alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects usage of powershell cmdlets to disable or remove ETW trace sessions
Matching passage: Sigma rule: Detects usage of powershell cmdlets to disable or remove ETW trace sessions. Logsource: windows / ps_script. Rule: title: Disable of ETW Trace - Powershell id: 115fdba9-f017-42e6-84cf-d5573bf2ddf8 related: - id: a238b5d0-ce2d-4414-a676-7a531b3d13d6 type: derived status: test description: Detects usage of powershell cmdlets to disable or remove ETW trace sessions references: - https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-28 modified: 2022-11-25 tags: - attack.stealth - attack.defense-impairment - attack.t1070 - attack.t1685 - car.2016-04-002 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_pwsh_remove: ScriptBlockText|contains: 'Remove-EtwTraceProvider ' selection_pwsh_set: ScriptBlockText|contains|all: - 'Set-EtwTraceProvider ' - '0x11' condition: 1 of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintex. Logsource: windows / registry_event. Rule: title: Security Support Provider (SSP) Added to LSA Configuration id: eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc status: test description: 'Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows. ' references: - https://powersploit.readthedocs.io/en/latest/Persistence/Install-SSP/ - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/data/module_source/persistence/Install-SSP.ps1#L157 author: iwillkeepwatch date: 2019-01-18 modified: 2026-03-30 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.005 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: - \Control\Lsa\Security Packages - \Control\Lsa\OSConfig\Security Packages filter_main_msiexec: Image: - C:\Windows\system32\msiexec.exe - C:\Windows\syswow64\MsiExec.exe filter_main_image_null: Image: null condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: describe CVE-2015-8988
Matching passage: CVE-2015-8988. CWE: CWE-77. CVSS: 8.800000190734863. Unquoted executable path vulnerability in Client Management and Gateway components in McAfee (now Intel Security) ePO Deep Command (eDC) 2.2 and 2.1 allows authenticated users to execute a command of their choice via dropping a malicious file for the path.
Near-miss passage: CVE-2015-1986. CWE: CWE-77. CVSS: 10.0. The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to execute arbitrary commands via unspecified vectors, a different vulnerability than CVE-2015-1938.
Query: what is T1554
Matching passage: T1554 Compromise Host Software Binary. Tactics: persistence. Description: Adversaries may modify host software binaries to establish persistent access to systems. Software binaries/executables provide a wide range of system commands or services, programs, and libraries. Common software binaries are SSH clients, FTP clients, email clients, web browsers, and many other user or server applications. Adversaries may establish persistence though modifications to host software binaries. For example, an adversary may replace or otherwise infect a legitimate application binary (or support files) with a backdoor. Since these binaries may be routinely executed by applications or the user, the adversary can leverage this for persistent access to the host. An adversary may also modify a software binary such as an SSH client in order to persistently collect credentials during logins (i.e., [Modify Authentication Process](https://attack.mitre.org/techniques/T1556)).(Citation: Google Cloud Mandiant UNC3886 2024) An adversary may also modify an existing binary by patching in malicious functionality (e.g., IAT Hooking/Entry point patching)(Citation: Unit42 Banking Trojans Hooking 2022) prior to the binary’s legitimate execution. For example, an adversary may modify the entry point of a binary to point to malicious code patched in by the adversary before resuming normal execution flow.(Citation: ESET FontOnLake Analysis 2021) After modifying a binary, an adversary may attempt to impair defenses by preventing it from updating (e.g., via the `yum-versionlock` command or `versionlock.list` file in Linux systems that use the yum package manager).(Citation: Google Cloud Mandiant UNC3886 2024)
Near-miss passage: T1037.001 Logon Script (Windows). Tactics: persistence, privilege escalation. Description: Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.(Citation: TechNet Logon Scripts) This is done via adding a path to a script to the <code>HKCU\Environment\UserInitMprLogonScript</code> Registry key.(Citation: Hexacorn Logon Scripts) Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
Query: execution using Source
Matching passage: T1153 Source. Tactics: execution. Description: **This technique has been deprecated and should no longer be used.** The <code>source</code> command loads functions into the current shell or executes files in the current context. This built-in command can be run in two different ways <code>source /path/to/filename [arguments]</code> or <code>.**This technique has been deprecated and should no longer be used.** /path/to/filename [arguments]</code>. Take note of the space after the ".". Without a space, a new shell is created that runs the program instead of running the program within the current context. This is often used to make certain features or functions available to a shell or to update a specific shell's environment.(Citation: Source Manual) Adversaries can abuse this functionality to execute programs. The file executed with this technique does not need to be marked executable beforehand.
