alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Identifies when an account hasn't signed in during the past n number of days.
Matching passage: Sigma rule: Identifies when an account hasn't signed in during the past n number of days.. Logsource: azure / pim. Rule: title: Stale Accounts In A Privileged Role id: e402c26a-267a-45bd-9615-bd9ceda6da85 status: test description: Identifies when an account hasn't signed in during the past n number of days. references: - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#potential-stale-accounts-in-a-privileged-role author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-14 tags: - attack.initial-access - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation logsource: product: azure service: pim detection: selection: riskEventType: staleSignInAlertIncident condition: selection falsepositives: - Investigate if potential generic account that cannot be removed. level: high
Near-miss passage: Sigma rule: Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed). Logsource: windows / file_event. Rule: title: AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File id: d353dac0-1b41-46c2-820c-d7d2561fc6ed related: - id: 074e0ded-6ced-4ebd-8b4d-53f55908119d type: derived status: test description: Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed) references: - https://posts.specterops.io/application-whitelisting-bypass-and-arbitrary-unsigned-code-execution-technique-in-winrm-vbs-c8c24fb40404 author: Julia Fomina, oscd.community date: 2020-10-06 modified: 2022-11-28 tags: - attack.stealth - attack.t1216 logsource: product: windows category: file_event detection: system_files: TargetFilename|endswith: - WsmPty.xsl - WsmTxt.xsl in_system_folder: TargetFilename|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ condition: system_files and not in_system_folder falsepositives: - Unlikely level: medium
Query: exploit SAP ABAP & Java Server allows remote attackers to cause a denial of service (service termination) via unspecified vectors, aka SAP Security Note 2121661.
Matching passage: CVE-2015-4158. CWE: UNKNOWN. CVSS: 5.0. SAP ABAP & Java Server allows remote attackers to cause a denial of service (service termination) via unspecified vectors, aka SAP Security Note 2121661.
Near-miss passage: CVE-2015-5429. CWE: UNKNOWN. CVSS: 7.5. HP Matrix Operating Environment before 7.5.0 allows remote attackers to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2015-5427 and CVE-2015-5428.
Query: risk of Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to caus
Matching passage: CVE-2015-3192. CWE: CWE-119. CVSS: 5.5. Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.
Near-miss passage: CVE-2015-8572. CWE: CWE-119. CVSS: 6.800000190734863. Multiple buffer overflows in Autodesk Design Review (ADR) before 2013 Hotfix 2 allow remote attackers to execute arbitrary code via crafted RLE data in a (1) BMP or (2) FLI file, (3) encoded scan lines in a PCX file, or (4) DataSubBlock or (5) GlobalColorTable in a GIF file.
Query: CVE similar to CVE-2015-0276
Matching passage: CVE-2015-0276. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in Kallithea before 0.2.
Near-miss passage: CVE-2015-3370. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Node Invite module before 6.x-2.5 for Drupal allows remote attackers to hijack the authentication of users with the "node_invite_can_manage_invite" permission for requests that re-enable node invitations via unspecified vectors.
