alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Outbound C2 pattern associated with Modify Registry
Matching passage: T1112 Modify Registry. Tactics: defense impairment, persistence. Description: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution. Access to specific areas of the Registry depends on account permissions, with some keys requiring administrator-level access. The built-in Windows command-line utility [Reg](https://attack.mitre.org/software/S0075) may be used for local or remote Registry modification.(Citation: Microsoft Reg) Other tools, such as remote access tools, may also contain functionality to interact with the Registry through the Windows API. The Registry may be modified in order to hide configuration information or malicious payloads via [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027).(Citation: Unit42 BabyShark Feb 2019)(Citation: Avaddon Ransomware 2021)(Citation: Microsoft BlackCat Jun 2022)(Citation: CISA Russian Gov Critical Infra 2018) The Registry may also be modified to impair defenses, such as by enabling macros for all Microsoft Office products, allowing privilege escalation without alerting the user, increasing the maximum number of allowed outbound requests, and/or modifying systems to store plaintext credentials in memory.(Citation: CISA LockBit 2023)(Citation: Unit42 BabyShark Feb 2019) The Registry of a remote system may be modified to aid in execution of files as part of lateral movement. It requires the remote Registry service to be running on the target system.(Citation: Microsoft Remote) Often [Valid Accounts](https://attack.mitre.org/techniques/T1078) are required, along with access to the remote system's [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) for RPC communication. Finally, Registry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via [Reg](https://attack.mitre.org/software/S0075) or other utilities using the Win32 API.(Citation: Microsoft Reghide NOV 2
Near-miss passage: T1205.001 Port Knocking. Tactics: stealth, persistence, command and control. Description: Adversaries may use port knocking to hide open ports used for persistence or command and control. To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports. After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software. This technique has been observed both for the dynamic opening of a listening port as well as the initiating of a connection to a listening server on a different system. The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects a suspicious or uncommon parent processes of PowerShell. Logsource: windows / process_creation. Rule: title: Suspicious PowerShell Parent Process id: 754ed792-634f-40ae-b3bc-e0448d33f695 related: - id: 692f0bec-83ba-4d04-af7e-e884a96059b6 type: derived status: test description: Detects a suspicious or uncommon parent processes of PowerShell references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=26 author: Teymur Kheirkhabarov, Harish Segar date: 2020-03-20 modified: 2023-02-04 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_parent: - ParentImage|contains: tomcat - ParentImage|endswith: - \amigo.exe - \browser.exe - \chrome.exe - \firefox.exe - \httpd.exe - \iexplore.exe - \jbosssvc.exe - \microsoftedge.exe - \microsoftedgecp.exe - \MicrosoftEdgeSH.exe - \mshta.exe - \nginx.exe - \outlook.exe - \php-cgi.exe - \regsvr32.exe - \rundll32.exe - \safari.exe - \services.exe - \sqlagent.exe - \sqlserver.exe - \sqlservr.exe - \vivaldi.exe - \w3wp.exe selection_powershell: - Image|endswith: - \powershell.exe - \pwsh.exe - CommandLine|contains: - /c powershell - /c pwsh - Description: Windows PowerShell - Product: PowerShell Core 6 - OriginalFileName: - PowerShell.EXE - pwsh.dll condition: all of selection_* falsepositives: - Other scripts level: high
Near-miss passage: Sigma rule: Detects a suspicious CertReq execution downloading a file. This behavior is often used by attackers to download addition. Logsource: windows / process_creation. Rule: title: Suspicious CertReq Command to Download id: 4480827a-9799-4232-b2c4-ccc6c4e9e12b status: experimental description: 'Detects a suspicious CertReq execution downloading a file. This behavior is often used by attackers to download additional payloads or configuration files. Certreq is a built-in Windows utility used to request and retrieve certificates from a certification authority (CA). However, it can be abused by threat actors for malicious purposes. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Certreq/ author: Christian Burkard (Nextron Systems) date: 2021-11-24 modified: 2025-10-29 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certreq.exe - OriginalFileName: CertReq.exe selection_cli_flag_post: CommandLine|contains|windash: -Post selection_cli_flag_config: CommandLine|contains|windash: -config selection_cli_http: CommandLine|contains: http condition: all of selection_* falsepositives: - Unlikely level: high
Query: describe CVE-2015-5692
Matching passage: CVE-2015-5692. CWE: CWE-264. CVSS: 7.900000095367432. admin_messages.php in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary code by uploading a file with a safe extension and content type, and then leveraging an improper Sudo configuration to make this a setuid-root file.
Near-miss passage: CVE-2015-3379. CWE: CWE-264. CVSS: 4.0. The Views module before 6.x-2.18, 6.x-3.x before 6.x-3.2, and 7.x-3.x before 7.x-3.10 for Drupal does not properly restrict access to the default views configurations, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
Query: Outbound C2 pattern associated with Security Software Discovery
Matching passage: T1518.001 Security Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Example commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), <code>reg query</code> with [Reg](https://attack.mitre.org/software/S0075), <code>dir</code> with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software. Adversaries may also utilize the [Cloud API](https://attack.mitre.org/techniques/T1059/009) to discover cloud-native security software installed on compute infrastructure, such as the AWS CloudWatch agent, Azure VM Agent, and Google Cloud Monitor agent. These agents may collect metrics and logs from the VM, which may be centrally aggregated in a cloud-based monitoring platform.
