alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly" in logs
Matching passage: Sigma rule: Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly". Logsource: windows / process_creation. Rule: title: Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call id: 9c0295ce-d60d-40bd-bd74-84673b7592b1 related: - id: 62b7ccc9-23b4-471e-aa15-6da3663c4d59 type: similar status: test description: Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly" references: - https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/mal_revil.yar - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/ - https://learn.microsoft.com/en-us/dotnet/api/system.appdomain.load?view=net-7.0 author: pH-T (Nextron Systems) date: 2022-03-01 modified: 2023-04-06 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1027 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - OgA6ACgAIgBMACIAKwAiAG8AYQBkACIAKQ - oAOgAoACIATAAiACsAIgBvAGEAZAAiACkA - 6ADoAKAAiAEwAIgArACIAbwBhAGQAIgApA - OgA6ACgAIgBMAG8AIgArACIAYQBkACIAKQ - oAOgAoACIATABvACIAKwAiAGEAZAAiACkA - 6ADoAKAAiAEwAbwAiACsAIgBhAGQAIgApA - OgA6ACgAIgBMAG8AYQAiACsAIgBkACIAKQ - oAOgAoACIATABvAGEAIgArACIAZAAiACkA - 6ADoAKAAiAEwAbwBhACIAKwAiAGQAIgApA - OgA6ACgAJwBMACcAKwAnAG8AYQBkACcAKQ - oAOgAoACcATAAnACsAJwBvAGEAZAAnACkA - 6ADoAKAAnAEwAJwArACcAbwBhAGQAJwApA - OgA6ACgAJwBMAG8AJwArACcAYQBkACcAKQ - oAOgAoACcATABvACcAKwAnAGEAZAAnACkA - 6ADoAKAAnAEwAbwAnACsAJwBhAGQAJwApA - OgA6ACgAJwBMAG8AYQAnACsAJwBkACcAKQ - oAOgAoACcATABvAGEAJwArACcAZAAnACkA - 6ADoAKAAnAEwAbwBhACcAKwAnAGQAJwApA condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects Azure Hybrid Connection Manager services querying the Azure service bus service. Logsource: windows / dns_query. Rule: title: DNS HybridConnectionManager Service Bus id: 7bd3902d-8b8b-4dd4-838a-c6862d40150d status: test description: Detects Azure Hybrid Connection Manager services querying the Azure service bus service references: - https://twitter.com/Cyb3rWard0g/status/1381642789369286662 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2021-04-12 modified: 2023-01-16 tags: - attack.persistence - attack.t1554 logsource: product: windows category: dns_query detection: selection: QueryName|contains: servicebus.windows.net Image|contains: HybridConnectionManager condition: selection falsepositives: - Legitimate use of Azure Hybrid Connection Manager and the Azure Service Bus service level: high
Query: exploit Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before
Matching passage: CVE-2015-3090. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3078, CVE-2015-3089, and CVE-2015-3093.
Near-miss passage: CVE-2015-2726. CWE: CWE-119. CVSS: 10.0. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Query: vulnerability: The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly maintain a cert
Matching passage: CVE-2015-4604. CWE: CWE-20. CVSS: 7.5. The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly maintain a certain pointer relationship, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string that is mishandled by a "Python script text executable" rule.
Near-miss passage: CVE-2015-1131. CWE: CWE-20. CVSS: 7.199999809265137. fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1132, CVE-2015-1133, CVE-2015-1134, and CVE-2015-1135.
Query: patch priority for CVE-2015-5180
Matching passage: CVE-2015-5180. CWE: CWE-476. CVSS: 7.5. res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash).
Near-miss passage: CVE-2015-4444. CWE: CWE-476. CVSS: 5.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to cause a denial of service (NULL pointer dereference) via unspecified vectors, a different vulnerability than CVE-2015-4443.
