alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for linux / network_connection
Matching passage: Sigma rule: Detects programs that connect to known malware callback ports based on threat intelligence reports.. Logsource: linux / network_connection. Rule: title: Potentially Suspicious Malware Callback Communication - Linux id: dbfc7c98-04ab-4ab7-aa94-c74d22aa7376 related: - id: 4b89abaa-99fe-4232-afdd-8f9aa4d20382 type: derived status: test description: 'Detects programs that connect to known malware callback ports based on threat intelligence reports. ' references: - https://www.mandiant.com/resources/blog/triton-actor-ttp-profile-custom-attack-tools-detections - https://www.mandiant.com/resources/blog/ukraine-and-sandworm-team - https://www.elastic.co/guide/en/security/current/potential-non-standard-port-ssh-connection.html - https://thehackernews.com/2024/01/systembc-malwares-c2-server-analysis.html - https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors author: hasselj date: 2024-05-10 tags: - attack.persistence - attack.command-and-control - attack.t1571 logsource: category: network_connection product: linux detection: selection: Initiated: 'true' DestinationPort: - 888 - 999 - 2200 - 2222 - 4000 - 4444 - 6789 - 8531 - 50501 - 51820 filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of msdt.exe using the "cab" flag which could indicates suspicious diagcab files with embedded answer f. Logsource: windows / process_creation. Rule: title: Suspicious Cabinet File Execution Via Msdt.EXE id: dc4576d4-7467-424f-9eee-fd2b02855fe0 related: - id: 6545ce61-a1bd-4119-b9be-fcbee42c0cf3 type: obsolete status: test description: Detects execution of msdt.exe using the "cab" flag which could indicates suspicious diagcab files with embedded answer files leveraging CVE-2022-30190 references: - https://twitter.com/nas_bench/status/1537896324837781506 - https://github.com/GossiTheDog/ThreatHunting/blob/e85884abbf05d5b41efc809ea6532b10b45bd05c/AdvancedHuntingQueries/DogWalk-DiagCab - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-9015912909545e72ed42cbac4d1e96295e8964579c406d23fd9c47a8091576a0 - https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd author: Nasreddine Bencherchali (Nextron Systems), GossiTheDog, frack113 date: 2022-06-21 modified: 2024-03-13 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \msdt.exe - OriginalFileName: msdt.exe selection_cmd: CommandLine|contains|windash: ' -cab ' condition: all of selection_* falsepositives: - Legitimate usage of ".diagcab" files level: medium
Query: risk of The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter.
Matching passage: CVE-2015-7873. CWE: CWE-254. CVSS: 5.0. The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter.
Near-miss passage: CVE-2015-8400. CWE: CWE-254. CVSS: 7.400000095367432. The HTTPS fallback implementation in Shell In A Box (aka shellinabox) before 2.19 makes it easier for remote attackers to conduct DNS rebinding attacks via the "/plain" URL.
Query: what is T1001
Matching passage: T1001 Data Obfuscation. Tactics: command and control. Description: Adversaries may obfuscate command and control traffic to make it more difficult to detect.(Citation: Bitdefender FunnyDream Campaign November 2020) Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Near-miss passage: T1001.001 Junk Data. Tactics: command and control. Description: Adversaries may add junk data to protocols used for command and control to make detection more difficult.(Citation: FireEye SUNBURST Backdoor December 2020) By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, deciphering, or otherwise analyzing the traffic. Examples may include appending/prepending data with junk characters or writing junk characters between significant characters.
