alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Suspicious Break Process Trees execution detected on endpoint
Matching passage: T1036.009 Break Process Trees. Tactics: stealth. Description: An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID). If endpoint protection software leverages the “parent-child" relationship for detection, breaking this relationship could result in the adversary’s behavior not being associated with previous process tree activity. On Unix-based systems breaking this process tree is common practice for administrators to execute software using scripts and programs.(Citation: 3OHA double-fork 2022) On Linux systems, adversaries may execute a series of [Native API](https://attack.mitre.org/techniques/T1106) calls to alter malware's process tree. For example, adversaries can execute their payload without any arguments, call the `fork()` API call twice, then have the parent process exit. This creates a grandchild process with no parent process that is immediately adopted by the `init` system process (PID 1), which successfully disconnects the execution of the adversary's payload from its previous process tree. Another example is using the “daemon” syscall to detach from the current parent process and run in the background.(Citation: Sandfly BPFDoor 2022)(Citation: Microsoft XorDdos Linux Stealth 2022)
Near-miss passage: T1036.007 Double File Extension. Tactics: stealth. Description: Adversaries may abuse a double extension in the filename as a means of masquerading the true file type. A file name may include a secondary file type extension that may cause only the first extension to be displayed (ex: <code>File.txt.exe</code> may render in some views as just <code>File.txt</code>). However, the second extension is the true file type that determines how the file is opened and executed. The real file extension may be hidden by the operating system in the file browser (ex: explorer.exe), as well as in any software configured using or similar to the system’s policies.(Citation: PCMag DoubleExtension)(Citation: SOCPrime DoubleExtension) Adversaries may abuse double extensions to attempt to conceal dangerous file types of payloads. A very common usage involves tricking a user into opening what they think is a benign file type but is actually executable code. Such files often pose as email attachments and allow an adversary to gain [Initial Access](https://attack.mitre.org/tactics/TA0001) into a user’s system via [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) then [User Execution](https://attack.mitre.org/techniques/T1204). For example, an executable file attachment named <code>Evil.txt.exe</code> may display as <code>Evil.txt</code> to a user. The user may then view it as a benign text file and open it, inadvertently executing the hidden malware.(Citation: SOCPrime DoubleExtension) Common file types, such as text files (.txt, .doc, etc.) and image files (.jpg, .gif, etc.) are typically used as the first extension to appear benign. Executable extensions commonly regarded as dangerous, such as .exe, .lnk, .hta, and .scr, often appear as the second extension and true file type.
Query: exploit Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence MSE 8000 devices allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu9044
Matching passage: CVE-2015-4258. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence MSE 8000 devices allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu90444.
Near-miss passage: CVE-2015-10001. CWE: CWE-352. CVSS: 4.300000190734863. The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads
Query: describe CVE-2015-5107
Matching passage: CVE-2015-5107. CWE: CWE-200. CVSS: 4.300000190734863. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-7836. CWE: CWE-200. CVSS: 3.299999952316284. Siemens RUGGEDCOM ROS before 4.2.1 allows remote attackers to obtain sensitive information by sniffing the network for VLAN data within the padding section of an Ethernet frame.
Query: alert when Detects when an account dumps the LAPS password from Entra ID.
