alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects AnyDesk Remote Desktop silent installation. Which can be used by attackers to gain remote access.
Matching passage: Sigma rule: Detects AnyDesk Remote Desktop silent installation. Which can be used by attackers to gain remote access.. Logsource: windows / process_creation. Rule: title: Remote Access Tool - AnyDesk Silent Installation id: 114e7f1c-f137-48c8-8f54-3088c24ce4b9 status: test description: Detects AnyDesk Remote Desktop silent installation. Which can be used by attackers to gain remote access. references: - https://twitter.com/TheDFIRReport/status/1423361119926816776?s=20 - https://support.anydesk.com/Automatic_Deployment author: Ján Trenčanský date: 2021-08-06 modified: 2023-03-05 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - --install - --start-with-win - --silent condition: selection falsepositives: - Legitimate deployment of AnyDesk level: high
Near-miss passage: Sigma rule: Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to. Logsource: windows / process_creation. Rule: title: Potential Mftrace.EXE Abuse id: 3d48c9d3-1aa6-418d-98d3-8fd3c01a564e status: test description: Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to execute arbitrary binaries. references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Mftrace/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-09 modified: 2023-08-03 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \mftrace.exe condition: selection falsepositives: - Legitimate use for tracing purposes level: medium
Query: how to detect Mail Protocols
Matching passage: T1071.003 Mail Protocols. Tactics: command and control. Description: Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as SMTP/S, POP3/S, and IMAP that carry electronic mail may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the email messages themselves. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: FireEye APT28)
Near-miss passage: T1071 Application Layer Protocol. Tactics: command and control. Description: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.(Citation: Mandiant APT29 Eye Spy Email Nov 22)
Query: detection engineering for Unix Shell
Matching passage: T1059.004 Unix Shell. Tactics: execution. Description: Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) Unix shells can control every aspect of a system, with certain commands requiring elevated privileges. Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems. Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with [SSH](https://attack.mitre.org/techniques/T1021/004). Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence. Some systems, such as embedded devices, lightweight Linux distributions, and ESXi servers, may leverage stripped-down Unix shells via Busybox, a small executable that contains a variety of tools, including a simple shell.
Near-miss passage: T1059.009 Cloud API. Tactics: execution. Description: Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant. These APIs may be utilized through various methods such as command line interpreters (CLIs), in-browser Cloud Shells, [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules like Azure for PowerShell(Citation: Microsoft - Azure PowerShell), or software developer kits (SDKs) available for languages such as [Python](https://attack.mitre.org/techniques/T1059/006). Cloud API functionality may allow for administrative access across all major services in a tenant such as compute, storage, identity and access management (IAM), networking, and security policies. With proper permissions (often via use of credentials such as [Application Access Token](https://attack.mitre.org/techniques/T1550/001) and [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004)), adversaries may abuse cloud APIs to invoke various functions that execute malicious actions. For example, CLI and PowerShell functionality may be accessed through binaries installed on cloud-hosted or on-premises hosts or accessed through a browser-based cloud shell offered by many cloud platforms (such as AWS, Azure, and GCP). These cloud shells are often a packaged unified environment to use CLI and/or scripting modules hosted as a container in the cloud environment.
Query: patch priority for CVE-2015-9060
Matching passage: CVE-2015-9060. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a pointer is not properly validated in a QTEE system call.
Near-miss passage: CVE-2015-3318. CWE: CWE-20. CVSS: 4.599999904632568. CA Common Services, as used in CA Client Automation r12.5 SP01, r12.8, and r12.9; CA Network and Systems Management r11.0, r11.1, and r11.2; CA NSM Job Management Option r11.0, r11.1, and r11.2; CA Universal Job Management Agent; CA Virtual Assurance for Infrastructure Managers (aka SystemEDGE) 12.6, 12.7, 12.8, and 12.9; and CA Workload Automation AE r11, r11.3, r11.3.5, and r11.3.6 on UNIX, does not properly validate an unspecified variable, which allows local users to gain privileges via unknown vectors.
