alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Indicates suspicious rules such as an inbox rule that forwards a copy of all emails to an external address
Matching passage: Sigma rule: Indicates suspicious rules such as an inbox rule that forwards a copy of all emails to an external address. Logsource: azure / riskdetection. Rule: title: Suspicious Inbox Forwarding Identity Protection id: 27e4f1d6-ae72-4ea0-8a67-77a73a289c3d status: test description: Indicates suspicious rules such as an inbox rule that forwards a copy of all emails to an external address references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-inbox-forwarding - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.t1114.003 - attack.collection logsource: product: azure service: riskdetection detection: selection: riskEventType: suspiciousInboxForwarding condition: selection falsepositives: - A legitimate forwarding rule. level: high
Near-miss passage: Sigma rule: Aversaries may use to interact with a remote network share using Server Message Block (SMB). This technique is used by p. Logsource: windows / file_event. Rule: title: Writing Local Admin Share id: 4aafb0fa-bff5-4b9d-b99e-8093e659c65f status: test description: 'Aversaries may use to interact with a remote network share using Server Message Block (SMB). This technique is used by post-exploitation frameworks. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.002/T1021.002.md#atomic-test-4---execute-command-writing-output-to-local-admin-share author: frack113 date: 2022-01-01 modified: 2022-08-13 tags: - attack.privilege-escalation - attack.persistence - attack.lateral-movement - attack.t1546.002 logsource: product: windows category: file_event detection: selection: TargetFilename|contains|all: - \\\\127.0.0 - \ADMIN$\ condition: selection falsepositives: - Unknown level: medium
Query: write Sigma for Detects keywords that could indicate clearing PowerShell history
Matching passage: Sigma rule: Detects keywords that could indicate clearing PowerShell history. Logsource: windows / ps_module. Rule: title: Clear PowerShell History - PowerShell Module id: f99276ad-d122-4989-a09a-d00904a5f9d2 related: - id: dfba4ce1-e0ea-495f-986e-97140f31af2d type: derived status: test description: Detects keywords that could indicate clearing PowerShell history references: - https://gist.github.com/hook-s3c/7363a856c3cdbadeb71085147f042c1a author: Ilyas Ochkov, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community date: 2019-10-25 modified: 2022-12-02 tags: - attack.stealth - attack.t1070.003 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_1a_payload: Payload|contains: - del - Remove-Item - rm selection_1b_payload: Payload|contains: (Get-PSReadlineOption).HistorySavePath selection_payload_2: Payload|contains|all: - Set-PSReadlineOption - –HistorySaveStyle - SaveNothing selection_payload_3: Payload|contains|all: - Set-PSReadlineOption - -HistorySaveStyle - SaveNothing condition: 1 of selection_payload_* or all of selection_1* falsepositives: - Legitimate PowerShell scripts level: medium
Near-miss passage: Sigma rule: Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect u. Logsource: linux / auditd. Rule: title: Binary Padding - Linux id: c52a914f-3d8b-4b2a-bb75-b3991e75f8ba status: test description: 'Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.001/T1027.001.md author: Igor Fits, oscd.community date: 2020-10-13 modified: 2023-05-03 tags: - attack.stealth - attack.t1027.001 logsource: product: linux service: auditd detection: selection_execve: type: EXECVE keywords_truncate: '|all': - truncate - -s keywords_dd: '|all': - dd - if= keywords_filter: - of= condition: selection_execve and (keywords_truncate or (keywords_dd and not keywords_filter)) falsepositives: - Unknown level: high simulation: - type: atomic-red-team name: Pad Binary to Change Hash - Linux/macOS dd technique: T1027.001 atomic_guid: ffe2346c-abd5-4b45-a713-bf5f1ebd573a
Query: risk of libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXML
Matching passage: CVE-2015-0236. CWE: CWE-200. CVSS: 3.5. libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.
Near-miss passage: CVE-2015-7945. CWE: CWE-200. CVSS: 7.5. The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2 allows remote attackers to obtain the DRBD secret via instance information job results.
Query: mitigate Selective Exclusion
Matching passage: T1679 Selective Exclusion. Tactics: stealth. Description: Adversaries may intentionally exclude certain files, folders, directories, file types, or system components from encryption or tampering during a ransomware or malicious payload execution. Some file extensions that adversaries may avoid encrypting include `.dll`, `.exe`, and `.lnk`.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024) Adversaries may perform this behavior to avoid alerting users, to evade detection by security tools and analysts, or, in the case of ransomware, to ensure that the system remains operational enough to deliver the ransom notice. Exclusions may target files and components whose corruption would cause instability, break core services, or immediately expose the attack. By carefully avoiding these areas, adversaries maintain system responsiveness while minimizing indicators that could trigger alarms or otherwise inhibit achieving their goals.