Near-miss passage: T1648 Serverless Execution. Tactics: execution. Description: Adversaries may abuse serverless computing, integration, and automation services to execute arbitrary code in cloud environments. Many cloud providers offer a variety of serverless resources, including compute engines, application integration services, and web servers. Adversaries may abuse these resources in various ways as a means of executing arbitrary commands. For example, adversaries may use serverless functions to execute malicious code, such as crypto-mining malware (i.e. [Resource Hijacking](https://attack.mitre.org/techniques/T1496)).(Citation: Cado Security Denonia) Adversaries may also create functions that enable further compromise of the cloud environment. For example, an adversary may use the `IAM:PassRole` permission in AWS or the `iam.serviceAccounts.actAs` permission in Google Cloud to add [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) to a serverless cloud function, which may then be able to perform actions the original user cannot.(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Rhingo Security Labs GCP Privilege Escalation) Serverless functions can also be invoked in response to cloud events (i.e. [Event Triggered Execution](https://attack.mitre.org/techniques/T1546)), potentially enabling persistent execution over time. For example, in AWS environments, an adversary may create a Lambda function that automatically adds [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) to a user and a corresponding CloudWatch events rule that invokes that function whenever a new user is created.(Citation: Backdooring an AWS account) This is also possible in many cloud-based office application suites. For example, in Microsoft 365 environments, an adversary may create a Power Automate workflow that forwards all emails a user receives or creates anonymous sharing links whenever a user is granted access to a document in SharePoint.(Citation: Varonis Power Automate Data Exfiltration)(Citation: Mic
Query: describe CVE-2015-5427
Matching passage: CVE-2015-5427. CWE: UNKNOWN. CVSS: 7.5. HP Matrix Operating Environment before 7.5.0 allows remote attackers to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2015-5428 and CVE-2015-5429.
Near-miss passage: CVE-2015-1587. CWE: UNKNOWN. CVSS: 7.5. Unrestricted file upload vulnerability in file_to_index.php in Maarch LetterBox 2.8 and earlier and GEC/GED 1.4 and earlier allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a request to a predictable filename in tmp/.
Query: rule covering Detects well-known credential dumping tools execution via specific named pipe creation
Matching passage: Sigma rule: Detects well-known credential dumping tools execution via specific named pipe creation. Logsource: windows / pipe_created. Rule: title: HackTool - Credential Dumping Tools Named Pipe Created id: 961d0ba2-3eea-4303-a930-2cf78bbfcc5e status: test description: Detects well-known credential dumping tools execution via specific named pipe creation references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment - https://image.slidesharecdn.com/zeronights2017kheirkhabarov-171118103000/75/hunting-for-credentials-dumping-in-windows-environment-57-2048.jpg?cb=1666035799 author: Teymur Kheirkhabarov, oscd.community date: 2019-11-01 modified: 2023-08-07 tags: - attack.credential-access - attack.t1003.001 - attack.t1003.002 - attack.t1003.004 - attack.t1003.005 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName|contains: - \cachedump - \lsadump - \wceservicepipe condition: selection falsepositives: - Legitimate Administrator using tool for password recovery level: critical
Near-miss passage: Sigma rule: Detects execution of network scanning and reconnaisance tools. These tools can be used for the enumeration of local or r. Logsource: linux / process_creation. Rule: title: Linux Network Service Scanning Tools Execution id: 3e102cd9-a70d-4a7a-9508-403963092f31 status: test description: Detects execution of network scanning and reconnaisance tools. These tools can be used for the enumeration of local or remote network services for example. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md - https://github.com/projectdiscovery/naabu - https://github.com/Tib3rius/AutoRecon author: Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]) date: 2020-10-21 modified: 2024-09-19 tags: - attack.discovery - attack.t1046 logsource: category: process_creation product: linux detection: selection_netcat: Image|endswith: - /nc - /ncat - /netcat - /socat selection_network_scanning_tools: Image|endswith: - /autorecon - /hping - /hping2 - /hping3 - /naabu - /nmap - /nping - /telnet - /zenmap filter_main_netcat_listen_flag: CommandLine|contains: - ' --listen ' - ' -l ' condition: (selection_netcat and not filter_main_netcat_listen_flag) or selection_network_scanning_tools falsepositives: - Legitimate administration activities level: low
