alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: intelligence brief on T1098.007
Matching passage: T1098.007 Additional Local or Domain Groups. Tactics: persistence, privilege escalation. Description: An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent access to a system or domain. On Windows, accounts may use the `net localgroup` and `net group` commands to add existing users to local and domain groups.(Citation: Microsoft Net Localgroup)(Citation: Microsoft Net Group) On Linux, adversaries may use the `usermod` command for the same purpose.(Citation: Linux Usermod) For example, accounts may be added to the local administrators group on Windows devices to maintain elevated privileges. They may also be added to the Remote Desktop Users group, which allows them to leverage [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) to log into the endpoints in the future.(Citation: Microsoft RDP Logons) Adversaries may also add accounts to VPN user groups to gain future persistence on the network.(Citation: Cyber Security News) On Linux, accounts may be added to the sudoers group, allowing them to persistently leverage [Sudo and Sudo Caching](https://attack.mitre.org/techniques/T1548/003) for elevated privileges. In Windows environments, machine accounts may also be added to domain groups. This allows the local SYSTEM account to gain privileges on the domain.(Citation: RootDSE AD Detection 2022)
Near-miss passage: T1098.006 Additional Container Cluster Roles. Tactics: persistence, privilege escalation. Description: An adversary may add additional roles or permissions to an adversary-controlled user or service account to maintain persistent access to a container orchestration system. For example, an adversary with sufficient permissions may create a RoleBinding or a ClusterRoleBinding to bind a Role or ClusterRole to a Kubernetes account.(Citation: Kubernetes RBAC)(Citation: Aquasec Kubernetes Attack 2023) Where attribute-based access control (ABAC) is in use, an adversary with sufficient permissions may modify a Kubernetes ABAC policy to give the target account additional permissions.(Citation: Kuberentes ABAC) This account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised. Note that where container orchestration systems are deployed in cloud environments, as with Google Kubernetes Engine, Amazon Elastic Kubernetes Service, and Azure Kubernetes Service, cloud-based role-based access control (RBAC) assignments or ABAC policies can often be used in place of or in addition to local permission assignments.(Citation: Google Cloud Kubernetes IAM)(Citation: AWS EKS IAM Roles for Service Accounts)(Citation: Microsoft Azure Kubernetes Service Service Accounts) In these cases, this technique may be used in conjunction with [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003).
Query: risk of The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.
Matching passage: CVE-2015-8860. CWE: CWE-59. CVSS: 7.5. The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.
Near-miss passage: CVE-2015-3629. CWE: CWE-59. CVSS: 7.800000190734863. Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container.
Query: secure coding against Incorrect Regular Expression
Matching passage: CWE-185 Incorrect Regular Expression. The product specifies a regular expression in a way that causes data to be improperly matched or compared.
Near-miss passage: CWE-83 Improper Neutralization of Script in Attributes in a Web Page. The product does not neutralize or incorrectly neutralizes javascript: or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.
Query: exploit XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attacker
Matching passage: CVE-2015-0263. CWE: UNKNOWN. CVSS: 5.0. XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource.
Near-miss passage: CVE-2015-0302. CWE: UNKNOWN. CVSS: 5.0. Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow attackers to obtain sensitive keystroke information via unspecified vectors.
Query: risk of The CSSFontFaceSrcValue::fetch function in core/css/CSSFontFaceSrcValue.cpp in the Cascading Style Sheets (CSS) implementation in Blink, as used in Google Chrome before 46.0.2490.7
Matching passage: CVE-2015-6762. CWE: CWE-254. CVSS: 7.5. The CSSFontFaceSrcValue::fetch function in core/css/CSSFontFaceSrcValue.cpp in the Cascading Style Sheets (CSS) implementation in Blink, as used in Google Chrome before 46.0.2490.71, does not use the CORS cross-origin request algorithm when a font's URL appears to be a same-origin URL, which allows remote web servers to bypass the Same Origin Policy via a redirect.
Near-miss passage: CVE-2015-7225. CWE: CWE-254. CVSS: 5.300000190734863. Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing a man-in-the-middle attack between the provider and verifier, or shoulder surfing, and replaying the OTP in the current time-step.
