alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: EDR alert: possible Input Capture (T1056)
Matching passage: T1056 Input Capture. Tactics: collection, credential access. Description: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004)) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. [Web Portal Capture](https://attack.mitre.org/techniques/T1056/003)).
Near-miss passage: T1056.004 Credential API Hooking. Tactics: collection, credential access. Description: Adversaries may hook into Windows application programming interface (API) functions and Linux system functions to collect user credentials. Malicious hooking mechanisms may capture API or function calls that include parameters that reveal user authentication credentials.(Citation: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017) Unlike [Keylogging](https://attack.mitre.org/techniques/T1056/001), this technique focuses specifically on API functions that include parameters that reveal user credentials. In Windows, hooking involves redirecting calls to these functions and can be implemented via: * **Hooks procedures**, which intercept and execute designated code in response to events such as messages, keystrokes, and mouse inputs.(Citation: Microsoft Hook Overview)(Citation: Elastic Process Injection July 2017) * **Import address table (IAT) hooking**, which use modifications to a process’s IAT, where pointers to imported API functions are stored.(Citation: Elastic Process Injection July 2017)(Citation: Adlice Software IAT Hooks Oct 2014)(Citation: MWRInfoSecurity Dynamic Hooking 2015) * **Inline hooking**, which overwrites the first bytes in an API function to redirect code flow.(Citation: Elastic Process Injection July 2017)(Citation: HighTech Bridge Inline Hooking Sept 2011)(Citation: MWRInfoSecurity Dynamic Hooking 2015) In Linux and macOS, adversaries may hook into system functions via the `LD_PRELOAD` (Linux) or `DYLD_INSERT_LIBRARIES` (macOS) environment variables, which enables loading shared libraries into a program’s address space. For example, an adversary may capture credentials by hooking into the `libc read` function leveraged by SSH or SCP.(Citation: Intezer Symbiote 2022)
Query: ATT&CK technique for Service Execution
Matching passage: T1569.002 Service Execution. Tactics: execution. Description: Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and [Net](https://attack.mitre.org/software/S0039). [PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals) Tools such as [PsExec](https://attack.mitre.org/software/S0029) and <code>sc.exe</code> can accept remote servers as arguments and may be used to conduct remote execution. Adversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.
Near-miss passage: T1569 System Services. Tactics: execution. Description: Adversaries may abuse system services or daemons to execute commands or programs. Adversaries can execute malicious content by interacting with or creating services either locally or remotely. Many services are set to run at boot, which can aid in achieving persistence ([Create or Modify System Process](https://attack.mitre.org/techniques/T1543)), but adversaries can also abuse services for one-time or temporary execution.
Query: describe CVE-2015-4962
Matching passage: CVE-2015-4962. CWE: CWE-200. CVSS: 3.5. Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management (CLM) 3.x and 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Quality Manager (RQM) 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Team Concert (RTC) 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Requirements Composer (RRC) 3.x before 3.0.1.6 IF7 and 4.x before 4.0.7 IF9; Rational DOORS Next Generation (RDNG) 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Engineering Lifecycle Manager (RELM) 4.x through 4.0.7, 5.x through 5.0.2, and 6.x before 6.0.1; Rational Rhapsody Design Manager (DM) 4.x through 4.0.7, 5.x through 5.0.2, and 6.x before 6.0.1; and Rational Software Architect Design Manager (DM) 4.x through 4.0.7, 5.x through 5.0.2, and 6.x before 6.0.1 uses weak permissions for unspecified project areas, which allows remote authenticated users to obtain sensitive information via unknown vectors.
Near-miss passage: CVE-2015-5310. CWE: CWE-200. CVSS: 4.300000190734863. The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 does not properly ignore key data in response frames when management frame protection (MFP) was not negotiated, which allows remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service (ignored packets) via a WNM Sleep Mode response.
Query: adversary uses Time Providers
Matching passage: T1547.003 Time Providers. Tactics: persistence, privilege escalation. Description: Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.(Citation: Microsoft W32Time Feb 2018) W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients.(Citation: Microsoft TimeProvider) Time providers are implemented as dynamic-link libraries (DLLs) that are registered in the subkeys of `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders\`.(Citation: Microsoft TimeProvider) The time provider manager, directed by the service control manager, loads and starts time providers listed and enabled under this key at system startup and/or whenever parameters are changed.(Citation: Microsoft TimeProvider) Adversaries may abuse this architecture to establish persistence, specifically by creating a new arbitrarily named subkey pointing to a malicious DLL in the `DllName` value. Administrator privileges are required for time provider registration, though execution will run in context of the Local Service account.(Citation: Github W32Time Oct 2017)
Near-miss passage: T1547.010 Port Monitors. Tactics: persistence, privilege escalation. Description: Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the <code>AddMonitor</code> API call to set a DLL to be loaded at startup.(Citation: AddMonitor) This DLL can be located in <code>C:\Windows\System32</code> and will be loaded and run by the print spooler service, `spoolsv.exe`, under SYSTEM level permissions on boot.(Citation: Bloxham) Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to the `Driver` value of an existing or new arbitrarily named subkey of <code>HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors</code>. The Registry key contains entries for the following: * Local Port * Standard TCP/IP Port * USB Monitor * WSD Port
Query: CVE similar to CVE-2015-8742
Matching passage: CVE-2015-8742. CWE: CWE-20. CVSS: 5.5. The dissect_CPMSetBindings function in epan/dissectors/packet-mswsp.c in the MS-WSP dissector in Wireshark 2.0.x before 2.0.1 does not validate the column size, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet.