Query: SOC alert related to Udev Rules
Matching passage: T1546.017 Udev Rules. Tactics: persistence, privilege escalation. Description: Adversaries may maintain persistence through executing malicious content triggered using udev rules. Udev is the Linux kernel device manager that dynamically manages device nodes, handles access to pseudo-device files in the `/dev` directory, and responds to hardware events, such as when external devices like hard drives or keyboards are plugged in or removed. Udev uses rule files with `match keys` to specify the conditions a hardware event must meet and `action keys` to define the actions that should follow. Root permissions are required to create, modify, or delete rule files located in `/etc/udev/rules.d/`, `/run/udev/rules.d/`, `/usr/lib/udev/rules.d/`, `/usr/local/lib/udev/rules.d/`, and `/lib/udev/rules.d/`. Rule priority is determined by both directory and by the digit prefix in the rule filename.(Citation: Ignacio Udev research 2024)(Citation: Elastic Linux Persistence 2024) Adversaries may abuse the udev subsystem by adding or modifying rules in udev rule files to execute malicious content. For example, an adversary may configure a rule to execute their binary each time the pseudo-device file, such as `/dev/random`, is accessed by an application. Although udev is limited to running short tasks and is restricted by systemd-udevd's sandbox (blocking network and filesystem access), attackers may use scripting commands under the action key `RUN+=` to detach and run the malicious content’s process in the background to bypass these controls.(Citation: Reichert aon sedexp 2024)
Near-miss passage: T1546.007 Netsh Helper DLL. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility.(Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at <code>HKLM\SOFTWARE\Microsoft\Netsh</code>. Adversaries can use netsh.exe helper DLLs to trigger execution of arbitrary code in a persistent manner. This execution would take place anytime netsh.exe is executed, which could happen automatically, with another persistence technique, or if other software (ex: VPN) is present on the system that executes netsh.exe as part of its normal functionality.(Citation: Github Netsh Helper CS Beacon)(Citation: Demaske Netsh Persistence)
Query: what is T1087.003
Matching passage: T1087.003 Email Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists) In on-premises Exchange and Exchange Online, the <code>Get-GlobalAddressList</code> PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016) In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List)
Near-miss passage: T1087.004 Cloud Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. With authenticated access there are several tools that can be used to find accounts. The <code>Get-MsolRoleMember</code> PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365.(Citation: Microsoft msolrolemember)(Citation: GitHub Raindance) The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command <code>az ad user list</code> will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018) The AWS command <code>aws iam list-users</code> may be used to obtain a list of users in the current account while <code>aws iam list-roles</code> can obtain IAM roles that have a specified path prefix.(Citation: AWS List Roles)(Citation: AWS List Users) In GCP, <code>gcloud iam service-accounts list</code> and <code>gcloud projects get-iam-policy</code> may be used to obtain a listing of service accounts and users in a project.(Citation: Google Cloud - IAM Servie Accounts List API)
Query: alert when Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember".
Matching passage: Sigma rule: Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember".. Logsource: windows / process_creation. Rule: title: User Added To Highly Privileged Group id: 10fb649c-3600-4d37-b1e6-56ea90bb7e09 related: - id: ffa28e60-bdb1-46e0-9f82-05f7a61cc06e type: similar - id: ad720b90-25ad-43ff-9b5e-5c841facc8e5 type: similar status: test description: Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember". references: - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708 author: Nasreddine Bencherchali (Nextron Systems) date: 2024-02-23 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: category: process_creation product: windows detection: selection_main: - CommandLine|contains|all: - 'localgroup ' - ' /add' - CommandLine|contains|all: - 'Add-LocalGroupMember ' - ' -Group ' selection_group: CommandLine|contains: - Group Policy Creator Owners - Schema Admins condition: all of selection_* falsepositives: - Administrative activity that must be investigated level: high
Near-miss passage: Sigma rule: It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious pr. Logsource: windows / process_creation. Rule: title: Suspect Svchost Activity id: 16c37b52-b141-42a5-a3ea-bbe098444397 status: test description: It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space. references: - https://web.archive.org/web/20180718061628/https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2 author: David Burkett, @signalblur date: 2019-12-28 modified: 2022-06-27 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: category: process_creation product: windows detection: selection: CommandLine|endswith: svchost.exe Image|endswith: \svchost.exe filter: - ParentImage|endswith: - \rpcnet.exe - \rpcnetp.exe - CommandLine: null condition: selection and not filter falsepositives: - Rpcnet.exe / rpcnetp.exe which is a lojack style software. https://www.blackhat.com/docs/us-14/materials/us-14-Kamlyuk-Kamluk-Computrace-Backdoor-Revisited.pdf level: high
Query: SOC alert related to Exfiltration over USB
Matching passage: T1052.001 Exfiltration over USB. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
Near-miss passage: T1052 Exfiltration Over Physical Medium. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
Query: risk of The image-upgrade implementation on Cisco Desktop Collaboration Experience (aka Collaboration Desk Experience or DX) DX650 endpoints allows local users to execute arbitrary OS comm
Matching passage: CVE-2015-0584. CWE: CWE-20. CVSS: 7.199999809265137. The image-upgrade implementation on Cisco Desktop Collaboration Experience (aka Collaboration Desk Experience or DX) DX650 endpoints allows local users to execute arbitrary OS commands via an unspecified parameter, aka Bug ID CSCus38947.