Query: Sigma rule for Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permission
Matching passage: Sigma rule: Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permission. Logsource: windows / ps_script. Rule: title: Potentially Suspicious Call To Win32_NTEventlogFile Class - PSScript id: e2812b49-bae0-4b21-b366-7c142eafcde2 status: test description: Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permissions, etc.) from a PowerShell script references: - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/aa394225(v=vs.85) author: Nasreddine Bencherchali (Nextron Systems) date: 2023-07-13 tags: - attack.defense-impairment logsource: category: ps_script product: windows definition: bade5735-5ab0-4aa7-a642-a11be0e40872 detection: selection_class: ScriptBlockText|contains: Win32_NTEventlogFile selection_function: ScriptBlockText|contains: - .BackupEventlog( - .ChangeSecurityPermissions( - .ChangeSecurityPermissionsEx( - .ClearEventLog( - .Delete( - .DeleteEx( - .Rename( - .TakeOwnerShip( - .TakeOwnerShipEx( condition: all of selection_* falsepositives: - Legitimate administration and backup scripts level: medium
Near-miss passage: Sigma rule: Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected host. Logsource: windows / ps_classic_start. Rule: title: Netcat The Powershell Version id: c5b20776-639a-49bf-94c7-84f912b91c15 related: - id: bf7286e7-c0be-460b-a7e8-5b2e07ecc2f2 type: derived status: test description: Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network references: - https://nmap.org/ncat/ - https://github.com/besimorhino/powercat - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1095/T1095.md author: frack113 date: 2021-07-21 modified: 2023-10-27 tags: - attack.command-and-control - attack.execution - attack.t1095 - attack.t1059.001 logsource: product: windows category: ps_classic_start detection: selection: Data|contains: - 'powercat ' - powercat.ps1 condition: selection falsepositives: - Unknown level: medium
Query: Sigma rule for Detects execution of JavaScript or JSC files using NodeJs binary node.exe, that could be potentially suspicious. Node.js
Matching passage: Sigma rule: Detects execution of JavaScript or JSC files using NodeJs binary node.exe, that could be potentially suspicious. Node.js. Logsource: windows / process_creation. Rule: title: NodeJS Execution of JavaScript File id: ba3874b9-0fae-465f-836c-eb5d071a1789 status: experimental description: 'Detects execution of JavaScript or JSC files using NodeJs binary node.exe, that could be potentially suspicious. Node.js is a popular open-source JavaScript runtime that runs code outside browsers and is widely used for both frontend and backend development. Adversaries have been observed abusing Node.js to disguise malware as legitimate processes, evade security defenses, and maintain persistence within target systems. Because Node.js is commonly used, this rule may generate false positives in some environments. However, if such activity is unusual in your environment, it is highly suspicious and warrants immediate investigation. ' references: - https://www.microsoft.com/en-us/security/blog/2025/04/15/threat-actors-misuse-node-js-to-deliver-malware-and-other-malicious-payloads/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-04-21 tags: - attack.execution - attack.t1059.007 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \node.exe - OriginalFileName: node.exe - Product: Node.js selection_cmd: CommandLine|contains: .js condition: all of selection_* falsepositives: - Legitimate use of node.exe to execute JavaScript or JSC files on your environment level: low
Near-miss passage: Sigma rule: Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attack. Logsource: windows / process_creation. Rule: title: Loaded Module Enumeration Via Tasklist.EXE id: 34275eb8-fa19-436b-b959-3d9ecd53fa1f status: test description: 'Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question. In order to dump the process memory or perform other nefarious actions. ' references: - https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/ - https://pentestlab.blog/tag/svchost/ author: Swachchhanda Shrawan Poudel date: 2024-02-12 modified: 2024-03-13 tags: - attack.t1003 - attack.credential-access logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \tasklist.exe - OriginalFileName: tasklist.exe selection_flags: CommandLine|contains|windash: -m selection_module: CommandLine|contains: rdpcorets.dll condition: all of selection_* falsepositives: - Unknown level: medium
Query: detect Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module in logs
