alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: what is T1020.001
Matching passage: T1020.001 Traffic Duplication. Tactics: exfiltration. Description: Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis. For example, devices may be configured to forward network traffic to one or more destinations for analysis by a network analyzer or other monitoring device. (Citation: Cisco Traffic Mirroring)(Citation: Juniper Traffic Mirroring) Adversaries may abuse traffic mirroring to mirror or redirect network traffic through other infrastructure they control. Malicious modifications to network devices to enable traffic redirection may be possible through [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) or [Patch System Image](https://attack.mitre.org/techniques/T1601/001).(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks) Many cloud-based environments also support traffic mirroring. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to.(Citation: AWS Traffic Mirroring)(Citation: GCP Packet Mirroring)(Citation: Azure Virtual Network TAP) Adversaries may use traffic duplication in conjunction with [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Input Capture](https://attack.mitre.org/techniques/T1056), or [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) depending on the goals and objectives of the adversary.
Near-miss passage: T1020 Automated Exfiltration. Tactics: exfiltration. Description: Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.(Citation: ESET Gamaredon June 2020) When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).
Query: SOC runbook when seeing Persistence mechanism resembling Create Cloud Instance
Matching passage: Playbook for T1578.002 Create Cloud Instance. 1) Validate alert telemetry against T1578.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: defense impairment. 5) Eradicate persistence and recover. Reference detection notes: An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses. Creating a new instance may allow an adversary to bypass firewall rules and permissions that exist on instances currently residing within an account. An adversary may [Create Snapshot](https://attack.mitre.org/techniques/T1578/001) of one or more volumes in an account, cr
Near-miss passage: Playbook for T1578.001 Create Snapshot. Different response path focused on defense impairment.
Query: detection rule: Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take
Matching passage: Sigma rule: Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take. Logsource: windows / file_event. Rule: title: Creation Exe for Service with Unquoted Path id: 8c3c76ca-8f8b-4b1d-aaf3-81aebcd367c9 status: test description: 'Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary''s executable to launch. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.009/T1574.009.md author: frack113 date: 2021-12-30 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.009 logsource: product: windows category: file_event detection: selection: TargetFilename: C:\program.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of doas.conf file in linux host platform.. Logsource: linux / file_event. Rule: title: Linux Doas Conf File Creation id: 00eee2a5-fdb0-4746-a21d-e43fbdea5681 status: stable description: Detects the creation of doas.conf file in linux host platform. references: - https://research.splunk.com/endpoint/linux_doas_conf_file_creation/ - https://www.makeuseof.com/how-to-install-and-use-doas/ author: Sittikorn S, Teoderick Contreras date: 2022-01-20 modified: 2022-12-31 tags: - attack.privilege-escalation - attack.t1548 logsource: product: linux category: file_event detection: selection: TargetFilename|endswith: /etc/doas.conf condition: selection falsepositives: - Unlikely level: medium
Query: weakness Missing Origin Validation in WebSockets
Matching passage: CWE-1385 Missing Origin Validation in WebSockets. The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.
Near-miss passage: CWE-790 Improper Filtering of Special Elements. The product receives data from an upstream component, but does not filter or incorrectly filters special elements before sending it to a downstream component.
Query: patch priority for CVE-2015-4267
Matching passage: CVE-2015-4267. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2(0.793), 1.3(0.876), 1.4(0.109), 2.0(0.147), and 2.0(0.169) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus09940.
Near-miss passage: CVE-2015-3950. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in XZERES 442SR OS on 442SR wind turbines allows remote attackers to hijack the authentication of admins for requests that select a different default admin user via a GET request.
