alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: threat report mentioning Outlook Rules
Matching passage: T1137.005 Outlook Rules. Tactics: persistence. Description: Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system. Outlook rules allow a user to define automated behavior to manage email messages. A benign rule might, for example, automatically move an email to a particular folder in Outlook if it contains specific words from a specific sender. Malicious Outlook rules can be created that can trigger code execution when an adversary sends a specifically crafted email to that user.(Citation: SilentBreak Outlook Rules) Once malicious rules have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious rules will execute when an adversary sends a specifically crafted email to the user.(Citation: SilentBreak Outlook Rules)
Near-miss passage: T1137.002 Office Test. Tactics: persistence. Description: Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications. This Registry key is not created by default during an Office installation.(Citation: Hexacorn Office Test)(Citation: Palo Alto Office Test Sofacy) There exist user and global Registry keys for the Office Test feature, such as: * <code>HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf</code> * <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Office test\Special\Perf</code> Adversaries may add this Registry key and specify a malicious DLL that will be executed whenever an Office application, such as Word or Excel, is started.
Query: alert when VisualUiaVerifyNative.exe is a Windows SDK that can be used for AWL bypass and is listed in Microsoft's recommended bloc
Matching passage: Sigma rule: VisualUiaVerifyNative.exe is a Windows SDK that can be used for AWL bypass and is listed in Microsoft's recommended bloc. Logsource: windows / process_creation. Rule: title: Use of VisualUiaVerifyNative.exe id: b30a8bc5-e21b-4ca2-9420-0a94019ac56a status: test description: VisualUiaVerifyNative.exe is a Windows SDK that can be used for AWL bypass and is listed in Microsoft's recommended block rules. references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/VisualUiaVerifyNative/ - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac - https://bohops.com/2020/10/15/exploring-the-wdac-microsoft-recommended-block-rules-visualuiaverifynative/ - https://github.com/MicrosoftDocs/windows-itpro-docs/commit/937db704b9148e9cee7c7010cad4d00ce9c4fdad author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io date: 2022-06-01 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \VisualUiaVerifyNative.exe - OriginalFileName: VisualUiaVerifyNative.exe condition: selection falsepositives: - Legitimate testing of Microsoft UI parts. level: medium
Near-miss passage: Sigma rule: Detects usage of Gpg4win to encrypt files. Logsource: windows / process_creation. Rule: title: File Encryption Using Gpg4win id: 550bbb84-ce5d-4e61-84ad-e590f0024dcd status: test description: Detects usage of Gpg4win to encrypt files references: - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html - https://www.gpg4win.de/documentation.html - https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-09 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_metadata: - Image|endswith: - \gpg.exe - \gpg2.exe - Description: GnuPG’s OpenPGP tool selection_cli: CommandLine|contains|all: - ' -c ' - passphrase condition: all of selection_* falsepositives: - Unknown level: medium
Query: exploit The debug interface on Janitza UMG 508, 509, 511, 604, and 605 devices does not require authentication, which allows remote attackers to read or write to files, or execute arbitrar
Matching passage: CVE-2015-3971. CWE: CWE-284. CVSS: 7.5. The debug interface on Janitza UMG 508, 509, 511, 604, and 605 devices does not require authentication, which allows remote attackers to read or write to files, or execute arbitrary JASIC code, via a session on TCP port 1239.
Near-miss passage: CVE-2015-6867. CWE: CWE-284. CVSS: 7.5. The vertica-udx-zygote process in HP Vertica 7.1.1 UDx does not require authentication, which allows remote attackers to execute arbitrary commands via a crafted packet, aka ZDI-CAN-2914.
