alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: campaign using Threat Intel Vendors
Matching passage: T1597.001 Threat Intel Vendors. Tactics: reconnaissance. Description: Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures.(Citation: D3Secutrity CTI Feeds) Adversaries may search in private threat intelligence vendor data to gather actionable information. If a threat actor is searching for information on their own activities, that falls under [Search Threat Vendor Data](https://attack.mitre.org/techniques/T1681). Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Near-miss passage: T1597.002 Purchase Technical Data. Tactics: reconnaissance. Description: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure.(Citation: ZDNET Selling Data) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
Query: actor TTPs: Code Repositories
Matching passage: T1593.003 Code Repositories. Tactics: reconnaissance. Description: Adversaries may search public code repositories for information about victims that can be used during targeting. Victims may store code in repositories on various third-party websites such as GitHub, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git. Adversaries may search various public code repositories for various information about a victim. Public code repositories can often be a source of various general information about victims, such as commonly used programming languages and libraries as well as the names of employees. Adversaries may also identify more sensitive data, including accidentally leaked credentials or API keys.(Citation: GitHub Cloud Service Credentials) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Valid Accounts](https://attack.mitre.org/techniques/T1078) or [Phishing](https://attack.mitre.org/techniques/T1566)). **Note:** This is distinct from [Code Repositories](https://attack.mitre.org/techniques/T1213/003), which focuses on [Collection](https://attack.mitre.org/tactics/TA0009) from private and internally hosted code repositories.
Near-miss passage: T1593.002 Search Engines. Tactics: reconnaissance. Description: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes).(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking) Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Valid Accounts](https://attack.mitre.org/techniques/T1078) or [Phishing](https://attack.mitre.org/techniques/T1566)).
Query: describe CVE-2015-0697
Matching passage: CVE-2015-0697. CWE: CWE-601. CVSS: 5.800000190734863. Open redirect vulnerability in the login page in Cisco TC Software before 6.3-26 and 7.x before 7.3.0 on Cisco TelePresence Collaboration Desk and Room Endpoints devices allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCuq94980.
Near-miss passage: CVE-2015-5354. CWE: CWE-601. CVSS: 5.800000190734863. Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to admin/nos/login.
Query: rule covering Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child p
Matching passage: Sigma rule: Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child p. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Execution From Parent Process In Public Folder id: 69bd9b97-2be2-41b6-9816-fb08757a4d1a status: test description: 'Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines. ' references: - https://redcanary.com/blog/blackbyte-ransomware/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-02-25 modified: 2024-07-12 tags: - attack.execution - attack.stealth - attack.t1564 - attack.t1059 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|contains: :\Users\Public\ selection_child: - Image|endswith: - \bitsadmin.exe - \certutil.exe - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - CommandLine|contains: - bitsadmin - certutil - cscript - mshta - powershell - regsvr32 - rundll32 - wscript condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential malicious modification of run keys by winekey or team9 backdoor. Logsource: windows / registry_event. Rule: title: WINEKEY Registry Modification id: b98968aa-dbc0-4a9c-ac35-108363cbf8d5 status: test description: Detects potential malicious modification of run keys by winekey or team9 backdoor references: - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html author: omkar72 date: 2020-10-30 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.persistence - attack.t1547 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: Software\Microsoft\Windows\CurrentVersion\Run\Backup Mgr condition: selection falsepositives: - Unknown level: high
Query: detection rule: Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into
Matching passage: Sigma rule: Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into. Logsource: windows / registry_set. Rule: title: Uncommon Extension In Keyboard Layout IME File Registry Value id: b888e3f2-224d-4435-b00b-9dd66e9ea1f1 related: - id: 9d8f9bb8-01af-4e15-a3a2-349071530530 type: derived status: test description: 'Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message. Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path. IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean. ' references: - https://www.linkedin.com/pulse/guntior-story-advanced-bootkit-doesnt-rely-windows-disk-baranov-wue8e/ author: X__Junior (Nextron Systems) date: 2023-11-21 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_set detection: selection: TargetObject|contains|all: - \Control\Keyboard Layouts\ - Ime File filter_main_known_extension: Details|endswith: .ime condition: selection and not 1 of filter_main_* falsepositives: - IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean. level: high
