alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: intelligence brief on T1055.008
Matching passage: T1055.008 Ptrace System Calls. Tactics: stealth, privilege escalation. Description: Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process. Ptrace system call injection involves attaching to and modifying a running process. The ptrace system call enables a debugging process to observe and control another process (and each individual thread), including changing memory and register values.(Citation: PTRACE man) Ptrace system call injection is commonly performed by writing arbitrary code into a running process (ex: <code>malloc</code>) then invoking that memory with <code>PTRACE_SETREGS</code> to set the register containing the next instruction to execute. Ptrace system call injection can also be done with <code>PTRACE_POKETEXT</code>/<code>PTRACE_POKEDATA</code>, which copy data to a specific address in the target processes’ memory (ex: the current address of the next instruction). (Citation: PTRACE man)(Citation: Medium Ptrace JUL 2018) Ptrace system call injection may not be possible targeting processes that are non-child processes and/or have higher-privileges.(Citation: BH Linux Inject) Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via ptrace system call injection may also evade detection from security products since the execution is masked under a legitimate process.
Near-miss passage: T1055.014 VDSO Hijacking. Tactics: stealth, privilege escalation. Description: Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process-based defenses as well as possibly elevate privileges. Virtual dynamic shared object (vdso) hijacking is a method of executing arbitrary code in the address space of a separate live process. VDSO hijacking involves redirecting calls to dynamically linked shared libraries. Memory protections may prevent writing executable code to a process via [Ptrace System Calls](https://attack.mitre.org/techniques/T1055/008). However, an adversary may hijack the syscall interface code stubs mapped into a process from the vdso shared object to execute syscalls to open and map a malicious shared object. This code can then be invoked by redirecting the execution flow of the process via patched memory address references stored in a process' global offset table (which store absolute addresses of mapped library functions).(Citation: ELF Injection May 2009)(Citation: Backtrace VDSO)(Citation: VDSO Aug 2005)(Citation: Syscall 2014) Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via VDSO hijacking may also evade detection from security products since the execution is masked under a legitimate process.
Query: patch priority for CVE-2015-9322
Matching passage: CVE-2015-9322. CWE: CWE-352. CVSS: 8.800000190734863. The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.
Near-miss passage: CVE-2015-1568. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the GD Infinite Scroll module before 7.x-1.4 for Drupal allows remote attackers to hijack the authentication of users with the "edit gd infinite scroll settings" permission for requests that delete settings via unspecified vectors.
Query: Sigma YAML for windows / wmi
Matching passage: Sigma rule: Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.. Logsource: windows / wmi. Rule: title: WMI Persistence id: 0b7889b4-5577-4521-a60a-3376ee7f9f7b status: test description: Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs. references: - https://twitter.com/mattifestation/status/899646620148539397 - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ author: Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community date: 2017-08-22 modified: 2022-02-10 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.003 logsource: product: windows service: wmi definition: WMI Namespaces Auditing and SACL should be configured, EventID 5861 and 5859 detection requires Windows 10, 2012 and higher detection: wmi_filter_to_consumer_binding: EventID: 5861 consumer_keywords: - ActiveScriptEventConsumer - CommandLineEventConsumer - CommandLineTemplate wmi_filter_registration: EventID: 5859 filter_scmevent: Provider: SCM Event Provider Query: select * from MSFT_SCMEventLogEvent User: S-1-5-32-544 PossibleCause: Permanent condition: ( (wmi_filter_to_consumer_binding and consumer_keywords) or (wmi_filter_registration) ) and not filter_scmevent falsepositives: - Unknown (data set is too small; further testing needed) level: medium
Near-miss passage: Sigma rule: Detects the creation of a file by "dllhost.exe" in System32 directory part of "IDiagnosticProfileUAC" UAC bypass techniq. Logsource: windows / file_event. Rule: title: UAC Bypass Using IDiagnostic Profile - File id: 48ea844d-19b1-4642-944e-fe39c2cc1fec status: test description: Detects the creation of a file by "dllhost.exe" in System32 directory part of "IDiagnosticProfileUAC" UAC bypass technique references: - https://github.com/Wh04m1001/IDiagnosticProfileUAC author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-03 tags: - attack.execution - attack.privilege-escalation - attack.t1548.002 logsource: product: windows category: file_event detection: selection: Image|endswith: \DllHost.exe TargetFilename|startswith: C:\Windows\System32\ TargetFilename|endswith: .dll condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-7538
Matching passage: CVE-2015-7538. CWE: UNKNOWN. CVSS: 8.800000190734863. Jenkins before 1.640 and LTS before 1.625.2 allow remote attackers to bypass the CSRF protection mechanism via unspecified vectors.