Near-miss passage: T1564.013 Bind Mounts. Tactics: stealth. Description: Adversaries may abuse bind mounts on file structures to hide their activity and artifacts from native utilities. A bind mount maps a directory or file from one location on the filesystem to another, similar to a shortcut on Windows. It’s commonly used to provide access to specific files or directories across different environments, such as inside containers or chroot environments, and requires sudo access. Adversaries may use bind mounts to map either an empty directory or a benign `/proc` directory to a malicious process’s `/proc` directory. Using the commands `mount –o bind /proc/benign-process /proc/malicious-process` (or `mount –B`), the malicious process's `/proc` directory is overlayed with the contents of a benign process's `/proc` directory. When system utilities query process activity, such as `ps` and `top`, the kernel follows the bind mount and presents the benign directory’s contents instead of the malicious process's actual `/proc` directory. As a result, these utilities display information that appears to come from the benign process, effectively hiding the malicious process's metadata, executable, or other artifacts from detection.(Citation: Cado Security Commando Cat 2024)(Citation: Ahn Lab CoinMiner 2023)
Query: secure coding against Improper Adherence to Coding Standards
Matching passage: CWE-710 Improper Adherence to Coding Standards. The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.
Near-miss passage: CWE-344 Use of Invariant Value in Dynamically Changing Context. The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.
Query: SIEM correlation: persistence activity consistent with Server Software Component
Matching passage: T1505 Server Software Component. Tactics: persistence. Description: Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.(Citation: volexity_0day_sophos_FW)
Near-miss passage: T1505.003 Web Shell. Tactics: persistence. Description: Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.(Citation: volexity_0day_sophos_FW) In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. [China Chopper](https://attack.mitre.org/software/S0020) Web shell client).(Citation: Lee 2013)
Query: describe CVE-2015-6673
Matching passage: CVE-2015-6673. CWE: CWE-416. CVSS: 9.800000190734863. Use-after-free vulnerability in Decoder.cpp in libpgf before 6.15.32.
Near-miss passage: CVE-2015-6042. CWE: CWE-416. CVSS: 9.300000190734863. Use-after-free vulnerability in the CWindow object implementation in Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Query: detect Break Process Trees
Matching passage: T1036.009 Break Process Trees. Tactics: stealth. Description: An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID). If endpoint protection software leverages the “parent-child" relationship for detection, breaking this relationship could result in the adversary’s behavior not being associated with previous process tree activity. On Unix-based systems breaking this process tree is common practice for administrators to execute software using scripts and programs.(Citation: 3OHA double-fork 2022) On Linux systems, adversaries may execute a series of [Native API](https://attack.mitre.org/techniques/T1106) calls to alter malware's process tree. For example, adversaries can execute their payload without any arguments, call the `fork()` API call twice, then have the parent process exit. This creates a grandchild process with no parent process that is immediately adopted by the `init` system process (PID 1), which successfully disconnects the execution of the adversary's payload from its previous process tree. Another example is using the “daemon” syscall to detach from the current parent process and run in the background.(Citation: Sandfly BPFDoor 2022)(Citation: Microsoft XorDdos Linux Stealth 2022)
Near-miss passage: T1036.008 Masquerade File Type. Tactics: stealth. Description: Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type. For example, the header of a JPEG file, is <code> 0xFF 0xD8</code> and the file extension is either `.JPE`, `.JPEG` or `.JPG`. Adversaries may edit the header’s hex code and/or the file extension of a malicious payload in order to bypass file validation checks and/or input sanitization. This behavior is commonly used when payload files are transferred (e.g., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and stored (e.g., [Upload Malware](https://attack.mitre.org/techniques/T1608/001)) so that adversaries may move their malware without triggering detections. Common non-executable file types and extensions, such as text files (`.txt`) and image files (`.jpg`, `.gif`, etc.) may be typically treated as benign. Based on this, adversaries may use a file extension to disguise malware, such as naming a PHP backdoor code with a file name of <code>test.gif</code>. A user may not know that a file is malicious due to the benign appearance and file extension. Polyglot files, which are files that have multiple different file types and that function differently based on the application that will execute them, may also be used to disguise malicious malware and capabilities.(Citation: polygot_icedID)
Query: exploit Multiple cross-site scripting (XSS) vulnerabilities in edit_prefs.php in Beehive Forum 1.4.4 allow remote attackers to inject arbitrary web script or HTML via the (1) homepage_url,
Matching passage: CVE-2015-2198. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in edit_prefs.php in Beehive Forum 1.4.4 allow remote attackers to inject arbitrary web script or HTML via the (1) homepage_url, (2) pic_url, or (3) avatar_url parameter, which are not properly handled in an error message.
Near-miss passage: CVE-2015-2321. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Job Manager plugin 0.7.22 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the email field.
Query: describe CVE-2015-5800
Matching passage: CVE-2015-5800. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-5120. CWE: CWE-119. CVSS: 10.0. Adobe Shockwave Player before 12.1.9.159 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5121.
Query: Lateral movement indicators for Account Manipulation
Matching passage: T1098 Account Manipulation. Tactics: persistence, privilege escalation. Description: Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078).
