alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is
Matching passage: Sigma rule: Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is. Logsource: windows / taskscheduler. Rule: title: Scheduled Task Executed Uncommon LOLBIN id: f0767f15-0fb3-44b9-851e-e8d9a6d0005d status: test description: Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is an unusual program to be run from a Scheduled Task references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-05 modified: 2023-02-07 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.005 logsource: product: windows service: taskscheduler definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger' detection: selection: EventID: 129 Path|endswith: - \calc.exe - \cscript.exe - \mshta.exe - \mspaint.exe - \notepad.exe - \regsvr32.exe - \wscript.exe condition: selection falsepositives: - False positives may occur with some of the selected binaries if you have tasks using them (which could be very common in your environment). Exclude all the specific trusted tasks before using this rule level: medium
Near-miss passage: Sigma rule: Detects suspicious msiexec process starts with web addresses as parameter. Logsource: windows / process_creation. Rule: title: MsiExec Web Install id: f7b5f842-a6af-4da5-9e95-e32478f3cd2f related: - id: 8150732a-0c9d-4a99-82b9-9efb9b90c40c type: similar status: test description: Detects suspicious msiexec process starts with web addresses as parameter references: - https://blog.trendmicro.com/trendlabs-security-intelligence/attack-using-windows-installer-msiexec-exe-leads-lokibot/ author: Florian Roth (Nextron Systems) date: 2018-02-09 modified: 2022-01-07 tags: - attack.stealth - attack.t1218.007 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - ' msiexec' - :// condition: selection falsepositives: - False positives depend on scripts and administrative tools used in the monitored environment level: medium
Query: exploit The Connection Conversation Manager (aka CuCsMgr) process in Cisco Unity Connection 8.5 before 8.5(1)SU6, 8.6 before 8.6(2a)SU4, and 9.x before 9.1(2)SU2, when SIP trunk integratio
Matching passage: CVE-2015-0612. CWE: CWE-19. CVSS: 7.099999904632568. The Connection Conversation Manager (aka CuCsMgr) process in Cisco Unity Connection 8.5 before 8.5(1)SU6, 8.6 before 8.6(2a)SU4, and 9.x before 9.1(2)SU2, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (SIP outage) via a crafted UDP packet, aka Bug ID CSCuh25062.
Near-miss passage: CVE-2015-8240. CWE: CWE-19. CVSS: 7.5. The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and BIG-IP PEM before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.0 HF6 and BIG-IP PSM before 11.4.1 HF10 does not properly handle TCP options, which allows remote attackers to cause a denial of service via unspecified vectors, related to the tm.minpathmtu database variable.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.. Logsource: windows / process_creation. Rule: title: Potential Amazon SSM Agent Hijacking id: d20ee2f4-822c-4827-9e15-41500b1fff10 status: test description: Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report. references: - https://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan - https://www.bleepingcomputer.com/news/security/amazons-aws-ssm-agent-can-be-used-as-post-exploitation-rat-malware/ - https://www.helpnetsecurity.com/2023/08/02/aws-instances-attackers-access/ author: Muhammad Faisal date: 2023-08-02 tags: - attack.command-and-control - attack.persistence - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: Image|endswith: \amazon-ssm-agent.exe CommandLine|contains|all: - '-register ' - '-code ' - '-id ' - '-region ' condition: selection falsepositives: - Legitimate activity of system administrators level: medium
Near-miss passage: Sigma rule: Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned D. Logsource: windows / security-mitigations. Rule: title: Microsoft Defender Blocked from Loading Unsigned DLL id: 0b0ea3cc-99c8-4730-9c53-45deee2a4c86 status: test description: Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs which may be an attempt to sideload arbitrary DLL references: - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool author: Bhabesh Raj date: 2022-08-02 modified: 2022-09-28 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows service: security-mitigations detection: selection: EventID: - 11 - 12 ProcessPath|endswith: - \MpCmdRun.exe - \NisSrv.exe condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-8615
Matching passage: CVE-2015-8615. CWE: CWE-254. CVSS: 5.0. The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ).
