alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: what is T1593
Matching passage: T1593 Search Open Websites/Domains. Tactics: reconnaissance. Description: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.(Citation: Cyware Social Media)(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking) Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Phishing](https://attack.mitre.org/techniques/T1566)).
Near-miss passage: T1593.002 Search Engines. Tactics: reconnaissance. Description: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes).(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking) Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Valid Accounts](https://attack.mitre.org/techniques/T1078) or [Phishing](https://attack.mitre.org/techniques/T1566)).
Query: Multiple failed authentications followed by Overwrite Process Arguments
Matching passage: T1036.011 Overwrite Process Arguments. Tactics: stealth. Description: Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign process. On Linux, the operating system stores command-line arguments in the process’s stack and passes them to the `main()` function as the `argv` array. The first element, `argv[0]`, typically contains the process name or path - by default, the command used to actually start the process (e.g., `cat /etc/passwd`). By default, the Linux `/proc` filesystem uses this value to represent the process name. The `/proc/<PID>/cmdline` file reflects the contents of this memory, and tools like `ps` use it to display process information. Since arguments are stored in user-space memory at launch, this modification can be performed without elevated privileges. During runtime, adversaries can erase the memory used by all command-line arguments for a process, overwriting each argument string with null bytes. This removes evidence of how the process was originally launched. They can then write a spoofed string into the memory region previously occupied by `argv[0]` to mimic a benign command, such as `cat resolv.conf`. The new command-line string is reflected in `/proc/<PID>/cmdline` and displayed by tools like `ps`.(Citation: Sandfly BPFDoor 2022)(Citation: Microsoft XorDdos Linux Stealth 2022)
Near-miss passage: T1036.004 Masquerade Task or Service. Tactics: stealth. Description: Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.(Citation: TechNet Schtasks)(Citation: Systemd Service Units) Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones. Tasks or services contain other fields, such as a description, that adversaries may attempt to make appear legitimate.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Fysbis Dr Web Analysis)
Query: alert when Detects potential DLL sideloading using the Microsoft Office winword process via the '/l' flag.
Matching passage: Sigma rule: Detects potential DLL sideloading using the Microsoft Office winword process via the '/l' flag.. Logsource: windows / process_creation. Rule: title: Potential Arbitrary DLL Load Using Winword id: f7375e28-5c14-432f-b8d1-1db26c832df3 related: - id: 2621b3a6-3840-4810-ac14-a02426086171 type: obsolete status: test description: Detects potential DLL sideloading using the Microsoft Office winword process via the '/l' flag. references: - https://github.com/D4Vinci/One-Lin3r/blob/9fdfa5f0b9c698dfbd4cdfe7d2473192777ae1c6/one_lin3r/core/liners/windows/cmd/dll_loader_word.py author: Victor Sergeev, oscd.community date: 2020-10-09 modified: 2023-03-29 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WINWORD.exe - OriginalFileName: WinWord.exe selection_dll: CommandLine|contains|all: - '/l ' - .dll condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of "hh.exe" to open ".chm" files.. Logsource: windows / process_creation. Rule: title: HH.EXE Execution id: 68c8acb4-1b60-4890-8e82-3ddf7a6dba84 status: test description: Detects the execution of "hh.exe" to open ".chm" files. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.001/T1218.001.md - https://eqllib.readthedocs.io/en/latest/analytics/b25aa548-7937-11e9-8f5c-d46d6d62a49e.html - https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37 author: E.M. Anhaus (originally from Atomic Blue Detections, Dan Beavin), oscd.community date: 2019-10-24 modified: 2023-12-11 tags: - attack.stealth - attack.t1218.001 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: HH.exe - Image|endswith: \hh.exe selection_cli: CommandLine|contains: .chm condition: all of selection_* falsepositives: - False positives are expected with legitimate ".CHM" level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hh_chm_execution/info.yml
Query: vulnerability: The ARP implementation in Cisco NX-OS on Nexus 1000V devices for VMware vSphere 5.2(1)SV3(1.4), Nexus 3000 devices 7.3(0)ZD(0.47), Nexus 4000 devices 4.1(2)E1, Nexus 9000 devices 7
Matching passage: CVE-2015-6277. CWE: CWE-399. CVSS: 6.099999904632568. The ARP implementation in Cisco NX-OS on Nexus 1000V devices for VMware vSphere 5.2(1)SV3(1.4), Nexus 3000 devices 7.3(0)ZD(0.47), Nexus 4000 devices 4.1(2)E1, Nexus 9000 devices 7.3(0)ZD(0.61), and MDS 9000 devices 7.0(0)HSK(0.353) and SAN-OS NX-OS on MDS 9000 devices 7.0(0)HSK(0.353) allows remote attackers to cause a denial of service (ARP process restart) via crafted packet-header fields, aka Bug ID CSCut25292.
