alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: hunt for Login Hook activity
Matching passage: T1037.002 Login Hook. Tactics: persistence, privilege escalation. Description: Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that points to a specific script to execute with root privileges upon user logon. The plist file is located in the <code>/Library/Preferences/com.apple.loginwindow.plist</code> file and can be modified using the <code>defaults</code> command-line utility. This behavior is the same for logout hooks where a script can be executed upon user logout. All hooks require administrator permissions to modify or create hooks.(Citation: Login Scripts Apple Dev)(Citation: LoginWindowScripts Apple Dev) Adversaries can add or insert a path to a malicious script in the <code>com.apple.loginwindow.plist</code> file, using the <code>LoginHook</code> or <code>LogoutHook</code> key-value pair. The malicious script is executed upon the next user login. If a login hook already exists, adversaries can add additional commands to an existing login hook. There can be only one login and logout hook on a system at a time.(Citation: S1 macOs Persistence)(Citation: Wardle Persistence Chapter) **Note:** Login hooks were deprecated in 10.11 version of macOS in favor of [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001)
Near-miss passage: T1037.005 Startup Items. Tactics: persistence, privilege escalation. Description: Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.(Citation: Startup Items) This is technically a deprecated technology (superseded by [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)), and thus the appropriate folder, <code>/Library/StartupItems</code> isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. A startup item is a directory whose executable and configuration property list (plist), <code>StartupParameters.plist</code>, reside in the top-level directory. An adversary can create the appropriate folders/files in the StartupItems directory to register their own persistence mechanism.(Citation: Methods of Mac Malware Persistence) Additionally, since StartupItems run during the bootup phase of macOS, they will run as the elevated root user.
Query: ATT&CK technique for Break Process Trees
Matching passage: T1036.009 Break Process Trees. Tactics: stealth. Description: An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID). If endpoint protection software leverages the “parent-child" relationship for detection, breaking this relationship could result in the adversary’s behavior not being associated with previous process tree activity. On Unix-based systems breaking this process tree is common practice for administrators to execute software using scripts and programs.(Citation: 3OHA double-fork 2022) On Linux systems, adversaries may execute a series of [Native API](https://attack.mitre.org/techniques/T1106) calls to alter malware's process tree. For example, adversaries can execute their payload without any arguments, call the `fork()` API call twice, then have the parent process exit. This creates a grandchild process with no parent process that is immediately adopted by the `init` system process (PID 1), which successfully disconnects the execution of the adversary's payload from its previous process tree. Another example is using the “daemon” syscall to detach from the current parent process and run in the background.(Citation: Sandfly BPFDoor 2022)(Citation: Microsoft XorDdos Linux Stealth 2022)
Near-miss passage: T1036.011 Overwrite Process Arguments. Tactics: stealth. Description: Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign process. On Linux, the operating system stores command-line arguments in the process’s stack and passes them to the `main()` function as the `argv` array. The first element, `argv[0]`, typically contains the process name or path - by default, the command used to actually start the process (e.g., `cat /etc/passwd`). By default, the Linux `/proc` filesystem uses this value to represent the process name. The `/proc/<PID>/cmdline` file reflects the contents of this memory, and tools like `ps` use it to display process information. Since arguments are stored in user-space memory at launch, this modification can be performed without elevated privileges. During runtime, adversaries can erase the memory used by all command-line arguments for a process, overwriting each argument string with null bytes. This removes evidence of how the process was originally launched. They can then write a spoofed string into the memory region previously occupied by `argv[0]` to mimic a benign command, such as `cat resolv.conf`. The new command-line string is reflected in `/proc/<PID>/cmdline` and displayed by tools like `ps`.(Citation: Sandfly BPFDoor 2022)(Citation: Microsoft XorDdos Linux Stealth 2022)
Query: common weakness: Serializable Data Element Containing non-Serializable Item Elements
Matching passage: CWE-1070 Serializable Data Element Containing non-Serializable Item Elements. The product contains a serializable, storable data element such as a field or member, but the data element contains member elements that are not serializable.
Near-miss passage: CWE-1395 Dependency on Vulnerable Third-Party Component. The product has a dependency on a third-party component that contains one or more known vulnerabilities.