Near-miss passage: CVE-2015-4148. CWE: CWE-20. CVSS: 5.0. The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data type, related to a "type confusion" issue.
Query: CVE similar to CVE-2015-8605
Matching passage: CVE-2015-8605. CWE: CWE-20. CVSS: 6.5. ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x before 4.3.3-P1 allows remote attackers to cause a denial of service (application crash) via an invalid length field in a UDP IPv4 packet.
Near-miss passage: CVE-2015-8740. CWE: CWE-20. CVSS: 5.300000190734863. The dissect_tds7_colmetadata_token function in epan/dissectors/packet-tds.c in the TDS dissector in Wireshark 2.0.x before 2.0.1 does not validate the number of columns, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet.
Query: alert when Detects potential tampering with Windows Defender settings such as adding exclusion using wmic
Matching passage: Sigma rule: Detects potential tampering with Windows Defender settings such as adding exclusion using wmic. Logsource: windows / process_creation. Rule: title: Potential Windows Defender Tampering Via Wmic.EXE id: 51cbac1e-eee3-4a90-b1b7-358efb81fa0a status: test description: Detects potential tampering with Windows Defender settings such as adding exclusion using wmic references: - https://github.com/redcanaryco/atomic-red-team/blob/5c1e6f1b4fafd01c8d1ece85f510160fc1275fbf/atomics/T1562.001/T1562.001.md - https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/ - https://www.bleepingcomputer.com/news/security/iobit-forums-hacked-to-spread-ransomware-to-its-members/ author: frack113 date: 2022-12-11 modified: 2023-02-14 tags: - attack.execution - attack.defense-impairment - attack.t1047 - attack.t1685 logsource: product: windows category: process_creation detection: selection_img: - OriginalFileName: wmic.exe - Image|endswith: \WMIC.exe selection_cli: CommandLine|contains: /Namespace:\\\\root\\Microsoft\\Windows\\Defender condition: all of selection_* falsepositives: - Unknown level: high simulation: - type: atomic-red-team name: WMIC Tamper with Windows Defender Evade Scanning Folder technique: T1562.001 atomic_guid: 59d386fc-3a4b-41b8-850d-9e3eee24dfe4 regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_namespace_defender/info.yml
Near-miss passage: Sigma rule: Detects execution of "rundll32.exe" with a parent process of Explorer.exe. This has been observed by variants of Raspber. Logsource: windows / process_creation. Rule: title: Rundll32 Spawned Via Explorer.EXE id: 1723e720-616d-4ddc-ab02-f7e3685a4713 status: test description: Detects execution of "rundll32.exe" with a parent process of Explorer.exe. This has been observed by variants of Raspberry Robin, as first reported by Red Canary. references: - https://redcanary.com/blog/raspberry-robin/ - https://thedfirreport.com/2022/09/26/bumblebee-round-two/ author: CD_ROM_ date: 2022-05-21 modified: 2023-08-31 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \explorer.exe selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE filter_main_generic: - CommandLine|contains: ' C:\Windows\System32\' - CommandLine|endswith: ' -localserver 22d8c27b-47a1-48d1-ad08-7da7abd79617' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: detection rule: Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords. This was seen being used in combination with "icacls
Matching passage: Sigma rule: Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords. This was seen being used in combination with "icacls. Logsource: windows / process_creation. Rule: title: Permission Misconfiguration Reconnaissance Via Findstr.EXE id: 47e4bab7-c626-47dc-967b-255608c9a920 status: test description: 'Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords. This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions. ' references: - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-12 modified: 2023-11-11 tags: - attack.credential-access - attack.t1552.006 logsource: category: process_creation product: windows detection: selection_findstr_img: - Image|endswith: - \find.exe - \findstr.exe - OriginalFileName: - FIND.EXE - FINDSTR.EXE selection_findstr_cli: CommandLine|contains: - '"Everyone"' - '''Everyone''' - '"BUILTIN\\"' - '''BUILTIN\''' selection_special: CommandLine|contains|all: - 'icacls ' - 'findstr ' - Everyone condition: all of selection_findstr_* or selection_special falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_recon_everyone/info.yml