Matching passage: Sigma rule: Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module. Logsource: windows / process_creation. Rule: title: Rundll32 Execution Without Parameters id: 5bb68627-3198-40ca-b458-49f973db8752 status: test description: Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module references: - https://bczyz1.github.io/2021/01/30/psexec.html author: Bartlomiej Czyz, Relativity date: 2021-01-31 modified: 2023-02-28 tags: - attack.lateral-movement - attack.t1021.002 - attack.t1570 - attack.execution - attack.t1569.002 logsource: category: process_creation product: windows detection: selection: CommandLine: - rundll32.exe - rundll32 condition: selection falsepositives: - False positives may occur if a user called rundll32 from CLI with no options level: high
Near-miss passage: Sigma rule: Detects scheduled task creations that have suspicious action command and folder combinations. Logsource: windows / process_creation. Rule: title: Schtasks From Suspicious Folders id: 8a8379b8-780b-4dbf-b1e9-31c8d112fefb status: test description: Detects scheduled task creations that have suspicious action command and folder combinations references: - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-dream-job-chemical author: Florian Roth (Nextron Systems) date: 2022-04-15 modified: 2022-11-18 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_create: CommandLine|contains: ' /create ' selection_command: CommandLine|contains: - powershell - pwsh - 'cmd /c ' - 'cmd /k ' - 'cmd /r ' - 'cmd.exe /c ' - 'cmd.exe /k ' - 'cmd.exe /r ' selection_all_folders: CommandLine|contains: - C:\ProgramData\ - '%ProgramData%' condition: all of selection_* falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-7011
Matching passage: CVE-2015-7011. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 9.0.1 and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-3 and APPLE-SA-2015-10-21-5.
Near-miss passage: CVE-2015-2546. CWE: CWE-119. CVSS: 8.199999809265137. The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Win32k Memory Corruption Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2511, CVE-2015-2517, and CVE-2015-2518.
Query: Sigma rule for Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExe
Matching passage: Sigma rule: Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExe. Logsource: windows / process_creation. Rule: title: HackTool - Impersonate Execution id: cf0c254b-22f1-4b2b-8221-e137b3c0af94 status: test description: Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively references: - https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/ - https://github.com/sensepost/impersonate author: Sai Prashanth Pulisetti @pulisettis date: 2022-12-21 modified: 2024-11-23 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.001 - attack.t1134.003 logsource: product: windows category: process_creation detection: selection_commandline_exe: CommandLine|contains: impersonate.exe selection_commandline_opt: CommandLine|contains: - ' list ' - ' exec ' - ' adduser ' selection_hash: Hashes|contains: - MD5=9520714AB576B0ED01D1513691377D01 - SHA256=E81CC96E2118DC4FBFE5BAD1604E0AC7681960143E2101E1A024D52264BB0A8A - IMPHASH=0A358FFC1697B7A07D0E817AC740DF62 condition: all of selection_commandline_* or selection_hash falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detect file time attribute change to hide new or changes to existing files. Logsource: macos / process_creation. Rule: title: File Time Attribute Change id: 88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0 status: test description: Detect file time attribute change to hide new or changes to existing files references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md author: Igor Fits, Mikhail Larin, oscd.community date: 2020-10-19 modified: 2022-01-12 tags: - attack.stealth - attack.t1070.006 logsource: product: macos category: process_creation detection: selection: Image|endswith: /touch CommandLine|contains: - -t - -acmr - -d - -r condition: selection falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-7971
Matching passage: CVE-2015-7971. CWE: CWE-19. CVSS: 2.0999999046325684. Xen 3.2.x through 4.6.x does not limit the number of printk console messages when logging certain pmu and profiling hypercalls, which allows local guests to cause a denial of service via a sequence of crafted (1) HYPERCALL_xenoprof_op hypercalls, which are not properly handled in the do_xenoprof_op function in common/xenoprof.c, or (2) HYPERVISOR_xenpmu_op hypercalls, which are not properly handled in the do_xenpmu_op function in arch/x86/cpu/vpmu.c.
Near-miss passage: CVE-2015-8772. CWE: CWE-19. CVSS: 9.100000381469727. McPvDrv.sys 4.6.111.0 in McAfee File Lock 5.x in McAfee Total Protection allows local users to obtain sensitive information from kernel memory or cause a denial of service (system crash) via a large VERIFY_INFORMATION.Length value in an IOCTL_DISK_VERIFY ioctl call.