Query: write Sigma for Detects execution of "certmgr" with the "add" flag in order to install a new certificate on the system. Adversaries may
Matching passage: Sigma rule: Detects execution of "certmgr" with the "add" flag in order to install a new certificate on the system. Adversaries may. Logsource: windows / process_creation. Rule: title: New Root Certificate Installed Via CertMgr.EXE id: ff992eac-6449-4c60-8c1d-91c9722a1d48 related: - id: 42821614-9264-4761-acfc-5772c3286f76 type: derived - id: 46591fae-7a4c-46ea-aec3-dff5e6d785dc type: obsolete status: test description: 'Detects execution of "certmgr" with the "add" flag in order to install a new certificate on the system. Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md - https://securelist.com/to-crypt-or-to-mine-that-is-the-question/86307/ author: oscd.community, @redcanary, Zach Stanford @svch0st date: 2023-03-05 tags: - attack.defense-impairment - attack.t1553.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \CertMgr.exe - OriginalFileName: CERTMGT.EXE selection_cli: CommandLine|contains|all: - /add - root condition: all of selection_* falsepositives: - Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to test if GPO push doesn't trigger FP level: medium
Near-miss passage: Sigma rule: List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe. Logsource: windows / process_creation. Rule: title: Windows Credential Manager Access via VaultCmd id: 58f50261-c53b-4c88-bd12-1d71f12eda4c status: test description: List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.004/T1555.004.md#atomic-test-1---access-saved-credentials-via-vaultcmd author: frack113 date: 2022-04-08 modified: 2022-05-13 tags: - attack.credential-access - attack.t1555.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \VaultCmd.exe - OriginalFileName: VAULTCMD.EXE selection_cli: CommandLine|contains: '/listcreds:' condition: all of selection* falsepositives: - Unknown level: medium
Query: risk of Integer overflow in the _authenticate function in svc_auth.c in Wind River VxWorks 5.5 through 6.9.4.1, when the Remote Procedure Call (RPC) protocol is enabled, allows remote atta
Matching passage: CVE-2015-7599. CWE: CWE-190. CVSS: 8.100000381469727. Integer overflow in the _authenticate function in svc_auth.c in Wind River VxWorks 5.5 through 6.9.4.1, when the Remote Procedure Call (RPC) protocol is enabled, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a username and password.
Near-miss passage: CVE-2015-1527. CWE: CWE-190. CVSS: 7.800000190734863. Integer overflow in IAudioPolicyService.cpp in Android allows local users to gain privileges via a crafted application, aka Android Bug ID 19261727.
Query: weakness Improper Handling of Length Parameter Inconsistency
Matching passage: CWE-130 Improper Handling of Length Parameter Inconsistency. The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
Near-miss passage: CWE-764 Multiple Locks of a Critical Resource. The product locks a critical resource more times than intended, leading to an unexpected state in the system.