Query: alert when Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate po
Matching passage: Sigma rule: Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate po. Logsource: windows / process_creation. Rule: title: ConvertTo-SecureString Cmdlet Usage Via CommandLine id: 74403157-20f5-415d-89a7-c505779585cf status: test description: Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65 - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/convertto-securestring?view=powershell-7.3#examples author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton date: 2020-10-11 modified: 2023-02-01 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli: CommandLine|contains: ConvertTo-SecureString condition: all of selection_* falsepositives: - Legitimate use to pass password to different powershell commands level: medium
Near-miss passage: Sigma rule: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping o. Logsource: zeek / dce_rpc. Rule: title: MITRE BZAR Indicators for Execution id: b640c0b8-87f8-4daa-aef8-95a24261dd1d status: test description: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE references: - https://github.com/mitre-attack/bzar#indicators-for-attck-execution author: '@neu5ron, SOC Prime' date: 2020-03-19 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1047 - attack.t1053.002 - attack.t1569.002 logsource: product: zeek service: dce_rpc detection: op1: endpoint: JobAdd operation: atsvc op2: endpoint: ITaskSchedulerService operation: SchRpcEnableTask op3: endpoint: ITaskSchedulerService operation: SchRpcRegisterTask op4: endpoint: ITaskSchedulerService operation: SchRpcRun op5: endpoint: IWbemServices operation: ExecMethod op6: endpoint: IWbemServices operation: ExecMethodAsync op7: endpoint: svcctl operation: CreateServiceA op8: endpoint: svcctl operation: CreateServiceW op9: endpoint: svcctl operation: StartServiceA op10: endpoint: svcctl operation: StartServiceW condition: 1 of op* falsepositives: - Windows administrator tasks or troubleshooting - Windows management scripts or software level: medium
Query: CVE similar to CVE-2015-8406
Matching passage: CVE-2015-8406. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-6983. CWE: UNKNOWN. CVSS: 8.800000190734863. Double free vulnerability in Apple iOS before 9.1 and OS X before 10.11.1 allows attackers to write to arbitrary files via a crafted app that accesses AtomicBufferedFile descriptors.
Query: vulnerability: Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to cause a denial of service (NUL
Matching passage: CVE-2015-0326. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2015-0325 and CVE-2015-0328.
Near-miss passage: CVE-2015-0444. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality based on Trillium, a different vulnerability than CVE-2015-0443, CVE-2015-0445, CVE-2015-0446, CVE-2015-2634, CVE-2015-2635, CVE-2015-2636, CVE-2015-4758, and CVE-2015-4759.
Query: describe CVE-2015-0804
Matching passage: CVE-2015-0804. CWE: CWE-264. CVSS: 7.5. The HTMLSourceElement::BindToTree function in Mozilla Firefox before 37.0 does not properly constrain a data type after omitting namespace validation during certain tree-binding operations, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document containing a SOURCE element.
Near-miss passage: CVE-2015-3844. CWE: CWE-264. CVSS: 6.800000190734863. The getProcessRecordLocked method in services/core/java/com/android/server/am/ActivityManagerService.java in ActivityManager in Android before 5.1.1 LMY48I allows attackers to trigger incorrect process loading via a crafted application, as demonstrated by interfering with use of the Settings application, aka internal bug 21669445.
Query: vulnerability: The Unity Web Player plugin before 4.6.6f2 and 5.x before 5.0.3f2 allows attackers to read messages or access online services via a victim's credentials
Matching passage: CVE-2015-9288. CWE: CWE-200. CVSS: 6.5. The Unity Web Player plugin before 4.6.6f2 and 5.x before 5.0.3f2 allows attackers to read messages or access online services via a victim's credentials
Near-miss passage: CVE-2015-0763. CWE: CWE-200. CVSS: 5.0. Cisco Unified MeetingPlace 8.6(1.2) does not properly validate session IDs in http URLs, which allows remote attackers to obtain sensitive session information via a crafted URL, aka Bug ID CSCuu60338.
Query: rule covering Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.
