alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects the setting of the environement variable "windir" to a non default value. Attackers often abuse this variable in
Matching passage: Sigma rule: Detects the setting of the environement variable "windir" to a non default value. Attackers often abuse this variable in. Logsource: windows / registry_set. Rule: title: Bypass UAC Using SilentCleanup Task id: 724ea201-6514-4f38-9739-e5973c34f49a status: test description: 'Detects the setting of the environement variable "windir" to a non default value. Attackers often abuse this variable in order to trigger a UAC bypass via the "SilentCleanup" task. The SilentCleanup task located in %windir%\system32\cleanmgr.exe is an auto-elevated task that can be abused to elevate any file with administrator privileges without prompting UAC. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-9---bypass-uac-using-silentcleanup-task - https://www.reddit.com/r/hacking/comments/ajtrws/bypassing_highest_uac_level_windows_810/ - https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign author: frack113, Nextron Systems date: 2022-01-06 modified: 2024-01-30 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Environment\windir filter_main_default: Details: '%SystemRoot%' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_bypass_uac_using_silentcleanup_task/info.yml simulation: - type: atomic-red-team name: Bypass UAC using SilentCleanup Task technique: T1548.002 atomic_guid: 28104f8a-4ff1-4582-bcf6-699dce156608
Near-miss passage: Sigma rule: Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\. Logsource: windows / file_event. Rule: title: Suspicious Creation with Colorcpl id: e15b518d-b4ce-4410-a9cd-501f23ce4a18 status: test description: Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\ references: - https://twitter.com/eral4m/status/1480468728324231172?s=20 author: frack113 date: 2022-01-21 modified: 2023-01-05 tags: - attack.stealth - attack.t1564 logsource: product: windows category: file_event detection: selection: Image|endswith: \colorcpl.exe filter_ext: TargetFilename|endswith: - .icm - .gmmp - .cdmp - .camp condition: selection and not 1 of filter_* falsepositives: - Unknown level: high
Query: CWE for Use of Uninitialized Resource
Matching passage: CWE-908 Use of Uninitialized Resource. The product uses or accesses a resource that has not been initialized.
Near-miss passage: CWE-315 Cleartext Storage of Sensitive Information in a Cookie. The product stores sensitive information in cleartext in a cookie.
Query: Persistence mechanism resembling Communication Through Removable Media
Matching passage: T1092 Communication Through Removable Media. Tactics: command and control. Description: Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.(Citation: ESET Sednit USBStealer 2014) Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091). Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.
Near-miss passage: T1001.002 Steganography. Tactics: command and control. Description: Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.
Query: CVE similar to CVE-2015-1670
Matching passage: CVE-2015-1670. CWE: CWE-200. CVSS: 4.300000190734863. The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, allows remote attackers to obtain sensitive information from process memory via a crafted OpenType font on a web site, aka "OpenType Font Parsing Vulnerability."
Near-miss passage: CVE-2015-0991. CWE: CWE-200. CVSS: 5.0. Inductive Automation Ignition 7.7.2 allows remote attackers to obtain sensitive information by reading an error message about an unhandled exception, as demonstrated by pathname information.
