alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permiss
Matching passage: Sigma rule: Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permiss. Logsource: windows / process_creation. Rule: title: PUA - Wsudo Suspicious Execution id: bdeeabc9-ff2a-4a51-be59-bb253aac7891 status: test description: Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permissions (System, Trusted Installer, Administrator...etc) references: - https://github.com/M2Team/Privexec/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-02 modified: 2023-02-14 tags: - attack.execution - attack.privilege-escalation - attack.t1059 logsource: category: process_creation product: windows detection: selection_metadata: - Image|endswith: \wsudo.exe - OriginalFileName: wsudo.exe - Description: Windows sudo utility - ParentImage|endswith: \wsudo-bridge.exe selection_cli: CommandLine|contains: - -u System - -uSystem - -u TrustedInstaller - -uTrustedInstaller - ' --ti ' condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects possible NTLM coercion via certutil using the 'syncwithWU' flag. Logsource: windows / process_creation. Rule: title: Potential NTLM Coercion Via Certutil.EXE id: 6c6d9280-e6d0-4b9d-80ac-254701b64916 status: test description: Detects possible NTLM coercion via certutil using the 'syncwithWU' flag references: - https://github.com/LOLBAS-Project/LOLBAS/issues/243 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-01 modified: 2023-02-14 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certutil.exe - OriginalFileName: CertUtil.exe selection_cli: CommandLine|contains|all: - ' -syncwithWU ' - ' \\\\' condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_ntlm_coercion/info.yml
Query: exploit Cross-site scripting (XSS) vulnerability in the quick edit function in xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.8.5 allows remote attackers to inject arbitrary web script
Matching passage: CVE-2015-4552. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the quick edit function in xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the content of a post.
Near-miss passage: CVE-2015-6337. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) 1.0.10 allows remote attackers to inject arbitrary web script or HTML via a crafted hostname in an SNMP response, aka Bug ID CSCuw47238.
Query: exploit Cross-site request forgery (CSRF) vulnerability in MikroTik RouterOS 5.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that change
Matching passage: CVE-2015-2350. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in MikroTik RouterOS 5.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request in the status page to /cfg.
Near-miss passage: CVE-2015-4140. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the WP Smiley plugin 1.4.1 for WordPress allows remote attackers to hijack the authentication of editors for requests that conduct cross-site scripting (XSS) attacks via the s4w-more parameter to the smilies4wp.php page to wp-admin/options-general.php.
Query: vulnerability: Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and A
Matching passage: CVE-2015-4448. CWE: CWE-416. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5095, CVE-2015-5099, CVE-2015-5101, CVE-2015-5111, CVE-2015-5113, and CVE-2015-5114.
Near-miss passage: CVE-2015-3075. CWE: CWE-416. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3053, CVE-2015-3054, CVE-2015-3055, and CVE-2015-3059.
