alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Automated Collection
Matching passage: T1119 Automated Collection. Tactics: collection. Description: Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals. In cloud-based environments, adversaries may also use cloud APIs, data pipelines, command line interfaces, or extract, transform, and load (ETL) services to automatically collect data.(Citation: Mandiant UNC3944 SMS Phishing 2023) This functionality could also be built into remote access tools. This technique may incorporate use of other techniques such as [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) and [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570) to identify and move files, as well as [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538) and [Cloud Storage Object Discovery](https://attack.mitre.org/techniques/T1619) to identify resources in cloud environments.
Near-miss passage: T1074.002 Remote Data Staging. Tactics: collection. Description: Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location. In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and stage data in that instance.(Citation: Mandiant M-Trends 2020) By staging data on one system prior to Exfiltration, adversaries can minimize the number of connections made to their C2 server and better evade detection.
Query: exploit Heap-based buffer overflow in the QualifierList retrieve_qualifier_list function in Medicomp MEDCIN Engine before 2.22.20153.226 might allow remote attackers to execute arbitrary c
Matching passage: CVE-2015-2899. CWE: CWE-119. CVSS: 6.800000190734863. Heap-based buffer overflow in the QualifierList retrieve_qualifier_list function in Medicomp MEDCIN Engine before 2.22.20153.226 might allow remote attackers to execute arbitrary code via a long list name in a packet on port 8190.
Near-miss passage: CVE-2015-7183. CWE: CWE-119. CVSS: 7.5. Integer overflow in the PL_ARENA_ALLOCATE implementation in Netscape Portable Runtime (NSPR) in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.
Query: Sigma rule for Execution of ssh.exe to perform data exfiltration and tunneling through RDP
Matching passage: Sigma rule: Execution of ssh.exe to perform data exfiltration and tunneling through RDP. Logsource: windows / process_creation. Rule: title: Potential RDP Tunneling Via SSH id: f7d7ebd5-a016-46e2-9c54-f9932f2d386d related: - id: f38ce0b9-5e97-4b47-a211-7dc8d8b871da type: similar status: test description: Execution of ssh.exe to perform data exfiltration and tunneling through RDP references: - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-12 modified: 2023-01-25 tags: - attack.command-and-control - attack.t1572 logsource: category: process_creation product: windows detection: selection: Image|endswith: \ssh.exe CommandLine|contains: :3389 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: WinSock2 Autorun Keys Modification id: d6c2ce7e-afb5-4337-9ca4-4b5254ed0565 related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: derived status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: winsock_parameters_base: TargetObject|contains: \System\CurrentControlSet\Services\WinSock2\Parameters winsock_parameters: TargetObject|contains: - \Protocol_Catalog9\Catalog_Entries - \NameSpace_Catalog5\Catalog_Entries filter: - Details: (Empty) - Image: C:\Windows\System32\MsiExec.exe - Image: C:\Windows\syswow64\MsiExec.exe condition: winsock_parameters_base and winsock_parameters and not filter falsepositives: - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason - Legitimate administrator sets up autorun keys for legitimate reason level: medium
Query: patch priority for CVE-2015-0162
Matching passage: CVE-2015-0162. CWE: CWE-264. CVSS: 7.0. IBM Security SiteProtector System 3.0, 3.1, and 3.1.1 allows local users to gain privileges.
Near-miss passage: CVE-2015-6620. CWE: CWE-264. CVSS: 9.300000190734863. libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bugs 24123723 and 24445127.
Query: CVE similar to CVE-2015-1720
Matching passage: CVE-2015-1720. CWE: CWE-416. CVSS: 7.199999809265137. Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Microsoft Windows Kernel Use After Free Vulnerability."
Near-miss passage: CVE-2015-5101. CWE: CWE-416. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-4448, CVE-2015-5095, CVE-2015-5099, CVE-2015-5111, CVE-2015-5113, and CVE-2015-5114.
Query: explain CWE-1126
Matching passage: CWE-1126 Declaration of Variable with Unnecessarily Wide Scope. The source code declares a variable in one scope, but the variable is only used within a narrower scope.
Near-miss passage: CWE-206 Observable Internal Behavioral Discrepancy. The product performs multiple behaviors that are combined to produce a single result, but the individual behaviors are observable separately in a way that allows attackers to reveal internal state or internal decision points.
Query: weakness Cleartext Storage of Sensitive Information in GUI
Matching passage: CWE-317 Cleartext Storage of Sensitive Information in GUI. The product stores sensitive information in cleartext within the GUI.
Near-miss passage: CWE-49 Path Equivalence: 'filename/' (Trailing Slash). The product accepts path input in the form of trailing slash ('filedir/') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Query: secure coding against Incorrect User Management
Matching passage: CWE-286 Incorrect User Management. The product does not properly manage a user within its environment.
