alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Outbound C2 pattern associated with Thread Local Storage
Matching passage: T1055.005 Thread Local Storage. Tactics: stealth, privilege escalation. Description: Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade process-based defenses as well as possibly elevate privileges. TLS callback injection is a method of executing arbitrary code in the address space of a separate live process. TLS callback injection involves manipulating pointers inside a portable executable (PE) to redirect a process to malicious code before reaching the code's legitimate entry point. TLS callbacks are normally used by the OS to setup and/or cleanup data used by threads. Manipulating TLS callbacks may be performed by allocating and writing to specific offsets within a process’ memory space using other [Process Injection](https://attack.mitre.org/techniques/T1055) techniques such as [Process Hollowing](https://attack.mitre.org/techniques/T1055/012).(Citation: FireEye TLS Nov 2017) Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via TLS callback injection may also evade detection from security products since the execution is masked under a legitimate process.
Near-miss passage: T1055.008 Ptrace System Calls. Tactics: stealth, privilege escalation. Description: Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process. Ptrace system call injection involves attaching to and modifying a running process. The ptrace system call enables a debugging process to observe and control another process (and each individual thread), including changing memory and register values.(Citation: PTRACE man) Ptrace system call injection is commonly performed by writing arbitrary code into a running process (ex: <code>malloc</code>) then invoking that memory with <code>PTRACE_SETREGS</code> to set the register containing the next instruction to execute. Ptrace system call injection can also be done with <code>PTRACE_POKETEXT</code>/<code>PTRACE_POKEDATA</code>, which copy data to a specific address in the target processes’ memory (ex: the current address of the next instruction). (Citation: PTRACE man)(Citation: Medium Ptrace JUL 2018) Ptrace system call injection may not be possible targeting processes that are non-child processes and/or have higher-privileges.(Citation: BH Linux Inject) Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via ptrace system call injection may also evade detection from security products since the execution is masked under a legitimate process.
Query: risk of In KeePassX before 0.4.4, a cleartext copy of password data is created upon a cancel of an XML export action. This allows context-dependent attackers to obtain sensitive informatio
Matching passage: CVE-2015-8378. CWE: CWE-200. CVSS: 7.5. In KeePassX before 0.4.4, a cleartext copy of password data is created upon a cancel of an XML export action. This allows context-dependent attackers to obtain sensitive information by reading the .xml dotfile.
Near-miss passage: CVE-2015-2374. CWE: CWE-200. CVSS: 3.299999952316284. The Netlogon service in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2 does not properly implement domain-controller communication, which allows remote attackers to discover credentials by leveraging certain PDC access and spoofing the BDC role in a PDC communication channel, aka "Elevation of Privilege Vulnerability in Netlogon."
Query: detection rule: Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are
Matching passage: Sigma rule: Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are. Logsource: windows / ps_script. Rule: title: Detected Windows Software Discovery - PowerShell id: 2650dd1a-eb2a-412d-ac36-83f06c4f2282 status: test description: Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518/T1518.md - https://github.com/harleyQu1nn/AggressorScripts author: Nikita Nazarov, oscd.community date: 2020-10-16 modified: 2022-12-02 tags: - attack.discovery - attack.t1518 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - get-itemProperty - \software\ - select-object - format-table condition: selection falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects the removal of Sysmon, which could be a potential attempt at defense evasion. Logsource: windows / process_creation. Rule: title: Uninstall Sysinternals Sysmon id: 6a5f68d1-c4b5-46b9-94ee-5324892ea939 status: test description: Detects the removal of Sysmon, which could be a potential attempt at defense evasion references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md#atomic-test-11---uninstall-sysmon author: frack113 date: 2022-01-12 modified: 2026-06-29 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_pe: - Image|endswith: - \Sysmon64.exe - \Sysmon64a.exe - \Sysmon.exe - Description: System activity monitor selection_cli: CommandLine|contains|windash: -u condition: all of selection_* falsepositives: - Legitimate administrators might use this command to remove Sysmon for debugging purposes level: high
Query: detect Detects Cmdlet names from PowerView of the PowerSploit exploitation framework. in logs