Query: common weakness: Use of a Key Past its Expiration Date
Matching passage: CWE-324 Use of a Key Past its Expiration Date. The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
Near-miss passage: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Detects attempts to remove Windows Defender configuration using the 'MpPreference' cmdlet. Logsource: windows / ps_script. Rule: title: Tamper Windows Defender Remove-MpPreference - ScriptBlockLogging id: ae2bdd58-0681-48ac-be7f-58ab4e593458 related: - id: 07e3cb2c-0608-410d-be4b-1511cb1a0448 type: similar status: test description: Detects attempts to remove Windows Defender configuration using the 'MpPreference' cmdlet references: - https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-controlled-folder-access-event-search/ba-p/2326088 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_remove: ScriptBlockText|contains: Remove-MpPreference selection_tamper: ScriptBlockText|contains: - '-ControlledFolderAccessProtectedFolders ' - '-AttackSurfaceReductionRules_Ids ' - '-AttackSurfaceReductionRules_Actions ' - '-CheckForSignaturesBeforeRunningScan ' condition: all of selection_* falsepositives: - Legitimate PowerShell scripts level: high
Near-miss passage: Sigma rule: Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unau. Logsource: linux / process_creation. Rule: title: Shell Invocation Via Ssh - Linux id: 8737b7f6-8df3-4bb7-b1da-06019b99b687 status: test description: 'Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. ' references: - https://gtfobins.github.io/gtfobins/ssh/ - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-08-29 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /ssh CommandLine|contains: - ProxyCommand=; - permitlocalcommand=yes - localhost selection_cli: CommandLine|contains: - /bin/bash - /bin/dash - /bin/fish - /bin/sh - /bin/zsh - sh 0<&2 1>&2 - sh 1>&2 0<&2 condition: all of selection_* falsepositives: - Unknown level: high
Query: risk of Directory traversal vulnerability in the SwiftKey language-pack update implementation on Samsung Galaxy S4, S4 Mini, S5, and S6 devices allows remote web servers to write to arbitr
Matching passage: CVE-2015-4641. CWE: CWE-22. CVSS: 6.400000095367432. Directory traversal vulnerability in the SwiftKey language-pack update implementation on Samsung Galaxy S4, S4 Mini, S5, and S6 devices allows remote web servers to write to arbitrary files, and consequently execute arbitrary code in a privileged context, by leveraging control of the skslm.swiftkey.net domain name and providing a .. (dot dot) in an entry in a ZIP archive, as demonstrated by a traversal to the /data/dalvik-cache directory.
Near-miss passage: CVE-2015-5688. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI.
Query: common weakness: Observable Behavioral Discrepancy With Equivalent Products
Matching passage: CWE-207 Observable Behavioral Discrepancy With Equivalent Products. The product operates in an environment in which its existence or specific identity should not be known, but it behaves differently than other products with equivalent functionality, in a way that is observable to an attacker.
Near-miss passage: CWE-1281 Sequence of Processor Instructions Leads to Unexpected Behavior. Specific combinations of processor instructions lead to undesirable behavior such as locking the processor until a hard reset performed.
Query: risk of The System Integrity Protection feature in Apple OS X before 10.11.2 mishandles union mounts, which allows attackers to execute arbitrary code in a privileged context via a crafted
Matching passage: CVE-2015-7044. CWE: CWE-254. CVSS: 7.599999904632568. The System Integrity Protection feature in Apple OS X before 10.11.2 mishandles union mounts, which allows attackers to execute arbitrary code in a privileged context via a crafted app with root privileges.
Near-miss passage: CVE-2015-7435. CWE: CWE-254. CVSS: 2.5. IBM Tivoli Common Reporting (TCR) 2.1 before IF14, 2.1.1 before IF22, 2.1.1.2 before IF9, 3.1.0.0 through 3.1.2 as used in Cognos Business Intelligence before 10.2 IF16, and 3.1.2.1 as used in Cognos Business Intelligence before 10.2.1.1 IF12 allows local users to bypass the Cognos Application Firewall (CAF) protection mechanism via leading whitespace in the BackURL field.
Query: exploit The "RAP console" feature in ArubaOS 5.x through 6.2.x, 6.3.x before 6.3.1.15, and 6.4.x before 6.4.2.4 on Aruba access points in Remote Access Point (AP) mode allows remote attack
Matching passage: CVE-2015-1388. CWE: CWE-78. CVSS: 7.199999809265137. The "RAP console" feature in ArubaOS 5.x through 6.2.x, 6.3.x before 6.3.1.15, and 6.4.x before 6.4.2.4 on Aruba access points in Remote Access Point (AP) mode allows remote attackers to execute arbitrary commands via unspecified vectors.
Near-miss passage: CVE-2015-7774. CWE: CWE-78. CVSS: 6.5. PC-EGG pWebManager before 3.3.10, and before 2.2.2 for PHP 4.x, allows remote authenticated users to execute arbitrary OS commands by leveraging the editor role.
Query: describe CVE-2015-2683
Matching passage: CVE-2015-2683. CWE: CWE-264. CVSS: 7.5. Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 does not properly restrict access to the Advent Java Management Extensions (JMX) Servlet, which allows remote attackers to execute arbitrary code via unspecified vectors to servlets/Jmx_dynamic.