Near-miss passage: CVE-2015-7036. CWE: CWE-20. CVSS: 7.5. The fts3_tokenizer function in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a SQL command that triggers an API call with a crafted pointer value in the second argument.
Query: vulnerability: Mozilla Firefox before 41.0 does not properly restrict the availability of High Resolution Time API times, which allows remote attackers to track last-level cache access, and conse
Matching passage: CVE-2015-7327. CWE: CWE-200. CVSS: 4.300000190734863. Mozilla Firefox before 41.0 does not properly restrict the availability of High Resolution Time API times, which allows remote attackers to track last-level cache access, and consequently obtain sensitive information, via crafted JavaScript code that makes performance.now calls.
Near-miss passage: CVE-2015-0080. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly initialize memory for rendering of malformed PNG images, which allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Malformed PNG Parsing Information Disclosure Vulnerability."
Query: detect Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application in logs
Matching passage: Sigma rule: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application. Logsource: windows / file_event. Rule: title: New Custom Shim Database Created id: ee63c85c-6d51-4d12-ad09-04e25877a947 status: test description: 'Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.011/T1546.011.md#atomic-test-2---new-shim-database-files-created-in-the-default-shim-database-directory - https://www.mandiant.com/resources/blog/fin7-shim-databases-persistence - https://liberty-shell.com/sec/2020/02/25/shim-persistence/ - https://andreafortuna.org/2018/11/12/process-injection-and-persistence-using-application-shimming/ author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-12-29 modified: 2023-12-06 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.009 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: - :\Windows\apppatch\Custom\ - :\Windows\apppatch\CustomSDB\ condition: selection falsepositives: - Legitimate custom SHIM installations will also trigger this rule level: medium regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_creation_new_shim_database/info.yml
Near-miss passage: Sigma rule: The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows. Logsource: windows / process_creation. Rule: title: Arbitrary Shell Command Execution Via Settingcontent-Ms id: 24de4f3b-804c-4165-b442-5a06a2302c7e status: test description: The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries. references: - https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39 author: Sreeman date: 2020-03-13 modified: 2022-04-14 tags: - attack.t1204 - attack.t1566.001 - attack.execution - attack.initial-access logsource: category: process_creation product: windows detection: selection: CommandLine|contains: .SettingContent-ms filter: CommandLine|contains: immersivecontrolpanel condition: selection and not filter falsepositives: - Unknown level: medium
Query: indicators of Compromise Hardware Supply Chain
Matching passage: T1195.003 Compromise Hardware Supply Chain. Tactics: initial access. Description: Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system. Hardware backdoors may be inserted into various devices, such as servers, workstations, network infrastructure, or peripherals.
Near-miss passage: T1195.002 Compromise Software Supply Chain. Tactics: initial access. Description: Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version. Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.(Citation: Avast CCleaner3 2018)(Citation: Command Five SK 2011)
Query: alert when Detects Base64 encoded Shellcode
Matching passage: Sigma rule: Detects Base64 encoded Shellcode. Logsource: windows / ps_script. Rule: title: PowerShell ShellCode id: 16b37b70-6fcf-4814-a092-c36bd3aafcbd status: test description: Detects Base64 encoded Shellcode references: - https://twitter.com/cyb3rops/status/1063072865992523776 author: David Ledbetter (shellcode), Florian Roth (Nextron Systems) date: 2018-11-17 modified: 2024-01-25 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - OiCAAAAYInlM - OiJAAAAYInlM condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Identifies the creation of local users via the net.exe command.. Logsource: windows / process_creation. Rule: title: New User Created Via Net.EXE id: cd219ff3-fa99-45d4-8380-a7d15116c6dc related: - id: b9f0e6f5-09b4-4358-bae4-08408705bd5c type: similar status: test description: Identifies the creation of local users via the net.exe command. references: - https://eqllib.readthedocs.io/en/latest/analytics/014c3f51-89c6-40f1-ac9c-5688f26090ab.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.001/T1136.001.md author: Endgame, JHasenbusch (adapted to Sigma for oscd.community) date: 2018-10-30 modified: 2023-02-21 tags: - attack.persistence - attack.t1136.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: CommandLine|contains|all: - user - add condition: all of selection_* falsepositives: - Legitimate user creation. - Better use event IDs for user creation rather than command line rules. level: medium
Query: detect Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to loca in logs
Matching passage: Sigma rule: Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to loca. Logsource: windows / security. Rule: title: Potential Privilege Escalation via Local Kerberos Relay over LDAP id: 749c9f5e-b353-4b90-a9c1-05243357ca4b status: test description: 'Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account. This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges. ' references: - https://twitter.com/sbousseaden/status/1518976397364056071?s=12&t=qKO5eKHvWhAP19a50FTZ7g - https://github.com/elastic/detection-rules/blob/5fe7833312031a4787e07893e27e4ea7a7665745/rules/_deprecated/privilege_escalation_krbrelayup_suspicious_logon.toml#L38 author: Elastic, @SBousseaden date: 2022-04-27 modified: 2024-08-13 tags: - attack.privilege-escalation - attack.credential-access - attack.t1548 logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 3 AuthenticationPackageName: Kerberos IpAddress: 127.0.0.1 TargetUserSid|startswith: S-1-5-21- TargetUserSid|endswith: '-500' filter_main_ip_null: IpPort: '0' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of PktMon, a tool that captures network packets.. Logsource: windows / process_creation. Rule: title: PktMon.EXE Execution id: f956c7c1-0f60-4bc5-b7d7-b39ab3c08908 status: test description: Detects execution of PktMon, a tool that captures network packets. references: - https://lolbas-project.github.io/lolbas/Binaries/Pktmon/ author: frack113 date: 2022-03-17 modified: 2023-06-23 tags: - attack.discovery - attack.credential-access - attack.t1040 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \pktmon.exe - OriginalFileName: PktMon.exe condition: selection falsepositives: - Legitimate use level: medium
Query: risk of In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and
Matching passage: CVE-2015-9108. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, no address argument validation performed on calls to a QSEE syscall may lead to arbitrary read/write or NULL Pointer exception when calling a downstream function.