Near-miss passage: Sigma rule: Detects a network connection that is initiated by the "notepad.exe" process. This might be a sign of process injection f. Logsource: windows / network_connection. Rule: title: Network Connection Initiated Via Notepad.EXE id: e81528db-fc02-45e8-8e98-4e84aba1f10b status: test description: 'Detects a network connection that is initiated by the "notepad.exe" process. This might be a sign of process injection from a beacon process or something similar. Notepad rarely initiates a network communication except when printing documents for example. ' references: - https://web.archive.org/web/20200219102749/https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1492186586.pdf - https://www.cobaltstrike.com/blog/why-is-notepad-exe-connecting-to-the-internet author: EagleEye Team date: 2020-05-14 modified: 2024-02-02 tags: - attack.privilege-escalation - attack.command-and-control - attack.execution - attack.stealth - attack.t1055 logsource: category: network_connection product: windows detection: selection: Image|endswith: \notepad.exe filter_optional_printing: DestinationPort: 9100 condition: selection and not 1 of filter_optional_* falsepositives: - Printing documents via notepad might cause communication with the printer via port 9100 or similar. level: high
Query: adversary uses Password Filter DLL
Matching passage: T1556.002 Password Filter DLL. Tactics: defense impairment, persistence, credential access. Description: Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated. Windows password filters are password policy enforcement mechanisms for both domain and local accounts. Filters are implemented as DLLs containing a method to validate potential passwords against password policies. Filter DLLs can be positioned on local computers for local accounts and/or domain controllers for domain accounts. Before registering new passwords in the Security Accounts Manager (SAM), the Local Security Authority (LSA) requests validation from each registered filter. Any potential changes cannot take effect until every registered filter acknowledges validation. Adversaries can register malicious password filters to harvest credentials from local computers and/or entire domains. To perform proper validation, filters must receive plain-text credentials from the LSA. A malicious password filter would receive these plain-text credentials every time a password request is made.(Citation: Carnal Ownage Password Filters Sept 2013)
Near-miss passage: T1556.001 Domain Controller Authentication. Tactics: defense impairment, persistence, credential access. Description: Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts. Malware may be used to inject false credentials into the authentication process on a domain controller with the intent of creating a backdoor used to access any user’s account and/or credentials (ex: [Skeleton Key](https://attack.mitre.org/software/S0007)). Skeleton key works through a patch on an enterprise domain controller authentication process (LSASS) with credentials that adversaries may use to bypass the standard authentication system. Once patched, an adversary can use the injected password to successfully authenticate as any domain user account (until the the skeleton key is erased from memory by a reboot of the domain controller). Authenticated access may enable unfettered access to hosts and/or resources within single-factor authentication environments.(Citation: Dell Skeleton)
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in AdaptCMS 3.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) data[Category][title] parameter to a
Matching passage: CVE-2015-1058. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in AdaptCMS 3.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) data[Category][title] parameter to admin/categories/add, (2) data[Field][title] parameter to admin/fields/ajax_fields/, (3) name property in a basicInfo JSON object to admin/tools/create_theme, (4) data[Link][link_title] parameter to admin/links/links/add, or (5) data[ForumTopic][subject] parameter to forums/off-topic/new.
Near-miss passage: CVE-2015-4260. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Cisco Hosted Collaboration Solution 10.6(1) allows remote attackers to inject arbitrary web script or HTML via a crafted value in a URL, aka Bug ID CSCuu14862.
Query: CVE similar to CVE-2015-0811
Matching passage: CVE-2015-0811. CWE: CWE-119. CVSS: 6.400000095367432. The QCMS implementation in Mozilla Firefox before 37.0 allows remote attackers to obtain sensitive information from process heap memory or cause a denial of service (out-of-bounds read) via an image that is improperly handled during transformation.
Near-miss passage: CVE-2015-6674. CWE: CWE-119. CVSS: 9.800000190734863. Buffer underflow vulnerability in the Debian inspircd package before 2.0.5-1+deb7u1 for wheezy and before 2.0.16-1 for jessie and sid. NOTE: This issue exists as an additional issue from an incomplete fix of CVE-2012-1836.
Query: CVE similar to CVE-2015-3293
Matching passage: CVE-2015-3293. CWE: CWE-200. CVSS: 4.0. FortiMail 5.0.3 through 5.2.3 allows remote administrators to obtain credentials via the "diag debug application httpd" command.
Near-miss passage: CVE-2015-5382. CWE: CWE-200. CVSS: 6.5. program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard.
Query: risk of login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions b
Matching passage: CVE-2015-3179. CWE: CWE-264. CVSS: 3.5. login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions by leveraging access to an unconfirmed suspended account.
