alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: intelligence brief on T1200
Matching passage: T1200 Hardware Additions. Tactics: initial access. Description: Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091)), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused. While public references of usage by threat actors are scarce, many red teams/penetration testers leverage hardware additions for initial access. Commercial and open source products can be leveraged with capabilities such as passive network tapping, network traffic modification (i.e. [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557)), keystroke injection, kernel memory reading via DMA, addition of new wireless access points to an existing network, and others.(Citation: Ossmann Star Feb 2011)(Citation: Aleks Weapons Nov 2015)(Citation: Frisk DMA August 2016)(Citation: McMillan Pwn March 2012)
Near-miss passage: T1078 Valid Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.(Citation: volexity_0day_sophos_FW) Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence. In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account.(Citation: CISA MFA PrintNightmare) The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.(Citation: TechNet Credential Theft)
Query: patch priority for CVE-2015-5868
Matching passage: CVE-2015-5868. CWE: CWE-119. CVSS: 7.199999809265137. The kernel in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5896 and CVE-2015-5903.
Near-miss passage: CVE-2015-9070. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in a TrustZone syscall.
Query: detect Detects Obfuscated Powershell via Stdin in Scripts in logs
Matching passage: Sigma rule: Detects Obfuscated Powershell via Stdin in Scripts. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation Via Stdin - PowerShell Module id: c72aca44-8d52-45ad-8f81-f96c4d3c755e related: - id: 86b896ba-ffa1-4fea-83e3-ee28a4c915c7 type: derived status: test description: Detects Obfuscated Powershell via Stdin in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-12 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|re: (?i)(set).*&&\s?set.*(environment|invoke|\$?\{?input).*&&.*" condition: selection_4103 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects DNS queries for subdomains related to "Put.io" sharing website.. Logsource: windows / dns-client. Rule: title: DNS Query To Put.io - DNS Client id: 8b69fd42-9dad-4674-abef-7fdef43ef92a status: test description: Detects DNS queries for subdomains related to "Put.io" sharing website. references: - https://darkatlas.io/blog/medusa-ransomware-group-opsec-failure author: Omar Khaled (@beacon_exe) date: 2024-08-23 tags: - attack.command-and-control logsource: product: windows service: dns-client definition: 'Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events.' detection: selection: EventID: 3008 QueryName|contains: - api.put.io - upload.put.io condition: selection falsepositives: - Legitimate DNS queries and usage of Put.io level: medium
Query: detect Detects value modification of registry key containing path to binary used as screensaver. in logs
Matching passage: Sigma rule: Detects value modification of registry key containing path to binary used as screensaver.. Logsource: windows / registry_event. Rule: title: Path To Screensaver Binary Modified id: 67a6c006-3fbe-46a7-9074-2ba3b82c3000 status: test description: Detects value modification of registry key containing path to binary used as screensaver. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.002/T1546.002.md - https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf author: Bartlomiej Czyz @bczyz1, oscd.community date: 2020-10-11 modified: 2021-11-27 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.002 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: \Control Panel\Desktop\SCRNSAVE.EXE filter: Image|endswith: - \rundll32.exe - \explorer.exe condition: selection and not filter falsepositives: - Legitimate modification of screensaver level: medium
Near-miss passage: Sigma rule: Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic. Logsource: windows / security. Rule: title: HackTool - EDRSilencer Execution - Filter Added id: 98054878-5eab-434c-85d4-72d4e5a3361b status: test description: 'Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names. ' references: - https://github.com/netero1010/EDRSilencer author: Thodoris Polyzos (@SmoothDeploy) date: 2024-01-29 modified: 2024-01-30 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: security definition: 'Requirements: Audit Filtering Platform Policy Change needs to be enabled' detection: selection: EventID: - 5441 - 5447 FilterName|contains: Custom Outbound Filter condition: selection falsepositives: - Unknown level: high
Query: risk of The Values module 7.x-1.x before 7.x-1.2 for Drupal does not properly check permissions, which allows remote administrators with the "Import value sets" permission to execute arbit
Matching passage: CVE-2015-8761. CWE: CWE-94. CVSS: 9.0. The Values module 7.x-1.x before 7.x-1.2 for Drupal does not properly check permissions, which allows remote administrators with the "Import value sets" permission to execute arbitrary PHP code via the exported values list in a ctools import.
Near-miss passage: CVE-2015-1675. CWE: CWE-94. CVSS: 9.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1695, CVE-2015-1696, CVE-2015-1697, CVE-2015-1698, and CVE-2015-1699.