Near-miss passage: Sigma rule: Clear command history in network OS which is used for defense evasion. Logsource: cisco / aaa. Rule: title: Cisco Clear Logs id: ceb407f6-8277-439b-951f-e4210e3ed956 status: test description: Clear command history in network OS which is used for defense evasion references: - https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/command/reference/sysmgmt/n5k-sysmgmt-cr/n5k-sm_cmds_c.html - https://www.cisco.com/c/en/us/td/docs/ios/12_2sr/12_2sra/feature/guide/srmgtint.html#wp1127609 author: Austin Clark date: 2019-08-12 modified: 2023-05-26 tags: - attack.stealth - attack.t1070.003 logsource: product: cisco service: aaa detection: keywords: - clear logging - clear archive condition: keywords falsepositives: - Legitimate administrators may run these commands level: high
Query: Sigma rule for Detect the harvesting of wifi credentials using netsh.exe
Matching passage: Sigma rule: Detect the harvesting of wifi credentials using netsh.exe. Logsource: windows / process_creation. Rule: title: Harvesting Of Wifi Credentials Via Netsh.EXE id: 42b1a5b8-353f-4f10-b256-39de4467faff status: test description: Detect the harvesting of wifi credentials using netsh.exe references: - https://blog.malwarebytes.com/threat-analysis/2020/04/new-agenttesla-variant-steals-wifi-credentials/ author: Andreas Hunkeler (@Karneades), oscd.community date: 2020-04-20 modified: 2023-02-13 tags: - attack.discovery - attack.credential-access - attack.t1040 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: CommandLine|contains|all: - wlan - ' s' - ' p' - ' k' - =clear condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects function calls from the EditionUpgradeManager COM interface. Which is an interface that is not used by standard. Logsource: windows / process_access. Rule: title: Function Call From Undocumented COM Interface EditionUpgradeManager id: fb3722e4-1a06-46b6-b772-253e2e7db933 status: test description: Detects function calls from the EditionUpgradeManager COM interface. Which is an interface that is not used by standard executables. references: - https://www.snip2code.com/Snippet/4397378/UAC-bypass-using-EditionUpgradeManager-C/ - https://gist.github.com/hfiref0x/de9c83966623236f5ebf8d9ae2407611 author: oscd.community, Dmitry Uchakin date: 2020-10-07 modified: 2023-11-30 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_access product: windows detection: selection: CallTrace|contains: editionupgrademanagerobj.dll condition: selection falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-5499
Matching passage: CVE-2015-5499. CWE: CWE-264. CVSS: 4.0. The Navigate module for Drupal does not properly check permissions, which allows remote authenticated users to modify custom widgets and create widget database records by leveraging the "navigate view" permission.
Near-miss passage: CVE-2015-8967. CWE: CWE-264. CVSS: 7.800000190734863. arch/arm64/kernel/sys.c in the Linux kernel before 4.0 allows local users to bypass the "strict page permissions" protection mechanism and modify the system-call table, and consequently gain privileges, by leveraging write access.
Query: containment actions for Multiple failed authentications followed by VNC
Matching passage: Playbook for T1021.005 VNC. 1) Validate alert telemetry against T1021.005. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: lateral movement. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely control machines using Virtual Network Computing (VNC). VNC is a platform-independent desktop sharing system that uses the RFB (“remote framebuffer”) protocol to enable users to remotely control another computer’s display by relaying the screen, mouse, and keyboard inputs over the network.(Citation: The Rem
Near-miss passage: Playbook for T1021.006 Windows Remote Management. Different response path focused on lateral movement.