alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: campaign using TFTP Boot
Matching passage: T1542.005 TFTP Boot. Tactics: stealth, persistence. Description: Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images. Adversaries may manipulate the configuration on the network device specifying use of a malicious TFTP server, which may be used in conjunction with [Modify System Image](https://attack.mitre.org/techniques/T1601) to load a modified image on device startup or reset. The unauthorized image allows adversaries to modify device configuration, add malicious capabilities to the device, and introduce backdoors to maintain control of the network device while minimizing detection through use of a standard functionality. This technique is similar to [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) and may result in the network device running a modified image. (Citation: Cisco Blog Legacy Device Attacks)
Near-miss passage: T1542.003 Bootkit. Tactics: stealth, persistence. Description: Adversaries may use bootkits to persist on systems. A bootkit is a malware variant that modifies the boot sectors of a hard drive, allowing malicious code to execute before a computer's operating system has loaded. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly. In BIOS systems, a bootkit may modify the Master Boot Record (MBR) and/or Volume Boot Record (VBR).(Citation: Mandiant M Trends 2016) The MBR is the section of disk that is first loaded after completing hardware initialization by the BIOS. It is the location of the boot loader. An adversary who has raw access to the boot drive may overwrite this area, diverting execution during startup from the normal boot loader to adversary code.(Citation: Lau 2011) The MBR passes control of the boot process to the VBR. Similar to the case of MBR, an adversary who has raw access to the boot drive may overwrite the VBR to divert execution during startup to adversary code. In UEFI (Unified Extensible Firmware Interface) systems, a bootkit may instead create or modify files in the EFI system partition (ESP). The ESP is a partition on data storage used by devices containing UEFI that allows the system to boot the OS and other utilities used by the system. An adversary can use the newly created or patched files in the ESP to run malicious kernel code.(Citation: Microsoft Security)(Citation: welivesecurity)
Query: Sigma rule for Detects the initial execution of "cmd.exe" which spawns "explorer.exe" with the appropriate command line arguments for o
Matching passage: Sigma rule: Detects the initial execution of "cmd.exe" which spawns "explorer.exe" with the appropriate command line arguments for o. Logsource: windows / process_creation. Rule: title: File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell id: c3d76afc-93df-461e-8e67-9b2bad3f2ac4 status: test description: 'Detects the initial execution of "cmd.exe" which spawns "explorer.exe" with the appropriate command line arguments for opening the "My Computer" folder. ' author: '@Kostastsale' references: - https://ss64.com/nt/shell.html date: 2022-12-22 modified: 2024-08-23 tags: - attack.discovery - attack.t1135 logsource: product: windows category: process_creation detection: selection: ParentImage|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe Image|endswith: \explorer.exe CommandLine|contains: shell:mycomputerfolder condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_explorer_folder_shortcut_via_shell_binary/info.yml
Near-miss passage: Sigma rule: Detects when an application Sign-on Policy is modified or deleted.. Logsource: okta / okta. Rule: title: Okta Application Sign-On Policy Modified or Deleted id: 8f668cc4-c18e-45fe-ad00-624a981cf88a status: test description: Detects when an application Sign-on Policy is modified or deleted. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-12 modified: 2026-04-27 tags: - attack.impact logsource: product: okta service: okta detection: selection: eventType: - application.policy.sign_on.update - application.policy.sign_on.rule.delete condition: selection falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-0749
Matching passage: CVE-2015-0749. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on the affected software. The vulnerabilities is due to improper input validation of certain parameters passed to the affected software. An attacker could exploit this vulnerability by convincing a user to follow a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected site or allow the attacker to access sensitive browser-based information.
Near-miss passage: CVE-2015-6494. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Query: describe CVE-2015-2016
Matching passage: CVE-2015-2016. CWE: UNKNOWN. CVSS: 9.0. Unspecified vulnerability in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges via unknown vectors.