Matching passage: Sigma rule: Detects Cmdlet names from PowerView of the PowerSploit exploitation framework.. Logsource: windows / ps_script. Rule: title: PowerView PowerShell Cmdlets - ScriptBlock id: dcd74b95-3f36-4ed9-9598-0490951643aa related: - id: b2317cfa-4a47-4ead-b3ff-297438c0bc2d type: similar status: test description: Detects Cmdlet names from PowerView of the PowerSploit exploitation framework. references: - https://powersploit.readthedocs.io/en/stable/Recon/README - https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon - https://thedfirreport.com/2020/10/08/ryuks-return - https://adsecurity.org/?p=2277 author: Bhabesh Raj date: 2021-05-18 modified: 2023-11-22 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Export-PowerViewCSV - Find-DomainLocalGroupMember - Find-DomainObjectPropertyOutlier - Find-DomainProcess - Find-DomainShare - Find-DomainUserEvent - Find-DomainUserLocation - Find-ForeignGroup - Find-ForeignUser - Find-GPOComputerAdmin - Find-GPOLocation - Find-InterestingDomain - Find-InterestingFile - Find-LocalAdminAccess - Find-ManagedSecurityGroups - Get-CachedRDPConnection - Get-DFSshare - Get-DomainDFSShare - Get-DomainDNSRecord - Get-DomainDNSZone - Get-DomainFileServer - Get-DomainGPOComputerLocalGroupMapping - Get-DomainGPOLocalGroup - Get-DomainGPOUserLocalGroupMapping - Get-LastLoggedOn - Get-LoggedOnLocal - Get-NetFileServer - Get-NetForest - Get-NetGPOGroup - Get-NetProcess - Get-NetRDPSession - Get-RegistryMountedDrive - Get-RegLoggedOn - Get-WMIRegCachedRDPConnection - Get-WMIRegLastLoggedOn - Get-WMIRegMountedDrive - Get-WMIRegProxy - Invoke-ACLScanner - Invoke-CheckLocalAdminAccess - Invoke-EnumerateLocalAdmin - Invoke-EventHunter - Invoke-FileFinder - Invoke-Kerberoast - Invoke-MapDomainTrust - Invoke-ProcessHunter - Invoke-RevertToSelf - Invoke-ShareFinder - Invoke-UserHunter - Invoke-UserImpersonation - Remove-RemoteConnection - Request-SPNTicket - Resolve-IPAddress condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.. Logsource: aws / cloudtrail. Rule: title: AWS GuardDuty Important Change id: 6e61ee20-ce00-4f8d-8aee-bedd8216f7e3 status: test description: Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs. references: - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/guardduty__whitelist_ip/main.py#L9 author: faloker date: 2020-02-11 modified: 2022-10-09 tags: - attack.defense-impairment - attack.t1685 logsource: product: aws service: cloudtrail detection: selection_source: eventSource: guardduty.amazonaws.com eventName: CreateIPSet condition: selection_source falsepositives: - Valid change in the GuardDuty (e.g. to ignore internal scanners) level: high
Query: containment actions for SIEM correlation: resource development activity consistent with Malvertising
Matching passage: Playbook for T1583.008 Malvertising. 1) Validate alert telemetry against T1583.008. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: resource development. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may purchase online advertisements that can be abused to distribute malware to victims. Ads can be purchased to plant as well as favorably position artifacts in specific locations online, such as prominently placed within search engine results. These ads may make it more difficult for users to distinguish between actual search results and advertisements.(Citation: spamhaus-malvertising
Near-miss passage: Playbook for T1583.005 Botnet. Different response path focused on resource development.
Query: detect One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by usi in logs
Matching passage: Sigma rule: One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by usi. Logsource: windows / process_creation. Rule: title: Esentutl Steals Browser Information id: 6a69f62d-ce75-4b57-8dce-6351eb55b362 status: test description: One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe references: - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ - https://redcanary.com/threat-detection-report/threats/qbot/ - https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/ author: frack113 date: 2022-02-13 modified: 2024-03-05 tags: - attack.collection - attack.t1005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \esentutl.exe - OriginalFileName: esentutl.exe selection_flag: CommandLine|contains|windash: -r selection_webcache: CommandLine|contains: \Windows\WebCache condition: all of selection* falsepositives: - Legitimate use level: medium
Near-miss passage: Sigma rule: Identifies when a service account is modified in Google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud Service Account Modified id: 6b67c12e-5e40-47c6-b3b0-1e6b571184cc status: test description: Identifies when a service account is modified in Google Cloud. references: - https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts author: Austin Songer @austinsonger date: 2021-08-14 modified: 2022-10-09 tags: - attack.impact logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name|endswith: - .serviceAccounts.patch - .serviceAccounts.create - .serviceAccounts.update - .serviceAccounts.enable - .serviceAccounts.undelete condition: selection falsepositives: - Service Account being modified may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Service Account modified from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: Suspicious Network Devices execution detected on endpoint
Matching passage: T1584.008 Network Devices. Tactics: resource development. Description: Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not [Initial Access](https://attack.mitre.org/tactics/TA0001) to that environment, but rather to leverage these devices to support additional targeting. Once an adversary has control, compromised network devices can be used to launch additional operations, such as hosting payloads for [Phishing](https://attack.mitre.org/techniques/T1566) campaigns (i.e., [Link Target](https://attack.mitre.org/techniques/T1608/005)) or enabling the required access to execute [Content Injection](https://attack.mitre.org/techniques/T1659) operations. Adversaries may also be able to harvest reusable credentials (i.e., [Valid Accounts](https://attack.mitre.org/techniques/T1078)) from compromised network devices. Adversaries often target Internet-facing edge devices and related network appliances that specifically do not support robust host-based defenses.(Citation: Mandiant Fortinet Zero Day)(Citation: Wired Russia Cyberwar) Compromised network devices may be used to support subsequent [Command and Control](https://attack.mitre.org/tactics/TA0011) activity, such as [Hide Infrastructure](https://attack.mitre.org/techniques/T1665) through an established [Proxy](https://attack.mitre.org/techniques/T1090) and/or [Botnet](https://attack.mitre.org/techniques/T1584/005) network.(Citation: Justice GRU 2024)
