alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects rundll32 loading a renamed comsvcs.dll to dump process memory
Matching passage: Sigma rule: Detects rundll32 loading a renamed comsvcs.dll to dump process memory. Logsource: windows / image_load. Rule: title: Suspicious Renamed Comsvcs DLL Loaded By Rundll32 id: 8cde342c-ba48-4b74-b615-172c330f2e93 status: test description: Detects rundll32 loading a renamed comsvcs.dll to dump process memory references: - https://twitter.com/sbousseaden/status/1555200155351228419 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-14 modified: 2023-02-17 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: image_load detection: selection: Image|endswith: \rundll32.exe Hashes|contains: - IMPHASH=eed93054cb555f3de70eaa9787f32ebb - IMPHASH=5e0dbdec1fce52daae251a110b4f309d - IMPHASH=eadbccbb324829acb5f2bbe87e5549a8 - IMPHASH=407ca0f7b523319d758a40d7c0193699 - IMPHASH=281d618f4e6271e527e6386ea6f748de filter: ImageLoaded|endswith: \comsvcs.dll condition: selection and not filter falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the expansion or decompression of cabinet files from potentially suspicious or uncommon locations, e.g. seen in. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Cabinet File Expansion id: 9f107a84-532c-41af-b005-8d12a607639f status: test description: Detects the expansion or decompression of cabinet files from potentially suspicious or uncommon locations, e.g. seen in Iranian MeteorExpress related attacks references: - https://labs.sentinelone.com/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll - https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/ author: Bhabesh Raj, X__Junior (Nextron Systems) date: 2021-07-30 modified: 2024-11-13 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_cmd: Image|endswith: \expand.exe CommandLine|contains|windash: '-F:' selection_folders_1: CommandLine|contains: - :\Perflogs\ - :\ProgramData - :\Users\Public\ - :\Windows\Temp\ - \Admin$\ - \AppData\Local\Temp\ - \AppData\Roaming\ - \C$\ - \Temporary Internet selection_folders_2: - CommandLine|contains|all: - :\Users\ - \Favorites\ - CommandLine|contains|all: - :\Users\ - \Favourites\ - CommandLine|contains|all: - :\Users\ - \Contacts\ filter_optional_dell: ParentImage: C:\Program Files (x86)\Dell\UpdateService\ServiceShell.exe CommandLine|contains: C:\ProgramData\Dell\UpdateService\Temp\ condition: selection_cmd and 1 of selection_folders_* and not 1 of filter_optional_* falsepositives: - System administrator Usage level: medium
Query: intelligence brief on T1578.005
Matching passage: T1578.005 Modify Cloud Compute Configurations. Tactics: defense impairment. Description: Adversaries may modify settings that directly affect the size, locations, and resources available to cloud compute infrastructure in order to evade defenses. These settings may include service quotas, subscription associations, tenant-wide policies, or other configurations that impact available compute. Such modifications may allow adversaries to abuse the victim’s compute resources to achieve their goals, potentially without affecting the execution of running instances and/or revealing their activities to the victim. For example, cloud providers often limit customer usage of compute resources via quotas. Customers may request adjustments to these quotas to support increased computing needs, though these adjustments may require approval from the cloud provider. Adversaries who compromise a cloud environment may similarly request quota adjustments in order to support their activities, such as enabling additional [Resource Hijacking](https://attack.mitre.org/techniques/T1496) without raising suspicion by using up a victim’s entire quota.(Citation: Microsoft Cryptojacking 2023) Adversaries may also increase allowed resource usage by modifying any tenant-wide policies that limit the sizes of deployed virtual machines.(Citation: Microsoft Azure Policy) Adversaries may also modify settings that affect where cloud resources can be deployed, such as enabling [Unused/Unsupported Cloud Regions](https://attack.mitre.org/techniques/T1535).