Near-miss passage: CVE-2015-0057. CWE: CWE-264. CVSS: 7.199999809265137. win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Query: write Sigma for Detects when highly privileged delegated permissions are granted on behalf of all users
Matching passage: Sigma rule: Detects when highly privileged delegated permissions are granted on behalf of all users. Logsource: azure / auditlogs. Rule: title: Delegated Permissions Granted For All Users id: a6355fbe-f36f-45d8-8efc-ab42465cbc52 status: test description: Detects when highly privileged delegated permissions are granted on behalf of all users references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-granted-highly-privileged-permissions author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow' date: 2022-07-28 tags: - attack.credential-access - attack.t1528 logsource: product: azure service: auditlogs detection: selection: properties.message: Add delegated permission grant condition: selection falsepositives: - When the permission is legitimately needed for the app level: high
Near-miss passage: Sigma rule: Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers comm. Logsource: windows / process_creation. Rule: title: Potential Browser Data Stealing id: 47147b5b-9e17-4d76-b8d2-7bac24c5ce1b related: - id: fc028194-969d-4122-8abe-0470d5b8f12f type: derived status: test description: 'Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.003/T1555.003.md - https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware_2.pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-23 modified: 2025-03-19 tags: - attack.credential-access - attack.t1555.003 logsource: category: process_creation product: windows detection: selection_cmd: - CommandLine|contains: - copy-item - 'copy ' - 'cpi ' - ' cp ' - 'move ' - move-item - ' mi ' - ' mv ' - Image|endswith: - \esentutl.exe - \xcopy.exe - \robocopy.exe - OriginalFileName: - esentutl.exe - XCOPY.EXE - robocopy.exe selection_path: CommandLine|contains: - \Amigo\User Data - \BraveSoftware\Brave-Browser\User Data - \CentBrowser\User Data - \Chromium\User Data - \CocCoc\Browser\User Data - \Comodo\Dragon\User Data - \Elements Browser\User Data - \Epic Privacy Browser\User Data - \Google\Chrome Beta\User Data - \Google\Chrome SxS\User Data - \Google\Chrome\User Data\ - \Kometa\User Data - \Maxthon5\Users - \Microsoft\Edge\User Data - \Mozilla\Firefox\Profiles - \Nichrome\User Data - \Opera Software\Opera GX Stable\ - \Opera Software\Opera Neon\User Data - \Opera Software\Opera Stable\ - \Orbitum\User Data - \QIP Surf\User Data - \Sputnik\User Data - \Torch\User Data - \uCozMedia\Uran\User Data - \Vivaldi\User Data condition: all of selection_* falsepositives: - Unknown level: medium
Query: vulnerability: Buffer overflow in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows
Matching passage: CVE-2015-1725. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Buffer Overflow Vulnerability."
Near-miss passage: CVE-2015-9053. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in the processing of certain responses from the USIM.
Query: risk of OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hija
Matching passage: CVE-2015-0259. CWE: CWE-345. CVSS: 5.099999904632568. OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.
Near-miss passage: CVE-2015-8254. CWE: CWE-345. CVSS: 5.900000095367432. The Frontel protocol before 3 on RSI Video Technologies Videofied devices does not use integrity protection, which makes it easier for man-in-the-middle attackers to (1) initiate a false alarm or (2) deactivate an alarm by modifying the client-server data stream.
Query: alert when Detects PAExec default named pipe
Matching passage: Sigma rule: Detects PAExec default named pipe. Logsource: windows / pipe_created. Rule: title: PUA - PAExec Default Named Pipe id: f6451de4-df0a-41fa-8d72-b39f54a08db5 status: test description: Detects PAExec default named pipe references: - https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/efa17a600b43c897b4b7463cc8541daa1987eeb4/Command%20and%20Control/C2-NamedPipe.md - https://github.com/poweradminllc/PAExec author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-26 tags: - attack.execution - attack.t1569.002 logsource: category: pipe_created product: windows definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName|startswith: \PAExec condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects instances where an SSH service on an OpenCanary node has had a connection attempt.. Logsource: opencanary / application. Rule: title: OpenCanary - SSH New Connection Attempt id: cd55f721-5623-4663-bd9b-5229cab5237d status: test description: Detects instances where an SSH service on an OpenCanary node has had a connection attempt. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.privilege-escalation - attack.initial-access - attack.lateral-movement - attack.persistence - attack.stealth - attack.t1133 - attack.t1021 - attack.t1078 logsource: category: application product: opencanary detection: selection: logtype: 4000 condition: selection falsepositives: - Unlikely level: high