alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Si
Matching passage: Sigma rule: Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Si. Logsource: windows / security. Rule: title: Local User Creation id: 66b6be3d-55d0-4f47-9855-d69df21740ea status: test description: 'Detects local user creation on Windows servers, which shouldn''t happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs. ' references: - https://patrick-bareiss.com/detecting-local-user-creation-in-ad-with-sigma/ author: Patrick Bareiss date: 2019-04-18 modified: 2021-01-17 tags: - attack.persistence - attack.t1136.001 logsource: product: windows service: security detection: selection: EventID: 4720 condition: selection falsepositives: - Domain Controller Logs - Local accounts managed by privileged account management tools level: low
Near-miss passage: Sigma rule: Detects the use of the 'setcap' utility to set the 'setgid' capability (cap_setgid) on a binary file. This capability al. Logsource: linux / process_creation. Rule: title: Linux Setgid Capability Set on a Binary via Setcap Utility id: 3a716279-c18c-4488-83be-f9ececbfb9fc status: experimental description: 'Detects the use of the ''setcap'' utility to set the ''setgid'' capability (cap_setgid) on a binary file. This capability allows a non privileged process to make arbitrary manipulations of group IDs (GIDs), including setting its current GID to a value that would otherwise be restricted (i.e. GID 0, the root group). This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed. ' references: - https://man7.org/linux/man-pages/man8/setcap.8.html - https://dfir.ch/posts/linux_capabilities/ - https://juggernaut-sec.com/capabilities/#cap_setgid author: Luc Génaux date: 2026-01-24 tags: - attack.privilege-escalation - attack.persistence - attack.t1548 - attack.t1554 logsource: product: linux category: process_creation detection: selection: Image|endswith: /setcap CommandLine|contains: cap_setgid condition: selection falsepositives: - Unknown level: low
Query: secure coding against J2EE Framework: Saving Unserializable Objects to Disk
Matching passage: CWE-594 J2EE Framework: Saving Unserializable Objects to Disk. When the J2EE container attempts to write unserializable objects to disk there is no guarantee that the process will complete successfully.
Near-miss passage: CWE-460 Improper Cleanup on Thrown Exception. The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.
Query: how to detect Hardware Additions
Matching passage: T1200 Hardware Additions. Tactics: initial access. Description: Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091)), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused. While public references of usage by threat actors are scarce, many red teams/penetration testers leverage hardware additions for initial access. Commercial and open source products can be leveraged with capabilities such as passive network tapping, network traffic modification (i.e. [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557)), keystroke injection, kernel memory reading via DMA, addition of new wireless access points to an existing network, and others.(Citation: Ossmann Star Feb 2011)(Citation: Aleks Weapons Nov 2015)(Citation: Frisk DMA August 2016)(Citation: McMillan Pwn March 2012)
Near-miss passage: T1199 Trusted Relationship. Tactics: initial access. Description: Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network. Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security). The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, [Valid Accounts](https://attack.mitre.org/techniques/T1078) used by the other party for access to internal network systems may be compromised and used.(Citation: CISA IT Service Providers) In Office 365 environments, organizations may grant Microsoft partners or resellers delegated administrator permissions. By compromising a partner or reseller account, an adversary may be able to leverage existing delegated administrator relationships or send new delegated administrator offers to clients in order to gain administrative control over the victim tenant.(Citation: Office 365 Delegated Administration)
Query: patch priority for CVE-2015-6752
Matching passage: CVE-2015-6752. CWE: CWE-79. CVSS: 2.0999999046325684. Cross-site scripting (XSS) vulnerability in the Search API Autocomplete module 7.x-1.x before 7.x-1.3 for Drupal, when the search index is configured to use the HTML filter processor, allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in the returned suggestions.
Near-miss passage: CVE-2015-1053. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the administrative backend in Croogo before 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to admin/file_manager/file_manager/editfile.
Query: CVE similar to CVE-2015-3134
Matching passage: CVE-2015-3134. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3117, CVE-2015-3123, CVE-2015-3130, CVE-2015-3133, and CVE-2015-4431.
Near-miss passage: CVE-2015-5803. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Query: CVE similar to CVE-2015-7822
Matching passage: CVE-2015-7822. CWE: CWE-79. CVSS: 5.0. Multiple cross-site scripting (XSS) vulnerabilities in Kentico CMS 8.2 allow remote attackers to inject arbitrary web script or HTML via a (1) parameter name to CMSModules/AdminControls/Pages/UIPage.aspx or the (2) CMSBodyClass cookie variable to the default URI.
Near-miss passage: CVE-2015-1437. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Asus RT-N10+ D1 router with firmware 2.1.1.1.70 allow remote attackers to inject arbitrary web script or HTML via the flag parameter to (1) result_of_get_changed_status.asp or (2) error_page.htm.