Near-miss passage: T1584.006 Web Services. Tactics: resource development. Description: Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)), [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567), or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Recorded Future Turla Infra 2020) Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential. Logsource: windows / process_creation. Rule: title: Remote XSL Execution Via Msxsl.EXE id: 75d0a94e-6252-448d-a7be-d953dff527bb status: test description: Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential remote execution of XSL files. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/ author: Swachchhanda Shrawan Poudel date: 2023-11-09 tags: - attack.stealth - attack.t1220 logsource: category: process_creation product: windows detection: selection: Image|endswith: \msxsl.exe CommandLine|contains: http condition: selection falsepositives: - Msxsl is not installed by default and is deprecated, so unlikely on most systems. level: high
Near-miss passage: Sigma rule: Detects scheduled task creations or modification on a suspicious schedule type. Logsource: windows / process_creation. Rule: title: Suspicious Schtasks Schedule Types id: 24c8392b-aa3c-46b7-a545-43f71657fe98 related: - id: 7a02e22e-b885-4404-b38b-1ddc7e65258a type: similar status: test description: Detects scheduled task creations or modification on a suspicious schedule type references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-change - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-09 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_time: CommandLine|contains: - ' ONLOGON ' - ' ONSTART ' - ' ONCE ' - ' ONIDLE ' filter_privs: CommandLine|contains: - NT AUT - ' SYSTEM' - HIGHEST condition: all of selection_* and not 1 of filter_* falsepositives: - Legitimate processes that run at logon. Filter according to your environment level: high
Query: how to detect Archive via Utility
Matching passage: T1560.001 Archive via Utility. Tactics: collection. Description: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport. Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as <code>tar</code> on Linux and macOS or <code>zip</code> on Windows systems. On Windows, <code>diantz</code> or <code> makecab</code> may be used to package collected files into a cabinet (.cab) file. <code>diantz</code> may also be used to download and compress files from remote locations (i.e. [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002)).(Citation: diantz.exe_lolbas) <code>xcopy</code> on Windows can copy files and directories with a variety of options. Additionally, adversaries may use [certutil](https://attack.mitre.org/software/S0160) to Base64 encode collected data before exfiltration. Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.(Citation: 7zip Homepage)(Citation: WinRAR Homepage)(Citation: WinZip Homepage)
Near-miss passage: T1560.003 Archive via Custom Method. Tactics: collection. Description: An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.(Citation: ESET Sednit Part 2)
Query: vulnerability: The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold a
Matching passage: CVE-2015-2518. CWE: CWE-264. CVSS: 6.900000095367432. The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Win32k Memory Corruption Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2511, CVE-2015-2517, and CVE-2015-2546.
Near-miss passage: CVE-2015-3246. CWE: CWE-264. CVSS: 7.199999809265137. libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.
Query: detect Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads rem in logs
Matching passage: Sigma rule: Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads rem. Logsource: windows / process_creation. Rule: title: Install New Package Via Winget Local Manifest id: 313d6012-51a0-4d93-8dfc-de8553239e25 status: test description: 'Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them. The manifest option enables you to install an application by passing in a YAML file directly to the client. Winget can be used to download and install exe, msi or msix files later. ' references: - https://learn.microsoft.com/en-us/windows/package-manager/winget/install#local-install - https://lolbas-project.github.io/lolbas/Binaries/Winget/ - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget author: Sreeman, Florian Roth (Nextron Systems), frack113 date: 2020-04-21 modified: 2023-04-17 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \winget.exe - OriginalFileName: winget.exe selection_install_flag: CommandLine|contains: - install - ' add ' selection_manifest_flag: CommandLine|contains: - '-m ' - --manifest condition: all of selection_* falsepositives: - Some false positives are expected in some environment that may use this functionality to install and test their custom applications level: medium
Near-miss passage: Sigma rule: Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels. Logsource: cisco / ldp. Rule: title: Cisco LDP Authentication Failures id: 50e606bf-04ce-4ca7-9d54-3449494bbd4b status: test description: Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels references: - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf author: Tim Brown date: 2023-01-09 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.credential-access - attack.collection - attack.stealth - attack.t1078 - attack.t1110 - attack.t1557 logsource: product: cisco service: ldp definition: 'Requirements: cisco ldp logs need to be enabled and ingested' detection: selection_protocol: - LDP selection_keywords: - SOCKET_TCP_PACKET_MD5_AUTHEN_FAIL - TCPMD5AuthenFail condition: selection_protocol and selection_keywords falsepositives: - Unlikely. Except due to misconfigurations level: low