Query: write Sigma for Detects when a user downloads a file from an IP based URL using CertOC.exe
Matching passage: Sigma rule: Detects when a user downloads a file from an IP based URL using CertOC.exe. Logsource: windows / process_creation. Rule: title: File Download From IP Based URL Via CertOC.EXE id: b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a related: - id: 70ad0861-d1fe-491c-a45f-fa48148a300d type: similar status: test description: Detects when a user downloads a file from an IP based URL using CertOC.exe references: - https://lolbas-project.github.io/lolbas/Binaries/Certoc/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-10-18 tags: - attack.command-and-control - attack.execution - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certoc.exe - OriginalFileName: CertOC.exe selection_ip: CommandLine|re: ://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3} selection_cli: CommandLine|contains: -GetCACAPS condition: all of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential "ShellDispatch.dll" functionality abuse to execute arbitrary binaries via "ShellExecute". Logsource: windows / process_creation. Rule: title: Potential ShellDispatch.DLL Functionality Abuse id: 82343930-652f-43f5-ab70-2ee9fdd6d5e9 status: test description: Detects potential "ShellDispatch.dll" functionality abuse to execute arbitrary binaries via "ShellExecute" references: - https://www.hexacorn.com/blog/2023/06/07/this-lolbin-doesnt-exist/ author: X__Junior (Nextron Systems) date: 2023-06-20 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|contains: RunDll_ShellExecuteW condition: all of selection_* falsepositives: - Unlikely level: medium
Query: detect Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other in logs
Matching passage: Sigma rule: Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other. Logsource: windows / process_creation. Rule: title: PUA - System Informer Execution id: 5722dff1-4bdd-4949-86ab-fbaf707e767a related: - id: 811e0002-b13b-4a15-9d00-a613fce66e42 type: similar status: test description: Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations references: - https://github.com/winsiderss/systeminformer author: Florian Roth (Nextron Systems) date: 2023-05-08 modified: 2024-11-23 tags: - attack.persistence - attack.privilege-escalation - attack.discovery - attack.stealth - attack.t1082 - attack.t1564 - attack.t1543 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \SystemInformer.exe - OriginalFileName: SystemInformer.exe - Description: System Informer - Product: System Informer - Hashes|contains: - MD5=19426363A37C03C3ED6FEDF57B6696EC - SHA1=8B12C6DA8FAC0D5E8AB999C31E5EA04AF32D53DC - SHA256=8EE9D84DE50803545937A63C686822388A3338497CDDB660D5D69CF68B68F287 - IMPHASH=B68908ADAEB5D662F87F2528AF318F12 condition: selection falsepositives: - System Informer is regularly used legitimately by system administrators or developers. Apply additional filters accordingly level: medium
Near-miss passage: Sigma rule: Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing comm. Logsource: windows / network_connection. Rule: title: Suspicious Outbound SMTP Connections id: 9976fa64-2804-423c-8a5b-646ade840773 status: test description: 'Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048.003/T1048.003.md#atomic-test-5---exfiltration-over-alternative-protocol---smtp - https://www.ietf.org/rfc/rfc2821.txt author: frack113 date: 2022-01-07 modified: 2022-09-21 tags: - attack.exfiltration - attack.t1048.003 logsource: category: network_connection product: windows detection: selection: DestinationPort: - 25 - 587 - 465 - 2525 Initiated: 'true' filter_clients: Image|endswith: - \thunderbird.exe - \outlook.exe filter_mailserver: Image|startswith: C:\Program Files\Microsoft\Exchange Server\ filter_outlook: Image|startswith: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_ Image|endswith: \HxTsr.exe condition: selection and not 1 of filter_* falsepositives: - Other SMTP tools level: medium
Query: vulnerability: The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wp_ajax functions are mishandled.
Matching passage: CVE-2015-9390. CWE: CWE-269. CVSS: 4.300000190734863. The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wp_ajax functions are mishandled.
Near-miss passage: CVE-2015-4719. CWE: CWE-269. CVSS: 9.800000190734863. The client API authentication mechanism in Pexip Infinity before 10 allows remote attackers to gain privileges via a crafted request.