Query: detect Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and making network connections. in logs
Matching passage: Sigma rule: Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and making network connections.. Logsource: windows / network_connection. Rule: title: Potentially Suspicious Wuauclt Network Connection id: c649a6c7-cd8c-4a78-9c04-000fc76df954 status: test description: 'Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and making network connections. One could easily make the DLL spawn a new process and inject to it to proxy the network connection and bypass this rule. ' references: - https://dtm.uk/wuauclt/ author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-12 modified: 2024-03-12 tags: - attack.stealth - attack.t1218 logsource: category: network_connection product: windows definition: 'Requirements: The CommandLine field enrichment is required in order for this rule to be used.' detection: selection: Image|contains: wuauclt CommandLine|contains: ' /RunHandlerComServer' filter_main_ip: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 169.254.0.0/16 - 172.16.0.0/12 - 192.168.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 filter_main_msrange: DestinationIp|cidr: - 20.184.0.0/13 - 20.192.0.0/10 - 23.79.0.0/16 - 51.10.0.0/15 - 51.103.0.0/16 - 51.104.0.0/15 - 52.224.0.0/11 filter_main_uus: CommandLine|contains: - :\Windows\UUS\Packages\Preview\amd64\updatedeploy.dll /ClassId - :\Windows\UUS\amd64\UpdateDeploy.dll /ClassId filter_main_winsxs: CommandLine|contains|all: - :\Windows\WinSxS\ - '\UpdateDeploy.dll /ClassId ' filter_main_cli_null: CommandLine: null filter_main_cli_empty: CommandLine: '' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: User Added to an Administrator's Azure AD Role. Logsource: azure / auditlogs. Rule: title: User Added to an Administrator's Azure AD Role id: ebbeb024-5b1d-4e16-9c0c-917f86c708a7 status: test description: User Added to an Administrator's Azure AD Role references: - https://web.archive.org/web/20250904191633/https://m365internals.com/2021/07/13/what-ive-learned-from-doing-a-year-of-cloud-forensics-in-azure-ad/ - https://research.splunk.com/cloud/a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a/ - https://analyticsrules.exchange/analyticrules/2a09f8cb-deb7-4c40-b08b-9137667f1c0b/ - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory author: Raphaël CALVET, @MetallicHack date: 2021-10-04 modified: 2026-04-30 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.stealth - attack.t1098.003 - attack.t1078 logsource: product: azure service: auditlogs detection: selection: operationName: Add member to role properties.targetResources|contains: - Admins - Administrator condition: selection falsepositives: - PIM (Privileged Identity Management) generates this event each time 'eligible role' is enabled. level: medium
Query: describe CVE-2015-2726
Matching passage: CVE-2015-2726. CWE: CWE-119. CVSS: 10.0. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Near-miss passage: CVE-2015-2494. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486, CVE-2015-2487, CVE-2015-2490, CVE-2015-2492, CVE-2015-2498, and CVE-2015-2499.
Query: describe CVE-2015-1503
Matching passage: CVE-2015-1503. CWE: CWE-22. CVSS: 7.5. Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the file parameter to a webmail/client/skins/default/css/css.php page or .../. (dot dot dot slash dot) in the (2) script or (3) style parameter to webmail/old/calendar/minimizer/index.php.
Near-miss passage: CVE-2015-4704. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in the Download Zip Attachments plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the File parameter to download.php.