Near-miss passage: T1098.005 Device Registration. Tactics: persistence, privilege escalation. Description: Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance. MFA systems, such as Duo or Okta, allow users to associate devices with their accounts in order to complete MFA requirements. An adversary that compromises a user’s credentials may enroll a new device in order to bypass initial MFA requirements and gain persistent access to a network.(Citation: CISA MFA PrintNightmare)(Citation: DarkReading FireEye SolarWinds) In some cases, the MFA self-enrollment process may require only a username and password to enroll the account's first device or to enroll a device to an inactive account. (Citation: Mandiant APT29 Microsoft 365 2022) Similarly, an adversary with existing access to a network may register a device or a virtual machine to Entra ID and/or its device management system, Microsoft Intune, in order to access sensitive data or resources while bypassing conditional access policies.(Citation: AADInternals - Device Registration)(Citation: AADInternals - Conditional Access Bypass)(Citation: Microsoft DEV-0537)(Citation: Expel Atlas Lion 2025) Devices registered in Entra ID may be able to conduct [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) campaigns via intra-organizational emails, which are less likely to be treated as suspicious by the email client.(Citation: Microsoft - Device Registration) Additionally, an adversary may be able to perform a [Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002) on an Entra ID tenant by registering a large number of devices.(Citation: AADInternals - BPRT)
Query: Lateral movement indicators for Shared Modules
Matching passage: T1129 Shared Modules. Tactics: execution. Description: Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., [Native API](https://attack.mitre.org/techniques/T1106)). Adversaries may use this functionality as a way to execute arbitrary payloads on a victim system. For example, adversaries can modularize functionality of their malware into shared objects that perform various functions such as managing C2 network communications or execution of specific actions on objective. The Linux & macOS module loader can load and execute shared objects from arbitrary local paths. This functionality resides in `dlfcn.h` in functions such as `dlopen` and `dlsym`. Although macOS can execute `.so` files, common practice uses `.dylib` files.(Citation: Apple Dev Dynamic Libraries)(Citation: Linux Shared Libraries)(Citation: RotaJakiro 2021 netlab360 analysis)(Citation: Unit42 OceanLotus 2017) The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in `NTDLL.dll` and is part of the Windows [Native API](https://attack.mitre.org/techniques/T1106) which is called from functions like `LoadLibrary` at run time.(Citation: Microsoft DLL)
Near-miss passage: T1059.004 Unix Shell. Tactics: execution. Description: Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) Unix shells can control every aspect of a system, with certain commands requiring elevated privileges. Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems. Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with [SSH](https://attack.mitre.org/techniques/T1021/004). Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence. Some systems, such as embedded devices, lightweight Linux distributions, and ESXi servers, may leverage stripped-down Unix shells via Busybox, a small executable that contains a variety of tools, including a simple shell.
Query: describe CVE-2015-5279
Matching passage: CVE-2015-5279. CWE: CWE-119. CVSS: 7.199999809265137. Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.
Near-miss passage: CVE-2015-7091. CWE: CWE-119. CVSS: 6.599999904632568. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7092, and CVE-2015-7117.
Query: write Sigma for Detects enumeration of local system groups. Adversaries may attempt to find local system groups and permission settings
Matching passage: Sigma rule: Detects enumeration of local system groups. Adversaries may attempt to find local system groups and permission settings. Logsource: linux / process_creation. Rule: title: Local Groups Discovery - Linux id: 676381a6-15ca-4d73-a9c8-6a22e970b90d status: test description: Detects enumeration of local system groups. Adversaries may attempt to find local system groups and permission settings references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.001/T1069.001.md author: Ömer Günal, Alejandro Ortuno, oscd.community date: 2020-10-11 modified: 2025-06-04 tags: - attack.discovery - attack.t1069.001 logsource: category: process_creation product: linux detection: selection_1: Image|endswith: /groups selection_2: Image|endswith: - /cat - /ed - /head - /less - /more - /nano - /tail - /vi - /vim CommandLine|contains: /etc/group condition: 1 of selection_* falsepositives: - Legitimate administration activities level: low
Near-miss passage: Sigma rule: Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any. Logsource: windows / process_creation. Rule: title: MpiExec Lolbin id: 729ce0ea-5d8f-4769-9762-e35de441586d status: test description: Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary references: - https://twitter.com/mrd0x/status/1465058133303246867 - https://learn.microsoft.com/en-us/powershell/high-performance-computing/mpiexec?view=hpc19-ps author: Florian Roth (Nextron Systems) date: 2022-01-11 modified: 2024-11-23 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_binary: - Image|endswith: \mpiexec.exe - Hashes|contains: IMPHASH=d8b52ef6aaa3a81501bdfff9dbb96217 selection_flags: CommandLine|contains: - ' /n 1 ' - ' -n 1 ' condition: all of selection* falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-6629
Matching passage: CVE-2015-6629. CWE: CWE-200. CVSS: 5.0. Wi-Fi in Android 5.x before 5.1.1 LMY48Z allows attackers to obtain sensitive information via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 22667667.
Near-miss passage: CVE-2015-6858. CWE: CWE-200. CVSS: 3.700000047683716. HP Insight Control server provisioning before 7.5.0 RabbitMQ allows remote attackers to obtain sensitive information via unspecified vectors.