alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding. in logs
Matching passage: Sigma rule: Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted id: 25cb259b-bbdc-4b87-98b7-90d7c72f8743 status: test description: Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1 author: Austin Songer @austinsonger date: 2021-08-07 modified: 2022-08-23 tags: - attack.impact - attack.credential-access - attack.t1485 - attack.t1496 - attack.t1489 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLEBINDINGS/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLEBINDINGS/DELETE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLEBINDINGS/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLEBINDINGS/DELETE condition: selection falsepositives: - RoleBinding/ClusterRoleBinding being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - RoleBinding/ClusterRoleBinding modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects the use of smbexec.py tool by detecting a specific service installation. Logsource: windows / system. Rule: title: smbexec.py Service Installation id: 52a85084-6989-40c3-8f32-091e12e13f09 status: test description: Detects the use of smbexec.py tool by detecting a specific service installation references: - https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-2-psexec-and-services/ - https://github.com/fortra/impacket/blob/33058eb2fde6976ea62e04bc7d6b629d64d44712/examples/smbexec.py#L286-L296 - https://github.com/fortra/impacket/blob/edef71f17bc1240f9f8c957bbda98662951ac3ec/examples/smbexec.py#L60 author: Omer Faruk Celik date: 2018-03-20 modified: 2023-11-09 tags: - attack.lateral-movement - attack.execution - attack.t1021.002 - attack.t1569.002 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7045 selection_service_name: ServiceName: BTOBTO selection_service_image: ImagePath|contains: - '.bat & del ' - __output 2^>^&1 > condition: selection_eid and 1 of selection_service_* falsepositives: - Unknown level: high
Query: vulnerability: The CryptProtectMemory function in cng.sys (aka the Cryptography Next Generation driver) in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows
Matching passage: CVE-2015-0010. CWE: CWE-310. CVSS: 1.899999976158142. The CryptProtectMemory function in cng.sys (aka the Cryptography Next Generation driver) in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1, when the CRYPTPROTECTMEMORY_SAME_LOGON option is used, does not check an impersonation token's level, which allows local users to bypass intended decryption restrictions by leveraging a service that (1) has a named-pipe planting vulnerability or (2) uses world-readable shared memory for encrypted data, aka "CNG Security Feature Bypass Vulnerability" or MSRC ID 20707.
Near-miss passage: CVE-2015-5824. CWE: CWE-310. CVSS: 4.300000190734863. The NSURL implementation in the CFNetwork SSL component in Apple iOS before 9 does not properly verify X.509 certificates from SSL servers after a certificate change, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Query: Multiple failed authentications followed by Office Test
Matching passage: T1137.002 Office Test. Tactics: persistence. Description: Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications. This Registry key is not created by default during an Office installation.(Citation: Hexacorn Office Test)(Citation: Palo Alto Office Test Sofacy) There exist user and global Registry keys for the Office Test feature, such as: * <code>HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf</code> * <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Office test\Special\Perf</code> Adversaries may add this Registry key and specify a malicious DLL that will be executed whenever an Office application, such as Word or Excel, is started.