Near-miss passage: CVE-2015-1885. CWE: CWE-264. CVSS: 9.300000190734863. WebSphereOauth20SP.ear in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, 8.5 Liberty Profile before 8.5.5.5, and 8.5 Full Profile before 8.5.5.6, when the OAuth grant type requires sending a password, allows remote attackers to gain privileges via unspecified vectors.
Query: vulnerability: Mozilla Firefox before 42.0, when NTLM v1 is enabled for HTTP authentication, allows remote attackers to obtain sensitive hostname information by constructing a crafted web site th
Matching passage: CVE-2015-4515. CWE: CWE-200. CVSS: 4.300000190734863. Mozilla Firefox before 42.0, when NTLM v1 is enabled for HTTP authentication, allows remote attackers to obtain sensitive hostname information by constructing a crafted web site that sends an NTLM request and reads the Workstation field of an NTLM type 3 message.
Near-miss passage: CVE-2015-7058. CWE: CWE-200. CVSS: 4.300000190734863. Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 improperly validate keychain item ACLs, which allows attackers to obtain access to keychain items via a crafted app.
Query: telemetry for T1496.004
Matching passage: T1496.004 Cloud Service Hijacking. Tactics: impact. Description: Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability. For example, adversaries may leverage email and messaging services, such as AWS Simple Email Service (SES), AWS Simple Notification Service (SNS), SendGrid, and Twilio, in order to send large quantities of spam / [Phishing](https://attack.mitre.org/techniques/T1566) emails and SMS messages.(Citation: Invictus IR DangerDev 2024)(Citation: Permiso SES Abuse 2023)(Citation: SentinelLabs SNS Sender 2024) Alternatively, they may engage in LLMJacking by leveraging reverse proxies to hijack the power of cloud-hosted AI models.(Citation: Sysdig LLMJacking 2024)(Citation: Lacework LLMJacking 2024) In some cases, adversaries may leverage services that the victim is already using. In others, particularly when the service is part of a larger cloud platform, they may first enable the service.(Citation: Sysdig LLMJacking 2024) Leveraging SaaS applications may cause the victim to incur significant financial costs, use up service quotas, and otherwise impact availability.
Near-miss passage: T1496.003 SMS Pumping. Tactics: impact. Description: Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted service availability.(Citation: Twilio SMS Pumping) SMS pumping is a type of telecommunications fraud whereby a threat actor first obtains a set of phone numbers from a telecommunications provider, then leverages a victim’s messaging infrastructure to send large amounts of SMS messages to numbers in that set. By generating SMS traffic to their phone number set, a threat actor may earn payments from the telecommunications provider.(Citation: Twilio SMS Pumping Fraud) Threat actors often use publicly available web forms, such as one-time password (OTP) or account verification fields, in order to generate SMS traffic. These fields may leverage services such as Twilio, AWS SNS, and Amazon Cognito in the background.(Citation: Twilio SMS Pumping)(Citation: AWS RE:Inforce Threat Detection 2024) In response to the large quantity of requests, SMS costs may increase and communication channels may become overwhelmed.(Citation: Twilio SMS Pumping)
Query: playbook for alert: Outbound C2 pattern associated with Time Providers
Matching passage: Playbook for T1547.003 Time Providers. 1) Validate alert telemetry against T1547.003. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: persistence, privilege escalation. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.(Citation: Microsoft W32Time Feb 2018) W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients.(Citation: Microsoft TimeProvider) Time prov
Near-miss passage: Playbook for T1547.002 Authentication Package. Different response path focused on persistence, privilege escalation.