Query: explain CWE-1268
Matching passage: CWE-1268 Policy Privileges are not Assigned Consistently Between Control and Data Agents. The product's hardware-enforced access control for a particular resource improperly accounts for privilege discrepancies between control and write policies.
Near-miss passage: CWE-164 Improper Neutralization of Internal Special Elements. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes internal special elements that could be interpreted in unexpected ways when they are sent to a downstream component.
Query: incident response steps for Outbound C2 pattern associated with Udev Rules
Matching passage: Playbook for T1546.017 Udev Rules. 1) Validate alert telemetry against T1546.017. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: persistence, privilege escalation. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may maintain persistence through executing malicious content triggered using udev rules. Udev is the Linux kernel device manager that dynamically manages device nodes, handles access to pseudo-device files in the `/dev` directory, and responds to hardware events, such as when external devices like hard drives or keyboards are plugged in or removed. Udev uses rule files with `match keys
Near-miss passage: Playbook for T1546.009 AppCert DLLs. Different response path focused on privilege escalation, persistence.
Query: patch priority for CVE-2015-6303
Matching passage: CVE-2015-6303. CWE: CWE-200. CVSS: 4.300000190734863. The Cisco Spark application 2015-07-04 for mobile operating systems does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, aka Bug IDs CSCut36742 and CSCut36844.
Near-miss passage: CVE-2015-2935. CWE: CWE-200. CVSS: 5.0. MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by "@imporT."
Query: indicators of Software Discovery
Matching passage: T1518 Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from [Software Discovery](https://attack.mitre.org/techniques/T1518) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Such software may be deployed widely across the environment for configuration management or security reasons, such as [Software Deployment Tools](https://attack.mitre.org/techniques/T1072), and may allow adversaries broad access to infect devices or move laterally. Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable to [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).
Near-miss passage: T1518.001 Security Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Example commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), <code>reg query</code> with [Reg](https://attack.mitre.org/software/S0075), <code>dir</code> with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software. Adversaries may also utilize the [Cloud API](https://attack.mitre.org/techniques/T1059/009) to discover cloud-native security software installed on compute infrastructure, such as the AWS CloudWatch agent, Azure VM Agent, and Google Cloud Monitor agent. These agents may collect metrics and logs from the VM, which may be centrally aggregated in a cloud-based monitoring platform.
Query: resource development using Email Accounts
Matching passage: T1585.002 Email Accounts. Tactics: resource development. Description: Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) Establishing email accounts may also allow adversaries to abuse free services – such as trial periods – to [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) for follow-on purposes.(Citation: Free Trial PurpleUrchin) Adversaries may also take steps to cultivate a persona around the email account, such as through use of [Social Media Accounts](https://attack.mitre.org/techniques/T1585/001), to increase the chance of success of follow-on behaviors. Created email accounts can also be used in the acquisition of infrastructure (ex: [Domains](https://attack.mitre.org/techniques/T1583/001)).(Citation: Mandiant APT1) To decrease the chance of physically tying back operations to themselves, adversaries may make use of disposable email services.(Citation: Trend Micro R980 2016)
Near-miss passage: T1585 Establish Accounts. Tactics: resource development. Description: Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) For operations incorporating social engineering, the utilization of an online persona may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, GitHub, Docker Hub, etc.). Establishing a persona may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) Establishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) In addition, establishing accounts may allow adversaries to abuse free services, such as registering for trial periods to [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) for malicious purposes.(Citation: Free Trial PurpleUrchin)
Query: rule covering Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule
Matching passage: Sigma rule: Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule. Logsource: windows / process_creation. Rule: title: New Port Forwarding Rule Added Via Netsh.EXE id: 322ed9ec-fcab-4f67-9a34-e7c6aef43614 status: test description: Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule references: - https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html - https://adepts.of0x.cc/netsh-portproxy-code/ - https://www.dfirnotes.net/portproxy_detection/ author: Florian Roth (Nextron Systems), omkar72, oscd.community, Swachchhanda Shrawan Poudel date: 2019-01-29 modified: 2023-09-01 tags: - attack.lateral-movement - attack.command-and-control - attack.t1090 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli_1: CommandLine|contains|all: - interface - portproxy - add - v4tov4 selection_cli_2: CommandLine|contains|all: - 'i ' - 'p ' - 'a ' - 'v ' selection_cli_3: CommandLine|contains|all: - connectp - listena - c= condition: selection_img and 1 of selection_cli_* falsepositives: - Legitimate administration activity - WSL2 network bridge PowerShell script used for WSL/Kubernetes/Docker (e.g. https://github.com/microsoft/WSL/issues/4150#issuecomment-504209723) level: medium
Near-miss passage: Sigma rule: Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh. Logsource: linux / process_creation. Rule: title: Execution Of Script Located In Potentially Suspicious Directory id: 30bcce26-51c5-49f2-99c8-7b59e3af36c7 status: test description: Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh", etc. references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.execution logsource: product: linux category: process_creation detection: selection_img: Image|endswith: - /bash - /csh - /dash - /fish - /ksh - /sh - /zsh selection_flag: CommandLine|contains: ' -c ' selection_paths: CommandLine|contains: /tmp/ condition: all of selection_* falsepositives: - Unknown level: medium
Query: write Sigma for Identifies when an user or application modified the federation settings on the domain.