Near-miss passage: T1137.001 Office Template Macros. Tactics: persistence. Description: Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Microsoft Office contains templates that are part of common Office applications and are used to customize styles. The base templates within the application are used each time an application starts. (Citation: Microsoft Change Normal Template) Office Visual Basic for Applications (VBA) macros (Citation: MSDN VBA in Office) can be inserted into the base template and used to execute code when the respective Office application starts in order to obtain persistence. Examples for both Word and Excel have been discovered and published. By default, Word has a Normal.dotm template created that can be modified to include a malicious macro. Excel does not have a template file created by default, but one can be added that will automatically be loaded.(Citation: enigma0x3 normal.dotm)(Citation: Hexacorn Office Template Macros) Shared templates may also be stored and pulled from remote locations.(Citation: GlobalDotName Jun 2019) Word Normal.dotm location:<br> <code>C:\Users\&lt;username&gt;\AppData\Roaming\Microsoft\Templates\Normal.dotm</code> Excel Personal.xlsb location:<br> <code>C:\Users\&lt;username&gt;\AppData\Roaming\Microsoft\Excel\XLSTART\PERSONAL.XLSB</code> Adversaries may also change the location of the base template to point to their own by hijacking the application's search order, e.g. Word 2016 will first look for Normal.dotm under <code>C:\Program Files (x86)\Microsoft Office\root\Office16\</code>, or by modifying the GlobalDotName registry key. By modifying the GlobalDotName registry key an adversary can specify an arbitrary location, file name, and file extension to use for the template that will be loaded on application startup. To abuse GlobalDotName, adversaries may first need to register the template as a trusted document or place it in a trusted location.(Citation: GlobalDotName Jun 2019) An adversary may need to enable macros to execute unrestricted depending
Query: patch priority for CVE-2015-5303
Matching passage: CVE-2015-5303. CWE: CWE-254. CVSS: 7.5. The TripleO Heat templates (tripleo-heat-templates), when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter.
Near-miss passage: CVE-2015-5759. CWE: CWE-254. CVSS: 5.0. WebKit in Apple iOS before 8.4.1 allows remote attackers to spoof clicks via a crafted web site that leverages tap events.
Query: vulnerability: The Hidden Service (HS) server implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote attackers to cause a denial of service (asse
Matching passage: CVE-2015-2928. CWE: UNKNOWN. CVSS: 7.5. The Hidden Service (HS) server implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors.
Near-miss passage: CVE-2015-1031. CWE: UNKNOWN. CVSS: 7.5. Multiple use-after-free vulnerabilities in Privoxy before 3.0.22 allow remote attackers to have unspecified impact via vectors related to (1) the unmap function in list.c or (2) "two additional unconfirmed use-after-free complaints made by Coverity scan." NOTE: some of these details are obtained from third party information.
Query: Sigma rule for NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are leg
Matching passage: Sigma rule: NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are leg. Logsource: zeek / dns. Rule: title: New Kind of Network (NKN) Detection id: fa7703d6-0ee8-4949-889c-48c84bc15b6f status: test description: NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma> references: - https://github.com/nknorg/nkn-sdk-go - https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/ - https://github.com/Maka8ka/NGLite author: Michael Portera (@mportatoes) date: 2022-04-21 tags: - attack.command-and-control logsource: product: zeek service: dns detection: selection: query|contains|all: - seed - .nkn.org condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows. Logsource: windows / process_creation. Rule: title: Arbitrary Shell Command Execution Via Settingcontent-Ms id: 24de4f3b-804c-4165-b442-5a06a2302c7e status: test description: The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries. references: - https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39 author: Sreeman date: 2020-03-13 modified: 2022-04-14 tags: - attack.t1204 - attack.t1566.001 - attack.execution - attack.initial-access logsource: category: process_creation product: windows detection: selection: CommandLine|contains: .SettingContent-ms filter: CommandLine|contains: immersivecontrolpanel condition: selection and not filter falsepositives: - Unknown level: medium
Query: Outbound C2 pattern associated with Server Software Component
Matching passage: T1505 Server Software Component. Tactics: persistence. Description: Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.(Citation: volexity_0day_sophos_FW)