Matching passage: Sigma rule: Detects when an account dumps the LAPS password from Entra ID.. Logsource: azure / auditlogs. Rule: title: Windows LAPS Credential Dump From Entra ID id: a4b25073-8947-489c-a8dd-93b41c23f26d status: test description: Detects when an account dumps the LAPS password from Entra ID. references: - https://twitter.com/NathanMcNulty/status/1785051227568632263 - https://www.cloudcoffee.ch/microsoft-365/configure-windows-laps-in-microsoft-intune/ - https://techcommunity.microsoft.com/t5/microsoft-entra-blog/introducing-windows-local-administrator-password-solution-with/ba-p/1942487 author: andrewdanis date: 2024-06-26 tags: - attack.privilege-escalation - attack.persistence - attack.t1098.005 logsource: product: azure service: auditlogs detection: selection: category: Device activityType|contains: Recover device local administrator password additionalDetails.additionalInfo|contains: Successfully recovered local credential by device id condition: selection falsepositives: - Approved activity performed by an Administrator. level: high
Near-miss passage: Sigma rule: Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account. This c. Logsource: windows / network_connection. Rule: title: Potential Remote PowerShell Session Initiated id: c539afac-c12a-46ed-b1bd-5a5567c9f045 status: test description: 'Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account. This could potentially indicates a remote PowerShell connection. ' references: - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-09-12 modified: 2024-02-02 tags: - attack.execution - attack.t1059.001 - attack.lateral-movement - attack.t1021.006 logsource: category: network_connection product: windows detection: selection: DestinationPort: - 5985 - 5986 Initiated: 'true' SourceIsIpv6: 'false' filter_main_service_users: - User|contains: - NETWORK SERVICE - NETZWERKDIENST - SERVICIO DE RED - SERVIZIO DI RETE - User|contains|all: - SERVICE R - SEAU filter_main_localhost: SourceIp: - ::1 - 127.0.0.1 DestinationIp: - ::1 - 127.0.0.1 filter_optional_avast: Image: - C:\Program Files\Avast Software\Avast\AvastSvc.exe - C:\Program Files (x86)\Avast Software\Avast\AvastSvc.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate usage of remote PowerShell, e.g. remote administration and monitoring. - Network Service user name of a not-covered localization level: high
Query: detect Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintex in logs
Matching passage: Sigma rule: Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintex. Logsource: windows / registry_event. Rule: title: Security Support Provider (SSP) Added to LSA Configuration id: eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc status: test description: 'Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows. ' references: - https://powersploit.readthedocs.io/en/latest/Persistence/Install-SSP/ - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/data/module_source/persistence/Install-SSP.ps1#L157 author: iwillkeepwatch date: 2019-01-18 modified: 2026-03-30 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.005 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: - \Control\Lsa\Security Packages - \Control\Lsa\OSConfig\Security Packages filter_main_msiexec: Image: - C:\Windows\system32\msiexec.exe - C:\Windows\syswow64\MsiExec.exe filter_main_image_null: Image: null condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects MSI package installation from suspicious locations. Logsource: windows / application. Rule: title: MSI Installation From Suspicious Locations id: c7c8aa1c-5aff-408e-828b-998e3620b341 status: test description: Detects MSI package installation from suspicious locations references: - https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-31 modified: 2023-10-23 tags: - attack.execution logsource: product: windows service: application detection: selection: Provider_Name: MsiInstaller EventID: - 1040 - 1042 Data|contains: - :\Windows\TEMP\ - \\\\ - \Desktop\ - \PerfLogs\ - \Users\Public\ filter_winget: Data|contains: \AppData\Local\Temp\WinGet\ filter_updhealthtools: Data|contains: C:\Windows\TEMP\UpdHealthTools.msi condition: selection and not 1 of filter_* falsepositives: - False positives may occur if you allow installation from folders such as the desktop, the public folder or remote shares. A baseline is required before production use. level: medium
Query: patch priority for CVE-2015-3385
Matching passage: CVE-2015-3385. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Taxonomy Path module before 7.x-1.2 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the "Link to path" field formatter.
Near-miss passage: CVE-2015-10021. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in ritterim definely. It has been classified as problematic. Affected is an unknown function of the file src/database.js. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is b31a022ba4d8d17148445a13ebb5a42ad593dbaa. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217608.