Near-miss passage: CVE-2015-5557. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.
Query: Outbound C2 pattern associated with Network Trust Dependencies
Matching passage: T1590.003 Network Trust Dependencies. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's network trust dependencies that can be used during targeting. Information about network trusts may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about network trusts may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: Pentesting AD Forests) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Near-miss passage: T1590.005 IP Addresses. Tactics: reconnaissance. Description: Adversaries may gather the victim's IP addresses that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses. Information about assigned IP addresses may include a variety of details, such as which IP addresses are in use. IP addresses may also enable an adversary to derive other details about a victim, such as organizational size, physical location(s), Internet service provider, and or where/how their publicly-facing infrastructure is hosted. Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about assigned IP addresses may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Query: describe CVE-2015-7255
Matching passage: CVE-2015-7255. CWE: CWE-200. CVSS: 7.5. ZTE OX-330P, ZXHN H108N, W300V1.0.0S_ZRD_TR1_D68, HG110, GAN9.8T101A-B, MF28G, ZXHN H108N use non-unique X.509 certificates and SSH host keys, which might allow remote attackers to obtain credentials or other sensitive information via a man-in-the-middle attack, passive decryption attack, or impersonating a legitimate device.
Near-miss passage: CVE-2015-1426. CWE: CWE-200. CVSS: 2.0999999046325684. Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.
Query: alert when Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual"
Matching passage: Sigma rule: Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual". Logsource: windows / process_creation. Rule: title: Service StartupType Change Via PowerShell Set-Service id: 62b20d44-1546-4e61-afce-8e175eb9473c status: test description: Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual" references: - https://www.virustotal.com/gui/file/38283b775552da8981452941ea74191aa0d203edd3f61fb2dee7b0aea3514955 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-04 tags: - attack.execution - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \powershell.exe - OriginalFileName: PowerShell.EXE selection_cli: CommandLine|contains|all: - Set-Service - -StartupType CommandLine|contains: - Disabled - Manual condition: all of selection_* falsepositives: - False positives may occur with troubleshooting scripts level: medium
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via COMPRESS OBFUSCATION. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell id: 20e5497e-331c-4cd5-8d36-935f6e2a9a07 status: test description: Detects Obfuscated Powershell via COMPRESS OBFUSCATION references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|contains|all: - new-object - text.encoding]::ascii ScriptBlockText|contains: - system.io.compression.deflatestream - system.io.streamreader ScriptBlockText|endswith: readtoend condition: selection_4104 falsepositives: - Unknown level: medium
Query: describe CVE-2015-3837
Matching passage: CVE-2015-3837. CWE: CWE-20. CVSS: 9.300000190734863. The OpenSSLX509Certificate class in org/conscrypt/OpenSSLX509Certificate.java in Android before 5.1.1 LMY48I improperly includes certain context data during serialization and deserialization, which allows attackers to execute arbitrary code via an application that sends a crafted Intent, aka internal bug 21437603.
Near-miss passage: CVE-2015-8229. CWE: CWE-20. CVSS: 4.0. Huawei eSpace U2980 unified gateway with software before V100R001C10 and U2990 with software before V200R001C10 allow remote authenticated users to cause a denial of service via crafted signaling packets from a registered device.
Query: secure coding against Access Control Check Implemented After Asset is Accessed
Matching passage: CWE-1280 Access Control Check Implemented After Asset is Accessed. A product's hardware-based access control check occurs after the asset has been accessed.
Near-miss passage: CWE-607 Public Static Final Field References Mutable Object. A public or protected static final field references a mutable object, which allows the object to be changed by malicious code, or accidentally from another package.
Query: secure coding against Improper Handling of Values
Matching passage: CWE-229 Improper Handling of Values. The product does not properly handle when the expected number of values for parameters, fields, or arguments is not provided in input, or if those values are undefined.