Query: exploit The RuntimeEventRouter::OnExtensionUninstalled function in extensions/browser/api/runtime/runtime_api.cc in Google Chrome before 45.0.2454.85 does not ensure that the setUninstallU
Matching passage: CVE-2015-1298. CWE: CWE-254. CVSS: 4.300000190734863. The RuntimeEventRouter::OnExtensionUninstalled function in extensions/browser/api/runtime/runtime_api.cc in Google Chrome before 45.0.2454.85 does not ensure that the setUninstallURL preference corresponds to the URL of a web site, which allows user-assisted remote attackers to trigger access to an arbitrary URL via a crafted extension that is uninstalled.
Near-miss passage: CVE-2015-8777. CWE: CWE-254. CVSS: 5.5. The process_envvars function in elf/rtld.c in the GNU C Library (aka glibc or libc6) before 2.23 allows local users to bypass a pointer-guarding protection mechanism via a zero value of the LD_POINTER_GUARD environment variable.
Query: CWE for Improper Zeroization of Hardware Register
Matching passage: CWE-1239 Improper Zeroization of Hardware Register. The hardware product does not properly clear sensitive information from built-in registers when the user of the hardware block changes.
Near-miss passage: CWE-343 Predictable Value Range from Previous Values. The product's random number generator produces a series of values which, when observed, can be used to infer a relatively small range of possibilities for the next value that could be generated.
Query: CVE similar to CVE-2015-7881
Matching passage: CVE-2015-7881. CWE: CWE-284. CVSS: 3.5. The Colorbox module 7.x-2.x before 7.x-2.10 for Drupal allows remote authenticated users with certain permissions to bypass intended access restrictions and "add unexpected content to a Colorbox" via unspecified vectors, possibly related to a link in a comment.
Near-miss passage: CVE-2015-0660. CWE: CWE-284. CVSS: 7.199999809265137. Cisco Virtual TelePresence Server Software does not properly restrict use of the serial port, which allows local users to execute arbitrary OS commands as root by leveraging vSphere controller administrative privileges, aka Bug ID CSCus61123.
Query: ATT&CK technique for Reflective Code Loading
Matching passage: T1620 Reflective Code Loading. Tactics: stealth. Description: Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., [Shared Modules](https://attack.mitre.org/techniques/T1129)). Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode).(Citation: Introducing Donut)(Citation: S1 Custom Shellcode Tool)(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Mandiant BYOL) For example, the `Assembly.Load()` method executed by [PowerShell](https://attack.mitre.org/techniques/T1059/001) may be abused to load raw code into the running process.(Citation: Microsoft AssemblyLoad) Reflective code injection is very similar to [Process Injection](https://attack.mitre.org/techniques/T1055) except that the “injection” loads code into the processes’ own memory instead of that of a separate process. Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process. Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Intezer ACBackdoor)(Citation: S1 Old Rat New Tricks)
Near-miss passage: T1036.009 Break Process Trees. Tactics: stealth. Description: An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID). If endpoint protection software leverages the “parent-child" relationship for detection, breaking this relationship could result in the adversary’s behavior not being associated with previous process tree activity. On Unix-based systems breaking this process tree is common practice for administrators to execute software using scripts and programs.(Citation: 3OHA double-fork 2022) On Linux systems, adversaries may execute a series of [Native API](https://attack.mitre.org/techniques/T1106) calls to alter malware's process tree. For example, adversaries can execute their payload without any arguments, call the `fork()` API call twice, then have the parent process exit. This creates a grandchild process with no parent process that is immediately adopted by the `init` system process (PID 1), which successfully disconnects the execution of the adversary's payload from its previous process tree. Another example is using the “daemon” syscall to detach from the current parent process and run in the background.(Citation: Sandfly BPFDoor 2022)(Citation: Microsoft XorDdos Linux Stealth 2022)
Query: exploit The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive information via an (1) unterminated encoding value or (2) in
Matching passage: CVE-2015-8317. CWE: CWE-119. CVSS: 5.0. The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive information via an (1) unterminated encoding value or (2) incomplete XML declaration in XML data, which triggers an out-of-bounds heap read.