Query: detect Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux syste in logs
Matching passage: Sigma rule: Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux syste. Logsource: linux / process_creation. Rule: title: Disable Or Stop Services id: de25eeb8-3655-4643-ac3a-b662d3f26b6b status: test description: 'Detects the usage of utilities such as ''systemctl'', ''service''...etc to stop or disable tools and services on Linux systems. Attackers may stop or disable security tools and services to evade detection, maintain persistence, or disrupt system operations. ' references: - https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-15 modified: 2025-03-18 tags: - attack.defense-impairment - attack.t1685 - attack.impact - attack.t1489 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /service - /systemctl - /chkconfig CommandLine|contains: - ' stop ' - ' disable ' filter_main_legit_snapd: Image|endswith: /systemctl CommandLine|contains: - --no-reload disable snap-snapd- - ' stop snap-snapd-' filter_main_ssh_preinstall: Image|endswith: /systemctl ParentCommandLine|contains: tmp.ci/preinst upgrade CommandLine|contains|all: - ' stop ' - ssh. filter_main_ubuntu_upgrade: ParentCommandLine|contains: /dpkg/info/ubuntu-pro-client.prerm upgrade Image|endswith: /systemctl filter_optional_aws_agent: Image|endswith: /systemctl CommandLine|endswith: snap.amazon-ssm-agent.amazon-ssm-agent.service condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate administration activities - Some false positives are to be expected. Apply additional filters as needed before pushing to production. level: medium
Near-miss passage: Sigma rule: Detects function calls from the EditionUpgradeManager COM interface. Which is an interface that is not used by standard. Logsource: windows / process_access. Rule: title: Function Call From Undocumented COM Interface EditionUpgradeManager id: fb3722e4-1a06-46b6-b772-253e2e7db933 status: test description: Detects function calls from the EditionUpgradeManager COM interface. Which is an interface that is not used by standard executables. references: - https://www.snip2code.com/Snippet/4397378/UAC-bypass-using-EditionUpgradeManager-C/ - https://gist.github.com/hfiref0x/de9c83966623236f5ebf8d9ae2407611 author: oscd.community, Dmitry Uchakin date: 2020-10-07 modified: 2023-11-30 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_access product: windows detection: selection: CallTrace|contains: editionupgrademanagerobj.dll condition: selection falsepositives: - Unknown level: medium
Query: describe CVE-2015-4068
Matching passage: CVE-2015-4068. CWE: CWE-22. CVSS: 9.100000381469727. Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denial of service via a crafted file path to the (1) reportFileServlet or (2) exportServlet servlet.
Near-miss passage: CVE-2015-1386. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in unshield 1.0-1.
Query: exploit SQL injection vulnerability in Persian Car CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to the default URI.
Matching passage: CVE-2015-4678. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Persian Car CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to the default URI.
Near-miss passage: CVE-2015-6659. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment.
Query: explain T1069 Permission Groups Discovery
Matching passage: T1069 Permission Groups Discovery. Tactics: discovery. Description: Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions. Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.(Citation: CrowdStrike BloodHound April 2018)
Near-miss passage: T1069.002 Domain Groups. Tactics: discovery. Description: Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators. Commands such as <code>net group /domain</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscacheutil -q group</code> on macOS, and <code>ldapsearch</code> on Linux can list domain-level groups.
Query: SOC alert related to Redundant Access
Matching passage: T1108 Redundant Access. Tactics: stealth, persistence. Description: **This technique has been deprecated. Please use [Create Account](https://attack.mitre.org/techniques/T1136), [Web Shell](https://attack.mitre.org/techniques/T1505/003), and [External Remote Services](https://attack.mitre.org/techniques/T1133) where appropriate.** Adversaries may use more than one remote access tool with varying command and control protocols or credentialed access to remote services so they can maintain access if an access mechanism is detected or mitigated. If one type of tool is detected and blocked or removed as a response but the organization did not gain a full understanding of the adversary's tools and access, then the adversary will be able to retain access to the network. Adversaries may also attempt to gain access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) to use [External Remote Services](https://attack.mitre.org/techniques/T1133) such as external VPNs as a way to maintain access despite interruptions to remote access tools deployed within a target network.(Citation: Mandiant APT1) Adversaries may also retain access through cloud-based infrastructure and applications. Use of a [Web Shell](https://attack.mitre.org/techniques/T1100) is one such way to maintain access to a network through an externally accessible Web server.