Near-miss passage: T1518.002 Backup Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of backup software or configurations that are installed on a system. Adversaries may use this information to shape follow-on behaviors, such as [Data Destruction](https://attack.mitre.org/techniques/T1485), [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486). Commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), `reg query` with [Reg](https://attack.mitre.org/software/S0075), `dir` with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for, such as Veeam, Acronis, Dropbox, or Paragon.(Citation: Symantec Play Ransomware 2023)
Query: exploit Cross-site scripting (XSS) vulnerability in the administration interface in the Path Breadcrumbs module 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the
Matching passage: CVE-2015-6754. CWE: CWE-79. CVSS: 2.0999999046325684. Cross-site scripting (XSS) vulnerability in the administration interface in the Path Breadcrumbs module 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "Administer Path Breadcrumbs" permission to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-4392. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Display Suite module 7.x-2.7 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to field display settings.
Query: Multiple failed authentications followed by Data Obfuscation
Matching passage: T1001 Data Obfuscation. Tactics: command and control. Description: Adversaries may obfuscate command and control traffic to make it more difficult to detect.(Citation: Bitdefender FunnyDream Campaign November 2020) Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Near-miss passage: T1001.002 Steganography. Tactics: command and control. Description: Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.
Query: collection using Automated Collection
Matching passage: T1119 Automated Collection. Tactics: collection. Description: Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals. In cloud-based environments, adversaries may also use cloud APIs, data pipelines, command line interfaces, or extract, transform, and load (ETL) services to automatically collect data.(Citation: Mandiant UNC3944 SMS Phishing 2023) This functionality could also be built into remote access tools. This technique may incorporate use of other techniques such as [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) and [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570) to identify and move files, as well as [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538) and [Cloud Storage Object Discovery](https://attack.mitre.org/techniques/T1619) to identify resources in cloud environments.
Near-miss passage: T1056.004 Credential API Hooking. Tactics: collection, credential access. Description: Adversaries may hook into Windows application programming interface (API) functions and Linux system functions to collect user credentials. Malicious hooking mechanisms may capture API or function calls that include parameters that reveal user authentication credentials.(Citation: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017) Unlike [Keylogging](https://attack.mitre.org/techniques/T1056/001), this technique focuses specifically on API functions that include parameters that reveal user credentials. In Windows, hooking involves redirecting calls to these functions and can be implemented via: * **Hooks procedures**, which intercept and execute designated code in response to events such as messages, keystrokes, and mouse inputs.(Citation: Microsoft Hook Overview)(Citation: Elastic Process Injection July 2017) * **Import address table (IAT) hooking**, which use modifications to a process’s IAT, where pointers to imported API functions are stored.(Citation: Elastic Process Injection July 2017)(Citation: Adlice Software IAT Hooks Oct 2014)(Citation: MWRInfoSecurity Dynamic Hooking 2015) * **Inline hooking**, which overwrites the first bytes in an API function to redirect code flow.(Citation: Elastic Process Injection July 2017)(Citation: HighTech Bridge Inline Hooking Sept 2011)(Citation: MWRInfoSecurity Dynamic Hooking 2015) In Linux and macOS, adversaries may hook into system functions via the `LD_PRELOAD` (Linux) or `DYLD_INSERT_LIBRARIES` (macOS) environment variables, which enables loading shared libraries into a program’s address space. For example, an adversary may capture credentials by hooking into the `libc read` function leveraged by SSH or SCP.(Citation: Intezer Symbiote 2022)
Query: describe CVE-2015-6127
Matching passage: CVE-2015-6127. CWE: CWE-200. CVSS: 4.300000190734863. Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows remote attackers to read arbitrary files via a crafted .mcl file, aka "Windows Media Center Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-6671. CWE: CWE-200. CVSS: 5.900000095367432. Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup.
Query: patch priority for CVE-2015-1864
Matching passage: CVE-2015-1864. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in the administration pages in Kallithea before 0.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) first name or (2) last name user details, or the (3) repository, (4) repository group, or (5) user group description.
Near-miss passage: CVE-2015-4063. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the where1 parameter in the nsp_search page to wp-admin/admin.php.
Query: SOC runbook when seeing SIEM correlation: command and control activity consistent with External Proxy
Matching passage: Playbook for T1090.002 External Proxy. 1) Validate alert telemetry against T1090.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: command and control. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries u
Near-miss passage: Playbook for T1090 Proxy. Different response path focused on command and control.
Query: describe CVE-2015-9452
Matching passage: CVE-2015-9452. CWE: CWE-89. CVSS: 9.800000190734863. The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nex_forms_Id parameter.