Near-miss passage: CVE-2015-7044. CWE: CWE-254. CVSS: 7.599999904632568. The System Integrity Protection feature in Apple OS X before 10.11.2 mishandles union mounts, which allows attackers to execute arbitrary code in a privileged context via a crafted app with root privileges.
Query: detect Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string in logs
Matching passage: Sigma rule: Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string. Logsource: proxy. Rule: title: Rclone Activity via Proxy id: 2c03648b-e081-41a5-b9fb-7d854a915091 status: test description: Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string references: - https://rclone.org/ - https://www.kroll.com/en/insights/publications/cyber/new-m365-business-email-compromise-attacks-with-rclone author: Janantha Marasinghe date: 2022-10-18 tags: - attack.exfiltration - attack.t1567.002 logsource: category: proxy detection: selection: c-useragent|startswith: rclone/v condition: selection falsepositives: - Valid requests with this exact user agent to that is used by legitimate scripts or sysadmin operations level: medium
Near-miss passage: Sigma rule: Detects the abuse of custom file open handler, executing powershell. Logsource: windows / registry_set. Rule: title: Custom File Open Handler Executes PowerShell id: 7530b96f-ad8e-431d-a04d-ac85cc461fdc status: test description: Detects the abuse of custom file open handler, executing powershell references: - https://news.sophos.com/en-us/2022/02/01/solarmarker-campaign-used-novel-registry-changes-to-establish-persistence/?cmp=30728 author: CD_R0M_ date: 2022-06-11 modified: 2023-08-17 tags: - attack.stealth - attack.t1202 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: shell\open\command\ Details|contains|all: - powershell - -command condition: selection falsepositives: - Unknown level: high
Query: playbook for alert: Persistence mechanism resembling Indicator Removal from Tools
Matching passage: Playbook for T1027.005 Indicator Removal from Tools. 1) Validate alert telemetry against T1027.005. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems. A good example of this is when malware is detected with a file signature
Near-miss passage: Playbook for T1027.016 Junk Code Insertion. Different response path focused on stealth.
Query: explain CWE-1335
Matching passage: CWE-1335 Incorrect Bitwise Shift of Integer. An integer value is specified to be shifted by a negative amount or an amount greater than or equal to the number of bits contained in the value causing an unexpected or indeterminate result.
Near-miss passage: CWE-862 Missing Authorization. The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Query: exploit The AMF3ReadString function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to cause a denial of service (invalid pointer dereference and process crash).
Matching passage: CVE-2015-8270. CWE: CWE-476. CVSS: 7.5. The AMF3ReadString function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to cause a denial of service (invalid pointer dereference and process crash).
Near-miss passage: CVE-2015-9132. CWE: CWE-476. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Small Cell SoC FSM9055, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 800, and SD 810, possible arbitrary memory read due to untrusted pointer dereference when handling HLOS controlled values passed to the QSEE syscall helper.
Query: risk of Array index error in the MidiManagerUsb::DispatchSendMidiData function in media/midi/midi_manager_usb.cc in Google Chrome before 41.0.2272.76 allows remote attackers to cause a den
Matching passage: CVE-2015-1232. CWE: CWE-119. CVSS: 7.5. Array index error in the MidiManagerUsb::DispatchSendMidiData function in media/midi/midi_manager_usb.cc in Google Chrome before 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging renderer access to provide an invalid port index that triggers an out-of-bounds write operation, a different vulnerability than CVE-2015-1212.