Near-miss passage: CVE-2015-2473. CWE: UNKNOWN. CVSS: 9.300000190734863. Untrusted search path vulnerability in the client in Remote Desktop Protocol (RDP) through 8.1 in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .rdp file, aka "Remote Desktop Protocol DLL Planting Remote Code Execution Vulnerability."
Query: describe CVE-2015-2486
Matching passage: CVE-2015-2486. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2487, CVE-2015-2490, CVE-2015-2492, CVE-2015-2494, CVE-2015-2498, and CVE-2015-2499.
Near-miss passage: CVE-2015-2380. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, and Word 2013 RT SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: ATT&CK technique for Local Groups
Matching passage: T1069.001 Local Groups. Tactics: discovery. Description: Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group. Commands such as <code>net localgroup</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscl . -list /Groups</code> on macOS, and <code>groups</code> on Linux can list local groups.
Near-miss passage: T1069.003 Cloud Groups. Tactics: discovery. Description: Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group. With authenticated access there are several tools that can be used to find permissions groups. The <code>Get-MsolRole</code> PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts (Citation: Microsoft Msolrole)(Citation: GitHub Raindance). Azure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups. The command <code>az ad user get-member-groups</code> will list groups associated to a user account for Azure while the API endpoint <code>GET https://cloudidentity.googleapis.com/v1/groups</code> lists group resources available to a user for Google.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: Google Cloud Identity API Documentation) In AWS, the commands `ListRolePolicies` and `ListAttachedRolePolicies` allow users to enumerate the policies attached to a role.(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022) Adversaries may attempt to list ACLs for objects to determine the owner and other accounts with access to the object, for example, via the AWS <code>GetBucketAcl</code> API (Citation: AWS Get Bucket ACL). Using this information an adversary can target accounts with permissions to a given object or leverage accounts they have already compromised to access the object.
Query: patch priority for CVE-2015-6003
Matching passage: CVE-2015-6003. CWE: CWE-22. CVSS: 9.300000190734863. Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.
Near-miss passage: CVE-2015-7372. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in delivery-dev/al.php in Revive Adserver before 3.2.2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the layerstyle parameter.
Query: risk of Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remot
Matching passage: CVE-2015-7225. CWE: CWE-254. CVSS: 5.300000190734863. Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing a man-in-the-middle attack between the provider and verifier, or shoulder surfing, and replaying the OTP in the current time-step.
Near-miss passage: CVE-2015-7330. CWE: CWE-254. CVSS: 8.800000190734863. Puppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist protection mechanism by leveraging the Puppet communications protocol.
Query: risk of Unspecified vulnerability in Boosted Boards skateboards allows physically proximate attackers to modify skateboard movement, cause human injury, or cause physical damage via vector
Matching passage: CVE-2015-2247. CWE: UNKNOWN. CVSS: 8.300000190734863. Unspecified vulnerability in Boosted Boards skateboards allows physically proximate attackers to modify skateboard movement, cause human injury, or cause physical damage via vectors related to an "injection attack" that blocks and hijacks a Bluetooth signal.