Query: Multiple failed authentications followed by Dylib Hijacking
Matching passage: T1574.004 Dylib Hijacking. Tactics: stealth, execution. Description: Adversaries may execute their own payloads by placing a malicious dynamic library (dylib) with an expected name in a path a victim application searches at runtime. The dynamic loader will try to find the dylibs based on the sequential order of the search paths. Paths to dylibs may be prefixed with <code>@rpath</code>, which allows developers to use relative paths to specify an array of search paths used at runtime based on the location of the executable. Additionally, if weak linking is used, such as the <code>LC_LOAD_WEAK_DYLIB</code> function, an application will still execute even if an expected dylib is not present. Weak linking enables developers to run an application on multiple macOS versions as new APIs are added. Adversaries may gain execution by inserting malicious dylibs with the name of the missing dylib in the identified path.(Citation: Wardle Dylib Hijack Vulnerable Apps)(Citation: Wardle Dylib Hijacking OSX 2015)(Citation: Github EmpireProject HijackScanner)(Citation: Github EmpireProject CreateHijacker Dylib) Dylibs are loaded into an application's address space allowing the malicious dylib to inherit the application's privilege level and resources. Based on the application, this could result in privilege escalation and uninhibited network access. This method may also evade detection from security products since the execution is masked under a legitimate process.(Citation: Writing Bad Malware for OSX)(Citation: wardle artofmalware volume1)(Citation: MalwareUnicorn macOS Dylib Injection MachO)
Near-miss passage: T1574.010 Services File Permissions Weakness. Tactics: stealth, execution. Description: Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM. Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.
Query: detection rule: Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping
Matching passage: Sigma rule: Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping. Logsource: windows / process_creation. Rule: title: Webshell Hacking Activity Patterns id: 4ebc877f-4612-45cb-b3a5-8e3834db36c9 status: test description: 'Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system ' references: - https://youtu.be/7aemGhaE9ds?t=641 author: Florian Roth (Nextron Systems) date: 2022-03-17 modified: 2023-11-09 tags: - attack.persistence - attack.discovery - attack.t1505.003 - attack.t1018 - attack.t1033 - attack.t1087 logsource: category: process_creation product: windows detection: selection_webserver_image: ParentImage|endswith: - \caddy.exe - \httpd.exe - \nginx.exe - \php-cgi.exe - \w3wp.exe - \ws_tomcatservice.exe selection_webserver_characteristics_tomcat1: ParentImage|endswith: - \java.exe - \javaw.exe ParentImage|contains: - -tomcat- - \tomcat selection_webserver_characteristics_tomcat2: ParentImage|endswith: - \java.exe - \javaw.exe CommandLine|contains: - catalina.jar - CATALINA_HOME selection_child_1: CommandLine|contains|all: - rundll32 - comsvcs selection_child_2: CommandLine|contains|all: - ' -hp' - ' a ' - ' -m' selection_child_3: CommandLine|contains|all: - net - ' user ' - ' /add' selection_child_4: CommandLine|contains|all: - net - ' localgroup ' - ' administrators ' - /add selection_child_5: Image|endswith: - \ntdsutil.exe - \ldifde.exe - \adfind.exe - \procdump.exe - \Nanodump.exe - \vssadmin.exe - \fsutil.exe selection_child_6: CommandLine|contains: - ' -decode ' - ' -NoP ' - ' -W Hidden ' - ' /decode ' - ' /ticket:' - ' sekurlsa' - .dmp full - .downloadfile( - .downloadstring( - FromBase64String - process call create - 'reg save ' - whoami /priv condition: 1 of selection_webserver_* and 1 of selection_child_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows. Logsource: windows / process_creation. Rule: title: Arbitrary Shell Command Execution Via Settingcontent-Ms id: 24de4f3b-804c-4165-b442-5a06a2302c7e status: test description: The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries. references: - https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39 author: Sreeman date: 2020-03-13 modified: 2022-04-14 tags: - attack.t1204 - attack.t1566.001 - attack.execution - attack.initial-access logsource: category: process_creation product: windows detection: selection: CommandLine|contains: .SettingContent-ms filter: CommandLine|contains: immersivecontrolpanel condition: selection and not filter falsepositives: - Unknown level: medium