Query: detection rule: Detect AD credential dumping using impacket secretdump HKTL
Matching passage: Sigma rule: Detect AD credential dumping using impacket secretdump HKTL. Logsource: windows / security. Rule: title: Possible Impacket SecretDump Remote Activity id: 252902e3-5830-4cf6-bf21-c22083dfd5cf status: test description: Detect AD credential dumping using impacket secretdump HKTL references: - https://web.archive.org/web/20230329153811/https://blog.menasec.net/2019/02/threat-huting-10-impacketsecretdump.html author: Samir Bousseaden, wagga date: 2019-04-03 modified: 2022-08-11 tags: - attack.credential-access - attack.t1003.002 - attack.t1003.004 - attack.t1003.003 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure detection: selection: EventID: 5145 ShareName: \\\\\*\\ADMIN$ RelativeTargetName|contains|all: - SYSTEM32\ - .tmp condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikat. Logsource: windows / process_access. Rule: title: Remote LSASS Process Access Through Windows Remote Management id: aa35a627-33fb-4d04-a165-d33b4afca3e8 status: stable description: Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz. references: - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/ author: Patryk Prauze - ING Tech date: 2019-05-20 modified: 2023-11-29 tags: - attack.credential-access - attack.execution - attack.t1003.001 - attack.t1059.001 - attack.lateral-movement - attack.t1021.006 - attack.s0002 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe SourceImage|endswith: :\Windows\system32\wsmprovhost.exe filter_main_access: GrantedAccess: '0x80000000' condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Query: rule covering Detects a suspicious IIS module registration as described in Microsoft threat report on IIS backdoors
Matching passage: Sigma rule: Detects a suspicious IIS module registration as described in Microsoft threat report on IIS backdoors. Logsource: windows / process_creation. Rule: title: Suspicious IIS Module Registration id: 043c4b8b-3a54-4780-9682-081cb6b8185c status: test description: Detects a suspicious IIS module registration as described in Microsoft threat report on IIS backdoors references: - https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/ author: Florian Roth (Nextron Systems), Microsoft (idea) date: 2022-08-04 modified: 2023-01-23 tags: - attack.persistence - attack.t1505.004 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \w3wp.exe selection_cli_1: CommandLine|contains: appcmd.exe add module selection_cli_2: CommandLine|contains: ' system.enterpriseservices.internal.publish' Image|endswith: \powershell.exe selection_cli_3: CommandLine|contains|all: - gacutil - ' /I' condition: selection_parent and 1 of selection_cli_* falsepositives: - Administrative activity level: high
Near-miss passage: Sigma rule: Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against. Logsource: windows / process_creation. Rule: title: HackTool - Hashcat Password Cracker Execution id: 39b31e81-5f5f-4898-9c0e-2160cfc0f9bf status: test description: Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1110.002/T1110.002.md#atomic-test-1---password-cracking-with-hashcat - https://hashcat.net/wiki/doku.php?id=hashcat author: frack113 date: 2021-12-27 modified: 2023-02-04 tags: - attack.credential-access - attack.t1110.002 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \hashcat.exe selection_cli: CommandLine|contains|all: - '-a ' - '-m 1000 ' - '-r ' condition: 1 of selection_* falsepositives: - Tools that use similar command line flags and values level: high
Query: detect Detects disabling Windows Defender Tamper Protection in logs
Matching passage: Sigma rule: Detects disabling Windows Defender Tamper Protection. Logsource: windows / registry_set. Rule: title: Disable Tamper Protection on Windows Defender id: 93d298a1-d28f-47f1-a468-d971e7796679 status: test description: Detects disabling Windows Defender Tamper Protection references: - https://www.tenforums.com/tutorials/123792-turn-off-tamper-protection-microsoft-defender-antivirus.html author: Austin Songer @austinsonger date: 2021-08-04 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Windows Defender\Features\TamperProtection Details: DWORD (0x00000000) filter_msmpeng_client: Image|startswith: C:\ProgramData\Microsoft\Windows Defender\Platform\ Image|endswith: \MsMpEng.exe filter_msmpeng_domain_controller: Image: C:\Program Files\Windows Defender\MsMpEng.exe condition: selection and not 1 of filter_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects default PsExec service filename which indicates PsExec service installation and execution. Logsource: windows / file_event. Rule: title: PsExec Service File Creation id: 259e5a6a-b8d2-4c38-86e2-26c5e651361d related: - id: 42c575ea-e41e-41f1-b248-8093c3e82a28 type: derived status: test description: Detects default PsExec service filename which indicates PsExec service installation and execution references: - https://www.jpcert.or.jp/english/pub/sr/ir_research.html - https://jpcertcc.github.io/ToolAnalysisResultSheet author: Thomas Patzke date: 2017-06-12 modified: 2022-10-26 tags: - attack.execution - attack.t1569.002 - attack.s0029 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: \PSEXESVC.exe condition: selection falsepositives: - Unknown level: low
Query: write Sigma for Detects usage of winget to add new potentially suspicious download sources
Matching passage: Sigma rule: Detects usage of winget to add new potentially suspicious download sources. Logsource: windows / process_creation. Rule: title: Add Potential Suspicious New Download Source To Winget id: c15a46a0-07d4-4c87-b4b6-89207835a83b related: - id: 05ebafc8-7aa2-4bcd-a269-2aec93f9e842 type: similar - id: 81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2 type: similar status: test description: Detects usage of winget to add new potentially suspicious download sources references: - https://learn.microsoft.com/en-us/windows/package-manager/winget/source - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-17 modified: 2023-12-04 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \winget.exe - OriginalFileName: winget.exe selection_cli: CommandLine|contains|all: - 'source ' - 'add ' selection_source_direct_ip: CommandLine|re: ://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious PowerShell invocation command parameters. Logsource: windows / ps_module. Rule: title: Suspicious PowerShell Invocations - Generic - PowerShell Module id: bbb80e91-5746-4fbe-8898-122e2cafdbf4 related: - id: 3d304fda-78aa-43ed-975c-d740798a49c1 type: derived - id: ed965133-513f-41d9-a441-e38076a0798f type: similar status: test description: Detects suspicious PowerShell invocation command parameters references: - Internal Research author: Florian Roth (Nextron Systems) date: 2017-03-12 modified: 2023-01-03 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_encoded: ContextInfo|contains: - ' -enc ' - ' -EncodedCommand ' - ' -ec ' selection_hidden: ContextInfo|contains: - ' -w hidden ' - ' -window hidden ' - ' -windowstyle hidden ' - ' -w 1 ' selection_noninteractive: ContextInfo|contains: - ' -noni ' - ' -noninteractive ' condition: all of selection* falsepositives: - Very special / sneaky PowerShell scripts level: high
Query: CVE similar to CVE-2015-6618
Matching passage: CVE-2015-6618. CWE: CWE-254. CVSS: 4.300000190734863. Bluetooth in Android 4.4 and 5.x before 5.1.1 LMY48Z allows user-assisted remote attackers to execute arbitrary code by leveraging access to the local physical environment, aka internal bug 24595992.
