alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Lateral movement indicators for Employee Names
Matching passage: T1589.003 Employee Names. Tactics: reconnaissance. Description: Adversaries may gather employee names that can be used during targeting. Employee names be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures. Adversaries may easily gather employee names, since they may be readily available and exposed via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
Near-miss passage: T1589.002 Email Addresses. Tactics: reconnaissance. Description: Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees. Adversaries may easily gather email addresses, since they may be readily available and exposed via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: HackersArise Email)(Citation: CNET Leaks) Email addresses could also be enumerated via more active means (i.e. [Active Scanning](https://attack.mitre.org/techniques/T1595)), such as probing and analyzing responses from authentication services that may reveal valid usernames in a system.(Citation: GrimBlog UsernameEnum) For example, adversaries may be able to enumerate email addresses in Office 365 environments by querying a variety of publicly available API endpoints, such as autodiscover and GetCredentialType.(Citation: GitHub Office 365 User Enumeration)(Citation: Azure Active Directory Reconnaisance) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Email Accounts](https://attack.mitre.org/techniques/T1586/002)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Brute Force](https://attack.mitre.org/techniques/T1110) via [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Query: ATT&CK technique for Internet Connection Discovery
Matching passage: T1016.001 Internet Connection Discovery. Tactics: discovery. Description: Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using [Ping](https://attack.mitre.org/software/S0097), <code>tracert</code>, and GET requests to websites, or performing initial speed testing to confirm bandwidth. Adversaries may use the results and responses from these requests to determine if the system is capable of communicating with their C2 servers before attempting to connect to them. The results may also be used to identify routes, redirectors, and proxy servers.
Near-miss passage: T1016.002 Wi-Fi Discovery. Tactics: discovery. Description: Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. Adversaries may use Wi-Fi information as part of [Account Discovery](https://attack.mitre.org/techniques/T1087), [Remote System Discovery](https://attack.mitre.org/techniques/T1018), and other discovery or [Credential Access](https://attack.mitre.org/tactics/TA0006) activity to support both ongoing and future campaigns. Adversaries may collect various types of information about Wi-Fi networks from hosts. For example, on Windows names and passwords of all Wi-Fi networks a device has previously connected to may be available through `netsh wlan show profiles` to enumerate Wi-Fi names and then `netsh wlan show profile “Wi-Fi name” key=clear` to show a Wi-Fi network’s corresponding password.(Citation: BleepingComputer Agent Tesla steal wifi passwords)(Citation: Malware Bytes New AgentTesla variant steals WiFi credentials)(Citation: Check Point APT35 CharmPower January 2022) Additionally, names and other details of locally reachable Wi-Fi networks can be discovered using calls to `wlanAPI.dll` [Native API](https://attack.mitre.org/techniques/T1106) functions.(Citation: Binary Defense Emotes Wi-Fi Spreader) On Linux, names and passwords of all Wi-Fi-networks a device has previously connected to may be available in files under ` /etc/NetworkManager/system-connections/`.(Citation: Wi-Fi Password of All Connected Networks in Windows/Linux) On macOS, the password of a known Wi-Fi may be identified with ` security find-generic-password -wa wifiname` (requires admin username/password).(Citation: Find Wi-Fi Password on Mac)
Query: CVE similar to CVE-2015-0223
Matching passage: CVE-2015-0223. CWE: CWE-264. CVSS: 5.0. Unspecified vulnerability in Apache Qpid 0.30 and earlier allows remote attackers to bypass access restrictions on qpidd via unknown vectors, related to 0-10 connection handling.
Near-miss passage: CVE-2015-6607. CWE: CWE-264. CVSS: 6.800000190734863. SQLite before 3.8.9, as used in Android before 5.1.1 LMY48T, allows attackers to gain privileges via a crafted application, aka internal bug 20099586.
Query: exploit The kernel in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 does not properly constrain impersonation levels, which al
Matching passage: CVE-2015-0075. CWE: CWE-264. CVSS: 7.199999809265137. The kernel in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 does not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Impersonation Level Check Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-5264. CWE: CWE-264. CVSS: 5.400000095367432. The lesson module in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to bypass intended access restrictions and enter additional answer attempts by leveraging the student role.
Query: ATT&CK technique for Multiband Communication
Matching passage: T1026 Multiband Communication. Tactics: command and control. Description: **This technique has been deprecated and should no longer be used.** Some adversaries may split communications between different protocols. There could be one protocol for inbound command and control and another for outbound data, allowing it to bypass certain firewall restrictions. The split could also be random to simply avoid data threshold alerts on any one communication.
Near-miss passage: T1568 Dynamic Resolution. Tactics: command and control. Description: Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control. Adversaries may use dynamic resolution for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)
Query: CVE similar to CVE-2015-6747
Matching passage: CVE-2015-6747. CWE: CWE-200. CVSS: 5.0. Basware Banking (Maksuliikenne) 8.90.07.X does not properly prevent access to private keys, which allows remote attackers to spoof communications with banks via unspecified vectors. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 due to different vulnerability types. NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-6746.
Near-miss passage: CVE-2015-7991. CWE: CWE-200. CVSS: 5.0. The Web Dispatcher service in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to read web dispatcher and security trace files and possibly obtain passwords via unspecified vectors, aka SAP Security Note 2148854.
Query: alert when Detects the execution of 'auditctl' with the '-D' command line parameter, which deletes all configured audit rules and w
Matching passage: Sigma rule: Detects the execution of 'auditctl' with the '-D' command line parameter, which deletes all configured audit rules and w. Logsource: linux / process_creation. Rule: title: Audit Rules Deleted Via Auditctl id: bed26dea-4525-47f4-b24a-76e30e44ffb0 status: experimental description: 'Detects the execution of ''auditctl'' with the ''-D'' command line parameter, which deletes all configured audit rules and watches on Linux systems. This technique is commonly used by attackers to disable audit logging and cover their tracks by removing monitoring capabilities. Removal of audit rules can significantly impair detection of malicious activities on the affected system. ' references: - https://www.atomicredteam.io/atomic-red-team/atomics/T1562.012 - https://linux.die.net/man/8/auditct author: Mohamed LAKRI date: 2025-10-17 tags: - attack.defense-impairment - attack.t1685.004 logsource: product: linux category: process_creation detection: selection: Image|endswith: /auditctl CommandLine|re: -D condition: selection falsepositives: - An administrator troubleshooting. Investigate all attempts. level: high
Near-miss passage: Sigma rule: Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell". Logsource: windows / process_creation. Rule: title: Always Install Elevated MSI Spawned Cmd And Powershell id: 1e53dd56-8d83-4eb4-a43e-b790a05510aa status: test description: Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell" references: - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-50-638.jpg author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community date: 2020-10-13 modified: 2022-10-20 tags: - attack.privilege-escalation - attack.t1548.002 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - Cmd.Exe - PowerShell.EXE - pwsh.dll selection_parent: ParentImage|contains|all: - \Windows\Installer\ - msi ParentImage|endswith: tmp condition: all of selection_* falsepositives: - Unknown level: medium
Query: ATT&CK technique for Determine Physical Locations
Matching passage: T1591.001 Determine Physical Locations. Tactics: reconnaissance. Description: Adversaries may gather the victim's physical location(s) that can be used during targeting. Information about physical locations of a target organization may include a variety of details, including where key resources and infrastructure are housed. Physical locations may also indicate what legal jurisdiction and/or authorities the victim operates within. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Physical locations of a target organization may also be exposed to adversaries via online or other accessible data sets (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594) or [Social Media](https://attack.mitre.org/techniques/T1593/001)).(Citation: ThreatPost Broadvoice Leak)(Citation: SEC EDGAR Search) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Hardware Additions](https://attack.mitre.org/techniques/T1200)).
Near-miss passage: T1591.004 Identify Roles. Tactics: reconnaissance. Description: Adversaries may gather information about identities and roles within the victim organization that can be used during targeting. Information about business roles may reveal a variety of targetable details, including identifiable information for key personnel as well as what data/resources they have access to. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about business roles may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).
Query: rule covering Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently acc
Matching passage: Sigma rule: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently acc. Logsource: windows / ps_classic_start. Rule: title: Use Get-NetTCPConnection id: b366adb4-d63d-422d-8a2c-186463b5ded0 status: test description: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-2---system-network-connections-discovery-with-powershell author: frack113 date: 2021-12-10 modified: 2023-10-27 tags: - attack.discovery - attack.t1049 logsource: product: windows category: ps_classic_start detection: selection: Data|contains: Get-NetTCPConnection condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (a. Logsource: windows / process_creation. Rule: title: Suspicious UltraVNC Execution id: 871b9555-69ca-4993-99d3-35a59f9f3599 status: test description: Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (as seen being used by Gamaredon threat group) references: - https://web.archive.org/web/20220224045756/https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine - https://unit42.paloaltonetworks.com/unit-42-title-gamaredon-group-toolset-evolution - https://uvnc.com/docs/uvnc-viewer/52-ultravnc-viewer-commandline-parameters.html author: Bhabesh Raj date: 2022-03-04 modified: 2022-03-09 tags: - attack.lateral-movement - attack.g0047 - attack.t1021.005 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - '-autoreconnect ' - '-connect ' - '-id:' condition: selection falsepositives: - Unknown level: high
Query: alert when Detects Obfuscated use of Environment Variables to execute PowerShell
Matching passage: Sigma rule: Detects Obfuscated use of Environment Variables to execute PowerShell. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation VAR+ Launcher - PowerShell Module id: 6bfb8fa7-b2e7-4f6c-8d9d-824e5d06ea9e related: - id: 0adfbc14-0ed1-11eb-adc1-0242ac120002 type: derived status: test description: Detects Obfuscated use of Environment Variables to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|re: cmd.{0,5}(?:/c|/r)(?:\s|)"set\s[a-zA-Z]{3,6}.*(?:\{\d\}){1,}\\"\s+?-f(?:.*\)){1,}.*" condition: selection_4103 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads. Logsource: windows / file_event. Rule: title: Potential Webshell Creation On Static Website id: 39f1f9f2-9636-45de-98f6-a4046aa8e4b9 status: test description: Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell. references: - PT ESC rule and personal experience - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/c95a0a1a2855dc0cd7f7327614545fe30482a636/Upload%20Insecure%20Files/README.md author: Beyu Denis, oscd.community, Tim Shelton, Thurein Oo date: 2019-10-22 modified: 2023-10-15 tags: - attack.persistence - attack.t1505.003 logsource: product: windows category: file_event detection: selection_wwwroot_path: TargetFilename|contains: \inetpub\wwwroot\ selection_wwwroot_ext: TargetFilename|contains: - .ashx - .asp - .ph - .soap selection_htdocs_path: TargetFilename|contains: - \www\ - \htdocs\ - \html\ selection_htdocs_ext: TargetFilename|contains: .ph filter_main_temp: TargetFilename|contains: - \AppData\Local\Temp\ - \Windows\Temp\ filter_main_system: Image: System filter_main_legitimate: TargetFilename|contains: \xampp condition: (all of selection_wwwroot_* or all of selection_htdocs_*) and not 1 of filter_main_* falsepositives: - Legitimate administrator or developer creating legitimate executable files in a web application folder level: medium
Query: Sigma rule for Detects DNS queries to domains commonly used by threat actors to host malware payloads or redirect through URL shortener
Matching passage: Sigma rule: Detects DNS queries to domains commonly used by threat actors to host malware payloads or redirect through URL shortener. Logsource: windows / dns_query. Rule: title: DNS Query To Common Malware Hosting and Shortener Services id: f8c1e80b-c73a-476a-ae24-6c72528b1521 status: experimental description: 'Detects DNS queries to domains commonly used by threat actors to host malware payloads or redirect through URL shorteners. These include platforms like Cloudflare Workers, TryCloudflare, InfinityFree, and URL shorteners such as tinyurl and lihi.cc. Such DNS activity can indicate potential delivery or command-and-control communication attempts. ' references: - https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics author: Ahmed Nosir (@egycondor) date: 2025-06-02 tags: - attack.command-and-control - attack.t1071.004 logsource: product: windows category: dns_query detection: selection: QueryName|contains: - msapp.workers.dev - trycloudflare.com - infinityfreeapp.com - my5353.com - reurl.cc - lihi.cc - tinyurl.com condition: selection falsepositives: - Legitimate use of these services is possible but rare in enterprise environments level: medium
Near-miss passage: Sigma rule: Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order. Logsource: windows / registry_set. Rule: title: Hypervisor Enforced Paging Translation Disabled id: 7f2954d2-99c2-4d42-a065-ca36740f187b status: test description: 'Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order to disable the Hypervisor Enforced Paging Translation feature. ' references: - https://twitter.com/standa_t/status/1808868985678803222 - https://github.com/AaLl86/WindowsInternals/blob/070dc4f317726dfb6ffd2b7a7c121a33a8659b5e/Slides/Hypervisor-enforced%20Paging%20Translation%20-%20The%20end%20of%20non%20data-driven%20Kernel%20Exploits%20(Recon2024).pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2024-07-05 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \DisableHypervisorEnforcedPagingTranslation Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: high
Query: containment actions for Outbound C2 pattern associated with Hijack Execution Flow
Matching passage: Playbook for T1574 Hijack Execution Flow. 1) Validate alert telemetry against T1574. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth, execution. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. There are many ways an advers
Near-miss passage: Playbook for T1574.010 Services File Permissions Weakness. Different response path focused on stealth, execution.
Query: risk of SolarWinds Log and Event Manager (LEM) allows remote attackers to execute arbitrary commands on managed computers via a request to services/messagebroker/nonsecurestreamingamf invo
Matching passage: CVE-2015-7839. CWE: CWE-77. CVSS: 7.5. SolarWinds Log and Event Manager (LEM) allows remote attackers to execute arbitrary commands on managed computers via a request to services/messagebroker/nonsecurestreamingamf involving the traceroute functionality.
Near-miss passage: CVE-2015-20108. CWE: CWE-77. CVSS: 9.800000190734863. xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.
Query: exploit The Accelerate Framework component in Apple iOS before 9.1 and OS X before 10.11.1, when multi-threading is enabled, omits certain validation and locking steps, which allows remote
Matching passage: CVE-2015-5940. CWE: CWE-119. CVSS: 6.800000190734863. The Accelerate Framework component in Apple iOS before 9.1 and OS X before 10.11.1, when multi-threading is enabled, omits certain validation and locking steps, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Near-miss passage: CVE-2015-7894. CWE: CWE-119. CVSS: 8.800000190734863. The DCMProvider service in Samsung LibQjpeg on a Samsung SM-G925V device running build number LRX22G.G925VVRU1AOE2 allows remote attackers to cause a denial of service (segmentation fault and process crash) and execute arbitrary code via a crafted JPG.