Near-miss passage: CVE-2015-7005. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1.
Query: patch priority for CVE-2015-1376
Matching passage: CVE-2015-1376. CWE: CWE-284. CVSS: 4.0. pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrary files via an upload URL with a host other than pixabay.com.
Near-miss passage: CVE-2015-3657. CWE: CWE-284. CVSS: 7.199999809265137. Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain "Super Admin" privileges via unspecified vectors.
Query: vulnerability: Use-after-free vulnerability in the my_login function in DBD::mysql before 4.033_01 allows attackers to have unspecified impact by leveraging a call to mysql_errno after a failure 
Matching passage: CVE-2015-8949. CWE: CWE-416. CVSS: 9.800000190734863. Use-after-free vulnerability in the my_login function in DBD::mysql before 4.033_01 allows attackers to have unspecified impact by leveraging a call to mysql_errno after a failure of my_login.
Near-miss passage: CVE-2015-5095. CWE: CWE-416. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-4448, CVE-2015-5099, CVE-2015-5101, CVE-2015-5111, CVE-2015-5113, and CVE-2015-5114.
Query: patch priority for CVE-2015-3620
Matching passage: CVE-2015-3620. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1 and FortiManager 5.0.3 through 5.0.10 and 5.2.0 through 5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-4465. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: campaign using Application Exhaustion Flood
Matching passage: T1499.003 Application Exhaustion Flood. Tactics: impact. Description: Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications. For example, specific features in web applications may be highly resource intensive. Repeated requests to those features may be able to exhaust system resources and deny access to the application or the server itself.(Citation: Arbor AnnualDoSreport Jan 2018)
Near-miss passage: T1499.001 OS Exhaustion Flood. Tactics: impact. Description: Adversaries may launch a denial of service (DoS) attack targeting an endpoint's operating system (OS). A system's OS is responsible for managing the finite resources as well as preventing the entire system from being overwhelmed by excessive demands on its capacity. These attacks do not need to exhaust the actual resources on a system; the attacks may simply exhaust the limits and available resources that an OS self-imposes. Different ways to achieve this exist, including TCP state-exhaustion attacks such as SYN floods and ACK floods.(Citation: Arbor AnnualDoSreport Jan 2018) With SYN floods, excessive amounts of SYN packets are sent, but the 3-way TCP handshake is never completed. Because each OS has a maximum number of concurrent TCP connections that it will allow, this can quickly exhaust the ability of the system to receive new requests for TCP connections, thus preventing access to any TCP service provided by the server.(Citation: Cloudflare SynFlood) ACK floods leverage the stateful nature of the TCP protocol. A flood of ACK packets are sent to the target. This forces the OS to search its state table for a related TCP connection that has already been established. Because the ACK packets are for connections that do not exist, the OS will have to search the entire state table to confirm that no match exists. When it is necessary to do this for a large flood of packets, the computational requirements can cause the server to become sluggish and/or unresponsive, due to the work it must do to eliminate the rogue ACK packets. This greatly reduces the resources available for providing the targeted service.(Citation: Corero SYN-ACKflood)
Query: SOC runbook when seeing Lateral movement indicators for Email Spoofing
Matching passage: Playbook for T1684.002 Email Spoofing. 1) Validate alert telemetry against T1684.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may fake, or spoof, a sender’s identity by modifying the value of relevant email headers in order to establish contact with victims under false pretenses.(Citation: Proofpoint TA427 April 2024) In addition to actual email content, email headers (such as the FROM header, which contains the email address of the sender) may also be modified. Email clients display these headers when emails
Near-miss passage: Playbook for T1684 Social Engineering. Different response path focused on stealth.