Matching passage: Sigma rule: Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.. Logsource: macos / process_creation. Rule: title: Launch Agent/Daemon Execution Via Launchctl id: ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e status: test description: Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1569.001/T1569.001.md - https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/ - https://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-application-rebranded-bundled-malware/ - https://www.trendmicro.com/en_us/research/18/d/new-macos-backdoor-linked-to-oceanlotus-found.html - https://www.loobins.io/binaries/launchctl/ author: Pratinav Chandra date: 2024-05-13 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1569.001 - attack.t1543.001 - attack.t1543.004 logsource: category: process_creation product: macos detection: selection: Image|endswith: /launchctl CommandLine|contains: - submit - load - start condition: selection falsepositives: - Legitimate administration activities is expected to trigger false positives. Investigate the command line being passed to determine if the service or launch agent are suspicious. level: medium
Near-miss passage: Sigma rule: Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with th. Logsource: windows / process_creation. Rule: title: AgentExecutor PowerShell Execution id: 7efd2c8d-8b18-45b7-947d-adfe9ed04f61 related: - id: c0b40568-b1e9-4b03-8d6c-b096da6da9ab type: similar status: test description: Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument author: Nasreddine Bencherchali (Nextron Systems), memory-shards references: - https://twitter.com/lefterispan/status/1286259016436514816 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Agentexecutor/ - https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension - https://twitter.com/jseerden/status/1247985304667066373/photo/1 date: 2022-12-24 modified: 2024-08-07 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image: \AgentExecutor.exe - OriginalFileName: AgentExecutor.exe selection_cli: CommandLine|contains: - ' -powershell' - ' -remediationScript' filter_main_intune: ParentImage|endswith: \Microsoft.Management.Services.IntuneWindowsAgent.exe condition: all of selection_* and not 1 of filter_main_* falsepositives: - Legitimate use via Intune management. You exclude script paths and names to reduce FP rate level: medium
Query: describe CVE-2015-7730
Matching passage: CVE-2015-7730. CWE: CWE-119. CVSS: 10.0. SAP BusinessObjects BI Platform 4.1, BusinessObjects Edge 4.0, and BusinessObjects XI (BOXI) 3.1 R3 allow remote attackers to cause a denial of service (out-of-bounds read and listener crash) via a crafted GIOP packet, aka SAP Security Note 2001108.
Near-miss passage: CVE-2015-9181. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, and SD 835, in a crypto API function, a buffer over-read can occur.
Query: risk of Cross-site scripting (XSS) vulnerability in the Simple Subscription module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administ
Matching passage: CVE-2015-4367. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Simple Subscription module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer blocks" permission to inject arbitrary web script or HTML via vectors related to block content.
Near-miss passage: CVE-2015-1864. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in the administration pages in Kallithea before 0.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) first name or (2) last name user details, or the (3) repository, (4) repository group, or (5) user group description.
Query: patch priority for CVE-2015-9254
Matching passage: CVE-2015-9254. CWE: CWE-798. CVSS: 9.800000190734863. Datto ALTO and SIRIS devices have a default VNC password.
Near-miss passage: CVE-2015-2885. CWE: CWE-798. CVSS: 9.800000190734863. Lens Peek-a-View has a password of 2601hx for the backdoor admin account, a password of user for the backdoor user account, and a password of guest for the backdoor guest account.
