suspicious location
Matching passage: Sigma rule: Detects potential abuse of ntdsutil to dump ntds.dit database to a suspicious location. Logsource: windows / application. Rule: title: Dump Ntds.dit To Suspicious Location id: 94dc4390-6b7c-4784-8ffc-335334404650 status: test description: Detects potential abuse of ntdsutil to dump ntds.dit database to a suspicious location references: - https://twitter.com/mgreen27/status/1558223256704122882 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj574207(v=ws.11) author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-14 modified: 2023-10-23 tags: - attack.execution logsource: product: windows service: application detection: selection_root: Provider_Name: ESENT EventID: 325 Data|contains: ntds.dit selection_paths: Data|contains: - :\ntds.dit - \Appdata\ - \Desktop\ - \Downloads\ - \Perflogs\ - \Temp\ - \Users\Public\ condition: all of selection_* falsepositives: - Legitimate backup operation/creating shadow copies level: medium
Near-miss passage: Sigma rule: Detects suspicious ways to use the "DumpMinitool.exe" binary. Logsource: windows / process_creation. Rule: title: Suspicious DumpMinitool Execution id: eb1c4225-1c23-4241-8dd4-051389fde4ce status: test description: Detects suspicious ways to use the "DumpMinitool.exe" binary references: - https://twitter.com/mrd0x/status/1511415432888131586 - https://twitter.com/mrd0x/status/1511489821247684615 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/DumpMinitool/ author: Florian Roth (Nextron Systems) date: 2022-04-06 modified: 2023-04-12 tags: - attack.credential-access - attack.stealth - attack.t1036 - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \DumpMinitool.exe - \DumpMinitool.x86.exe - \DumpMinitool.arm64.exe - OriginalFileName: - DumpMinitool.exe - DumpMinitool.x86.exe - DumpMinitool.arm64.exe filter_folder: Image|contains: - \Microsoft Visual Studio\ - \Extensions\ susp_flags: CommandLine|contains: .txt cmd_has_flags: CommandLine|contains: - ' Full' - ' Mini' - ' WithHeap' filter_cmd_misses_flags: CommandLine|contains: --dumpType condition: selection and ( ( not filter_folder ) or susp_flags or ( cmd_has_flags and not filter_cmd_misses_flags ) ) falsepositives: - Unknown level: high
Query: common weakness: Incorrect Selection of Fuse Values
Matching passage: CWE-1253 Incorrect Selection of Fuse Values. The logic level used to set a system to a secure state relies on a fuse being unblown.
Near-miss passage: CWE-1078 Inappropriate Source Code Style or Formatting. The source code does not follow desired style or formatting for indentation, white space, comments, etc.
Query: CVE similar to CVE-2015-7763
Matching passage: CVE-2015-7763. CWE: CWE-200. CVSS: 5.0. rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.
Near-miss passage: CVE-2015-5865. CWE: CWE-200. CVSS: 4.300000190734863. IOGraphics in Apple OS X before 10.11 allows attackers to obtain sensitive kernel memory-layout information via a crafted app.
Query: risk of The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitra
Matching passage: CVE-2015-5351. CWE: CWE-352. CVSS: 8.800000190734863. The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token.
Near-miss passage: CVE-2015-2293. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page.
Query: CVE similar to CVE-2015-1879
Matching passage: CVE-2015-1879. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the profile parameter in an edit action in the gde-settings page to wp-admin/options-general.php.
Near-miss passage: CVE-2015-7191. CWE: CWE-79. CVSS: 4.300000190734863. Mozilla Firefox before 42.0 on Android improperly restricts URL strings in intents, which allows attackers to conduct cross-site scripting (XSS) attacks via vectors involving an intent: URL and fallback navigation, aka "Universal XSS (UXSS)."
Query: EDR alert: possible Embedded Payloads (T1027.009)
Matching passage: T1027.009 Embedded Payloads. Tactics: stealth. Description: Adversaries may embed payloads within other files to conceal malicious content from defenses. Otherwise seemingly benign files (such as scripts and executables) may be abused to carry and obfuscate malicious payloads and content. In some cases, embedded payloads may also enable adversaries to [Subvert Trust Controls](https://attack.mitre.org/techniques/T1553) by not impacting execution controls such as digital signatures and notarization tickets.(Citation: Sentinel Labs) Adversaries may embed payloads in various file formats to hide payloads.(Citation: Microsoft Learn) This is similar to [Steganography](https://attack.mitre.org/techniques/T1027/003), though does not involve weaving malicious content into specific bytes and patterns related to legitimate digital media formats.(Citation: GitHub PSImage) For example, adversaries have been observed embedding payloads within or as an overlay of an otherwise benign binary.(Citation: Securelist Dtrack2) Adversaries have also been observed nesting payloads (such as executables and run-only scripts) inside a file of the same format.(Citation: SentinelLabs reversing run-only applescripts 2021) Embedded content may also be used as [Process Injection](https://attack.mitre.org/techniques/T1055) payloads used to infect benign system processes.(Citation: Trend Micro) These embedded then injected payloads may be used as part of the modules of malware designed to provide specific features such as encrypting C2 communications in support of an orchestrator module. For example, an embedded module may be injected into default browsers, allowing adversaries to then communicate via the network.(Citation: Malware Analysis Report ComRAT)
Near-miss passage: T1027.003 Steganography. Tactics: stealth. Description: Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files. [Duqu](https://attack.mitre.org/software/S0038) was an early example of malware that used steganography. It encrypted the gathered information from a victim's system and hid it within an image before exfiltrating the image to a C2 server.(Citation: Wikipedia Duqu) By the end of 2017, a threat group used <code>Invoke-PSImage</code> to hide [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands in an image file (.png) and execute the code on a victim's system. In this particular case the [PowerShell](https://attack.mitre.org/techniques/T1059/001) code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary.(Citation: McAfee Malicious Doc Targets Pyeongchang Olympics)
Query: telemetry for T1542.002
Matching passage: T1542.002 Component Firmware. Tactics: stealth, persistence. Description: Adversaries may modify component firmware to persist on systems. Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. This technique may be similar to [System Firmware](https://attack.mitre.org/techniques/T1542/001) but conducted upon other system components/devices that may not have the same capability or level of integrity checking. Malicious component firmware could provide both a persistent level of access to systems despite potential typical failures to maintain access and hard disk re-images, as well as a way to evade host software-based defenses and integrity checks.
Near-miss passage: T1542.001 System Firmware. Tactics: stealth, persistence. Description: Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer.(Citation: Wikipedia BIOS)(Citation: Wikipedia UEFI)(Citation: About UEFI) System firmware like BIOS and (U)EFI underly the functionality of a computer and may be modified by an adversary to perform or assist in malicious activity. Capabilities exist to overwrite the system firmware, which may give sophisticated adversaries a means to install malicious firmware updates as a means of persistence on a system that may be difficult to detect.
Query: secure coding against Use of Same Invokable Control Element in Multiple Architectural Layers
Matching passage: CWE-1092 Use of Same Invokable Control Element in Multiple Architectural Layers. The product uses the same control element across multiple architectural layers.
Near-miss passage: CWE-296 Improper Following of a Certificate's Chain of Trust. The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate.