alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects the execution of powershell scripts with calls to the "Start-NetEventSession" cmdlet. Which allows an attacker t
Matching passage: Sigma rule: Detects the execution of powershell scripts with calls to the "Start-NetEventSession" cmdlet. Which allows an attacker t. Logsource: windows / ps_script. Rule: title: Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock id: da34e323-1e65-42db-83be-a6725ac2caa3 status: test description: 'Detects the execution of powershell scripts with calls to the "Start-NetEventSession" cmdlet. Which allows an attacker to start event and packet capture for a network event session. Adversaries may attempt to capture network to gather information over the course of an operation. Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/5f866ca4517e837c4ea576e7309d0891e78080a8/atomics/T1040/T1040.md#atomic-test-16---powershell-network-sniffing - https://github.com/0xsyr0/Awesome-Cybersecurity-Handbooks/blob/7b8935fe4c82cb64d61343de1a8b2e38dd968534/handbooks/10_post_exploitation.md - https://github.com/forgottentq/powershell/blob/9e616363d497143dc955c4fdce68e5c18d28a6cb/captureWindows-Endpoint.ps1#L13 author: frack113 date: 2024-05-12 tags: - attack.credential-access - attack.discovery - attack.t1040 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: Start-NetEventSession condition: selection falsepositives: - Legitimate network diagnostic scripts. level: medium
Near-miss passage: Sigma rule: Detects logons using NTLM, which could be caused by a legacy source or attackers. Logsource: windows / ntlm. Rule: title: NTLM Logon id: 98c3bcf1-56f2-49dc-9d8d-c66cf190238b status: test description: Detects logons using NTLM, which could be caused by a legacy source or attackers references: - https://twitter.com/JohnLaTwC/status/1004895028995477505 author: Florian Roth (Nextron Systems) date: 2018-06-08 modified: 2024-07-22 tags: - attack.lateral-movement - attack.t1550.002 logsource: product: windows service: ntlm definition: Requires events from Microsoft-Windows-NTLM/Operational detection: selection: EventID: 8002 condition: selection falsepositives: - Legacy hosts level: low
Query: patch priority for CVE-2015-0814
Matching passage: CVE-2015-0814. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Near-miss passage: CVE-2015-4880. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 allows remote attackers to affect integrity via unknown vectors related to Content Server, a different vulnerability than CVE-2015-4867.
Query: EDR alert: possible Reflective Code Loading (T1620)
Matching passage: T1620 Reflective Code Loading. Tactics: stealth. Description: Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., [Shared Modules](https://attack.mitre.org/techniques/T1129)). Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode).(Citation: Introducing Donut)(Citation: S1 Custom Shellcode Tool)(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Mandiant BYOL) For example, the `Assembly.Load()` method executed by [PowerShell](https://attack.mitre.org/techniques/T1059/001) may be abused to load raw code into the running process.(Citation: Microsoft AssemblyLoad) Reflective code injection is very similar to [Process Injection](https://attack.mitre.org/techniques/T1055) except that the “injection” loads code into the processes’ own memory instead of that of a separate process. Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process. Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Intezer ACBackdoor)(Citation: S1 Old Rat New Tricks)
Near-miss passage: T1205.001 Port Knocking. Tactics: stealth, persistence, command and control. Description: Adversaries may use port knocking to hide open ports used for persistence or command and control. To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports. After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software. This technique has been observed both for the dynamic opening of a listening port as well as the initiating of a connection to a listening server on a different system. The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.
Query: detection rule: Identifies when a key vault is modified or deleted.