Near-miss passage: CVE-2015-2668. CWE: CWE-399. CVSS: 5.0. ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted xz archive file.
Query: exploit Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Mem
Matching passage: CVE-2015-1718. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1658, CVE-2015-1706, CVE-2015-1711, and CVE-2015-1717.
Near-miss passage: CVE-2015-1521. CWE: CWE-119. CVSS: 7.5. analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not properly handle zero values of a packet length, which allows remote attackers to cause a denial of service (buffer overflow or buffer over-read if NDEBUG; otherwise assertion failure) via a crafted DNP3 packet.
Query: detection rule: Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial
Matching passage: Sigma rule: Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial. Logsource: proxy. Rule: title: Suspicious External WebDAV Execution id: 1ae64f96-72b6-48b3-ad3d-e71dff6c6398 related: - id: 4c55738d-72d8-490e-a2db-7969654e375f type: similar status: test description: 'Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns. ' references: - https://dear-territory-023.notion.site/WebDav-Share-Testing-e4950fa0c00149c3aa430d779b9b1d0f?pvs=4 - https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462 - https://www.trendmicro.com/en_no/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html - https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html author: Ahmed Farouk date: 2024-05-10 tags: - attack.initial-access - attack.resource-development - attack.t1584 - attack.t1566 logsource: category: proxy detection: selection_webdav: c-useragent|startswith: Microsoft-WebDAV-MiniRedir/ cs-method: GET selection_execution: c-uri|endswith: - .7z - .bat - .dat - .cmd - .exe - .js - .lnk - .ps1 - .rar - .url - .vbe - .vbs - .zip filter_main_local_ips: dst_ip|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse sh. Logsource: linux / process_creation. Rule: title: Potential Netcat Reverse Shell Execution id: 7f734ed0-4f47-46c0-837f-6ee62505abd9 status: test description: Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse shell setup. references: - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet - https://www.revshells.com/ - https://www.hackingtutorials.org/networking/hacking-netcat-part-2-bind-reverse-shells/ - https://www.infosecademy.com/netcat-reverse-shells/ - https://man7.org/linux/man-pages/man1/ncat.1.html author: '@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)' date: 2023-04-07 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection_nc: Image|endswith: - /nc - /ncat selection_flags: CommandLine|contains: - ' -c ' - ' -e ' selection_shell: CommandLine|contains: - ' ash' - ' bash' - ' bsh' - ' csh' - ' ksh' - ' pdksh' - ' sh' - ' tcsh' - /bin/ash - /bin/bash - /bin/bsh - /bin/csh - /bin/ksh - /bin/pdksh - /bin/sh - /bin/tcsh - /bin/zsh - $IFSash - $IFSbash - $IFSbsh - $IFScsh - $IFSksh - $IFSpdksh - $IFSsh - $IFStcsh - $IFSzsh condition: all of selection_* falsepositives: - Unlikely level: high
Query: vulnerability: Multiple cross-site request forgery (CSRF) vulnerabilities in Ipswitch MOVEit Mobile 1.2.0.962 and earlier allow remote attackers to hijack the authentication of unspecified victim
Matching passage: CVE-2015-7678. CWE: CWE-352. CVSS: 8.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Ipswitch MOVEit Mobile 1.2.0.962 and earlier allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Near-miss passage: CVE-2015-5999. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DIR-816L Wireless Router with firmware before 2.06.B09_BETA allow remote attackers to hijack the authentication of administrators for requests that (1) change the admin password, (2) change the network policy, or (3) possibly have other unspecified impact via crafted requests to hedwig.cgi and pigwidgeon.cgi.