Near-miss passage: T1137.004 Outlook Home Page. Tactics: persistence. Description: Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system. Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders. This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened. A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page.(Citation: SensePost Outlook Home Page) Once malicious home pages have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious Home Pages will execute when the right Outlook folder is loaded/reloaded.(Citation: SensePost Outlook Home Page)
Query: SIEM correlation: impact activity consistent with Email Bombing
Matching passage: T1667 Email Bombing. Tactics: impact. Description: Adversaries may flood targeted email addresses with an overwhelming volume of messages. This may bury legitimate emails in a flood of spam and disrupt business operations.(Citation: sophos-bombing)(Citation: krebs-email-bombing) An adversary may accomplish email bombing by leveraging an automated bot to register a targeted address for e-mail lists that do not validate new signups, such as online newsletters. The result can be a wave of thousands of e-mails that effectively overloads the victim’s inbox.(Citation: krebs-email-bombing)(Citation: hhs-email-bombing) By sending hundreds or thousands of e-mails in quick succession, adversaries may successfully divert attention away from and bury legitimate messages including security alerts, daily business processes like help desk tickets and client correspondence, or ongoing scams.(Citation: hhs-email-bombing) This behavior can also be used as a tool of harassment.(Citation: krebs-email-bombing) This behavior may be a precursor for [Spearphishing Voice](https://attack.mitre.org/techniques/T1566/004). For example, an adversary may email bomb a target and then follow up with a phone call to fraudulently offer assistance. This social engineering may lead to the use of [Remote Access Software](https://attack.mitre.org/techniques/T1663) to steal credentials, deploy ransomware, conduct [Financial Theft](https://attack.mitre.org/techniques/T1657)(Citation: sophos-bombing), or engage in other malicious activity.(Citation: rapid7-email-bombing)
Near-miss passage: T1531 Account Access Removal. Tactics: impact. Description: Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials, revoked permissions for SaaS platforms such as Sharepoint) to remove access to accounts.(Citation: Obsidian Security SaaS Ransomware June 2023) Adversaries may also subsequently log off and/or perform a [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to set malicious changes into place.(Citation: CarbonBlack LockerGoga 2019)(Citation: Unit42 LockerGoga 2019) In Windows, [Net](https://attack.mitre.org/software/S0039) utility, <code>Set-LocalUser</code> and <code>Set-ADAccountPassword</code> [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets may be used by adversaries to modify user accounts. Accounts could also be disabled by Group Policy. In Linux, the <code>passwd</code> utility may be used to change passwords. On ESXi servers, accounts can be removed or modified via esxcli (`system account set`, `system account remove`). Adversaries who use ransomware or similar attacks may first perform this and other Impact behaviors, such as [Data Destruction](https://attack.mitre.org/techniques/T1485) and [Defacement](https://attack.mitre.org/techniques/T1491), in order to impede incident response/recovery before completing the [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) objective.
Query: exploit A vulnerability was found in VictorFerraresi pokemon-database-php. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation le
Matching passage: CVE-2015-10064. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in VictorFerraresi pokemon-database-php. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The patch is named dd0e1e6cdf648d6a3deff441f515bcb1d7573d68. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218455.
Near-miss passage: CVE-2015-4654. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the EQ Event Calendar component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to eqfullevent.
Query: describe CVE-2015-6861
Matching passage: CVE-2015-6861. CWE: CWE-264. CVSS: 7.5. HPE Helion Eucalyptus 3.4.0 through 4.2.0 allows remote authenticated users to bypass an intended AssumeRole permission requirement and assume an IAM role by leveraging a policy setting for a user's account.
Near-miss passage: CVE-2015-0054. CWE: CWE-264. CVSS: 4.300000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."