Matching passage: Sigma rule: Identifies when a key vault is modified or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Key Vault Modified or Deleted id: 459a2970-bb84-4e6a-a32e-ff0fbd99448d status: test description: Identifies when a key vault is modified or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-08-16 modified: 2022-08-23 tags: - attack.impact - attack.credential-access - attack.t1552 - attack.t1552.001 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KEYVAULT/VAULTS/WRITE - MICROSOFT.KEYVAULT/VAULTS/DELETE - MICROSOFT.KEYVAULT/VAULTS/DEPLOY/ACTION - MICROSOFT.KEYVAULT/VAULTS/ACCESSPOLICIES/WRITE condition: selection falsepositives: - Key Vault being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Key Vault modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects if the push protection feature is disabled for an organization, enterprise, repositories or custom pattern rules. Logsource: github / audit. Rule: title: Github Push Protection Disabled id: ccd55945-badd-4bae-936b-823a735d37dd status: test description: Detects if the push protection feature is disabled for an organization, enterprise, repositories or custom pattern rules. references: - https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/push-protection-for-repositories-and-organizations - https://thehackernews.com/2024/03/github-rolls-out-default-secret.html author: Muhammad Faisal (@faisalusuf) date: 2024-03-07 tags: - attack.defense-impairment - attack.t1685 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action: - business_secret_scanning_custom_pattern_push_protection.disabled - business_secret_scanning_push_protection.disable - business_secret_scanning_push_protection.disabled_for_new_repos - org.secret_scanning_custom_pattern_push_protection_disabled - org.secret_scanning_push_protection_disable - org.secret_scanning_push_protection_new_repos_disable - repository_secret_scanning_custom_pattern_push_protection.disabled condition: selection falsepositives: - Allowed administrative activities. level: high
Query: detection rule: This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon mod
Matching passage: Sigma rule: This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon mod. Logsource: windows / system. Rule: title: Zerologon Exploitation Using Well-known Tools id: 18f37338-b9bd-4117-a039-280c81f7a596 status: stable description: This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon module or other exploits from machine with "kali" hostname. references: - https://www.secura.com/blog/zero-logon - https://bi-zone.medium.com/hunting-for-zerologon-f65c61586382 author: Demyan Sokolin @_drd0c, Teymur Kheirkhabarov @HeirhabarovT, oscd.community date: 2020-10-13 modified: 2021-05-30 tags: - attack.t1210 - attack.lateral-movement logsource: service: system product: windows detection: selection: EventID: - 5805 - 5723 keywords: - kali - mimikatz condition: selection and keywords level: critical
Near-miss passage: Sigma rule: Detects the execution of "dotnet-dump" with the "collect" flag. The execution could indicate potential process dumping o. Logsource: windows / process_creation. Rule: title: Process Memory Dump Via Dotnet-Dump id: 53d8d3e1-ca33-4012-adf3-e05a4d652e34 status: test description: 'Detects the execution of "dotnet-dump" with the "collect" flag. The execution could indicate potential process dumping of critical processes such as LSASS. ' references: - https://learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-dump#dotnet-dump-collect - https://twitter.com/bohops/status/1635288066909966338 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-14 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \dotnet-dump.exe - OriginalFileName: dotnet-dump.dll selection_cli: CommandLine|contains: collect condition: all of selection_* falsepositives: - Process dumping is the expected behavior of the tool. So false positives are expected in legitimate usage. The PID/Process Name of the process being dumped needs to be investigated level: medium
Query: Lateral movement indicators for Search Open Technical Databases
Matching passage: T1596 Search Open Technical Databases. Tactics: reconnaissance. Description: Adversaries may search freely available technical databases for information about victims that can be used during targeting. Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans.(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS)(Citation: Medium SSL Cert)(Citation: SSLShopper Lookup)(Citation: DigitalShadows CDN)(Citation: Shodan) Adversaries may search in different open databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Near-miss passage: T1596.005 Scan Databases. Tactics: reconnaissance. Description: Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners.(Citation: Shodan) Adversaries may search scan databases to gather actionable information. Threat actors can use online resources and lookup tools to harvest information from these services. Adversaries may seek information about their already identified targets, or use these datasets to discover opportunities for successful breaches. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).
Query: campaign using Browser Information Discovery
Matching passage: T1217 Browser Information Discovery. Tactics: discovery. Description: Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.(Citation: Kaspersky Autofill) Browser information may also highlight additional targets after an adversary has access to valid credentials, especially [Credentials In Files](https://attack.mitre.org/techniques/T1552/001) associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).(Citation: Chrome Roaming Profiles)
Near-miss passage: T1016 System Network Configuration Discovery. Tactics: discovery. Description: Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include [Arp](https://attack.mitre.org/software/S0099), [ipconfig](https://attack.mitre.org/software/S0100)/[ifconfig](https://attack.mitre.org/software/S0101), [nbtstat](https://attack.mitre.org/software/S0102), and [route](https://attack.mitre.org/software/S0103). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather information about configurations and settings, such as IP addresses of configured interfaces and static/dynamic routes (e.g. <code>show ip route</code>, <code>show ip interface</code>).(Citation: US-CERT-TA18-106A)(Citation: Mandiant APT41 Global Intrusion ) On ESXi, adversaries may leverage esxcli to gather network configuration information. For example, the command `esxcli network nic list` will retrieve the MAC address, while `esxcli network ip interface ipv4 get` will retrieve the local IPv4 address.(Citation: Trellix Rnasomhouse 2024) Adversaries may use the information from [System Network Configuration Discovery](https://attack.mitre.org/techniques/T1016) during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.