Query: exploit 2Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Matching passage: CVE-2015-9364. CWE: CWE-79. CVSS: 6.099999904632568. 2Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Near-miss passage: CVE-2015-0156. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.6.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: Sigma rule for Detects modifications to shell open registry keys that point to suspicious locations typically used by malware for persi
Matching passage: Sigma rule: Detects modifications to shell open registry keys that point to suspicious locations typically used by malware for persi. Logsource: windows / registry_set. Rule: title: Suspicious Shell Open Command Registry Modification id: 9e8894c0-0ae0-11ef-9d85-1f2942bec57c status: experimental description: 'Detects modifications to shell open registry keys that point to suspicious locations typically used by malware for persistence. Generally, modifications to the `*\shell\open\command` registry key can indicate an attempt to change the default action for opening files, and various UAC bypass or persistence techniques involve modifying these keys to execute malicious scripts or binaries. ' references: - https://www.trendmicro.com/en_us/research/25/f/water-curse.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-01-24 tags: - attack.privilege-escalation - attack.persistence - attack.t1548.002 - attack.t1546.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \shell\open\command\ Details|contains: - \$Recycle.Bin\ - \AppData\Local\Temp\ - \Contacts\ - \Music\ - \PerfLogs\ - \Photos\ - \Pictures\ - \Users\Public\ - \Videos\ - \Windows\Temp\ - '%AppData%' - '%LocalAppData%' - '%Temp%' - '%tmp%' condition: selection falsepositives: - Legitimate software installations or updates that modify the shell open command registry keys to these locations. level: medium
Near-miss passage: Sigma rule: Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation att. Logsource: nginx. Rule: title: Nginx Core Dump id: 59ec40bb-322e-40ab-808d-84fa690d7e56 status: test description: Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts. references: - https://docs.nginx.com/nginx/admin-guide/monitoring/debugging/#enabling-core-dumps - https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/ author: Florian Roth (Nextron Systems) date: 2021-05-31 modified: 2023-05-08 tags: - attack.impact - attack.t1499.004 logsource: service: nginx detection: keywords: - exited on signal 6 (core dumped) condition: keywords falsepositives: - Serious issues with a configuration or plugin level: high
Query: describe CVE-2015-1357
Matching passage: CVE-2015-1357. CWE: CWE-200. CVSS: 5.0. Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware before SS4.4.4624.35, WIN70xx devices with firmware before BS4.4.4621.32, and WIN72xx devices with firmware before BS4.4.4621.32 allow context-dependent attackers to discover password hashes by reading (1) files or (2) security logs.
Near-miss passage: CVE-2015-4308. CWE: CWE-200. CVSS: 6.800000190734863. The webGUI configuration-export feature in Cisco Edge Bluebird Operating System 1.2 on Edge 340 devices allows remote authenticated users to obtain sensitive information via unspecified vectors, aka Bug ID CSCuu43968.
Query: risk of Stack-based buffer overflow in Hospira LifeCare PCA Infusion System 5.0 and earlier, and possibly other versions, allows remote attackers to execute arbitrary code via unspecified 
Matching passage: CVE-2015-3955. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in Hospira LifeCare PCA Infusion System 5.0 and earlier, and possibly other versions, allows remote attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-5822. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Query: CVE similar to CVE-2015-2442
Matching passage: CVE-2015-2442. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 through 11 and Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2444.
Near-miss passage: CVE-2015-2376. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Office for Mac 2011, Excel Viewer 2007 SP3, Office Compatibility Pack SP3, Excel Services on SharePoint Server 2007 SP3, Excel Services on SharePoint Server 2010 SP2, and Excel Services on SharePoint Server 2013 SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: campaign using Social Media
Matching passage: T1593.001 Social Media. Tactics: reconnaissance. Description: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. [Spearphishing Service](https://attack.mitre.org/techniques/T1598/001)).(Citation: Cyware Social Media) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).