Query: SOC runbook when seeing EDR alert: possible Network Trust Dependencies (T1590.003)
Matching passage: Playbook for T1590.003 Network Trust Dependencies. 1) Validate alert telemetry against T1590.003. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: reconnaissance. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may gather information about the victim's network trust dependencies that can be used during targeting. Information about network trusts may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. Adversaries may gather this information in variou
Near-miss passage: Playbook for T1590.001 Domain Properties. Different response path focused on reconnaissance.
Query: exploit The ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular isoc
Matching passage: CVE-2015-8558. CWE: CWE-835. CVSS: 5.5. The ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular isochronous transfer descriptor (iTD) list.
Near-miss passage: CVE-2015-8900. CWE: CWE-835. CVSS: 5.5. The ReadHDRImage function in coders/hdr.c in ImageMagick 6.x and 7.x allows remote attackers to cause a denial of service (infinite loop) via a crafted HDR file.
Query: rule covering Detects potential arbitrary file download using a Microsoft Office application
Matching passage: Sigma rule: Detects potential arbitrary file download using a Microsoft Office application. Logsource: windows / process_creation. Rule: title: Potential Arbitrary File Download Using Office Application id: 4ae3e30b-b03f-43aa-87e3-b622f4048eed related: - id: 0c79148b-118e-472b-bdb7-9b57b444cc19 type: obsolete status: test description: Detects potential arbitrary file download using a Microsoft Office application references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Winword/ - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Powerpnt/ - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Excel/ - https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191 author: Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community date: 2022-05-17 modified: 2023-06-22 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \EXCEL.EXE - \POWERPNT.EXE - \WINWORD.exe - OriginalFileName: - Excel.exe - POWERPNT.EXE - WinWord.exe selection_http: CommandLine|contains: - http:// - https:// condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects svchost hosting RDP termsvcs communicating with the loopback address. Logsource: windows / security. Rule: title: RDP over Reverse SSH Tunnel WFP id: 5bed80b6-b3e8-428e-a3ae-d3c757589e41 status: test description: Detects svchost hosting RDP termsvcs communicating with the loopback address references: - https://twitter.com/SBousseaden/status/1096148422984384514 - https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/44fbe85f72ee91582876b49678f9a26292a155fb/Command%20and%20Control/DE_RDP_Tunnel_5156.evtx author: Samir Bousseaden date: 2019-02-16 modified: 2022-09-02 tags: - attack.command-and-control - attack.lateral-movement - attack.t1090.001 - attack.t1090.002 - attack.t1021.001 - car.2013-07-002 logsource: product: windows service: security detection: selection: EventID: 5156 sourceRDP: SourcePort: 3389 DestAddress: - 127.* - ::1 destinationRDP: DestPort: 3389 SourceAddress: - 127.* - ::1 filter_app_container: FilterOrigin: AppContainer Loopback filter_thor: Application|endswith: - \thor.exe - \thor64.exe condition: selection and ( sourceRDP or destinationRDP ) and not 1 of filter* falsepositives: - Programs that connect locally to the RDP port level: high
Query: EDR alert: possible Malicious File (T1204.002)
Matching passage: T1204.002 Malicious File. Tactics: execution. Description: An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001). Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.(Citation: Mandiant Trojanized Windows 10) Adversaries may employ various forms of [Masquerading](https://attack.mitre.org/techniques/T1036) and [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it.(Citation: Password Protected Word Docs) While [Malicious File](https://attack.mitre.org/techniques/T1204/002) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534).
Near-miss passage: T1204.003 Malicious Image. Tactics: execution. Description: Adversaries may rely on a user running a malicious image to facilitate execution. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored. Backdoored images may be uploaded to a public repository via [Upload Malware](https://attack.mitre.org/techniques/T1608/001), and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container.(Citation: Summit Route Malicious AMIs) Adversaries may also name images a certain way to increase the chance of users mistakenly deploying an instance or container from the image (ex: [Match Legitimate Resource Name or Location](https://attack.mitre.org/techniques/T1036/005)).(Citation: Aqua Security Cloud Native Threat Report June 2021)
Query: vulnerability: Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before
Matching passage: CVE-2015-3092. CWE: CWE-200. CVSS: 5.0. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2015-3091.
Near-miss passage: CVE-2015-2005. CWE: CWE-200. CVSS: 5.300000190734863. IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 and 7.2.x before 7.2.5 Patch 6 does not properly expire sessions, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation.
