alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: discovery using Remote System Discovery
Matching passage: T1018 Remote System Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as [Ping](https://attack.mitre.org/software/S0097), <code>net view</code> using [Net](https://attack.mitre.org/software/S0039), or, on ESXi servers, `esxcli network diag ping`. Adversaries may also analyze data from local host files (ex: <code>C:\Windows\System32\Drivers\etc\hosts</code> or <code>/etc/hosts</code>) or other passive means (such as local [Arp](https://attack.mitre.org/software/S0099) cache entries) in order to discover the presence of remote systems in an environment. Adversaries may also target discovery of network infrastructure as well as leverage [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands on network devices to gather detailed information about systems within a network (e.g. <code>show cdp neighbors</code>, <code>show arp</code>).(Citation: US-CERT-TA18-106A)(Citation: CISA AR21-126A FIVEHANDS May 2021)
Near-miss passage: T1087.001 Local Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. Commands such as <code>net user</code> and <code>net localgroup</code> of the [Net](https://attack.mitre.org/software/S0039) utility and <code>id</code> and <code>groups</code> on macOS and Linux can list local users and groups.(Citation: Mandiant APT1)(Citation: id man page)(Citation: groups man page) On Linux, local users can also be enumerated through the use of the <code>/etc/passwd</code> file. On macOS, the <code>dscl . list /Users</code> command can be used to enumerate local accounts. On ESXi servers, the `esxcli system account list` command can list local user accounts.(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)
Query: Encoded PowerShell / command-line abuse matching Source
Matching passage: T1153 Source. Tactics: execution. Description: **This technique has been deprecated and should no longer be used.** The <code>source</code> command loads functions into the current shell or executes files in the current context. This built-in command can be run in two different ways <code>source /path/to/filename [arguments]</code> or <code>.**This technique has been deprecated and should no longer be used.** /path/to/filename [arguments]</code>. Take note of the space after the ".". Without a space, a new shell is created that runs the program instead of running the program within the current context. This is often used to make certain features or functions available to a shell or to update a specific shell's environment.(Citation: Source Manual) Adversaries can abuse this functionality to execute programs. The file executed with this technique does not need to be marked executable beforehand.
Near-miss passage: T1127.002 ClickOnce. Tactics: stealth, execution. Description: Adversaries may use ClickOnce applications (.appref-ms and .application files) to proxy execution of code through a trusted Windows utility.(Citation: Burke/CISA ClickOnce BlackHat) ClickOnce is a deployment that enables a user to create self-updating Windows-based .NET applications (i.e, .XBAP, .EXE, or .DLL) that install and run from a file share or web page with minimal user interaction. The application launches as a child process of DFSVC.EXE, which is responsible for installing, launching, and updating the application.(Citation: SpectorOps Medium ClickOnce) Because ClickOnce applications receive only limited permissions, they do not require administrative permissions to install.(Citation: Microsoft Learn ClickOnce) As such, adversaries may abuse ClickOnce to proxy execution of malicious code without needing to escalate privileges. ClickOnce may be abused in a number of ways. For example, an adversary may rely on [User Execution](https://attack.mitre.org/techniques/T1204). When a user visits a malicious website, the .NET malware is disguised as legitimate software and a ClickOnce popup is displayed for installation.(Citation: NetSPI ClickOnce) Adversaries may also abuse ClickOnce to execute malware via a [Rundll32](https://attack.mitre.org/techniques/T1218/011) script using the command `rundll32.exe dfshim.dll,ShOpenVerbApplication1`.(Citation: LOLBAS /Dfsvc.exe) Additionally, an adversary can move the ClickOnce application file to a remote user’s startup folder for continued malicious code deployment (i.e., [Registry Run Keys / Startup Folder](https://attack.mitre.org/techniques/T1547/001)).(Citation: Burke/CISA ClickOnce BlackHat)(Citation: Burke/CISA ClickOnce Paper)
Query: describe CVE-2015-3932
Matching passage: CVE-2015-3932. CWE: CWE-91. CVSS: 7.800000190734863. Netlock Mokka before 2.7.8.1204 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object.
Near-miss passage: CVE-2015-3931. CWE: CWE-91. CVSS: 7.800000190734863. Microsec e-Szigno before 3.2.7.12 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object.