Query: Sigma rule for Detects usage of the "dir" command part of Windows CMD with the "/S" command line flag in order to enumerate files in a
Matching passage: Sigma rule: Detects usage of the "dir" command part of Windows CMD with the "/S" command line flag in order to enumerate files in a. Logsource: windows / process_creation. Rule: title: File And SubFolder Enumeration Via Dir Command id: 7c9340a9-e2ee-4e43-94c5-c54ebbea1006 status: test description: 'Detects usage of the "dir" command part of Windows CMD with the "/S" command line flag in order to enumerate files in a specified directory and all subdirectories. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1217/T1217.md author: frack113 date: 2021-12-13 modified: 2026-05-18 tags: - attack.discovery - attack.t1217 logsource: category: process_creation product: windows detection: selection_cmd: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cli: CommandLine|contains|windash: -s CommandLine|contains: 'dir ' filter_main_rmdir: CommandLine|contains: rmdir condition: all of selection_* and not 1 of filter_main_* falsepositives: - Likely level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_dir_execution/info.yml simulation: - type: atomic-red-team name: List Internet Explorer Bookmarks using the command prompt technique: T1217 atomic_guid: 727dbcdb-e495-4ab1-a6c4-80c7f77aef85
Near-miss passage: Sigma rule: Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation. Logsource: windows / system. Rule: title: Meterpreter or Cobalt Strike Getsystem Service Installation - System id: 843544a7-56e0-4dcc-a44f-5cc266dd97d6 status: test description: Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment - https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/ author: Teymur Kheirkhabarov, Ecco, Florian Roth (Nextron Systems) date: 2019-10-26 modified: 2023-11-15 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.001 - attack.t1134.002 logsource: product: windows service: system detection: selection_id: Provider_Name: Service Control Manager EventID: 7045 selection_cli_cmd: ImagePath|contains|all: - /c - echo - \pipe\ ImagePath|contains: - cmd - '%COMSPEC%' selection_cli_rundll: ImagePath|contains|all: - rundll32 - .dll,a - '/p:' selection_cli_share: ImagePath|startswith: \\\\127.0.0.1\\ADMIN$\ condition: selection_id and 1 of selection_cli_* falsepositives: - Unlikely level: high
Query: exploit Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and execute arbitrary php files via a relativ
Matching passage: CVE-2015-4153. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a load_template action to wp-admin/admin-ajax.php.
Near-miss passage: CVE-2015-7250. CWE: CWE-22. CVSS: 7.5. Absolute path traversal vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allows remote attackers to read arbitrary files via a full pathname in the getpage parameter.
Query: how to detect System Location Discovery
Matching passage: T1614 System Location Discovery. Tactics: discovery. Description: Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from [System Location Discovery](https://attack.mitre.org/techniques/T1614) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.(Citation: FBI Ragnar Locker 2020)(Citation: Sophos Geolocation 2016)(Citation: Bleepingcomputer RAT malware 2020) Windows API functions such as <code>GetLocaleInfoW</code> can also be used to determine the locale of the host.(Citation: FBI Ragnar Locker 2020) In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.(Citation: AWS Instance Identity Documents)(Citation: Microsoft Azure Instance Metadata 2021) Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.(Citation: Securelist Trasparent Tribe 2020)(Citation: Sophos Geolocation 2016)
Near-miss passage: T1614.001 System Language Discovery. Tactics: discovery. Description: Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host. This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions. This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities.(Citation: Malware System Language Check) There are various sources of data an adversary could use to infer system language, such as system defaults and keyboard layouts. Specific checks will vary based on the target and/or adversary, but may involve behaviors such as [Query Registry](https://attack.mitre.org/techniques/T1012) and calls to [Native API](https://attack.mitre.org/techniques/T1106) functions.(Citation: CrowdStrike Ryuk January 2019) For example, on a Windows system adversaries may attempt to infer the language of a system by querying the registry key <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language</code> or parsing the outputs of Windows API functions <code>GetUserDefaultUILanguage</code>, <code>GetSystemDefaultUILanguage</code>, <code>GetKeyboardLayoutList</code> and <code>GetUserDefaultLangID</code>.(Citation: Darkside Ransomware Cybereason)(Citation: Securelist JSWorm)(Citation: SecureList SynAck Doppelgänging May 2018) On a macOS or Linux system, adversaries may query <code>locale</code> to retrieve the value of the <code>$LANG</code> environment variable.
Query: incident response steps for EDR alert: possible Clear Persistence (T1070.009)
Matching passage: Playbook for T1070.009 Clear Persistence. 1) Validate alert telemetry against T1070.009. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, [Modify Registry](https://attack.mitre.org/techniques/T1112), [Plist File Modification](https://attack.mitre.org/techniques/T1647), or other methods of cleanup to prevent defender
Near-miss passage: Playbook for T1070 Indicator Removal. Different response path focused on stealth.