Near-miss passage: CWE-764 Multiple Locks of a Critical Resource. The product locks a critical resource more times than intended, leading to an unexpected state in the system.
Query: detect Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-ex in logs
Matching passage: Sigma rule: Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-ex. Logsource: macos / process_creation. Rule: title: System Integrity Protection (SIP) Disabled id: 3603f18a-ec15-43a1-9af2-d196c8a7fec6 status: test description: 'Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-exploit scenarios. ' references: - https://ss64.com/osx/csrutil.html - https://objective-see.org/blog/blog_0x6D.html - https://www.welivesecurity.com/2017/10/20/osx-proton-supply-chain-attack-elmedia/ - https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13caf9f60049760c312cd3/behavior author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2024-01-02 tags: - attack.discovery - attack.t1518.001 logsource: product: macos category: process_creation detection: selection: Image|endswith: /csrutil CommandLine|contains: disable condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.. Logsource: windows / registry_set. Rule: title: PowerShell Script Execution Policy Enabled id: 8218c875-90b9-42e2-b60d-0b0069816d10 related: - id: fad91067-08c5-4d1a-8d8c-d96a21b37814 type: derived status: test description: Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed. references: - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.PowerShell::EnableScripts author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo date: 2023-10-18 tags: - attack.execution logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Policies\Microsoft\Windows\PowerShell\EnableScripts Details: DWORD (0x00000001) condition: selection falsepositives: - Likely level: low
Query: CVE similar to CVE-2015-5191
Matching passage: CVE-2015-5191. CWE: CWE-362. CVSS: 6.699999809265137. VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of this issue may result in a local privilege escalation. CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Near-miss passage: CVE-2015-8997. CWE: CWE-362. CVSS: 7.0. In TrustZone a time-of-check time-of-use race condition could potentially exist in a listener routine in all Android releases from CAF using the Linux kernel.
Query: describe CVE-2015-9326
Matching passage: CVE-2015-9326. CWE: CWE-89. CVSS: 9.800000190734863. The wp-business-intelligence-lite plugin before 1.6.3 for WordPress has SQL injection.
Near-miss passage: CVE-2015-4609. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the wt_directory extension before 1.4.2 for TYPO3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Query: exploit Apple Online Store Kit in Apple OS X before 10.11 improperly validates iCloud keychain item ACLs, which allows attackers to obtain access to keychain items via a crafted app.
Matching passage: CVE-2015-5836. CWE: CWE-200. CVSS: 4.300000190734863. Apple Online Store Kit in Apple OS X before 10.11 improperly validates iCloud keychain item ACLs, which allows attackers to obtain access to keychain items via a crafted app.
Near-miss passage: CVE-2015-5610. CWE: CWE-200. CVSS: 4.0. The RSM (aka RSMWinService) service in SolarWinds N-Able N-Central before 9.5.1.4514 uses the same password decryption key across different customers' installations, which makes it easier for remote authenticated users to obtain the cleartext domain-administrator password by locating the encrypted password within HTML source code and then leveraging knowledge of this key from another installation.
Query: explain CWE-704
Matching passage: CWE-704 Incorrect Type Conversion or Cast. The product does not correctly convert an object, resource, or structure from one type to a different type.
Near-miss passage: CWE-655 Insufficient Psychological Acceptability. The product has a protection mechanism that is too difficult or inconvenient to use, encouraging non-malicious users to disable or bypass the mechanism, whether by accident or on purpose.
Query: patch priority for CVE-2015-0936
Matching passage: CVE-2015-0936. CWE: CWE-320. CVSS: 9.800000190734863. Ceragon FibeAir IP-10 have a default SSH public key in the authorized_keys file for the mateidu user, which allows remote attackers to obtain SSH access by leveraging knowledge of the private key.
Near-miss passage: CVE-2015-0153. CWE: CWE-320. CVSS: 7.5. D-Link DIR-815 devices with firmware before 2.07.B01 allow remote attackers to obtain sensitive information by leveraging cleartext storage of the wireless key.
Query: secure coding against Access of Resource Using Incompatible Type ('Type Confusion')
Matching passage: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion'). The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Near-miss passage: CWE-308 Use of Single-factor Authentication. The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.
Query: indicators of Create Snapshot
Matching passage: T1578.001 Create Snapshot. Tactics: defense impairment. Description: An adversary may create a snapshot or data backup within a cloud account to evade defenses. A snapshot is a point-in-time copy of an existing cloud compute component such as a virtual machine (VM), virtual hard drive, or volume. An adversary may leverage permissions to create a snapshot in order to bypass restrictions that prevent access to existing compute service infrastructure, unlike in [Revert Cloud Instance](https://attack.mitre.org/techniques/T1578/004) where an adversary may revert to a snapshot to evade detection and remove evidence of their presence. An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002), mount one or more created snapshots to that instance, and then apply a policy that allows the adversary access to the created instance, such as a firewall policy that allows them inbound and outbound SSH access.(Citation: Mandiant M-Trends 2020)
Near-miss passage: T1578.002 Create Cloud Instance. Tactics: defense impairment. Description: An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses. Creating a new instance may allow an adversary to bypass firewall rules and permissions that exist on instances currently residing within an account. An adversary may [Create Snapshot](https://attack.mitre.org/techniques/T1578/001) of one or more volumes in an account, create a new instance, mount the snapshots, and then apply a less restrictive security policy to collect [Data from Local System](https://attack.mitre.org/techniques/T1005) or for [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002).(Citation: Mandiant M-Trends 2020) Creating a new instance may also allow an adversary to carry out malicious activity within an environment without affecting the execution of current running instances.