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service". Logsource: windows / process_creation. Rule: title: Stop Windows Service Via PowerShell Stop-Service id: c49c5062-0966-4170-9efd-9968c913a6cf related: - id: eb87818d-db5d-49cc-a987-d5da331fbd90 type: obsolete status: test description: Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service" references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/stop-service?view=powershell-7.4 author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2023-03-05 tags: - attack.impact - attack.t1489 logsource: category: process_creation product: windows detection: selection_sc_net_img: - OriginalFileName: - PowerShell.EXE - pwsh.dll - Image|endswith: - \powershell.exe - \pwsh.exe selection_cli: CommandLine|contains: 'Stop-Service ' condition: all of selection_* falsepositives: - There are many legitimate reasons to stop a service. This rule isn't looking for any suspicious behaviour in particular. Filter legitimate activity accordingly level: low
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via use Clip.exe in Scripts. Logsource: windows / system. Rule: title: Invoke-Obfuscation Via Use Clip - System id: 63e3365d-4824-42d8-8b82-e56810fefa0c status: test description: Detects Obfuscated Powershell via use Clip.exe in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-09 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains: (Clipboard|i condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-7444
Matching passage: CVE-2015-7444. CWE: CWE-200. CVSS: 5.300000190734863. The Update Installer in IBM WebSphere Commerce Enterprise 7.0.0.8 and 7.0.0.9 does not properly replicate the search index, which allows attackers to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-2804. CWE: CWE-200. CVSS: 4.300000190734863. The management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400, and 6855 with firmware before 6.6.4.309.R01 and 6.6.5.x before 6.6.5.80.R02 generates weak session identifiers, which allows remote attackers to hijack arbitrary sessions via a brute force attack.
Query: write Sigma for Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary
Matching passage: Sigma rule: Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary. Logsource: windows / registry_event. Rule: title: UAC Bypass Via Wsreset id: 6ea3bf32-9680-422d-9f50-e90716b12a66 status: test description: Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary file contained in a low-privilege registry. references: - https://www.bleepingcomputer.com/news/security/trickbot-uses-a-new-windows-10-uac-bypass-to-launch-quietly - https://lolbas-project.github.io/lolbas/Binaries/Wsreset author: oscd.community, Dmitry Uchakin date: 2020-10-07 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: \AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of regsvr32 where the DLL is located in a potentially suspicious location.. Logsource: windows / process_creation. Rule: title: Regsvr32 Execution From Potential Suspicious Location id: 9525dc73-0327-438c-8c04-13c0e037e9da related: - id: 8e2b24c9-4add-46a0-b4bb-0057b4e6187d type: obsolete status: test description: Detects execution of regsvr32 where the DLL is located in a potentially suspicious location. references: - https://web.archive.org/web/20171001085340/https://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html - https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-05-26 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regsvr32.exe - OriginalFileName: REGSVR32.EXE selection_cli: CommandLine|contains: - :\ProgramData\ - :\Temp\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\Local\Temp\ - \AppData\Roaming\ condition: all of selection_* falsepositives: - Some installers might execute "regsvr32" with DLLs located in %TEMP% or in %PROGRAMDATA%. Apply additional filters if necessary. level: medium
Query: Encoded PowerShell / command-line abuse matching Socket Filters