Near-miss passage: CVE-2015-1013. CWE: CWE-89. CVSS: 6.5. OSIsoft PI AF 2.6 and 2.7 and PI SQL for AF 2.1.2.19 do not ensure that the PI SQL (AF) Trusted Users group lacks the Everyone account, which allows remote authenticated users to bypass intended command restrictions via SQL statements.
Query: detection rule: Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity
Matching passage: Sigma rule: Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity. Logsource: windows / ps_script. Rule: title: Suspicious TCP Tunnel Via PowerShell Script id: bd33d2aa-497e-4651-9893-5c5364646595 status: test description: Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity references: - https://github.com/Arno0x/PowerShellScripts/blob/a6b7d5490fbf0b20f91195838f3a11156724b4f7/proxyTunnel.ps1 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-08 tags: - attack.command-and-control - attack.t1090 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - '[System.Net.HttpWebRequest]' - System.Net.Sockets.TcpListener - AcceptTcpClient condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects a suspicious CertReq execution downloading a file. This behavior is often used by attackers to download addition. Logsource: windows / process_creation. Rule: title: Suspicious CertReq Command to Download id: 4480827a-9799-4232-b2c4-ccc6c4e9e12b status: experimental description: 'Detects a suspicious CertReq execution downloading a file. This behavior is often used by attackers to download additional payloads or configuration files. Certreq is a built-in Windows utility used to request and retrieve certificates from a certification authority (CA). However, it can be abused by threat actors for malicious purposes. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Certreq/ author: Christian Burkard (Nextron Systems) date: 2021-11-24 modified: 2025-10-29 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certreq.exe - OriginalFileName: CertReq.exe selection_cli_flag_post: CommandLine|contains|windash: -Post selection_cli_flag_config: CommandLine|contains|windash: -config selection_cli_http: CommandLine|contains: http condition: all of selection_* falsepositives: - Unlikely level: high
Query: exploit Multiple unspecified vulnerabilities in Google Chrome before 47.0.2526.73 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Matching passage: CVE-2015-6787. CWE: UNKNOWN. CVSS: 10.0. Multiple unspecified vulnerabilities in Google Chrome before 47.0.2526.73 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Near-miss passage: CVE-2015-1245. CWE: UNKNOWN. CVSS: 6.800000190734863. Use-after-free vulnerability in the OpenPDFInReaderView::Update function in browser/ui/views/location_bar/open_pdf_in_reader_view.cc in Google Chrome before 41.0.2272.76 might allow user-assisted remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by triggering interaction with a PDFium "Open PDF in Reader" button that has an invalid tab association.
Query: weakness Cleartext Storage of Sensitive Information in Executable
Matching passage: CWE-318 Cleartext Storage of Sensitive Information in Executable. The product stores sensitive information in cleartext in an executable.
Near-miss passage: CWE-636 Not Failing Securely ('Failing Open'). When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
Query: Sigma rule for Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)
Matching passage: Sigma rule: Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36). Logsource: windows / process_creation. Rule: title: UAC Bypass Using NTFS Reparse Point - Process id: 39ed3c80-e6a1-431b-9df3-911ac53d08a7 status: test description: Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection1: CommandLine|startswith: '"C:\Windows\system32\wusa.exe" /quiet C:\Users\' CommandLine|endswith: \AppData\Local\Temp\update.msu IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 selection2: ParentCommandLine: '"C:\Windows\system32\dism.exe" /online /quiet /norestart /add-package /packagepath:"C:\Windows\system32\pe386" /ignorecheck' IntegrityLevel: - High - System CommandLine|contains|all: - C:\Users\ - \AppData\Local\Temp\ - \dismhost.exe { Image|endswith: \DismHost.exe condition: 1 of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects incoming connections to AnyDesk. This could indicate a potential remote attacker trying to connect to a listenin. Logsource: windows / network_connection. Rule: title: Remote Access Tool - AnyDesk Incoming Connection id: d58ba5c6-0ed7-4b9d-a433-6878379efda9 status: experimental description: 'Detects incoming connections to AnyDesk. This could indicate a potential remote attacker trying to connect to a listening instance of AnyDesk and use it as potential command and control channel. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows - https://asec.ahnlab.com/en/40263/ author: '@d4ns4n_ (Wuerth-Phoenix)' date: 2024-09-02 modified: 2025-02-24 tags: - attack.persistence - attack.command-and-control - attack.t1219.002 logsource: category: network_connection product: windows detection: selection: Image|endswith: - \AnyDesk.exe - \AnyDeskMSI.exe Initiated: 'false' condition: selection falsepositives: - Legitimate incoming connections (e.g. sysadmin activity). Most of the time I would expect outgoing connections (initiated locally). level: medium
Query: exploit Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality, integrity, and availability via vectors related to Kernel Zones virtualized NIC d
Matching passage: CVE-2015-4817. CWE: UNKNOWN. CVSS: 6.199999809265137. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality, integrity, and availability via vectors related to Kernel Zones virtualized NIC driver.
Near-miss passage: CVE-2015-2118. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Secure Pull Print and Security Pull Print components in HP Access Control (AC) Software 12.x through 14.x before 14.1.2 allows remote authenticated users to obtain sensitive information via unknown vectors.