Near-miss passage: T1578.004 Revert Cloud Instance. Tactics: defense impairment. Description: An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence. In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine (VM) or data storage snapshots through the cloud management dashboard or cloud APIs. Another variation of this technique is to utilize temporary storage attached to the compute instance. Most cloud providers provide various types of storage including persistent, local, and/or ephemeral, with the ephemeral types often reset upon stop/restart of the VM.(Citation: Tech Republic - Restore AWS Snapshots)(Citation: Google - Restore Cloud Snapshot)
Query: exploit The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by
Matching passage: CVE-2015-1848. CWE: CWE-310. CVSS: 6.800000190734863. The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2015-3983 is for the issue with not setting the HTTPOnly flag.
Near-miss passage: CVE-2015-5039. CWE: CWE-310. CVSS: 7.400000095367432. The Remote Client and change management integrations in IBM Rational ClearCase 7.1.x, 8.0.0.x before 8.0.0.18, and 8.0.1.x before 8.0.1.11 do not properly validate hostnames in X.509 certificates from SSL servers, which allows remote attackers to spoof servers and obtain sensitive information or modify network traffic via a crafted certificate. IBM X-Force ID: 106715.
Query: alert when Detection use of the command "split" to split files into parts and possible transfer.
Matching passage: Sigma rule: Detection use of the command "split" to split files into parts and possible transfer.. Logsource: linux / auditd. Rule: title: Split A File Into Pieces - Linux id: 2dad0cba-c62a-4a4f-949f-5f6ecd619769 status: test description: Detection use of the command "split" to split files into parts and possible transfer. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1030/T1030.md author: Igor Fits, oscd.community date: 2020-10-15 modified: 2022-11-28 tags: - attack.exfiltration - attack.t1030 logsource: product: linux service: auditd detection: selection: type: SYSCALL comm: split condition: selection falsepositives: - Legitimate administrative activity level: low
Near-miss passage: Sigma rule: Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used. Logsource: windows / process_creation. Rule: title: Suspicious PowerShell Mailbox Export to Share id: 889719ef-dd62-43df-86c3-768fb08dc7c0 status: test description: Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations references: - https://youtu.be/5mqid-7zp8k?t=2481 - https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html - https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1 - https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/ author: Florian Roth (Nextron Systems) date: 2021-08-07 modified: 2022-10-26 tags: - attack.exfiltration logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - New-MailboxExportRequest - ' -Mailbox ' - ' -FilePath \\\\' condition: selection falsepositives: - Unknown level: critical
Query: risk of Cross-site scripting (XSS) vulnerability in adfs/ls in Active Directory Federation Services (AD FS) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 allows remote at
Matching passage: CVE-2015-1757. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in adfs/ls in Active Directory Federation Services (AD FS) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 allows remote attackers to inject arbitrary web script or HTML via the wct parameter, aka "ADFS XSS Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-6754. CWE: CWE-79. CVSS: 2.0999999046325684. Cross-site scripting (XSS) vulnerability in the administration interface in the Path Breadcrumbs module 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "Administer Path Breadcrumbs" permission to inject arbitrary web script or HTML via unspecified vectors.
