alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: SIEM correlation: stealth activity consistent with Process Argument Spoofing
Matching passage: T1564.010 Process Argument Spoofing. Tactics: stealth. Description: Adversaries may attempt to hide process command-line arguments by overwriting process memory. Process command-line arguments are stored in the process environment block (PEB), a data structure used by Windows to store various information about/used by a process. The PEB includes the process command-line arguments that are referenced when executing the process. When a process is created, defensive tools/sensors that monitor process creations may retrieve the process arguments from the PEB.(Citation: Microsoft PEB 2021)(Citation: Xpn Argue Like Cobalt 2019) Adversaries may manipulate a process PEB to evade defenses. For example, [Process Hollowing](https://attack.mitre.org/techniques/T1055/012) can be abused to spawn a process in a suspended state with benign arguments. After the process is spawned and the PEB is initialized (and process information is potentially logged by tools/sensors), adversaries may override the PEB to modify the command-line arguments (ex: using the [Native API](https://attack.mitre.org/techniques/T1106) <code>WriteProcessMemory()</code> function) then resume process execution with malicious arguments.(Citation: Cobalt Strike Arguments 2019)(Citation: Xpn Argue Like Cobalt 2019)(Citation: Nviso Spoof Command Line 2020) Adversaries may also execute a process with malicious command-line arguments then patch the memory with benign arguments that may bypass subsequent process memory analysis.(Citation: FireEye FiveHands April 2021) This behavior may also be combined with other tricks (such as [Parent PID Spoofing](https://attack.mitre.org/techniques/T1134/004)) to manipulate or further evade process-based detections.
Near-miss passage: T1564.011 Ignore Process Interrupts. Tactics: stealth. Description: Adversaries may evade defensive mechanisms by executing commands that hide from process interrupt signals. Many operating systems use signals to deliver messages to control process behavior. Command interpreters often include specific commands/flags that ignore errors and other hangups, such as when the user of the active session logs off.(Citation: Linux Signal Man) These interrupt signals may also be used by defensive tools and/or analysts to pause or terminate specified running processes. Adversaries may invoke processes using `nohup`, [PowerShell](https://attack.mitre.org/techniques/T1059/001) `-ErrorAction SilentlyContinue`, or similar commands that may be immune to hangups.(Citation: nohup Linux Man)(Citation: Microsoft PowerShell SilentlyContinue) This may enable malicious commands and malware to continue execution through system events that would otherwise terminate its execution, such as users logging off or the termination of its C2 network connection. Hiding from process interrupt signals may allow malware to continue execution, but unlike [Trap](https://attack.mitre.org/techniques/T1546/005) this does not establish [Persistence](https://attack.mitre.org/tactics/TA0003) since the process will not be re-invoked once actually terminated.
Query: exploit WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application cras
Matching passage: CVE-2015-5807. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-1710. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1694.
Query: indicators of Polymorphic Code
Matching passage: T1027.014 Polymorphic Code. Tactics: stealth. Description: Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection. Polymorphic code is a type of software capable of changing its runtime footprint during code execution.(Citation: polymorphic-blackberry) With each execution of the software, the code is mutated into a different version of itself that achieves the same purpose or objective as the original. This functionality enables the malware to evade traditional signature-based defenses, such as antivirus and antimalware tools.(Citation: polymorphic-sentinelone) Other obfuscation techniques can be used in conjunction with polymorphic code to accomplish the intended effects, including using mutation engines to conduct actions such as [Software Packing](https://attack.mitre.org/techniques/T1027/002), [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010), or [Encrypted/Encoded File](https://attack.mitre.org/techniques/T1027/013).(Citation: polymorphic-linkedin)(Citation: polymorphic-medium)
Near-miss passage: T1027.001 Binary Padding. Tactics: stealth. Description: Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations. Binary padding effectively changes the checksum of the file and can also be used to avoid hash-based blocklists and static anti-virus signatures.(Citation: ESET OceanLotus) The padding used is commonly generated by a function to create junk data and then appended to the end or applied to sections of malware.(Citation: Securelist Malware Tricks April 2017) Increasing the file size may decrease the effectiveness of certain tools and detection capabilities that are not designed or configured to scan large files. This may also reduce the likelihood of being collected for analysis. Public file scanning services, such as VirusTotal, limits the maximum size of an uploaded file to be analyzed.(Citation: VirusTotal FAQ)
Query: describe CVE-2015-8747
Matching passage: CVE-2015-8747. CWE: CWE-20. CVSS: 10.0. The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.