Query: EDR alert: possible RC Scripts (T1037.004)
Matching passage: T1037.004 RC Scripts. Tactics: persistence, privilege escalation. Description: Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify. Adversaries may establish persistence by adding a malicious binary path or shell commands to <code>rc.local</code>, <code>rc.common</code>, and other RC scripts specific to the Unix-like distribution.(Citation: IranThreats Kittens Dec 2017)(Citation: Intezer HiddenWasp Map 2019) Upon reboot, the system executes the script's contents as root, resulting in persistence. Adversary abuse of RC scripts is especially effective for lightweight Unix-like distributions using the root user as default, such as ESXi hypervisors, IoT, or embedded systems.(Citation: intezer-kaiji-malware) As ESXi servers store most system files in memory and therefore discard changes on shutdown, leveraging `/etc/rc.local.d/local.sh` is one of the few mechanisms for enabling persistence across reboots.(Citation: Juniper Networks ESXi Backdoor 2022) Several Unix-like systems have moved to Systemd and deprecated the use of RC scripts. This is now a deprecated mechanism in macOS in favor of Launchd.(Citation: Apple Developer Doco Archive Launchd)(Citation: Startup Items) This technique can be used on Mac OS X Panther v10.3 and earlier versions which still execute the RC scripts.(Citation: Methods of Mac Malware Persistence) To maintain backwards compatibility some systems, such as Ubuntu, will execute the RC scripts if they exist with the correct file permissions.(Citation: Ubuntu Manpage systemd rc)
Near-miss passage: T1037.001 Logon Script (Windows). Tactics: persistence, privilege escalation. Description: Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.(Citation: TechNet Logon Scripts) This is done via adding a path to a script to the <code>HKCU\Environment\UserInitMprLogonScript</code> Registry key.(Citation: Hexacorn Logon Scripts) Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
Query: vulnerability: drivers/video/msm/mdp4_util.c in the Qualcomm components in Android before 2016-08-05 on Nexus 7 (2013) devices does not validate r stages, g stages, or b stages data, which allows
Matching passage: CVE-2015-8939. CWE: CWE-264. CVSS: 7.800000190734863. drivers/video/msm/mdp4_util.c in the Qualcomm components in Android before 2016-08-05 on Nexus 7 (2013) devices does not validate r stages, g stages, or b stages data, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28398884 and Qualcomm internal bug CR779021.
Near-miss passage: CVE-2015-7966. CWE: CWE-264. CVSS: 7.800000190734863. SafeNet Authentication Service Windows Logon Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module, a different vulnerability than CVE-2015-7965.
Query: patch priority for CVE-2015-3794
Matching passage: CVE-2015-3794. CWE: CWE-119. CVSS: 6.800000190734863. The Speech UI in Apple OS X before 10.10.5, when speech alerts are enabled, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Unicode string.
Near-miss passage: CVE-2015-5815. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iTunes before 12.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-3.
Query: alert when Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option
Matching passage: Sigma rule: Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option. Logsource: macos / process_creation. Rule: title: Hidden User Creation id: b22a5b36-2431-493a-8be1-0bae56c28ef3 status: test description: Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.002/T1564.002.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-10 modified: 2021-11-27 tags: - attack.stealth - attack.t1564.002 logsource: category: process_creation product: macos detection: dscl_create: Image|endswith: /dscl CommandLine|contains: create id_below_500: CommandLine|contains: UniqueID CommandLine|re: ([0-9]|[1-9][0-9]|[1-4][0-9]{2}) ishidden_option_declaration: CommandLine|contains: IsHidden ishidden_option_confirmation: CommandLine|contains: - 'true' - 'yes' - '1' condition: dscl_create and id_below_500 or dscl_create and (ishidden_option_declaration and ishidden_option_confirmation) falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing wh. Logsource: windows / registry_set. Rule: title: Python Function Execution Security Warning Disabled In Excel - Registry id: 17e53739-a1fc-4a62-b1b9-87711c2d5e44 related: - id: 023c654f-8f16-44d9-bb2b-00ff36a62af9 type: similar status: test description: 'Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed. Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet. ' references: - https://support.microsoft.com/en-us/office/data-security-and-python-in-excel-33cc88a4-4a87-485e-9ff9-f35958278327 author: Nasreddine Bencherchali (Nextron Systems), @Kostastsale date: 2024-08-23 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Office\ TargetObject|endswith: \Excel\Security\PythonFunctionWarnings Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-8508
Matching passage: CVE-2015-8508. CWE: CWE-79. CVSS: 4.699999809265137. Cross-site scripting (XSS) vulnerability in showdependencygraph.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2.16, 4.3.x and 4.4.x before 4.4.11, and 4.5.x and 5.0.x before 5.0.2, when a local dot configuration is used, allows remote attackers to inject arbitrary web script or HTML via a crafted bug summary.