Query: detect Detects the creation of doas.conf file in linux host platform. in logs
Matching passage: Sigma rule: Detects the creation of doas.conf file in linux host platform.. Logsource: linux / file_event. Rule: title: Linux Doas Conf File Creation id: 00eee2a5-fdb0-4746-a21d-e43fbdea5681 status: stable description: Detects the creation of doas.conf file in linux host platform. references: - https://research.splunk.com/endpoint/linux_doas_conf_file_creation/ - https://www.makeuseof.com/how-to-install-and-use-doas/ author: Sittikorn S, Teoderick Contreras date: 2022-01-20 modified: 2022-12-31 tags: - attack.privilege-escalation - attack.t1548 logsource: product: linux category: file_event detection: selection: TargetFilename|endswith: /etc/doas.conf condition: selection falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Detects when a user manipulates with Firmward Password on MacOS. NOTE - this command has been disabled on silicon-based. Logsource: macos / process_creation. Rule: title: Suspicious MacOS Firmware Activity id: 7ed2c9f7-c59d-4c82-a7e2-f859aa676099 status: test description: Detects when a user manipulates with Firmward Password on MacOS. NOTE - this command has been disabled on silicon-based apple computers. references: - https://github.com/usnistgov/macos_security/blob/932a51f3e819dd3e02ebfcf3ef433cfffafbe28b/rules/os/os_firmware_password_require.yaml - https://www.manpagez.com/man/8/firmwarepasswd/ - https://support.apple.com/guide/security/firmware-password-protection-sec28382c9ca/web author: Austin Songer @austinsonger date: 2021-09-30 modified: 2022-10-09 tags: - attack.impact logsource: category: process_creation product: macos detection: selection1: Image: /usr/sbin/firmwarepasswd CommandLine|contains: - setpasswd - full - delete - check condition: selection1 falsepositives: - Legitimate administration activities level: medium
Query: risk of Directory traversal vulnerability in cm/newui/blog/export.jsp in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote authenticated users to read arbitrary files via a .. (
Matching passage: CVE-2015-2071. CWE: CWE-22. CVSS: 4.0. Directory traversal vulnerability in cm/newui/blog/export.jsp in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the filepath parameter.
Near-miss passage: CVE-2015-1550. CWE: CWE-22. CVSS: 9.0. Directory traversal vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allows remote administrators to execute arbitrary files via unspecified vectors.
Query: describe CVE-2015-5993
Matching passage: CVE-2015-5993. CWE: CWE-119. CVSS: 7.800000190734863. Buffer overflow in form2ping.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to cause a denial of service (device outage) via a long ipaddr parameter.
Near-miss passage: CVE-2015-3747. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Query: containment actions for Persistence mechanism resembling Container Service
Matching passage: Playbook for T1543.005 Container Service. 1) Validate alert telemetry against T1543.005. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: persistence, privilege escalation. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may create or modify container or container cluster management tools that run as daemons, agents, or services on individual hosts. These include software for creating and managing individual containers, such as Docker and Podman, as well as container cluster node-level agents such as kubelet. By modifying these services, an adversary may be able to achieve persistence or escalate their
Near-miss passage: Playbook for T1543.004 Launch Daemon. Different response path focused on persistence, privilege escalation.
Query: risk of WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and appli
Matching passage: CVE-2015-7098. CWE: CWE-119. CVSS: 6.800000190734863. WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.
Near-miss passage: CVE-2015-5917. CWE: CWE-119. CVSS: 5.0. The glob implementation in tnftpd (formerly lukemftpd), as used in Apple OS X before 10.11, allows remote attackers to cause a denial of service (memory consumption and daemon outage) via a STAT command containing a crafted pattern, as demonstrated by multiple instances of the {..,..,..}/* substring.
Query: Multiple failed authentications followed by Domain Fronting
Matching passage: T1090.004 Domain Fronting. Tactics: command and control. Description: Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. (Citation: Fifield Blocking Resistent Communication through domain fronting 2015) Domain fronting involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation of the the technique, "domainless" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored). For example, if domain-x and domain-y are customers of the same CDN, it is possible to place domain-x in the TLS header and domain-y in the HTTP header. Traffic will appear to be going to domain-x, however the CDN may route it to domain-y.
Near-miss passage: T1090.002 External Proxy. Tactics: command and control. Description: Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion. External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.