Query: detect Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have in logs
Matching passage: Sigma rule: Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE id: d2451be2-b582-4e15-8701-4196ac180260 related: - id: ca5583e9-8f80-46ac-ab91-7f314d13b984 type: similar status: test description: 'Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe". ' references: - https://thehackernews.com/2024/03/two-chinese-apt-groups-ramp-up-cyber.html - https://csirt-cti.net/2024/02/01/stately-taurus-continued-new-information-on-cyberespionage-attacks-against-myanmar-military-junta/ - https://bazaar.abuse.ch/sample/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831/ - https://twitter.com/Max_Mal_/status/1775222576639291859 - https://twitter.com/DTCERT/status/1712785426895839339 author: Swachchhanda Shrawan Poudel date: 2024-04-15 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: Image|endswith: - \KeyScrambler.exe - \KeyScramblerLogon.exe ImageLoaded|endswith: \KeyScramblerIE.dll filter_main_legitimate_path: Image|contains: - C:\Program Files (x86)\KeyScrambler\ - C:\Program Files\KeyScrambler\ ImageLoaded|contains: - C:\Program Files (x86)\KeyScrambler\ - C:\Program Files\KeyScrambler\ filter_main_signature: Signature: QFX Software Corporation SignatureStatus: Valid condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a remote thread creation of Ttdinject.exe used as proxy. Logsource: windows / create_remote_thread. Rule: title: Remote Thread Creation Ttdinject.exe Proxy id: c15e99a3-c474-48ab-b9a7-84549a7a9d16 status: test description: Detects a remote thread creation of Ttdinject.exe used as proxy references: - https://lolbas-project.github.io/lolbas/Binaries/Ttdinject/ author: frack113 date: 2022-05-16 modified: 2022-06-02 tags: - attack.execution - attack.stealth - attack.t1127 logsource: product: windows category: create_remote_thread detection: selection: SourceImage|endswith: \ttdinject.exe condition: selection falsepositives: - Unknown level: high
Query: alert when Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.
Matching passage: Sigma rule: Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.. Logsource: windows / process_creation. Rule: title: Renamed PingCastle Binary Execution id: 2433a154-bb3d-42e4-86c3-a26bdac91c45 status: test description: Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields. references: - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/ - https://www.pingcastle.com/documentation/scanner/ author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) date: 2024-01-11 tags: - attack.execution - attack.stealth - attack.t1059 - attack.t1202 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: - PingCastleReporting.exe - PingCastleCloud.exe - PingCastle.exe - CommandLine|contains: - --scanner aclcheck - --scanner antivirus - --scanner computerversion - --scanner foreignusers - --scanner laps_bitlocker - --scanner localadmin - --scanner nullsession - --scanner nullsession-trust - --scanner oxidbindings - --scanner remote - --scanner share - --scanner smb - --scanner smb3querynetwork - --scanner spooler - --scanner startup - --scanner zerologon - CommandLine|contains: --no-enum-limit - CommandLine|contains|all: - --healthcheck - --level Full - CommandLine|contains|all: - --healthcheck - '--server ' filter_main_img: Image|endswith: - \PingCastleReporting.exe - \PingCastleCloud.exe - \PingCastle.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / file_event. Rule: title: Anydesk Temporary Artefact id: 0b9ad457-2554-44c1-82c2-d56a99c42377 status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows author: frack113 date: 2022-02-11 modified: 2024-07-20 tags: - attack.command-and-control - attack.t1219.002 logsource: category: file_event product: windows detection: selection: TargetFilename|contains: - \AppData\Roaming\AnyDesk\user.conf - \AppData\Roaming\AnyDesk\system.conf condition: selection falsepositives: - Legitimate use level: medium regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_anydesk_artefact/info.yml
Query: incident response steps for Encoded PowerShell / command-line abuse matching Browser Extensions
Matching passage: Playbook for T1176.001 Browser Extensions. 1) Validate alert telemetry against T1176.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: persistence. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality to and customize aspects of internet browsers. They can be installed directly via a local file or custom URL or through a browser's app store - an official online platform where users can browse, install, and manage extensio
Near-miss passage: Playbook for T1176 Software Extensions. Different response path focused on persistence.