Near-miss passage: T1505.005 Terminal Services DLL. Tactics: persistence. Description: Adversaries may abuse components of Terminal Services to enable persistent access to systems. Microsoft Terminal Services, renamed to Remote Desktop Services in some Windows Server OSs as of 2022, enable remote terminal connections to hosts. Terminal Services allows servers to transmit a full, interactive, graphical user interface to clients via RDP.(Citation: Microsoft Remote Desktop Services) [Windows Service](https://attack.mitre.org/techniques/T1543/003)s that are run as a "generic" process (ex: <code>svchost.exe</code>) load the service's DLL file, the location of which is stored in a Registry entry named <code>ServiceDll</code>.(Citation: Microsoft System Services Fundamentals) The <code>termsrv.dll</code> file, typically stored in `%SystemRoot%\System32\`, is the default <code>ServiceDll</code> value for Terminal Services in `HKLM\System\CurrentControlSet\services\TermService\Parameters\`. Adversaries may modify and/or replace the Terminal Services DLL to enable persistent access to victimized hosts.(Citation: James TermServ DLL) Modifications to this DLL could be done to execute arbitrary payloads (while also potentially preserving normal <code>termsrv.dll</code> functionality) as well as to simply enable abusable features of Terminal Services. For example, an adversary may enable features such as concurrent [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) sessions by either patching the <code>termsrv.dll</code> file or modifying the <code>ServiceDll</code> value to point to a DLL that provides increased RDP functionality.(Citation: Windows OS Hub RDP)(Citation: RDPWrap Github) On a non-server Windows OS this increased functionality may also enable an adversary to avoid Terminal Services prompts that warn/log out users of a system when a new RDP session is created.
Query: secure coding against Device Unlock Credential Sharing
Matching passage: CWE-1273 Device Unlock Credential Sharing. The credentials necessary for unlocking a device are shared across multiple parties and may expose sensitive information.
Near-miss passage: CWE-1041 Use of Redundant Code. The product has multiple functions, methods, procedures, macros, etc. that contain the same code.
Query: patch priority for CVE-2015-3216
Matching passage: CVE-2015-3216. CWE: CWE-189. CVSS: 4.300000190734863. Race condition in a certain Red Hat patch to the PRNG lock implementation in the ssleay_rand_bytes function in OpenSSL, as distributed in openssl-1.0.1e-25.el7 in Red Hat Enterprise Linux (RHEL) 7 and other products, allows remote attackers to cause a denial of service (application crash) by establishing many TLS sessions to a multithreaded server, leading to use of a negative value for a certain length field.
Near-miss passage: CVE-2015-3808. CWE: CWE-189. CVSS: 7.800000190734863. The dissect_lbmr_pser function in epan/dissectors/packet-lbmr.c in the LBMR dissector in Wireshark 1.12.x before 1.12.5 does not reject a zero length, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
Query: exploit Multiple unspecified vulnerabilities in TIBCO Spotfire Client and Spotfire Web Player Client in Spotfire Analyst before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x bef
Matching passage: CVE-2015-4554. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in TIBCO Spotfire Client and Spotfire Web Player Client in Spotfire Analyst before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Analytics Platform for AWS 6.5 and 7.0.x before 7.0.1; Spotfire Automation Services before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Deployment Kit before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Desktop before 6.5.2 and 7.0.x before 7.0.1; Spotfire Desktop Language Packs 7.0.x before 7.0.1; Spotfire Professional before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Web Player before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; and Silver Fabric Enabler for Spotfire Web Player before 2.1.1 allow remote attackers to execute arbitrary code or obtain sensitive information via unknown vectors.
Near-miss passage: CVE-2015-7654. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted attachSound arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
Query: exploit The (1) Cross-System Tools and (2) Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, which allows remote attackers to obtain access via unspecified vectors, aka 
Matching passage: CVE-2015-5067. CWE: CWE-255. CVSS: 7.5. The (1) Cross-System Tools and (2) Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, which allows remote attackers to obtain access via unspecified vectors, aka SAP Security Notes 2059659 and 2057982.
Near-miss passage: CVE-2015-4319. CWE: CWE-255. CVSS: 5.5. The password-change feature in the administrative web interface in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.1 improperly performs authorization, which allows remote authenticated users to reset arbitrary active-user passwords via unspecified vectors, aka Bug ID CSCuv12338.