Matching passage: T1205.002 Socket Filters. Tactics: stealth, persistence, command and control. Description: Adversaries may attach filters to a network socket to monitor then activate backdoors used for persistence or command and control. With elevated permissions, adversaries can use features such as the `libpcap` library to open sockets and install filters to allow or disallow certain types of data to come through the socket. The filter may apply to all traffic passing through the specified network interface (or every interface if not specified). When the network interface receives a packet matching the filter criteria, additional actions can be triggered on the host, such as activation of a reverse shell. To establish a connection, an adversary sends a crafted packet to the targeted host that matches the installed filter criteria.(Citation: haking9 libpcap network sniffing) Adversaries have used these socket filters to trigger the installation of implants, conduct ping backs, and to invoke command shells. Communication with these socket filters may also be used in conjunction with [Protocol Tunneling](https://attack.mitre.org/techniques/T1572).(Citation: exatrack bpf filters passive backdoors)(Citation: Leonardo Turla Penquin May 2020) Filters can be installed on any Unix-like platform with `libpcap` installed or on Windows hosts using `Winpcap`. Adversaries may use either `libpcap` with `pcap_setfilter` or the standard library function `setsockopt` with `SO_ATTACH_FILTER` options. Since the socket connection is not active until the packet is received, this behavior may be difficult to detect due to the lack of activity on a host, low CPU overhead, and limited visibility into raw socket usage.
Near-miss passage: T1205.001 Port Knocking. Tactics: stealth, persistence, command and control. Description: Adversaries may use port knocking to hide open ports used for persistence or command and control. To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports. After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software. This technique has been observed both for the dynamic opening of a listening port as well as the initiating of a connection to a listening server on a different system. The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.
Query: detection rule: Detects suspicious use of 'calc.exe' with command line parameters or in a suspicious directory, which is likely caused b
Matching passage: Sigma rule: Detects suspicious use of 'calc.exe' with command line parameters or in a suspicious directory, which is likely caused b. Logsource: windows / process_creation. Rule: title: Suspicious Calculator Usage id: 737e618a-a410-49b5-bec3-9e55ff7fbc15 status: test description: 'Detects suspicious use of ''calc.exe'' with command line parameters or in a suspicious directory, which is likely caused by some PoC or detection evasion. ' references: - https://twitter.com/ItsReallyNick/status/1094080242686312448 author: Florian Roth (Nextron Systems) date: 2019-02-09 modified: 2023-11-09 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection_1: CommandLine|contains: '\calc.exe ' selection_2: Image|endswith: \calc.exe filter_main_known_locations: Image|contains: - :\Windows\System32\ - :\Windows\SysWOW64\ - :\Windows\WinSxS\ condition: selection_1 or ( selection_2 and not filter_main_known_locations ) falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately. Logsource: azure / activitylogs. Rule: title: Azure Subscription Permission Elevation Via ActivityLogs id: 09438caa-07b1-4870-8405-1dbafe3dad95 status: test description: 'Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn''t planned. This setting could allow an attacker access to Azure subscriptions in your environment. ' references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftauthorization author: Austin Songer @austinsonger date: 2021-11-26 modified: 2022-08-23 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078.004 logsource: product: azure service: activitylogs detection: selection: operationName: MICROSOFT.AUTHORIZATION/ELEVATEACCESS/ACTION condition: selection falsepositives: - If this was approved by System Administrator. level: high
Query: CVE similar to CVE-2015-5647
Matching passage: CVE-2015-5647. CWE: CWE-94. CVSS: 8.5. The RSS Reader component in Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-866.
Near-miss passage: CVE-2015-1645. CWE: CWE-94. CVSS: 9.300000190734863. Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to execute arbitrary code via a crafted Enhanced Metafile (EMF) image, aka "EMF Processing Remote Code Execution Vulnerability."