Near-miss passage: CWE-91 XML Injection (aka Blind XPath Injection). The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
Query: adversary uses Source
Matching passage: T1153 Source. Tactics: execution. Description: **This technique has been deprecated and should no longer be used.** The <code>source</code> command loads functions into the current shell or executes files in the current context. This built-in command can be run in two different ways <code>source /path/to/filename [arguments]</code> or <code>.**This technique has been deprecated and should no longer be used.** /path/to/filename [arguments]</code>. Take note of the space after the ".". Without a space, a new shell is created that runs the program instead of running the program within the current context. This is often used to make certain features or functions available to a shell or to update a specific shell's environment.(Citation: Source Manual) Adversaries can abuse this functionality to execute programs. The file executed with this technique does not need to be marked executable beforehand.
Near-miss passage: T1064 Scripting. Tactics: stealth, execution. Description: **This technique has been deprecated. Please use [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) where appropriate.** Adversaries may use scripts to aid in operations and perform multiple actions that would otherwise be manual. Scripting is useful for speeding up operational tasks and reducing the time required to gain access to critical resources. Some scripting languages may be used to bypass process monitoring mechanisms by directly interacting with the operating system at an API level instead of calling other programs. Common scripting languages for Windows include VBScript and [PowerShell](https://attack.mitre.org/techniques/T1086) but could also be in the form of command-line batch scripts. Scripts can be embedded inside Office documents as macros that can be set to execute when files used in [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) and other types of spearphishing are opened. Malicious embedded macros are an alternative means of execution than software exploitation through [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), where adversaries will rely on macros being allowed or that the user will accept to activate them. Many popular offensive frameworks exist which use forms of scripting for security testers and adversaries alike. Metasploit (Citation: Metasploit_Ref), Veil (Citation: Veil_Ref), and PowerSploit (Citation: Powersploit) are three examples that are popular among penetration testers for exploit and post-compromise operations and include many features for evading defenses. Some adversaries are known to use PowerShell. (Citation: Alperovitch 2014)
Query: risk of Microsoft Internet Explorer 6 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Cross-domain
Matching passage: CVE-2015-0070. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-1106. CWE: CWE-200. CVSS: 2.0999999046325684. The QuickType feature in the Keyboards subsystem in Apple iOS before 8.3 allows physically proximate attackers to discover passcodes by reading the lock screen during use of a Bluetooth keyboard.
Query: vulnerability: Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allows remote attackers to conduct XML injection attacks via (1) the id parameter to unapi.ph
Matching passage: CVE-2015-6011. CWE: UNKNOWN. CVSS: 5.0. Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allows remote attackers to conduct XML injection attacks via (1) the id parameter to unapi.php or (2) the stylesheet parameter to sru.php.
Near-miss passage: CVE-2015-6712. CWE: UNKNOWN. CVSS: 6.800000190734863. The ANSendApprovalToAuthorEnabled method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Query: explain CWE-835
Matching passage: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop'). The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Near-miss passage: CWE-532 Insertion of Sensitive Information into Log File. The product writes sensitive information to a log file.
Query: detection rule: Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Sc
Matching passage: Sigma rule: Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Sc. Logsource: windows / ps_script. Rule: title: Windows Screen Capture with CopyFromScreen id: d4a11f63-2390-411c-9adf-d791fd152830 status: test description: 'Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md#atomic-test-6---windows-screen-capture-copyfromscreen author: frack113 date: 2021-12-28 modified: 2022-07-07 tags: - attack.collection - attack.t1113 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: .CopyFromScreen condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to ga. Logsource: windows / process_creation. Rule: title: Potential Reconnaissance Activity Via GatherNetworkInfo.VBS id: 575dce0c-8139-4e30-9295-1ee75969f7fe related: - id: f92a6f1e-a512-4a15-9735-da09e78d7273 type: similar - id: 07aa184a-870d-413d-893a-157f317f6f58 type: similar status: test description: Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine references: - https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs - https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government author: blueteamer8699 date: 2022-01-03 modified: 2023-02-08 tags: - attack.discovery - attack.execution - attack.t1615 - attack.t1059.005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \cscript.exe - \wscript.exe - OriginalFileName: - cscript.exe - wscript.exe selection_cli: CommandLine|contains: gatherNetworkInfo.vbs condition: all of selection_* falsepositives: - Administrative activity level: medium