Near-miss passage: CVE-2015-8646. CWE: UNKNOWN. CVSS: 8.800000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
Query: write Sigma for Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs
Matching passage: Sigma rule: Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs. Logsource: windows / image_load. Rule: title: HackTool - SharpEvtMute DLL Load id: 49329257-089d-46e6-af37-4afce4290685 related: - id: bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c type: similar status: test description: Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs references: - https://github.com/bats3c/EvtMute author: Florian Roth (Nextron Systems) date: 2022-09-07 modified: 2024-11-23 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: image_load product: windows detection: selection: Hashes|contains: IMPHASH=330768A4F172E10ACB6287B87289D83B condition: selection falsepositives: - Other DLLs with the same Imphash level: high
Near-miss passage: Sigma rule: Detects potential persistence activity via outlook today page. An attacker can set a custom page to execute arbitrary co. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Outlook Today Page id: 487bb375-12ef-41f6-baae-c6a1572b4dd1 related: - id: ddd171b5-2cc6-4975-9e78-f0eccd08cc76 type: similar status: test description: 'Detects potential persistence activity via outlook today page. An attacker can set a custom page to execute arbitrary code and link to it via the registry values "URL" and "UserDefinedUrl". ' references: - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=74 - https://trustedsec.com/blog/specula-turning-outlook-into-a-c2-with-one-registry-change author: Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand date: 2021-06-10 modified: 2024-08-07 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection_main: TargetObject|contains|all: - Software\Microsoft\Office\ - \Outlook\Today\ selection_value_stamp: TargetObject|endswith: \Stamp Details: DWORD (0x00000001) selection_value_url: TargetObject|endswith: - \URL - \UserDefinedUrl filter_main_office: Image|startswith: - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\ Image|endswith: \OfficeClickToRun.exe condition: selection_main and 1 of selection_value_* and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: SOC runbook when seeing EDR alert: possible Data Transfer Size Limits (T1030)
Matching passage: Playbook for T1030 Data Transfer Size Limits. 1) Validate alert telemetry against T1030. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: exfiltration. 5) Eradicate persistence and recover. Reference detection notes: An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.
Near-miss passage: Playbook for T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol. Different response path focused on exfiltration.
Query: rule covering Detects creation of files with the ".pub" extension in suspicious or uncommon locations. This could be a sign of attacke
Matching passage: Sigma rule: Detects creation of files with the ".pub" extension in suspicious or uncommon locations. This could be a sign of attacke. Logsource: windows / file_event. Rule: title: Publisher Attachment File Dropped In Suspicious Location id: 3d2a2d59-929c-4b78-8c1a-145dfe9e07b1 status: test description: Detects creation of files with the ".pub" extension in suspicious or uncommon locations. This could be a sign of attackers abusing Publisher documents references: - https://twitter.com/EmericNasi/status/1623224526220804098 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-08 tags: - attack.stealth logsource: category: file_event product: windows detection: selection: TargetFilename|contains: - \AppData\Local\Temp\ - \Users\Public\ - \Windows\Temp\ - C:\Temp\ TargetFilename|endswith: .pub condition: selection falsepositives: - Legitimate usage of ".pub" files from those locations level: medium
Near-miss passage: Sigma rule: Detects keywords from well-known PowerShell exploitation frameworks. Logsource: windows / ps_script. Rule: title: Malicious PowerShell Keywords id: f62176f3-8128-4faa-bf6c-83261322e5eb status: test description: Detects keywords from well-known PowerShell exploitation frameworks references: - https://adsecurity.org/?p=2921 author: Sean Metcalf (source), Florian Roth (Nextron Systems) date: 2017-03-05 modified: 2023-06-20 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - AdjustTokenPrivileges - IMAGE_NT_OPTIONAL_HDR64_MAGIC - Metasploit - Microsoft.Win32.UnsafeNativeMethods - Mimikatz - MiniDumpWriteDump - PAGE_EXECUTE_READ - ReadProcessMemory.Invoke - SE_PRIVILEGE_ENABLED - SECURITY_DELEGATION - TOKEN_ADJUST_PRIVILEGES - TOKEN_ALL_ACCESS - TOKEN_ASSIGN_PRIMARY - TOKEN_DUPLICATE - TOKEN_ELEVATION - TOKEN_IMPERSONATE - TOKEN_INFORMATION_CLASS - TOKEN_PRIVILEGES - TOKEN_QUERY condition: selection falsepositives: - Depending on the scripts, this rule might require some initial tuning to fit the environment level: medium
Query: detect Browser Session Hijacking
Matching passage: T1185 Browser Session Hijacking. Tactics: collection. Description: Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.(Citation: Wikipedia Man in the Browser) A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as a way to pivot into an authenticated intranet.(Citation: Cobalt Strike Browser Pivot)(Citation: ICEBRG Chrome Extensions) Executing browser-based behaviors such as pivoting may require specific process permissions, such as <code>SeDebugPrivilege</code> and/or high-integrity/administrator rights. Another example involves pivoting browser traffic from the adversary's browser through the user's browser by setting up a proxy which will redirect web traffic. This does not alter the user's traffic in any way, and the proxy connection can be severed as soon as the browser is closed. The adversary assumes the security context of whichever browser process the proxy is injected into. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could potentially browse to any resource on an intranet, such as [Sharepoint](https://attack.mitre.org/techniques/T1213/002) or webmail, that is accessible through the browser and which the browser has sufficient permissions. Browser pivoting may also bypass security provided by 2-factor authentication.(Citation: cobaltstrike manual)
Near-miss passage: T1113 Screen Capture. Tactics: collection. Description: Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.(Citation: CopyFromScreen .NET)(Citation: Antiquated Mac Malware)
Query: patch priority for CVE-2015-8996
Matching passage: CVE-2015-8996. CWE: CWE-362. CVSS: 7.0. In TrustZone a time-of-check time-of-use race condition could potentially exist in a QFPROM routine in all Android releases from CAF using the Linux kernel.