Query: explain T1590.006 Network Security Appliances
Matching passage: T1590.006 Network Security Appliances. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's network security appliances that can be used during targeting. Information about network security appliances may include a variety of details, such as the existence and specifics of deployed firewalls, content filters, and proxies/bastion hosts. Adversaries may also target information about victim network-based intrusion detection systems (NIDS) or other appliances related to defensive cybersecurity operations. Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598).(Citation: Nmap Firewalls NIDS) Information about network security appliances may also be exposed to adversaries via online or other accessible data sets (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Near-miss passage: T1590.003 Network Trust Dependencies. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's network trust dependencies that can be used during targeting. Information about network trusts may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about network trusts may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: Pentesting AD Forests) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Query: detection rule: Detects the execution of the hacktool SafetyKatz via PE information and default Image name
Matching passage: Sigma rule: Detects the execution of the hacktool SafetyKatz via PE information and default Image name. Logsource: windows / process_creation. Rule: title: HackTool - SafetyKatz Execution id: b1876533-4ed5-4a83-90f3-b8645840a413 status: test description: Detects the execution of the hacktool SafetyKatz via PE information and default Image name references: - https://github.com/GhostPack/SafetyKatz author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-20 modified: 2023-02-04 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \SafetyKatz.exe - OriginalFileName: SafetyKatz.exe - Description: SafetyKatz condition: selection falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a. Logsource: windows / process_creation. Rule: title: Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script id: 7aa4e81a-a65c-4e10-9f81-b200eb229d7d related: - id: 236d8e89-ed95-4789-a982-36f4643738ba type: derived status: test description: Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state references: - https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/ - https://www.hexacorn.com/blog/2017/01/14/beyond-good-ol-run-key-part-53/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-14 tags: - attack.execution - attack.persistence - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \VMwareToolBoxCmd.exe - OriginalFileName: toolbox-cmd.exe selection_cli: CommandLine|contains|all: - ' script ' - ' set ' condition: all of selection_* falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-7597
Matching passage: CVE-2015-7597. CWE: CWE-264. CVSS: 7.800000190734863. SafeNet Authentication Service IIS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
Near-miss passage: CVE-2015-3185. CWE: CWE-264. CVSS: 4.300000190734863. The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior.
Query: detection rule: Detects DNS server discovery via LDAP query requests from uncommon applications
Matching passage: Sigma rule: Detects DNS server discovery via LDAP query requests from uncommon applications. Logsource: windows / dns_query. Rule: title: DNS Server Discovery Via LDAP Query id: a21bcd7e-38ec-49ad-b69a-9ea17e69509e status: test description: Detects DNS server discovery via LDAP query requests from uncommon applications references: - https://github.com/redcanaryco/atomic-red-team/blob/980f3f83fd81f37c1ca9c02dccfd1c3d9f9d0841/atomics/T1016/T1016.md#atomic-test-9---dns-server-discovery-using-nslookup - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/7fcdce70-5205-44d6-9c3a-260e616a2f04 author: frack113 date: 2022-08-20 modified: 2023-09-18 tags: - attack.discovery - attack.t1482 logsource: product: windows category: dns_query detection: selection: QueryName|startswith: _ldap. filter_main_generic: Image|contains: - :\Program Files\ - :\Program Files (x86)\ - :\Windows\ filter_main_defender: Image|contains: :\ProgramData\Microsoft\Windows Defender\Platform\ Image|endswith: \MsMpEng.exe filter_main_unknown: Image: <unknown process> filter_optional_azure: Image|startswith: C:\WindowsAzure\GuestAgent filter_main_null: Image: null filter_optional_browsers: Image|endswith: - \chrome.exe - \firefox.exe - \opera.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Likely level: low
Near-miss passage: Sigma rule: Collect pertinent data from the configuration files. Logsource: cisco / aaa. Rule: title: Cisco Collect Data id: cd072b25-a418-4f98-8ebc-5093fb38fe1a status: test description: Collect pertinent data from the configuration files references: - https://blog.router-switch.com/2013/11/show-running-config/ - https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/show_startup-config.htm - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/config-mgmt/configuration/15-sy/config-mgmt-15-sy-book/cm-config-diff.html author: Austin Clark date: 2019-08-11 modified: 2023-01-04 tags: - attack.discovery - attack.credential-access - attack.collection - attack.t1087.001 - attack.t1552.001 - attack.t1005 logsource: product: cisco service: aaa detection: keywords: - show running-config - show startup-config - show archive config - more condition: keywords falsepositives: - Commonly run by administrators level: low