Query: detection rule: Detects attempts to create and/or add an account to the admin group, thus granting admin privileges.
Matching passage: Sigma rule: Detects attempts to create and/or add an account to the admin group, thus granting admin privileges.. Logsource: macos / process_creation. Rule: title: User Added To Admin Group Via DseditGroup id: 5d0fdb62-f225-42fb-8402-3dfe64da468a status: test description: Detects attempts to create and/or add an account to the admin group, thus granting admin privileges. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-5---add-a-newexisting-user-to-the-admin-group-using-dseditgroup-utility---macos - https://ss64.com/osx/dseditgroup.html author: Sohan G (D4rkCiph3r) date: 2023-08-22 tags: - attack.persistence - attack.initial-access - attack.privilege-escalation - attack.stealth - attack.t1078.003 logsource: category: process_creation product: macos detection: selection: Image|endswith: /dseditgroup CommandLine|contains|all: - ' -o edit ' - ' -a ' - ' -t user' - admin condition: selection falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class. T. Logsource: windows / ps_classic_start. Rule: title: PowerShell Download Via Net.WebClient - PowerShell Classic id: 3236fcd0-b7e3-4433-b4f8-86ad61a9af2d related: - id: 65531a81-a694-4e31-ae04-f8ba5bc33759 type: derived status: test description: 'Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class. This technique is often abused by attackers to download additional payloads. ' references: - https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html author: Florian Roth (Nextron Systems) date: 2017-03-05 modified: 2026-04-28 tags: - attack.execution - attack.command-and-control - attack.t1059.001 - attack.t1105 logsource: product: windows category: ps_classic_start detection: selection_webclient: Data|contains: Net.WebClient selection_download: Data|contains: - .DownloadFile( - .DownloadString( condition: all of selection_* falsepositives: - This activity may be used by legitimate software, such as patch management tools or software updaters. Investigate any such activity and apply the necessary filter. level: low
Query: patch priority for CVE-2015-2949
Matching passage: CVE-2015-2949. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in ZenPhoto20 1.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-7316. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1.
Query: patch priority for CVE-2015-0949
Matching passage: CVE-2015-0949. CWE: CWE-269. CVSS: 7.800000190734863. The System Management Mode (SMM) implementation in Dell Latitude E6430 BIOS Revision A09, HP EliteBook 850 G1 BIOS revision L71 Ver. 01.09, and possibly other BIOS implementations does not ensure that function calls operate on SMRAM memory locations, which allows local users to bypass the Secure Boot protection mechanism and gain privileges by leveraging write access to physical memory.
Near-miss passage: CVE-2015-5071. CWE: CWE-269. CVSS: 6.5. AR System Mid Tier in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users to "navigate" to arbitrary files via the __report parameter of the BIRT viewer servlet.
Query: exploit Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, int
Matching passage: CVE-2015-4776. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790.
Near-miss passage: CVE-2015-2631. CWE: UNKNOWN. CVSS: 7.199999809265137. Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to rmformat.