Query: Encoded PowerShell / command-line abuse matching Web Portal Capture
Matching passage: T1056.003 Web Portal Capture. Tactics: collection, credential access. Description: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through [External Remote Services](https://attack.mitre.org/techniques/T1133) and [Valid Accounts](https://attack.mitre.org/techniques/T1078) or as part of the initial compromise by exploitation of the externally facing web service.(Citation: Volexity Virtual Private Keylogging)
Near-miss passage: T1056.001 Keylogging. Tactics: collection, credential access. Description: Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.(Citation: Talos Kimsuky Nov 2021) Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes.(Citation: Adventures of a Keystroke) Some methods include: * Hooking API callbacks used for processing keystrokes. Unlike [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004), this focuses solely on API functions intended for processing keystroke data. * Reading raw keystroke data from the hardware buffer. * Windows Registry modifications. * Custom drivers. * [Modify System Image](https://attack.mitre.org/techniques/T1601) may provide adversaries with hooks into the operating system of network devices to read raw keystrokes for login sessions.(Citation: Cisco Blog Legacy Device Attacks)
Query: Sigma rule for Detects deletion of local audit logs
Matching passage: Sigma rule: Detects deletion of local audit logs. Logsource: macos / process_creation. Rule: title: Indicator Removal on Host - Clear Mac System Logs id: acf61bd8-d814-4272-81f0-a7a269aa69aa status: test description: Detects deletion of local audit logs references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md author: remotephone, oscd.community date: 2020-10-11 modified: 2022-09-16 tags: - attack.defense-impairment - attack.t1685.006 logsource: product: macos category: process_creation detection: selection1: Image|endswith: - /rm - /unlink - /shred selection_cli_1: CommandLine|contains: /var/log selection_cli_2: CommandLine|contains|all: - /Users/ - /Library/Logs/ condition: selection1 and 1 of selection_cli* falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detect the use of "<" to read and potentially execute a file via cmd.exe. Logsource: windows / process_creation. Rule: title: Read Contents From Stdin Via Cmd.EXE id: 241e802a-b65e-484f-88cd-c2dc10f9206d related: - id: 00a4bacd-6db4-46d5-9258-a7d5ebff4003 type: obsolete status: test description: Detect the use of "<" to read and potentially execute a file via cmd.exe references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1059.003/T1059.003.md - https://web.archive.org/web/20220306121156/https://www.x86matthew.com/view_post?id=ntdll_pipe author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-03-07 tags: - attack.execution - attack.t1059.003 logsource: category: process_creation product: windows detection: selection_cmd: - OriginalFileName: Cmd.Exe - Image|endswith: \cmd.exe selection_cli: CommandLine|contains: < condition: all of selection_* falsepositives: - Unknown level: medium
Query: alert when Detects Remote Utilities Host service installation on the target system.
Matching passage: Sigma rule: Detects Remote Utilities Host service installation on the target system.. Logsource: windows / system. Rule: title: Remote Utilities Host Service Install id: 85cce894-dd8b-4427-a958-5cc47a4dc9b9 status: test description: Detects Remote Utilities Host service installation on the target system. references: - https://www.remoteutilities.com/support/kb/host-service-won-t-start/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-31 tags: - attack.persistence logsource: product: windows service: system detection: selection_root: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ImagePath|contains|all: - \rutserv.exe - -service - ServiceName: Remote Utilities - Host condition: all of selection_* falsepositives: - Legitimate use of the tool level: medium
Near-miss passage: Sigma rule: Detects user account creation on ESXi system via esxcli. Logsource: linux / process_creation. Rule: title: ESXi Account Creation Via ESXCLI id: b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db status: test description: Detects user account creation on ESXi system via esxcli references: - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html author: Cedric Maurugeon date: 2023-08-22 tags: - attack.persistence - attack.execution - attack.t1136 - attack.t1059.012 logsource: category: process_creation product: linux detection: selection: Image|endswith: /esxcli CommandLine|contains|all: - 'system ' - 'account ' - 'add ' condition: selection falsepositives: - Legitimate administration activities level: medium
Query: risk of A vulnerability, which was classified as problematic, was found in galaxy-data-resource up to 14.10.0. This affects an unknown part of the component Command Line Template. The mani
Matching passage: CVE-2015-10062. CWE: CWE-74. CVSS: 9.800000190734863. A vulnerability, which was classified as problematic, was found in galaxy-data-resource up to 14.10.0. This affects an unknown part of the component Command Line Template. The manipulation leads to injection. Upgrading to version 14.10.1 is able to address this issue. The patch is named 50d65f45d3f5be5d1fbff2e45ac5cec075f07d42. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218451.
Near-miss passage: CVE-2015-0169. CWE: CWE-74. CVSS: 4.0. IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to inject arguments via unspecified vectors.