Near-miss passage: CVE-2015-7188. CWE: CWE-254. CVSS: 7.5. Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to bypass the Same Origin Policy for an IP address origin, and conduct cross-site scripting (XSS) attacks, by appending whitespace characters to an IP address string.
Query: exploit Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and A
Matching passage: CVE-2015-6687. CWE: CWE-416. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7615, CVE-2015-7617, and CVE-2015-7621.
Near-miss passage: CVE-2015-7615. CWE: CWE-416. CVSS: 6.800000190734863. Use-after-free vulnerability in a SaveAs feature in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7617, and CVE-2015-7621.
Query: patch priority for CVE-2015-1479
Matching passage: CVE-2015-1479. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to execute arbitrary SQL commands via the site parameter.
Near-miss passage: CVE-2015-5591. CWE: CWE-89. CVSS: 7.199999809265137. SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute arbitrary SQL commands.
Query: exploit WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and appli
Matching passage: CVE-2015-7103. CWE: CWE-119. CVSS: 6.800000190734863. WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, and CVE-2015-7102.
Near-miss passage: CVE-2015-3679. CWE: CWE-119. CVSS: 6.800000190734863. Apple Type Services (ATS) in Apple OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-3680, CVE-2015-3681, and CVE-2015-3682.
Query: indicators of Boot or Logon Autostart Execution
Matching passage: T1547 Boot or Logon Autostart Execution. Tactics: persistence, privilege escalation. Description: Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming) These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel. Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.
Near-miss passage: T1547.014 Active Setup. Tactics: persistence, privilege escalation. Description: Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. Active Setup is a Windows mechanism that is used to execute programs when a user logs in. The value stored in the Registry key will be executed after a user logs into the computer.(Citation: Klein Active Setup 2010) These programs will be executed under the context of the user and will have the account's associated permissions level. Adversaries may abuse Active Setup by creating a key under <code> HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\</code> and setting a malicious value for <code>StubPath</code>. This value will serve as the program that will be executed when a user logs into the computer.(Citation: Mandiant Glyer APT 2010)(Citation: Citizenlab Packrat 2015)(Citation: FireEye CFR Watering Hole 2012)(Citation: SECURELIST Bright Star 2015)(Citation: paloalto Tropic Trooper 2016) Adversaries can abuse these components to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.
Query: vulnerability: Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2) ad
Matching passage: CVE-2015-8399. CWE: CWE-200. CVSS: 4.300000190734863. Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2) admin/viewdefaultdecorator.action.
Near-miss passage: CVE-2015-7902. CWE: CWE-200. CVSS: 5.0. Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 provides different error messages for failed login attempts in unspecified circumstances, which allows remote attackers to obtain sensitive information via a series of requests.
Query: describe CVE-2015-3279
Matching passage: CVE-2015-3279. CWE: CWE-189. CVSS: 7.5. Integer overflow in filter/texttopdf.c in texttopdf in cups-filters before 1.0.71 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted line size in a print job, which triggers a heap-based buffer overflow.
Near-miss passage: CVE-2015-4471. CWE: CWE-189. CVSS: 4.300000190734863. Off-by-one error in the lzxd_decompress function in lzxd.c in libmspack before 0.5 allows remote attackers to cause a denial of service (buffer under-read and application crash) via a crafted CAB archive.