Near-miss passage: CVE-2015-8299. CWE: CWE-119. CVSS: 9.800000190734863. Buffer overflow in the Group messages monitor (Falcon) in KNX ETS 4.1.5 (Build 3246) allows remote attackers to execute arbitrary code via a crafted KNXnet/IP UDP packet.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Uses the .NET InstallUtil.exe application in order to execute image without log. Logsource: windows / process_creation. Rule: title: Suspicious Execution of InstallUtil Without Log id: d042284c-a296-4988-9be5-f424fadcc28c status: test description: Uses the .NET InstallUtil.exe application in order to execute image without log references: - https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/ - https://learn.microsoft.com/en-us/dotnet/framework/tools/installutil-exe-installer-tool author: frack113 date: 2022-01-23 modified: 2022-02-04 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: Image|endswith: \InstallUtil.exe Image|contains: Microsoft.NET\Framework CommandLine|contains|all: - '/logfile= ' - /LogToConsole=false condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are prog. Logsource: windows / process_creation. Rule: title: Suspicious ScreenSave Change by Reg.exe id: 0fc35fc3-efe6-4898-8a37-0b233339524f status: test description: 'Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.002/T1546.002.md - https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf author: frack113 date: 2021-08-19 modified: 2022-06-02 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.002 logsource: category: process_creation product: windows detection: selection_reg: Image|endswith: \reg.exe CommandLine|contains: - HKEY_CURRENT_USER\Control Panel\Desktop - HKCU\Control Panel\Desktop selection_option_1: CommandLine|contains|all: - /v ScreenSaveActive - /t REG_SZ - /d 1 - /f selection_option_2: CommandLine|contains|all: - /v ScreenSaveTimeout - /t REG_SZ - '/d ' - /f selection_option_3: CommandLine|contains|all: - /v ScreenSaverIsSecure - /t REG_SZ - /d 0 - /f selection_option_4: CommandLine|contains|all: - /v SCRNSAVE.EXE - /t REG_SZ - '/d ' - .scr - /f condition: selection_reg and 1 of selection_option_* falsepositives: - GPO level: medium
Query: indicators of Data from Local System
Matching passage: T1005 Data from Local System. Tactics: collection. Description: Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106) as well as a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008), which have functionality to interact with the file system to gather information.(Citation: show_run_config_cmd_cisco) Adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on the local system.
Near-miss passage: T1557.002 ARP Cache Poisoning. Tactics: credential access, collection. Description: Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices. This activity may be used to enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). The ARP protocol is used to resolve IPv4 addresses to link layer addresses, such as a media access control (MAC) address.(Citation: RFC826 ARP) Devices in a local network segment communicate with each other by using link layer addresses. If a networked device does not have the link layer address of a particular networked device, it may send out a broadcast ARP request to the local network to translate the IP address to a MAC address. The device with the associated IP address directly replies with its MAC address. The networked device that made the ARP request will then use as well as store that information in its ARP cache. An adversary may passively wait for an ARP request to poison the ARP cache of the requesting device. The adversary may reply with their MAC address, thus deceiving the victim by making them believe that they are communicating with the intended networked device. For the adversary to poison the ARP cache, their reply must be faster than the one made by the legitimate IP address owner. Adversaries may also send a gratuitous ARP reply that maliciously announces the ownership of a particular IP address to all the devices in the local network segment. The ARP protocol is stateless and does not require authentication. Therefore, devices may wrongly add or update the MAC address of the IP address in their ARP cache.(Citation: Sans ARP Spoofing Aug 2003)(Citation: Cylance Cleaver) Adversaries may use ARP cache poisoning as a means to intercept network traffic. This activity may be used to collect and/or relay data such as credentials, especially those sent over an insecure, unencrypted protocol.(Citation:
Query: explain CWE-575
Matching passage: CWE-575 EJB Bad Practices: Use of AWT Swing. The product violates the Enterprise JavaBeans (EJB) specification by using AWT/Swing.
Near-miss passage: CWE-228 Improper Handling of Syntactically Invalid Structure. The product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the associated specification.
Query: detection rule: Detects when a API Token is revoked.