Query: actor TTPs: Exfiltration Over Other Network Medium
Matching passage: T1011 Exfiltration Over Other Network Medium. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel. Adversaries may choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Near-miss passage: T1011.001 Exfiltration Over Bluetooth. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel. Adversaries may choose to do this if they have sufficient access and proximity. Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Query: CVE similar to CVE-2015-2433
Matching passage: CVE-2015-2433. CWE: CWE-200. CVSS: 2.0999999046325684. The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to bypass the ASLR protection mechanism via a crafted application, aka "Kernel ASLR Bypass Vulnerability."
Near-miss passage: CVE-2015-1684. CWE: CWE-200. CVSS: 4.300000190734863. VBScript.dll in the Microsoft VBScript 5.6 through 5.8 engine, as used in Internet Explorer 8 through 11 and other products, allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "VBScript ASLR Bypass."
Query: vulnerability: The WPS UPnP function in hostapd, when using WPS AP, and wpa_supplicant, when using WPS external registrar (ER), 0.7.0 through 2.4 allows remote attackers to cause a denial of serv
Matching passage: CVE-2015-4141. CWE: CWE-119. CVSS: 4.300000190734863. The WPS UPnP function in hostapd, when using WPS AP, and wpa_supplicant, when using WPS external registrar (ER), 0.7.0 through 2.4 allows remote attackers to cause a denial of service (crash) via a negative chunk length, which triggers an out-of-bounds read or heap-based buffer overflow.
Near-miss passage: CVE-2015-7180. CWE: CWE-119. CVSS: 7.5. The ReadbackResultWriterD3D11::Run function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 misinterprets the return value of a function call, which might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.
Query: alert when Detects remote RPC calls to read information about scheduled tasks via SASec
Matching passage: Sigma rule: Detects remote RPC calls to read information about scheduled tasks via SASec. Logsource: rpc_firewall / application. Rule: title: Recon Activity via SASec id: 0a3ff354-93fc-4273-8a03-1078782de5b7 status: test description: Detects remote RPC calls to read information about scheduled tasks via SASec references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.discovery logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:378e52b0-c0a9-11cf-822d-00aa0051e40f"' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 378e52b0-c0a9-11cf-822d-00aa0051e40f filter: OpNum: - 0 - 1 condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects attempts to enable the root account via "dsenableroot". Logsource: macos / process_creation. Rule: title: Root Account Enable Via Dsenableroot id: 821bcf4d-46c7-4b87-bc57-9509d3ba7c11 status: test description: Detects attempts to enable the root account via "dsenableroot" references: - https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1078.003/T1078.003.md - https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/persistence_enable_root_account.toml - https://ss64.com/osx/dsenableroot.html author: Sohan G (D4rkCiph3r) date: 2023-08-22 tags: - attack.privilege-escalation - attack.stealth - attack.t1078 - attack.t1078.001 - attack.t1078.003 - attack.initial-access - attack.persistence logsource: category: process_creation product: macos detection: selection: Image|endswith: /dsenableroot filter_main_disable: CommandLine|contains: ' -d ' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: exploit The EAP-pwd peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not clear the L (Length) and M (More) flags before determining if a response should be fragmented
Matching passage: CVE-2015-4146. CWE: UNKNOWN. CVSS: 5.0. The EAP-pwd peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not clear the L (Length) and M (More) flags before determining if a response should be fragmented, which allows remote attackers to cause a denial of service (crash) via a crafted message.
Near-miss passage: CVE-2015-0544. CWE: UNKNOWN. CVSS: 9.300000190734863. EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to hijack sessions by predicting a value.
Query: describe CVE-2015-3152
Matching passage: CVE-2015-3152. CWE: CWE-295. CVSS: 5.900000095367432. Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, aka a "BACKRONYM" attack.
Near-miss passage: CVE-2015-0294. CWE: CWE-295. CVSS: 7.5. GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate.
Query: describe CVE-2015-1513
Matching passage: CVE-2015-1513. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in SIPhone Enterprise PBX allows remote attackers to execute arbitrary SQL commands via the Username.
Near-miss passage: CVE-2015-9301. CWE: CWE-89. CVSS: 9.800000190734863. The liveforms plugin before 3.2.0 for WordPress has SQL injection.
Query: describe CVE-2015-5774
Matching passage: CVE-2015-5774. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in IOHIDFamily in Apple iOS before 8.4.1 and OS X before 10.10.5 allows local users to gain privileges via unspecified vectors.
Near-miss passage: CVE-2015-6084. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6064 and CVE-2015-6085.