Matching passage: Sigma rule: Identifies when an user or application modified the federation settings on the domain.. Logsource: azure / auditlogs. Rule: title: Azure Domain Federation Settings Modified id: 352a54e1-74ba-4929-9d47-8193d67aba1e status: test description: Identifies when an user or application modified the federation settings on the domain. references: - https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-monitor-federation-changes author: Austin Songer date: 2021-09-06 modified: 2022-06-08 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 logsource: product: azure service: auditlogs detection: selection: ActivityDisplayName: Set federation settings on domain condition: selection falsepositives: - Federation Settings being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Federation Settings modified from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects keywords from well-known PowerShell exploitation frameworks. Logsource: windows / ps_script. Rule: title: Malicious PowerShell Keywords id: f62176f3-8128-4faa-bf6c-83261322e5eb status: test description: Detects keywords from well-known PowerShell exploitation frameworks references: - https://adsecurity.org/?p=2921 author: Sean Metcalf (source), Florian Roth (Nextron Systems) date: 2017-03-05 modified: 2023-06-20 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - AdjustTokenPrivileges - IMAGE_NT_OPTIONAL_HDR64_MAGIC - Metasploit - Microsoft.Win32.UnsafeNativeMethods - Mimikatz - MiniDumpWriteDump - PAGE_EXECUTE_READ - ReadProcessMemory.Invoke - SE_PRIVILEGE_ENABLED - SECURITY_DELEGATION - TOKEN_ADJUST_PRIVILEGES - TOKEN_ALL_ACCESS - TOKEN_ASSIGN_PRIMARY - TOKEN_DUPLICATE - TOKEN_ELEVATION - TOKEN_IMPERSONATE - TOKEN_INFORMATION_CLASS - TOKEN_PRIVILEGES - TOKEN_QUERY condition: selection falsepositives: - Depending on the scripts, this rule might require some initial tuning to fit the environment level: medium
Query: CVE similar to CVE-2015-0197
Matching passage: CVE-2015-0197. CWE: CWE-264. CVSS: 7.199999809265137. IBM General Parallel File System (GPFS) 3.4 before 3.4.0.32, 3.5 before 3.5.0.24, and 4.1 before 4.1.0.7 allows local users to obtain root privileges for program execution via unspecified vectors.
Near-miss passage: CVE-2015-6265. CWE: CWE-264. CVSS: 4.300000190734863. The CLI in Cisco Application Control Engine (ACE) 4700 A5 3.0 and earlier allows local users to bypass intended access restrictions, and read or write to files, by entering an unspecified CLI command with a crafted file as this command's input, aka Bug ID CSCur23662.
Query: Sigma rule for Detects LSASS process access requests from a source process with the "dump" keyword in its image name.
Matching passage: Sigma rule: Detects LSASS process access requests from a source process with the "dump" keyword in its image name.. Logsource: windows / process_access. Rule: title: LSASS Memory Access by Tool With Dump Keyword In Name id: 9bd012ee-0dff-44d7-84a0-aa698cfd87a3 status: test description: Detects LSASS process access requests from a source process with the "dump" keyword in its image name. references: - https://twitter.com/_xpn_/status/1491557187168178176 - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz author: Florian Roth (Nextron Systems) date: 2022-02-10 modified: 2023-11-29 tags: - attack.credential-access - attack.t1003.001 - attack.s0002 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe SourceImage|contains: dump GrantedAccess|endswith: - '10' - '30' - '50' - '70' - '90' - B0 - D0 - F0 - '18' - '38' - '58' - '78' - '98' - B8 - D8 - F8 - 1A - 3A - 5A - 7A - 9A - BA - DA - FA - '0x14C2' - FF condition: selection falsepositives: - Rare programs that contain the word dump in their name and access lsass level: high
Near-miss passage: Sigma rule: Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem. Logsource: linux / process_creation. Rule: title: Container Residence Discovery Via Proc Virtual FS id: 746c86fb-ccda-4816-8997-01386263acc4 status: test description: Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem references: - https://blog.skyplabs.net/posts/container-detection/ - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker tags: - attack.discovery - attack.t1082 author: Seth Hanford date: 2023-08-23 logsource: category: process_creation product: linux detection: selection_tools: Image|endswith: - awk - /cat - grep - /head - /less - /more - /nl - /tail selection_procfs_kthreadd: CommandLine|contains: /proc/2/ selection_procfs_target: CommandLine|contains: /proc/ CommandLine|endswith: - /cgroup - /sched condition: selection_tools and 1 of selection_procfs_* falsepositives: - Legitimate system administrator usage of these commands - Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered level: low