Query: detect Detects the modification of the PortProxy registry key which is used for port forwarding. in logs
Matching passage: Sigma rule: Detects the modification of the PortProxy registry key which is used for port forwarding.. Logsource: windows / registry_event. Rule: title: New PortProxy Registry Entry Added id: a54f842a-3713-4b45-8c84-5f136fdebd3c status: test description: Detects the modification of the PortProxy registry key which is used for port forwarding. references: - https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html - https://adepts.of0x.cc/netsh-portproxy-code/ - https://www.dfirnotes.net/portproxy_detection/ author: Andreas Hunkeler (@Karneades) date: 2021-06-22 modified: 2024-03-25 tags: - attack.lateral-movement - attack.command-and-control - attack.t1090 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: \Services\PortProxy\v4tov4\tcp\ condition: selection falsepositives: - WSL2 network bridge PowerShell script used for WSL/Kubernetes/Docker (e.g. https://github.com/microsoft/WSL/issues/4150#issuecomment-504209723) - Synergy Software KVM (https://symless.com/synergy) level: medium
Near-miss passage: Sigma rule: Detects the creation of a process via the Windows task manager. This might be an attempt to bypass UAC. Logsource: windows / process_creation. Rule: title: New Process Created Via Taskmgr.EXE id: 3d7679bd-0c00-440c-97b0-3f204273e6c7 status: test description: Detects the creation of a process via the Windows task manager. This might be an attempt to bypass UAC references: - https://twitter.com/ReneFreingruber/status/1172244989335810049 author: Florian Roth (Nextron Systems) date: 2018-03-13 modified: 2024-01-18 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \taskmgr.exe filter_main_generic: Image|endswith: - :\Windows\System32\mmc.exe - :\Windows\System32\resmon.exe - :\Windows\System32\Taskmgr.exe condition: selection and not 1 of filter_main_* falsepositives: - Administrative activity level: low
Query: risk of SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vec
Matching passage: CVE-2015-0894. CWE: CWE-89. CVSS: 6.0. SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-5641. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in baserCMS before 3.0.8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Query: rule covering Detects potential persistence using Appx DebugPath
Matching passage: Sigma rule: Detects potential persistence using Appx DebugPath. Logsource: windows / registry_set. Rule: title: Potential Persistence Using DebugPath id: df4dc653-1029-47ba-8231-3c44238cc0ae status: test description: Detects potential persistence using Appx DebugPath references: - https://oddvar.moe/2018/09/06/persistence-using-universal-windows-platform-apps-appx/ - https://github.com/rootm0s/WinPwnage author: frack113 date: 2022-07-27 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: category: registry_set product: windows detection: selection_debug: TargetObject|contains: Classes\ActivatableClasses\Package\Microsoft. TargetObject|endswith: \DebugPath selection_default: TargetObject|contains: \Software\Microsoft\Windows\CurrentVersion\PackagedAppXDebug\Microsoft. TargetObject|endswith: \(Default) condition: 1 of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious connections from Microsoft Sync Center to non-private IPs.. Logsource: windows / network_connection. Rule: title: Microsoft Sync Center Suspicious Network Connections id: 9f2cc74d-78af-4eb2-bb64-9cd1d292b87b status: test description: Detects suspicious connections from Microsoft Sync Center to non-private IPs. references: - https://redcanary.com/blog/intelligence-insights-november-2021/ author: elhoim date: 2022-04-28 modified: 2024-03-12 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 - attack.t1218 - attack.execution logsource: product: windows category: network_connection detection: selection: Image|endswith: \mobsync.exe filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: alert when Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report
Matching passage: Sigma rule: Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report. Logsource: windows / system. Rule: title: Moriya Rootkit - System id: 25b9c01c-350d-4b95-bed1-836d04a4f324 status: test description: Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report references: - https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831 author: Bhabesh Raj date: 2021-05-06 modified: 2022-11-29 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ServiceName: ZzNetSvc condition: selection falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects well-known credential dumping tools execution via specific named pipe creation. Logsource: windows / pipe_created. Rule: title: HackTool - Credential Dumping Tools Named Pipe Created id: 961d0ba2-3eea-4303-a930-2cf78bbfcc5e status: test description: Detects well-known credential dumping tools execution via specific named pipe creation references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment - https://image.slidesharecdn.com/zeronights2017kheirkhabarov-171118103000/75/hunting-for-credentials-dumping-in-windows-environment-57-2048.jpg?cb=1666035799 author: Teymur Kheirkhabarov, oscd.community date: 2019-11-01 modified: 2023-08-07 tags: - attack.credential-access - attack.t1003.001 - attack.t1003.002 - attack.t1003.004 - attack.t1003.005 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName|contains: - \cachedump - \lsadump - \wceservicepipe condition: selection falsepositives: - Legitimate Administrator using tool for password recovery level: critical