Near-miss passage: CVE-2015-8742. CWE: CWE-20. CVSS: 5.5. The dissect_CPMSetBindings function in epan/dissectors/packet-mswsp.c in the MS-WSP dissector in Wireshark 2.0.x before 2.0.1 does not validate the column size, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet.
Query: vulnerability: Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous befo
Matching passage: CVE-2015-5106. CWE: CWE-269. CVSS: 6.800000190734863. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass intended access restrictions and perform a transition from Low Integrity to Medium Integrity via unspecified vectors, a different vulnerability than CVE-2015-4446 and CVE-2015-5090.
Near-miss passage: CVE-2015-5072. CWE: CWE-269. CVSS: 6.5. The BIRT Engine servlet in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users to "navigate" to arbitrary local files via the __imageid parameter.
Query: write Sigma for Detects the Installation of a Exchange Transport Agent
Matching passage: Sigma rule: Detects the Installation of a Exchange Transport Agent. Logsource: windows / process_creation. Rule: title: MSExchange Transport Agent Installation id: 83809e84-4475-4b69-bc3e-4aad8568612f related: - id: 83809e84-4475-4b69-bc3e-4aad8568612f type: similar status: test description: Detects the Installation of a Exchange Transport Agent references: - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=7 author: Tobias Michalski (Nextron Systems) date: 2021-06-08 modified: 2022-10-09 tags: - attack.persistence - attack.t1505.002 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: Install-TransportAgent condition: selection falsepositives: - Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this. level: medium
Near-miss passage: Sigma rule: Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for re. Logsource: linux / process_creation. Rule: title: Print History File Contents id: d7821ff1-4527-4e33-9f84-d0d57fa2fb66 status: test description: Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance references: - https://github.com/sleventyeleven/linuxprivchecker/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md author: Florian Roth (Nextron Systems) date: 2022-06-20 modified: 2022-09-15 tags: - attack.reconnaissance - attack.t1592.004 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /cat - /head - /tail - /more selection_history: - CommandLine|contains: - /.bash_history - /.zsh_history - CommandLine|endswith: - _history - .history - zhistory condition: all of selection* falsepositives: - Legitimate administration activities level: medium
Query: exploit ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain ad
Matching passage: CVE-2015-7765. CWE: UNKNOWN. CVSS: 9.0. ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access by leveraging knowledge of this password.
Near-miss passage: CVE-2015-0509. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Hyperion BI+ component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote attackers to affect integrity via unknown vectors related to Reporting and Analysis.