Query: CVE similar to CVE-2015-0015
Matching passage: CVE-2015-0015. CWE: CWE-399. CVSS: 7.800000190734863. Microsoft Windows Server 2003 SP2, Server 2008 SP2 and R2 SP1, and Server 2012 Gold and R2 allow remote attackers to cause a denial of service (system hang and RADIUS outage) via crafted username strings to (1) Internet Authentication Service (IAS) or (2) Network Policy Server (NPS), aka "Network Policy Server RADIUS Implementation Denial of Service Vulnerability."
Near-miss passage: CVE-2015-7540. CWE: CWE-399. CVSS: 7.5. The LDAP server in the AD domain controller in Samba 4.x before 4.1.22 does not check return values to ensure successful ASN.1 memory allocation, which allows remote attackers to cause a denial of service (memory consumption and daemon crash) via crafted packets.
Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects changes to the AppInstaller (winget) policy. Specifically the activation of the local manifest installation, whi. Logsource: windows / registry_set. Rule: title: Enable Local Manifest Installation With Winget id: fa277e82-9b78-42dd-b05c-05555c7b6015 status: test description: Detects changes to the AppInstaller (winget) policy. Specifically the activation of the local manifest installation, which allows a user to install new packages via custom manifests. references: - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-17 modified: 2023-08-17 tags: - attack.persistence - attack.stealth logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: \AppInstaller\EnableLocalManifestFiles Details: DWORD (0x00000001) condition: selection falsepositives: - Administrators or developers might enable this for testing purposes or to install custom private packages level: medium
Near-miss passage: Sigma rule: Detects commands that temporarily turn off Volume Snapshots. Logsource: windows / process_creation. Rule: title: Disabled Volume Snapshots id: dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a status: test description: Detects commands that temporarily turn off Volume Snapshots references: - https://twitter.com/0gtweet/status/1354766164166115331 author: Florian Roth (Nextron Systems) date: 2021-01-28 modified: 2023-12-15 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - \Services\VSS\Diag - /d Disabled condition: selection falsepositives: - Legitimate administration level: high
Query: exploit Cross-site scripting (XSS) vulnerability in Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allow
Matching passage: CVE-2015-7467. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-2926. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Php/stats/statsRecent.inc.php in phpTrafficA 2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the HTTP User-Agent header to index.php.
Query: risk of The Microsoft (1) VBScript and (2) JScript engines, as used in Internet Explorer 8 through 11, allow remote attackers to execute arbitrary code or cause a denial of service (memory
Matching passage: CVE-2015-6089. CWE: CWE-119. CVSS: 9.300000190734863. The Microsoft (1) VBScript and (2) JScript engines, as used in Internet Explorer 8 through 11, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-5218. CWE: CWE-119. CVSS: 2.0999999046325684. Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a crafted file, related to the page global variable.
Query: SOC alert related to Rename Legitimate Utilities
Matching passage: T1036.003 Rename Legitimate Utilities. Tactics: stealth. Description: Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython.(Citation: LOLBAS Main Site)(Citation: Huntress Python Malware 2025)(Citation: The DFIR Report AutoHotKey 2023)(Citation: Splunk Detect Renamed PSExec) It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename <code>rundll32.exe</code>).(Citation: Elastic Masquerade Ball) An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.(Citation: F-Secure CozyDuke)
Near-miss passage: T1036.011 Overwrite Process Arguments. Tactics: stealth. Description: Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign process. On Linux, the operating system stores command-line arguments in the process’s stack and passes them to the `main()` function as the `argv` array. The first element, `argv[0]`, typically contains the process name or path - by default, the command used to actually start the process (e.g., `cat /etc/passwd`). By default, the Linux `/proc` filesystem uses this value to represent the process name. The `/proc/<PID>/cmdline` file reflects the contents of this memory, and tools like `ps` use it to display process information. Since arguments are stored in user-space memory at launch, this modification can be performed without elevated privileges. During runtime, adversaries can erase the memory used by all command-line arguments for a process, overwriting each argument string with null bytes. This removes evidence of how the process was originally launched. They can then write a spoofed string into the memory region previously occupied by `argv[0]` to mimic a benign command, such as `cat resolv.conf`. The new command-line string is reflected in `/proc/<PID>/cmdline` and displayed by tools like `ps`.(Citation: Sandfly BPFDoor 2022)(Citation: Microsoft XorDdos Linux Stealth 2022)
Query: CVE similar to CVE-2015-1705
Matching passage: CVE-2015-1705. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1689.
Near-miss passage: CVE-2015-7116. CWE: CWE-119. CVSS: 4.300000190734863. libxml2 in Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 allows remote attackers to obtain sensitive information or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2015-7115.