Matching passage: Sigma rule: Detects when a API Token is revoked.. Logsource: okta / okta. Rule: title: Okta API Token Revoked id: cf1dbc6b-6205-41b4-9b88-a83980d2255b status: test description: Detects when a API Token is revoked. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-12 modified: 2026-04-27 tags: - attack.impact logsource: product: okta service: okta detection: selection: eventType: system.api_token.revoke condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authenticatio. Logsource: kubernetes / audit. Rule: title: Kubernetes Unauthorized or Unauthenticated Access id: 0d933542-1f1f-420d-97d4-21b2c3c492d9 status: test description: 'Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used. This may indicate an attacker attempting to leverage credentials they have obtained. ' references: - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/ - https://www.datadoghq.com/blog/monitor-kubernetes-audit-logs/#monitor-api-authentication-issues author: kelnage date: 2024-04-12 tags: - attack.privilege-escalation logsource: product: kubernetes service: audit detection: selection: responseStatus.code: - 401 - 403 condition: selection falsepositives: - A misconfigured RBAC policy, a mistake by a valid user, or a wider issue with authentication tokens can also generate these errors. level: low
Query: indicators of SMS Pumping
Matching passage: T1496.003 SMS Pumping. Tactics: impact. Description: Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted service availability.(Citation: Twilio SMS Pumping) SMS pumping is a type of telecommunications fraud whereby a threat actor first obtains a set of phone numbers from a telecommunications provider, then leverages a victim’s messaging infrastructure to send large amounts of SMS messages to numbers in that set. By generating SMS traffic to their phone number set, a threat actor may earn payments from the telecommunications provider.(Citation: Twilio SMS Pumping Fraud) Threat actors often use publicly available web forms, such as one-time password (OTP) or account verification fields, in order to generate SMS traffic. These fields may leverage services such as Twilio, AWS SNS, and Amazon Cognito in the background.(Citation: Twilio SMS Pumping)(Citation: AWS RE:Inforce Threat Detection 2024) In response to the large quantity of requests, SMS costs may increase and communication channels may become overwhelmed.(Citation: Twilio SMS Pumping)
Near-miss passage: T1496.004 Cloud Service Hijacking. Tactics: impact. Description: Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability. For example, adversaries may leverage email and messaging services, such as AWS Simple Email Service (SES), AWS Simple Notification Service (SNS), SendGrid, and Twilio, in order to send large quantities of spam / [Phishing](https://attack.mitre.org/techniques/T1566) emails and SMS messages.(Citation: Invictus IR DangerDev 2024)(Citation: Permiso SES Abuse 2023)(Citation: SentinelLabs SNS Sender 2024) Alternatively, they may engage in LLMJacking by leveraging reverse proxies to hijack the power of cloud-hosted AI models.(Citation: Sysdig LLMJacking 2024)(Citation: Lacework LLMJacking 2024) In some cases, adversaries may leverage services that the victim is already using. In others, particularly when the service is part of a larger cloud platform, they may first enable the service.(Citation: Sysdig LLMJacking 2024) Leveraging SaaS applications may cause the victim to incur significant financial costs, use up service quotas, and otherwise impact availability.
Query: CVE similar to CVE-2015-3091
Matching passage: CVE-2015-3091. CWE: CWE-200. CVSS: 5.0. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2015-3092.
Near-miss passage: CVE-2015-3412. CWE: CWE-200. CVSS: 5.300000190734863. PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the stream_resolve_include_path function in ext/standard/streamsfuncs.c, as demonstrated by a filename\0.extension attack that bypasses an intended configuration in which client users may read files with only one specific extension.
Query: resource development using Botnet
Matching passage: T1584.005 Botnet. Tactics: resource development. Description: Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.(Citation: Norton Botnet) Instead of purchasing/renting a botnet from a booter/stresser service, adversaries may build their own botnet by compromising numerous third-party systems.(Citation: Imperva DDoS for Hire) Adversaries may also conduct a takeover of an existing botnet, such as redirecting bots to adversary-controlled C2 servers.(Citation: Dell Dridex Oct 2015) With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale [Phishing](https://attack.mitre.org/techniques/T1566) or Distributed Denial of Service (DDoS).
Near-miss passage: T1584.004 Server. Tactics: resource development. Description: Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control.(Citation: TrendMicro EarthLusca 2022) Instead of purchasing a [Server](https://attack.mitre.org/techniques/T1583/004) or [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may compromise third-party servers in support of operations. Adversaries may also compromise web servers to support watering hole operations, as in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), or email servers to support [Phishing](https://attack.mitre.org/techniques/T1566) operations.
Query: explain CWE-614
Matching passage: CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute. The Secure attribute for sensitive cookies in HTTPS sessions is not set.
Near-miss passage: CWE-1312 Missing Protection for Mirrored Regions in On-Chip Fabric Firewall. The firewall in an on-chip fabric protects the main addressed region, but it does not protect any mirrored memory or memory-mapped-IO (MMIO) regions.