Query: detection rule: Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH"
Matching passage: Sigma rule: Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH". Logsource: windows / ps_script. Rule: title: Add Windows Capability Via PowerShell Script id: 155c7fd5-47b4-49b2-bbeb-eb4fab335429 related: - id: b36d01a3-ddaf-4804-be18-18a6247adfcd type: similar status: test description: Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others. references: - https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=powershell - https://www.virustotal.com/gui/file/af1c82237b6e5a3a7cdbad82cc498d298c67845d92971bada450023d1335e267/content author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-22 modified: 2023-05-09 tags: - attack.execution logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmdlet: ScriptBlockText|contains: 'Add-WindowsCapability ' selection_capa: ScriptBlockText|contains: -Name OpenSSH. condition: all of selection_* falsepositives: - Legitimate usage of the capabilities by administrators or users. Add additional filters accordingly. level: medium
Near-miss passage: Sigma rule: Detects changes to the "MaxMpxCt" registry value. MaxMpxCt specifies the maximum outstanding network requests for the se. Logsource: windows / registry_set. Rule: title: MaxMpxCt Registry Value Changed id: 0e6a9e62-627e-496c-aef5-bfa39da29b5e status: test description: 'Detects changes to the "MaxMpxCt" registry value. MaxMpxCt specifies the maximum outstanding network requests for the server per client, which is used when negotiating a Server Message Block (SMB) connection with a client. Note if the value is set beyond 125 older Windows 9x clients will fail to negotiate. Ransomware threat actors and operators (specifically BlackCat) were seen increasing this value in order to handle a higher volume of traffic. ' references: - https://www.huntress.com/blog/blackcat-ransomware-affiliate-ttps - https://securityscorecard.com/research/deep-dive-into-alphv-blackcat-ransomware - https://www.intrinsec.com/alphv-ransomware-gang-analysis/?cn-reloaded=1 - https://www.sentinelone.com/labs/blackcat-ransomware-highly-configurable-rust-driven-raas-on-the-prowl-for-victims/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-03-19 tags: - attack.stealth - attack.t1070.005 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Services\LanmanServer\Parameters\MaxMpxCt condition: selection falsepositives: - Unknown level: low
Query: exploit SQL injection vulnerability in include/top_graph_header.php in Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary SQL commands via the rra_id parameter in a prop
Matching passage: CVE-2015-8369. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in include/top_graph_header.php in Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary SQL commands via the rra_id parameter in a properties action to graph.php.
Near-miss passage: CVE-2015-4188. CWE: CWE-89. CVSS: 5.0. SQL injection vulnerability in the Manager interface in Cisco Prime Collaboration 10.5(1) allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug IDs CSCuu29910, CSCuu29928, and CSCuu59104.
Query: detect Detects identities attempting to enumerate their Kubernetes RBAC permissions. In the early stages of a breach, attackers in logs
Matching passage: Sigma rule: Detects identities attempting to enumerate their Kubernetes RBAC permissions. In the early stages of a breach, attackers. Logsource: kubernetes / application / audit. Rule: title: RBAC Permission Enumeration Attempt id: 84b777bd-c946-4d17-aa2e-c39f5a454325 status: test description: 'Detects identities attempting to enumerate their Kubernetes RBAC permissions. In the early stages of a breach, attackers will aim to list the permissions they have within the compromised environment. In a Kubernetes cluster, this can be achieved by interacting with the API server, and querying the SelfSubjectAccessReview API via e.g. a "kubectl auth can-i --list" command. This will enumerate the Role-Based Access Controls (RBAC) rules defining the compromised user''s authorization. ' references: - https://www.elastic.co/guide/en/security/current/kubernetes-suspicious-self-subject-review.html author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.t1069.003 - attack.t1087.004 - attack.discovery logsource: category: application product: kubernetes service: audit detection: selection: verb: create apiGroup: authorization.k8s.io objectRef.resource: selfsubjectrulesreviews condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389. Logsource: windows / network_connection. Rule: title: RDP Over Reverse SSH Tunnel id: 5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4 status: test description: Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389 references: - https://twitter.com/cyb3rops/status/1096842275437625346 author: Samir Bousseaden date: 2019-02-16 modified: 2024-03-12 tags: - attack.command-and-control - attack.t1572 - attack.lateral-movement - attack.t1021.001 - car.2013-07-002 logsource: category: network_connection product: windows detection: selection_img: Image|endswith: \svchost.exe Initiated: 'true' SourcePort: 3389 selection_destination: DestinationIp|cidr: - 127.0.0.0/8 - ::1/128 condition: all of selection_* falsepositives: - Unknown level: high
Query: rule covering Detects file write event from/to a fake recycle bin folder that is often used as a staging directory for malware