Query: Multiple failed authentications followed by Multi-Factor Authentication Request Generation
Matching passage: T1621 Multi-Factor Authentication Request Generation. Tactics: credential access. Description: Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users. Adversaries in possession of credentials to [Valid Accounts](https://attack.mitre.org/techniques/T1078) may be unable to complete the login process if they lack access to the 2FA or MFA mechanisms required as an additional credential and security control. To circumvent this, adversaries may abuse the automatic generation of push notifications to MFA services such as Duo Push, Microsoft Authenticator, Okta, or similar services to have the user grant access to their account. If adversaries lack credentials to victim accounts, they may also abuse automatic push notification generation when this option is configured for self-service password reset (SSPR).(Citation: Obsidian SSPR Abuse 2023) In some cases, adversaries may continuously repeat login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls, potentially resulting in the user finally accepting the authentication request in response to “MFA fatigue.”(Citation: Russian 2FA Push Annoyance - Cimpanu)(Citation: MFA Fatigue Attacks - PortSwigger)(Citation: Suspected Russian Activity Targeting Government and Business Entities Around the Globe)
Near-miss passage: T1556.008 Network Provider DLL. Tactics: defense impairment, persistence, credential access. Description: Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process. Network provider DLLs allow Windows to interface with specific network protocols and can also support add-on credential management functions.(Citation: Network Provider API) During the logon process, Winlogon (the interactive logon module) sends credentials to the local `mpnotify.exe` process via RPC. The `mpnotify.exe` process then shares the credentials in cleartext with registered credential managers when notifying that a logon event is happening.(Citation: NPPSPY - Huntress)(Citation: NPPSPY Video)(Citation: NPLogonNotify) Adversaries can configure a malicious network provider DLL to receive credentials from `mpnotify.exe`.(Citation: NPPSPY) Once installed as a credential manager (via the Registry), a malicious DLL can receive and save credentials each time a user logs onto a Windows workstation or domain via the `NPLogonNotify()` function.(Citation: NPLogonNotify) Adversaries may target planting malicious network provider DLLs on systems known to have increased logon activity and/or administrator logon activity, such as servers and domain controllers.(Citation: NPPSPY - Huntress)
Query: hunt for Print Processors activity
Matching passage: T1547.012 Print Processors. Tactics: persistence, privilege escalation. Description: Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation. Print processors are DLLs that are loaded by the print spooler service, `spoolsv.exe`, during boot.(Citation: Microsoft Intro Print Processors) Adversaries may abuse the print spooler service by adding print processors that load malicious DLLs at startup. A print processor can be installed through the <code>AddPrintProcessor</code> API call with an account that has <code>SeLoadDriverPrivilege</code> enabled. Alternatively, a print processor can be registered to the print spooler service by adding the <code>HKLM\SYSTEM\\[CurrentControlSet or ControlSet001]\Control\Print\Environments\\[Windows architecture: e.g., Windows x64]\Print Processors\\[user defined]\Driver</code> Registry key that points to the DLL. For the malicious print processor to be correctly installed, the payload must be located in the dedicated system print-processor directory, that can be found with the <code>GetPrintProcessorDirectory</code> API call, or referenced via a relative path from this directory.(Citation: Microsoft AddPrintProcessor May 2018) After the print processors are installed, the print spooler service, which starts during boot, must be restarted in order for them to run.(Citation: ESET PipeMon May 2020) The print spooler service runs under SYSTEM level permissions, therefore print processors installed by an adversary may run under elevated privileges.
Near-miss passage: T1547.014 Active Setup. Tactics: persistence, privilege escalation. Description: Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. Active Setup is a Windows mechanism that is used to execute programs when a user logs in. The value stored in the Registry key will be executed after a user logs into the computer.(Citation: Klein Active Setup 2010) These programs will be executed under the context of the user and will have the account's associated permissions level. Adversaries may abuse Active Setup by creating a key under <code> HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\</code> and setting a malicious value for <code>StubPath</code>. This value will serve as the program that will be executed when a user logs into the computer.(Citation: Mandiant Glyer APT 2010)(Citation: Citizenlab Packrat 2015)(Citation: FireEye CFR Watering Hole 2012)(Citation: SECURELIST Bright Star 2015)(Citation: paloalto Tropic Trooper 2016) Adversaries can abuse these components to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.
Query: vulnerability: Double free vulnerability in the get_vrFilter function in servers/slapd/filter.c in OpenLDAP 2.4.40 allows remote attackers to cause a denial of service (crash) via a crafted searc
Matching passage: CVE-2015-1546. CWE: UNKNOWN. CVSS: 5.0. Double free vulnerability in the get_vrFilter function in servers/slapd/filter.c in OpenLDAP 2.4.40 allows remote attackers to cause a denial of service (crash) via a crafted search query with a matched values control.
Near-miss passage: CVE-2015-2368. CWE: UNKNOWN. CVSS: 6.900000095367432. Untrusted search path vulnerability in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka "Windows DLL Remote Code Execution Vulnerability."