Query: Suspicious Code Signing execution detected on endpoint
Matching passage: T1553.002 Code Signing. Tactics: defense impairment. Description: Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. (Citation: Wikipedia Code Signing) The certificates used during an operation may be created, acquired, or stolen by the adversary. (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates) Unlike [Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001), this activity will result in a valid signature. Code signing to verify software on first run can be used on modern Windows and macOS systems. It is not used on Linux due to the decentralized nature of the platform. (Citation: Wikipedia Code Signing)(Citation: EclecticLightChecksonEXECodeSigning) Code signing certificates may be used to bypass security policies that require signed code to execute on a system.
Near-miss passage: T1553.005 Mark-of-the-Web Bypass. Tactics: defense impairment. Description: Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, when files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named <code>Zone.Identifier</code> with a specific value known as the MOTW.(Citation: Microsoft Zone.Identifier 2020) Files that are tagged with MOTW are protected and cannot perform certain actions. For example, starting in MS Office 10, if a MS Office file has the MOTW, it will open in Protected View. Executables tagged with the MOTW will be processed by Windows Defender SmartScreen that compares files with an allowlist of well-known executables. If the file is not known/trusted, SmartScreen will prevent the execution and warn the user not to run it.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)(Citation: Intezer Russian APT Dec 2020) Adversaries may abuse container files such as compressed/archive (.arj, .gzip) and/or disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW. Container files downloaded from the Internet will be marked with MOTW but the files within may not inherit the MOTW after the container files are extracted and/or mounted. MOTW is a NTFS feature and many container files do not support NTFS alternative data streams. After a container file is extracted and/or mounted, the files contained within them may be treated as local files on disk and run without protections.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)
Query: SOC runbook when seeing EDR alert: possible Unused/Unsupported Cloud Regions (T1535)
Matching passage: Playbook for T1535 Unused/Unsupported Cloud Regions. 1) Validate alert telemetry against T1535. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure. Cloud service providers often provide infrastructure throughout the world in order to improve performance, provide redundancy, and allow customers to meet compliance requirements. Oftentimes, a custome
Near-miss passage: Playbook for T1218 System Binary Proxy Execution. Different response path focused on stealth.
Query: rule covering Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often us
Matching passage: Sigma rule: Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often us. Logsource: windows / process_creation. Rule: title: Potential Active Directory Enumeration Using AD Module - ProcCreation id: 70bc5215-526f-4477-963c-a47a5c9ebd12 related: - id: 9e620995-f2d8-4630-8430-4afd89f77604 type: similar - id: 74176142-4684-4d8a-8b0a-713257e7df8e type: similar status: test description: Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration. references: - https://github.com/samratashok/ADModule - https://twitter.com/cyb3rops/status/1617108657166061568?s=20 - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges author: frack113 date: 2023-01-22 tags: - attack.reconnaissance - attack.discovery - attack.impact logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cmdlet: CommandLine|contains: - 'Import-Module ' - 'ipmo ' selection_dll: CommandLine|contains: Microsoft.ActiveDirectory.Management.dll condition: all of selection_* falsepositives: - Legitimate use of the library for administrative activity level: medium
Near-miss passage: Sigma rule: Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Conv. Logsource: windows / process_creation. Rule: title: Visual Basic Command Line Compiler Usage id: 7b10f171-7f04-47c7-9fa2-5be43c76e535 status: test description: Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Converter. references: - https://lolbas-project.github.io/lolbas/Binaries/Vbc/ author: Ensar Şamil, @sblmsrsn, @oscd_initiative date: 2020-10-07 modified: 2021-11-27 tags: - attack.stealth - attack.t1027.004 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \vbc.exe Image|endswith: \cvtres.exe condition: selection falsepositives: - Utilization of this tool should not be seen in enterprise environment level: high
Query: CVE similar to CVE-2015-2544
Matching passage: CVE-2015-2544. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."
Near-miss passage: CVE-2015-7777. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in index.php in JosephErnest Void before 2015-10-02 allows remote attackers to inject arbitrary web script or HTML via a crafted URI.