Query: Sigma rule for Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote
Matching passage: Sigma rule: Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote. Logsource: windows / process_creation. Rule: title: Suspicious Download from Office Domain id: 00d49ed5-4491-4271-a8db-650a4ef6f8c1 status: test description: Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents references: - https://twitter.com/an0n_r0/status/1474698356635193346?s=12 - https://twitter.com/mrd0x/status/1475085452784844803?s=12 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-12-27 modified: 2022-08-02 tags: - attack.command-and-control - attack.resource-development - attack.t1105 - attack.t1608 logsource: product: windows category: process_creation detection: selection_download: - Image|endswith: - \curl.exe - \wget.exe - CommandLine|contains: - Invoke-WebRequest - 'iwr ' - 'curl ' - 'wget ' - Start-BitsTransfer - .DownloadFile( - .DownloadString( selection_domains: CommandLine|contains: - https://attachment.outlook.live.net/owa/ - https://onenoteonlinesync.onenote.com/onenoteonlinesync/ condition: all of selection_* falsepositives: - Scripts or tools that download attachments from these domains (OneNote, Outlook 365) level: high
Near-miss passage: Sigma rule: Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as. Logsource: windows / file_event. Rule: title: VsCode Powershell Profile Modification id: 3a9fa2ec-30bc-4ebd-b49e-7c9cff225502 related: - id: b5b78988-486d-4a80-b991-930eff3ff8bf type: similar status: test description: Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles?view=powershell-7.2 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-24 modified: 2023-01-06 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.013 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: \Microsoft.VSCode_profile.ps1 condition: selection falsepositives: - Legitimate use of the profile by developers or administrators level: medium
Query: write Sigma for Detects the use of at/atd which are utilities that are used to schedule tasks. They are often abused by adversaries to m
Matching passage: Sigma rule: Detects the use of at/atd which are utilities that are used to schedule tasks. They are often abused by adversaries to m. Logsource: linux / process_creation. Rule: title: Scheduled Task/Job At id: d2d642d7-b393-43fe-bae4-e81ed5915c4b status: stable description: 'Detects the use of at/atd which are utilities that are used to schedule tasks. They are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious code ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.002/T1053.002.md author: Ömer Günal, oscd.community date: 2020-10-06 modified: 2022-07-07 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.002 logsource: product: linux category: process_creation detection: selection: Image|endswith: - /at - /atd condition: selection falsepositives: - Legitimate administration activities level: low
Near-miss passage: Sigma rule: Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the networ. Logsource: windows / file_event. Rule: title: Wmiprvse Wbemcomn DLL Hijack - File id: 614a7e17-5643-4d89-b6fe-f9df1a79641c status: test description: Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario. references: - https://threathunterplaybook.com/hunts/windows/201009-RemoteWMIWbemcomnDLLHijack/notebook.html author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-12 modified: 2022-12-02 tags: - attack.execution - attack.t1047 - attack.lateral-movement - attack.t1021.002 logsource: product: windows category: file_event detection: selection: Image: System TargetFilename|endswith: \wbem\wbemcomn.dll condition: selection falsepositives: - Unknown level: critical
Query: patch priority for CVE-2015-8705
Matching passage: CVE-2015-8705. CWE: CWE-20. CVSS: 7.0. buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when debug logging is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit, or daemon crash) or possibly have unspecified other impact via (1) OPT data or (2) an ECS option.
Near-miss passage: CVE-2015-2754. CWE: CWE-20. CVSS: 6.800000190734863. FreeXL before 1.0.0i allows remote attackers to cause a denial of service (stack corruption) and possibly execute arbitrary code via a crafted workbook, related to a "premature EOF."
Query: write Sigma for Detects execution of Windows Defender "OfflineScannerShell.exe" from its non standard directory. The "OfflineScannerShel
Matching passage: Sigma rule: Detects execution of Windows Defender "OfflineScannerShell.exe" from its non standard directory. The "OfflineScannerShel. Logsource: windows / process_creation. Rule: title: Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution id: 02b18447-ea83-4b1b-8805-714a8a34546a status: test description: 'Detects execution of Windows Defender "OfflineScannerShell.exe" from its non standard directory. The "OfflineScannerShell.exe" binary is vulnerable to DLL side loading and will load any DLL named "mpclient.dll" from the current working directory. ' references: - https://lolbas-project.github.io/lolbas/Binaries/OfflineScannerShell/ author: frack113 date: 2022-03-06 modified: 2023-08-03 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \OfflineScannerShell.exe - OriginalFileName: OfflineScannerShell.exe filter_main_legit_dir: CurrentDirectory: C:\Program Files\Windows Defender\Offline\ filter_main_empty: CurrentDirectory: '' filter_main_null: CurrentDirectory: null condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation). Logsource: windows / process_creation. Rule: title: Suspicious Shells Spawn by Java Utility Keytool id: 90fb5e62-ca1f-4e22-b42e-cc521874c938 status: test description: Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation) references: - https://redcanary.com/blog/intelligence-insights-december-2021 - https://www.synacktiv.com/en/publications/how-to-exploit-cve-2021-40539-on-manageengine-adselfservice-plus.html author: Andreas Hunkeler (@Karneades) date: 2021-12-22 modified: 2023-01-21 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \keytool.exe Image|endswith: - \cmd.exe - \sh.exe - \bash.exe - \powershell.exe - \pwsh.exe - \schtasks.exe - \certutil.exe - \whoami.exe - \bitsadmin.exe - \wscript.exe - \cscript.exe - \scrcons.exe - \regsvr32.exe - \hh.exe - \wmic.exe - \mshta.exe - \rundll32.exe - \forfiles.exe - \scriptrunner.exe - \mftrace.exe - \AppVLP.exe - \systeminfo.exe - \reg.exe - \query.exe condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-2577
Matching passage: CVE-2015-2577. CWE: UNKNOWN. CVSS: 7.199999809265137. Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Accounting commands.