Matching passage: Sigma rule: Detects file write event from/to a fake recycle bin folder that is often used as a staging directory for malware. Logsource: windows / file_event. Rule: title: Suspicious File Creation Activity From Fake Recycle.Bin Folder id: cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca related: - id: 5ce0f04e-3efc-42af-839d-5b3a543b76c0 type: derived status: test description: Detects file write event from/to a fake recycle bin folder that is often used as a staging directory for malware references: - https://www.mandiant.com/resources/blog/infected-usb-steal-secrets - https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/ author: X__Junior (Nextron Systems) date: 2023-07-12 modified: 2023-12-11 tags: - attack.persistence - attack.stealth logsource: category: file_event product: windows detection: selection: - Image|contains: - RECYCLERS.BIN\ - RECYCLER.BIN\ - TargetFilename|contains: - RECYCLERS.BIN\ - RECYCLER.BIN\ condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_recycle_bin_fake_exec/info.yml
Near-miss passage: Sigma rule: Detects access to Okta admin functions through proxy.. Logsource: okta / okta. Rule: title: Okta Admin Functions Access Through Proxy id: 9058ca8b-f397-4fd1-a9fa-2b7aad4d6309 status: test description: Detects access to Okta admin functions through proxy. references: - https://www.beyondtrust.com/blog/entry/okta-support-unit-breach - https://dataconomy.com/2023/10/23/okta-data-breach/ - https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/ author: Muhammad Faisal @faisalusuf date: 2023-10-25 tags: - attack.credential-access logsource: service: okta product: okta detection: selection: debugContext.debugData.requestUri|contains: admin securityContext.isProxy: 'true' condition: selection falsepositives: - False positives are expected if administrators access these function through proxy legitimatly. Apply additional filters if necessary level: medium
Query: describe CVE-2015-6270
Matching passage: CVE-2015-6270. CWE: CWE-399. CVSS: 7.800000190734863. Cisco IOS XE before 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted IPv6 packet, aka Bug ID CSCsv98555.
Near-miss passage: CVE-2015-5262. CWE: CWE-399. CVSS: 4.300000190734863. http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.
Query: CVE similar to CVE-2015-10014
Matching passage: CVE-2015-10014. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability classified as critical has been found in arekk uke. This affects an unknown part of the file lib/uke/finder.rb. The manipulation leads to sql injection. The identifier of the patch is 52fd3b2d0bc16227ef57b7b98a3658bb67c1833f. It is recommended to apply a patch to fix this issue. The identifier VDB-217485 was assigned to this vulnerability.
Near-miss passage: CVE-2015-6659. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment.
Query: hunt for Exfiltration Over Physical Medium activity
Matching passage: T1052 Exfiltration Over Physical Medium. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
Near-miss passage: T1052.001 Exfiltration over USB. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
Query: alert when Detects disabling of Time Machine (Apple's automated backup utility software) via the native macOS backup utility "tmuti
Matching passage: Sigma rule: Detects disabling of Time Machine (Apple's automated backup utility software) via the native macOS backup utility "tmuti. Logsource: macos / process_creation. Rule: title: Time Machine Backup Disabled Via Tmutil - MacOS id: 2c95fa8a-8b8d-4787-afce-7117ceb8e3da status: test description: 'Detects disabling of Time Machine (Apple''s automated backup utility software) via the native macOS backup utility "tmutil". An attacker can use this to prevent backups from occurring. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine - https://www.loobins.io/binaries/tmutil/ author: Pratinav Chandra date: 2024-05-29 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: macos detection: selection_img: - Image|endswith: /tmutil - CommandLine|contains: tmutil selection_cmd: CommandLine|contains: disable condition: all of selection_* falsepositives: - Legitimate administrator activity level: medium
Near-miss passage: Sigma rule: Bypasses User Account Control using a fileless method. Logsource: windows / registry_set. Rule: title: Bypass UAC Using DelegateExecute id: 46dd5308-4572-4d12-aa43-8938f0184d4f status: test description: Bypasses User Account Control using a fileless method references: - https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand - https://devblogs.microsoft.com/oldnewthing/20100312-01/?p=14623 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-7---bypass-uac-using-sdclt-delegateexecute author: frack113 date: 2022-01-05 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \open\command\DelegateExecute Details: (Empty) condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_bypass_uac_using_delegateexecute/info.yml simulation: - type: atomic-red-team name: Bypass UAC using sdclt DelegateExecute technique: T1548.002 atomic_guid: 3be891eb-4608-4173-87e8-78b494c029b7
Query: risk of Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explore
Matching passage: CVE-2015-0050. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-8967 and CVE-2015-0044.
Near-miss passage: CVE-2015-1563. CWE: CWE-399. CVSS: 2.0999999046325684. The ARM GIC distributor virtualization in Xen 4.4.x and 4.5.x allows local guests to cause a denial of service by causing a large number messages to be logged.