Near-miss passage: CVE-2015-5232. CWE: CWE-362. CVSS: 8.100000381469727. Race conditions in opa-fm before 10.4.0.0.196 and opa-ff before 10.4.0.0.197.
Query: detect Detects when verclsid.exe is used to run COM object via GUID in logs
Matching passage: Sigma rule: Detects when verclsid.exe is used to run COM object via GUID. Logsource: windows / process_creation. Rule: title: Verclsid.exe Runs COM Object id: d06be4b9-8045-428b-a567-740a26d9db25 status: test description: Detects when verclsid.exe is used to run COM object via GUID references: - https://lolbas-project.github.io/lolbas/Binaries/Verclsid/ - https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5 - https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/ author: Victor Sergeev, oscd.community date: 2020-10-09 modified: 2025-10-07 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \verclsid.exe - OriginalFileName: verclsid.exe selection_cli: CommandLine|contains|all: - /S - /C filter_main_runtimebroker: ParentImage|endswith: C:\Windows\System32\RuntimeBroker.exe CommandLine|contains|all: - verclsid.exe" /S /C { - '} /I {' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detect usage of the "driverquery" utility to perform reconnaissance on installed drivers. Logsource: windows / process_creation. Rule: title: Potential Recon Activity Using DriverQuery.EXE id: 9fc3072c-dc8f-4bf7-b231-18950000fadd related: - id: a20def93-0709-4eae-9bd2-31206e21e6b2 type: similar status: test description: Detect usage of the "driverquery" utility to perform reconnaissance on installed drivers references: - https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/ - https://www.vmray.com/cyber-security-blog/analyzing-ursnif-behavior-malware-sandbox/ - https://www.fireeye.com/blog/threat-research/2020/01/saigon-mysterious-ursnif-fork.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-19 modified: 2023-09-29 tags: - attack.discovery logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: driverquery.exe - OriginalFileName: drvqry.exe selection_parent: - ParentImage|endswith: - \cscript.exe - \mshta.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - ParentImage|contains: - \AppData\Local\ - \Users\Public\ - \Windows\Temp\ condition: all of selection_* falsepositives: - Legitimate usage by some scripts might trigger this as well level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_driverquery_recon/info.yml
Query: patch priority for CVE-2015-8617
Matching passage: CVE-2015-8617. CWE: CWE-134. CVSS: 9.800000190734863. Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format string specifiers in a string that is misused as a class name, leading to incorrect error handling.
Near-miss passage: CVE-2015-10088. CWE: CWE-134. CVSS: 8.100000381469727. A vulnerability, which was classified as critical, was found in ayttm up to 0.5.0.89. This affects the function http_connect in the library libproxy/proxy.c. The manipulation leads to format string. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The patch is named 40e04680018614a7d2b68566b261b061a0597046. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-222267.