Near-miss passage: CVE-2015-4804. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the PeopleSoft Enterprise HCM Talent Acquisition Management component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
Query: detect Detects processes that query known 3rd party registry keys that holds credentials via commandline in logs
Matching passage: Sigma rule: Detects processes that query known 3rd party registry keys that holds credentials via commandline. Logsource: windows / process_creation. Rule: title: Enumeration for 3rd Party Creds From CLI id: 87a476dc-0079-4583-a985-dee7a20a03de related: - id: e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1 type: derived - id: cc1abf27-78a3-4ac5-a51c-f3070b1d8e40 type: similar status: test description: Detects processes that query known 3rd party registry keys that holds credentials via commandline references: - https://isc.sans.edu/diary/More+Data+Exfiltration/25698 - https://github.com/synacktiv/Radmin3-Password-Cracker/blob/acfc87393e4b7c06353973a14a6c7126a51f36ac/regkey.txt - https://github.com/HyperSine/how-does-MobaXterm-encrypt-password - https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#inside-the-registry author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-20 modified: 2025-05-22 tags: - attack.credential-access - attack.t1552.002 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - \Software\Aerofox\Foxmail\V3.1 - \Software\Aerofox\FoxmailPreview - \Software\DownloadManager\Passwords - \Software\FTPWare\COREFTP\Sites - \Software\IncrediMail\Identities - \Software\Martin Prikryl\WinSCP 2\Sessions - \Software\Mobatek\MobaXterm\ - \Software\OpenSSH\Agent\Keys - \Software\OpenVPN-GUI\configs - \Software\ORL\WinVNC3\Password - \Software\Qualcomm\Eudora\CommandLine - \Software\RealVNC\WinVNC4 - \Software\RimArts\B2\Settings - \Software\SimonTatham\PuTTY\Sessions - \Software\SimonTatham\PuTTY\SshHostKeys\ - \Software\Sota\FFFTP - \Software\TightVNC\Server - \Software\WOW6432Node\Radmin\v3.0\Server\Parameters\Radmin filter_main_other_rule: Image|endswith: reg.exe CommandLine|contains: - export - save condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the injection of code by overwriting the memory map of a Linux process using the "dd" Linux command.. Logsource: linux / process_creation. Rule: title: Potential Linux Process Code Injection Via DD Utility id: 4cad6c64-d6df-42d6-8dae-eb78defdc415 status: test description: Detects the injection of code by overwriting the memory map of a Linux process using the "dd" Linux command. references: - https://www.aon.com/cyber-solutions/aon_cyber_labs/linux-based-inter-process-code-injection-without-ptrace2/ - https://github.com/AonCyberLabs/Cexigua/blob/34d338620afae4c6335ba8d8d499e1d7d3d5d7b5/overwrite.sh author: Joseph Kamau date: 2023-12-01 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.009 logsource: product: linux category: process_creation detection: selection: Image|endswith: /dd CommandLine|contains|all: - of= - /proc/ - /mem condition: selection falsepositives: - Unknown level: medium
Query: containment actions for Outbound C2 pattern associated with Exfiltration Over Alternative Protocol
Matching passage: Playbook for T1048 Exfiltration Over Alternative Protocol. 1) Validate alert telemetry against T1048. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: exfiltration. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to e
Near-miss passage: Playbook for T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol. Different response path focused on exfiltration.