Query: CVE similar to CVE-2015-0316
Matching passage: CVE-2015-0316. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, and CVE-2015-0330.
Near-miss passage: CVE-2015-0326. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2015-0325 and CVE-2015-0328.
Query: describe CVE-2015-5410
Matching passage: CVE-2015-5410. CWE: UNKNOWN. CVSS: 6.5. HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to execute arbitrary code or cause a denial of service via unspecified vectors.
Near-miss passage: CVE-2015-0430. CWE: UNKNOWN. CVSS: 1.899999976158142. Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect confidentiality via vectors related to RPC Utility.
Query: CVE similar to CVE-2015-1820
Matching passage: CVE-2015-1820. CWE: CWE-384. CVSS: 9.800000190734863. REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect.
Near-miss passage: CVE-2015-5384. CWE: CWE-384. CVSS: 8.800000190734863. AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier is vulnerable to a Session Fixation attack.
Query: exploit Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo 
Matching passage: CVE-2015-3340. CWE: CWE-200. CVSS: 2.9000000953674316. Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.
Near-miss passage: CVE-2015-5089. CWE: CWE-200. CVSS: 5.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2014-8450, CVE-2015-4449, CVE-2015-4450, CVE-2015-5088, and CVE-2015-5092.
Query: detection rule: Detects the installation of RTCore service. Which could be an indication of Micro-Star MSI Afterburner vulnerable driver
Matching passage: Sigma rule: Detects the installation of RTCore service. Which could be an indication of Micro-Star MSI Afterburner vulnerable driver. Logsource: windows / system. Rule: title: RTCore Suspicious Service Installation id: 91c49341-e2ef-40c0-ac45-49ec5c3fe26c status: test description: Detects the installation of RTCore service. Which could be an indication of Micro-Star MSI Afterburner vulnerable driver abuse references: - https://github.com/br-sn/CheekyBlinder/blob/e1764a8a0e7cda8a3716aefa35799f560686e01c/CheekyBlinder/CheekyBlinder.cpp author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-30 tags: - attack.persistence logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ServiceName: RTCore64 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of "ioreg" which will show I/O Kit registry information. This process is used for system information dis. Logsource: macos / process_creation. Rule: title: System Information Discovery Using Ioreg id: 2d5e7a8b-f484-4a24-945d-7f0efd52eab0 status: test description: 'Detects the use of "ioreg" which will show I/O Kit registry information. This process is used for system information discovery. It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings. ' references: - https://www.virustotal.com/gui/file/0373d78db6c3c0f6f6dcc409821bf89e1ad8c165d6f95c5c80ecdce2219627d7/behavior - https://www.virustotal.com/gui/file/4ffdc72d1ff1ee8228e31691020fc275afd1baee5a985403a71ca8c7bd36e2e4/behavior - https://www.virustotal.com/gui/file/5907d59ec1303cfb5c0a0f4aaca3efc0830707d86c732ba6b9e842b5730b95dc/behavior - https://www.trendmicro.com/en_ph/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-12-20 modified: 2024-01-02 tags: - attack.discovery - attack.t1082 logsource: product: macos category: process_creation detection: selection_img: - Image|endswith: /ioreg - CommandLine|contains: ioreg selection_cmd1: CommandLine|contains: - -l - -c selection_cmd2: CommandLine|contains: - AppleAHCIDiskDriver - IOPlatformExpertDevice - Oracle - Parallels - USB Vendor Name - VirtualBox - VMware condition: all of selection_* falsepositives: - Legitimate administrative activities level: medium
Query: incident response steps for Suspicious Space after Filename execution detected on endpoint
Matching passage: Playbook for T1036.006 Space after Filename. 1) Validate alert telemetry against T1036.006. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system. For example, if there is a Mach-O executable file called <code>evil.bin</code>, when it is double clicked by a user, it will launc
Near-miss passage: Playbook for T1036.008 Masquerade File Type. Different response path focused on stealth.