Query: rule covering Detects default install commands of the Triple Cross eBPF rootkit based on the "deployer.sh" script
Matching passage: Sigma rule: Detects default install commands of the Triple Cross eBPF rootkit based on the "deployer.sh" script. Logsource: linux / process_creation. Rule: title: Triple Cross eBPF Rootkit Install Commands id: 22236d75-d5a0-4287-bf06-c93b1770860f status: test description: Detects default install commands of the Triple Cross eBPF rootkit based on the "deployer.sh" script references: - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/apps/deployer.sh author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-05 tags: - attack.stealth - attack.t1014 logsource: category: process_creation product: linux detection: selection: Image|endswith: /sudo CommandLine|contains|all: - ' tc ' - ' enp0s3 ' CommandLine|contains: - ' qdisc ' - ' filter ' condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder. This driver is used by S. Logsource: windows / file_event. Rule: title: Suspicious PROCEXP152.sys File Created In TMP id: 3da70954-0f2c-4103-adff-b7440368f50e status: test description: 'Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder. This driver is used by Sysinternals Process Explorer but also by KDU (https://github.com/hfiref0x/KDU) or Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU. ' references: - https://web.archive.org/web/20230331181619/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/ author: xknow (@xknow_infosec), xorxes (@xor_xes) date: 2019-04-08 modified: 2026-06-29 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \AppData\Local\Temp\ TargetFilename|endswith: PROCEXP152.sys filter: Image|contains: - \procexp64.exe - \procexp64a.exe - \procexp.exe - \procmon64.exe - \procmon64a.exe - \procmon.exe condition: selection and not filter falsepositives: - Other legimate tools using this driver and filename (like Sysinternals). Note - Clever attackers may easily bypass this detection by just renaming the driver filename. Therefore just Medium-level and don't rely on it. level: medium
Query: Multiple failed authentications followed by Network Device Authentication
Matching passage: T1556.004 Network Device Authentication. Tactics: defense impairment, persistence, credential access. Description: Adversaries may use [Patch System Image](https://attack.mitre.org/techniques/T1601/001) to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices. [Modify System Image](https://attack.mitre.org/techniques/T1601) may include implanted code to the operating system for network devices to provide access for adversaries using a specific password. The modification includes a specific password which is implanted in the operating system image via the patch. Upon authentication attempts, the inserted code will first check to see if the user input is the password. If so, access is granted. Otherwise, the implanted code will pass the credentials on for verification of potentially valid credentials.(Citation: Mandiant - Synful Knock)
Near-miss passage: T1556.003 Pluggable Authentication Modules. Tactics: defense impairment, persistence, credential access. Description: Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is <code>pam_unix.so</code>, which retrieves, sets, and verifies account authentication information in <code>/etc/passwd</code> and <code>/etc/shadow</code>.(Citation: Apple PAM)(Citation: Man Pam_Unix)(Citation: Red Hat PAM) Adversaries may modify components of the PAM system to create backdoors. PAM components, such as <code>pam_unix.so</code>, can be patched to accept arbitrary adversary supplied values as legitimate credentials.(Citation: PAM Backdoor) Malicious modifications to the PAM system may also be abused to steal credentials. Adversaries may infect PAM resources with code to harvest user credentials, since the values exchanged with PAM components may be plain-text since PAM does not store passwords.(Citation: PAM Creds)(Citation: Apple PAM)
Query: SOC runbook when seeing Outbound C2 pattern associated with Client Configurations
Matching passage: Playbook for T1592.004 Client Configurations. 1) Validate alert telemetry against T1592.004. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: reconnaissance. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may gather information about the victim's client configurations that can be used during targeting. Information about client configurations may include a variety of details and settings, including operating system/version, virtualization, architecture (ex: 32 or 64 bit), language, and/or time zone. Adversaries may gather this information in various ways, such as direct collection action
Near-miss passage: Playbook for T1592.002 Software. Different response path focused on reconnaissance.
Query: CVE similar to CVE-2015-5602
Matching passage: CVE-2015-5602. CWE: CWE-264. CVSS: 7.199999809265137. sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by "/home/*/*/file.txt."
Near-miss passage: CVE-2015-4304. CWE: CWE-264. CVSS: 9.0. The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended access restrictions, and create administrative accounts or read data from arbitrary tenant domains, via a crafted URL, aka Bug IDs CSCus62671 and CSCus62652.