Query: patch priority for CVE-2015-1100
Matching passage: CVE-2015-1100. CWE: CWE-119. CVSS: 5.400000095367432. The kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to cause a denial of service (out-of-bounds memory access) or obtain sensitive memory-content information via a crafted app.
Near-miss passage: CVE-2015-6146. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6145.
Query: detection rule: Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)
Matching passage: Sigma rule: Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato). Logsource: windows / process_creation. Rule: title: WhoAmI as Parameter id: e9142d84-fbe0-401d-ac50-3e519fb00c89 status: test description: Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato) references: - https://twitter.com/blackarrowsec/status/1463805700602224645?s=12 author: Florian Roth (Nextron Systems) date: 2021-11-29 modified: 2022-12-25 tags: - attack.discovery - attack.t1033 - car.2016-03-001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: .exe whoami condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects common NTLM brute force device names. Logsource: windows / ntlm. Rule: title: NTLM Brute Force id: 9c8acf1a-cbf9-4db6-b63c-74baabe03e59 status: test description: Detects common NTLM brute force device names references: - https://www.varonis.com/blog/investigate-ntlm-brute-force author: Jerry Shockley '@jsh0x' date: 2022-02-02 tags: - attack.credential-access - attack.t1110 logsource: product: windows service: ntlm definition: Requires events from Microsoft-Windows-NTLM/Operational detection: selection: EventID: 8004 devicename: WorkstationName: - Rdesktop - Remmina - Freerdp - Windows7 - Windows8 - Windows2012 - Windows2016 - Windows2019 condition: selection and devicename falsepositives: - Systems with names equal to the spoofed ones used by the brute force tools level: medium
Query: exploit Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows user-assisted remote attackers to execute arbitrary code via a crafted Media C
Matching passage: CVE-2015-2509. CWE: CWE-284. CVSS: 9.300000190734863. Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows user-assisted remote attackers to execute arbitrary code via a crafted Media Center link (mcl) file, aka "Windows Media Center RCE Vulnerability."
Near-miss passage: CVE-2015-3306. CWE: CWE-284. CVSS: 10.0. The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Query: write Sigma for Detects unusual parent or children of the wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool)
Matching passage: Sigma rule: Detects unusual parent or children of the wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool). Logsource: windows / process_creation. Rule: title: Wab/Wabmig Unusual Parent Or Child Processes id: 63d1ccc0-2a43-4f4b-9289-361b308991ff status: test description: Detects unusual parent or children of the wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) processes as seen being used with bumblebee activity references: - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime - https://thedfirreport.com/2022/09/26/bumblebee-round-two/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-12 modified: 2022-09-27 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \WmiPrvSE.exe - \svchost.exe - \dllhost.exe Image|endswith: - \wab.exe - \wabmig.exe selection_child: ParentImage|endswith: - \wab.exe - \wabmig.exe condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity. Logsource: proxy. Rule: title: PwnDrp Access id: 2b1ee7e4-89b6-4739-b7bb-b811b6607e5e status: test description: Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity references: - https://breakdev.org/pwndrop/ author: Florian Roth (Nextron Systems) date: 2020-04-15 modified: 2021-11-27 tags: - attack.command-and-control - attack.t1071.001 - attack.t1102.001 - attack.t1102.003 logsource: category: proxy detection: selection: c-uri|contains: /pwndrop/ condition: selection falsepositives: - Unknown level: critical
Query: CVE similar to CVE-2015-10029
Matching passage: CVE-2015-10029. CWE: CWE-611. CVSS: 9.800000190734863. A vulnerability classified as problematic was found in kelvinmo simplexrd up to 3.1.0. This vulnerability affects unknown code of the file simplexrd/simplexrd.class.php. The manipulation leads to xml external entity reference. Upgrading to version 3.1.1 is able to address this issue. The patch is identified as 4c9f2e028523ed705b555eca2c18c64e71f1a35d. It is recommended to upgrade the affected component. VDB-217630 is the identifier assigned to this vulnerability.
Near-miss passage: CVE-2015-7326. CWE: CWE-611. CVSS: 9.800000190734863. XML External Entity (XXE) vulnerability in Milton Webdav before 2.7.0.3.