Near-miss passage: T1593.002 Search Engines. Tactics: reconnaissance. Description: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes).(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking) Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Valid Accounts](https://attack.mitre.org/techniques/T1078) or [Phishing](https://attack.mitre.org/techniques/T1566)).
Query: Sigma rule for Detects when an instance identity has taken an action that isn't inside SSM. This can indicate that a compromised EC2 in
Matching passage: Sigma rule: Detects when an instance identity has taken an action that isn't inside SSM. This can indicate that a compromised EC2 in. Logsource: aws / cloudtrail. Rule: title: Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure id: 352a918a-34d8-4882-8470-44830c507aa3 status: test description: 'Detects when an instance identity has taken an action that isn''t inside SSM. This can indicate that a compromised EC2 instance is being used as a pivot point. ' references: - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-identity-roles.html - https://ermetic.com/blog/aws/aws-ec2-imds-what-you-need-to-know/ - https://www.packetmischief.ca/2023/07/31/amazon-ec2-credential-exfiltration-how-it-happens-and-how-to-mitigate-it/#lifting-credentials-from-imds-this-is-why-we-cant-have-nice-things author: jamesc-grafana date: 2024-07-11 tags: - attack.privilege-escalation - attack.initial-access - attack.persistence - attack.stealth - attack.t1078 - attack.t1078.002 logsource: product: aws service: cloudtrail detection: selection: userIdentity.arn|re: .+:assumed-role/aws:.+ filter_main_generic: - eventSource: ssm.amazonaws.com - eventName: RegisterManagedInstance - sourceIPAddress: AWS Internal condition: selection and not 1 of filter_main_* falsepositives: - A team has configured an EC2 instance to use instance profiles that grant the option for the EC2 instance to talk to other AWS Services level: high
Near-miss passage: Sigma rule: Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Child Process Of VsCode id: 5a3164f2-b373-4152-93cf-090b13c12d27 status: test description: Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles. references: - https://twitter.com/nas_bench/status/1618021838407495681 - https://twitter.com/nas_bench/status/1618021415852335105 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-26 modified: 2023-10-25 tags: - attack.execution - attack.stealth - attack.t1218 - attack.t1202 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \code.exe selection_children_images: Image|endswith: - \calc.exe - \regsvr32.exe - \rundll32.exe - \cscript.exe - \wscript.exe selection_children_cli: Image|endswith: - \powershell.exe - \pwsh.exe - \cmd.exe CommandLine|contains: - Invoke-Expressions - IEX - Invoke-Command - ICM - DownloadString - rundll32 - regsvr32 - wscript - cscript selection_children_paths: Image|contains: - :\Users\Public\ - :\Windows\Temp\ - :\Temp\ condition: selection_parent and 1 of selection_children_* falsepositives: - In development environment where VsCode is used heavily. False positives may occur when developers use task to compile or execute different types of code. Remove or add processes accordingly level: medium
Query: containment actions for Multiple failed authentications followed by Systemd Timers
Matching passage: Playbook for T1053.006 Systemd Timers. 1) Validate alert telemetry against T1053.006. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: execution, persistence, privilege escalation. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. Systemd timers are unit files with file extension <code>.timer</code> that control services. Timers can be set to run on a calendar event or after a time span relative to a starting point. They can be used as an alternative to [Cron](https://attack.mitre.org/techniques/T1053/003) i
Near-miss passage: Playbook for T1053.002 At. Different response path focused on execution, persistence, privilege escalation.
Query: secure coding against Use of Expired File Descriptor
Matching passage: CWE-910 Use of Expired File Descriptor. The product uses or accesses a file descriptor after it has been closed.
Near-miss passage: CWE-1384 Improper Handling of Physical or Environmental Conditions. The product does not properly handle unexpected physical or environmental conditions that occur naturally or are artificially induced.
Query: describe CVE-2015-1289
Matching passage: CVE-2015-1289. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google Chrome before 44.0.2403.89 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Near-miss passage: CVE-2015-0372. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality via unknown vectors.