Near-miss passage: CVE-2015-3758. CWE: CWE-20. CVSS: 4.300000190734863. UIKit WebView in Apple iOS before 8.4.1 allows attackers to bypass an intended user-confirmation requirement and initiate arbitrary FaceTime calls via an app that provides a crafted URL.
Query: detect Detects process execution related exceptions in JVM based apps, often relates to RCE in logs
Matching passage: Sigma rule: Detects process execution related exceptions in JVM based apps, often relates to RCE. Logsource: jvm / application. Rule: title: Process Execution Error In JVM Based Application id: d65f37da-a26a-48f8-8159-3dde96680ad2 status: test description: Detects process execution related exceptions in JVM based apps, often relates to RCE references: - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs author: Moti Harmats date: 2023-02-11 tags: - attack.initial-access - attack.t1190 logsource: category: application product: jvm definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)' detection: keywords: - Cannot run program - java.lang.ProcessImpl - java.lang.ProcessBuilder condition: keywords falsepositives: - Application bugs level: high
Near-miss passage: Sigma rule: Detects when a new admin is created.. Logsource: azure / auditlogs. Rule: title: Privileged Account Creation id: f7b5b004-dece-46e4-a4a5-f6fd0e1c6947 status: test description: Detects when a new admin is created. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#changes-to-privileged-accounts author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Tim Shelton date: 2022-08-11 modified: 2022-08-16 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.stealth - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: properties.message|contains|all: - Add user - Add member to role Status: Success condition: selection falsepositives: - A legitimate new admin account being created level: medium
Query: detect Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems. UFW is a popular firewall management tool in logs
Matching passage: Sigma rule: Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems. UFW is a popular firewall management tool. Logsource: linux / process_creation. Rule: title: UFW Disable Attempt id: 84c9e83c-599a-458a-a0cb-0ecce44e807a status: test description: 'Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems. UFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules. Disabling UFW can leave a system vulnerable to attacks, as it may allow unauthorized access to network services and resources. ' references: - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144 - https://manpages.debian.org/unstable/ufw/ufw-framework.8.en.html - https://www.cyberciti.biz/faq/linux-disable-firewall-command/ author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-01-18 modified: 2026-05-04 tags: - attack.defense-impairment - attack.t1686 logsource: product: linux category: process_creation detection: selection_ufw_init: Image|endswith: /ufw-init CommandLine|contains: - ' force-stop' - ' stop' - ' flush' selection_ufw_disable: CommandLine|contains|all: - 'ufw ' - disable condition: 1 of selection_* falsepositives: - Legitimate actions by system administrators to disable UFW. level: medium
Near-miss passage: Sigma rule: Detects execution of Windows Problem Steps Recorder (psr.exe), a utility used to record the user screen and clicks.. Logsource: windows / process_creation. Rule: title: Screen Capture Activity Via Psr.EXE id: 2158f96f-43c2-43cb-952a-ab4580f32382 status: test description: Detects execution of Windows Problem Steps Recorder (psr.exe), a utility used to record the user screen and clicks. references: - https://lolbas-project.github.io/lolbas/Binaries/Psr/ - https://web.archive.org/web/20200229201156/https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1493861893.pdf - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md author: Beyu Denis, oscd.community date: 2019-10-12 modified: 2024-01-04 tags: - attack.collection - attack.t1113 logsource: category: process_creation product: windows detection: selection: Image|endswith: \Psr.exe CommandLine|contains: - /start - -start condition: selection falsepositives: - Unknown level: medium
Query: CWE for Binding to an Unrestricted IP Address
Matching passage: CWE-1327 Binding to an Unrestricted IP Address. The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.
Near-miss passage: CWE-266 Incorrect Privilege Assignment. A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.