Query: rule covering Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind
Matching passage: Sigma rule: Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind. Logsource: dns. Rule: title: Telegram Bot API Request id: c64c5175-5189-431b-a55e-6d9882158251 status: test description: Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind references: - https://core.telegram.org/bots/faq - https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/ - https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/ - https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/ author: Florian Roth (Nextron Systems) date: 2018-06-05 modified: 2022-10-09 tags: - attack.command-and-control - attack.t1102.002 logsource: category: dns detection: selection: query: api.telegram.org condition: selection falsepositives: - Legitimate use of Telegram bots in the company level: medium
Near-miss passage: Sigma rule: Detects potential mimikatz-like tools accessing LSASS from non system account. Logsource: windows / security. Rule: title: LSASS Access From Non System Account id: 962fe167-e48d-4fd6-9974-11e5b9a5d6d1 status: test description: Detects potential mimikatz-like tools accessing LSASS from non system account references: - https://threathunterplaybook.com/hunts/windows/170105-LSASSMemoryReadAccess/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-06-20 modified: 2023-12-11 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows service: security detection: selection: EventID: - 4663 - 4656 AccessMask: - '0x100000' - '0x1010' - '0x1400' - '0x1410' - '0x1418' - '0x1438' - '0x143a' - '0x1f0fff' - '0x1f1fff' - '0x1f2fff' - '0x1f3fff' - '0x40' - 143a - 1f0fff - 1f1fff - 1f2fff - 1f3fff ObjectType: Process ObjectName|endswith: \lsass.exe filter_main_service_account: SubjectUserName|endswith: $ filter_main_generic: ProcessName|contains: - :\Program Files\ - :\Program Files (x86)\ filter_main_wmiprvse: ProcessName: C:\Windows\System32\wbem\WmiPrvSE.exe AccessMask: '0x1410' filter_optional_steam: ProcessName|contains: \SteamLibrary\steamapps\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Query: exploit Cross-site scripting (XSS) vulnerability in IBM Multi-Enterprise Integration Gateway 1.x through 1.0.0.1 and B2B Advanced Communications 1.0.0.2 and 1.0.0.3 before 1.0.0.3_2 allows
Matching passage: CVE-2015-4973. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in IBM Multi-Enterprise Integration Gateway 1.x through 1.0.0.1 and B2B Advanced Communications 1.0.0.2 and 1.0.0.3 before 1.0.0.3_2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-8935. CWE: CWE-79. CVSS: 6.099999904632568. The sapi_header_op function in main/SAPI.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 supports deprecated line folding without considering browser compatibility, which allows remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer by leveraging (1) %0A%20 or (2) %0D%0A%20 mishandling in the header function.
Query: indicators of Device Driver Discovery
Matching passage: T1652 Device Driver Discovery. Tactics: discovery. Description: Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) or other defenses (e.g., [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)), as well as potential exploitable vulnerabilities (e.g., [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)). Many OS utilities may provide information about local device drivers, such as `driverquery.exe` and the `EnumDeviceDrivers()` API function on Windows.(Citation: Microsoft Driverquery)(Citation: Microsoft EnumDeviceDrivers) Information about device drivers (as well as associated services, i.e., [System Service Discovery](https://attack.mitre.org/techniques/T1007)) may also be available in the Registry.(Citation: Microsoft Registry Drivers) On Linux/macOS, device drivers (in the form of kernel modules) may be visible within `/dev` or using utilities such as `lsmod` and `modinfo`.(Citation: Linux Kernel Programming)(Citation: lsmod man)(Citation: modinfo man)
Near-miss passage: T1614 System Location Discovery. Tactics: discovery. Description: Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from [System Location Discovery](https://attack.mitre.org/techniques/T1614) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.(Citation: FBI Ragnar Locker 2020)(Citation: Sophos Geolocation 2016)(Citation: Bleepingcomputer RAT malware 2020) Windows API functions such as <code>GetLocaleInfoW</code> can also be used to determine the locale of the host.(Citation: FBI Ragnar Locker 2020) In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.(Citation: AWS Instance Identity Documents)(Citation: Microsoft Azure Instance Metadata 2021) Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.(Citation: Securelist Trasparent Tribe 2020)(Citation: Sophos Geolocation 2016)