Near-miss passage: CVE-2015-0105. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Process Portal in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Query: campaign using Unused/Unsupported Cloud Regions
Matching passage: T1535 Unused/Unsupported Cloud Regions. Tactics: stealth. Description: Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure. Cloud service providers often provide infrastructure throughout the world in order to improve performance, provide redundancy, and allow customers to meet compliance requirements. Oftentimes, a customer will only use a subset of the available regions and may not actively monitor other regions. If an adversary creates resources in an unused region, they may be able to operate undetected. A variation on this behavior takes advantage of differences in functionality across cloud regions. An adversary could utilize regions which do not support advanced detection services in order to avoid detection of their activity. An example of adversary use of unused AWS regions is to mine cryptocurrency through [Resource Hijacking](https://attack.mitre.org/techniques/T1496), which can cost organizations substantial amounts of money over time depending on the processing power used.(Citation: CloudSploit - Unused AWS Regions)
Near-miss passage: T1027.007 Dynamic API Resolution. Tactics: stealth. Description: Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis. Malware commonly uses various [Native API](https://attack.mitre.org/techniques/T1106) functions provided by the OS to perform various tasks such as those involving processes, files, and other system artifacts. API functions called by malware may leave static artifacts such as strings in payload files. Defensive analysts may also uncover which functions a binary file may execute via an import address table (IAT) or other structures that help dynamically link calling code to the shared modules that provide functions.(Citation: Huntress API Hash)(Citation: IRED API Hashing) To avoid static or other defensive analysis, adversaries may use dynamic API resolution to conceal malware characteristics and functionalities. Similar to [Software Packing](https://attack.mitre.org/techniques/T1027/002), dynamic API resolution may change file signatures and obfuscate malicious API function calls until they are resolved and invoked during runtime. Various methods may be used to obfuscate malware calls to API functions. For example, hashes of function names are commonly stored in malware in lieu of literal strings. Malware can use these hashes (or other identifiers) to manually reproduce the linking and loading process using functions such as `GetProcAddress()` and `LoadLibrary()`. These hashes/identifiers can also be further obfuscated using encryption or other string manipulation tricks (requiring various forms of [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) during execution).(Citation: BlackHat API Packers)(Citation: Drakonia HInvoke)(Citation: Huntress API Hash)
Query: risk of FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font fil
Matching passage: CVE-2015-7018. CWE: CWE-119. CVSS: 6.800000190734863. FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, and CVE-2015-7010.
Near-miss passage: CVE-2015-0903. CWE: CWE-119. CVSS: 7.5. Buffer overflow in Saitoh Kikaku Maruo Editor 8.51 and earlier allows remote attackers to execute arbitrary code via a crafted .hmbook file.
Query: detect Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report. in logs
Matching passage: Sigma rule: Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.. Logsource: windows / process_creation. Rule: title: Potential Amazon SSM Agent Hijacking id: d20ee2f4-822c-4827-9e15-41500b1fff10 status: test description: Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report. references: - https://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan - https://www.bleepingcomputer.com/news/security/amazons-aws-ssm-agent-can-be-used-as-post-exploitation-rat-malware/ - https://www.helpnetsecurity.com/2023/08/02/aws-instances-attackers-access/ author: Muhammad Faisal date: 2023-08-02 tags: - attack.command-and-control - attack.persistence - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: Image|endswith: \amazon-ssm-agent.exe CommandLine|contains|all: - '-register ' - '-code ' - '-id ' - '-region ' condition: selection falsepositives: - Legitimate activity of system administrators level: medium
Near-miss passage: Sigma rule: Detects the execution of the hdiutil utility in order to create a disk image.. Logsource: macos / process_creation. Rule: title: Disk Image Creation Via Hdiutil - MacOS id: 1cf98dc2-fcb0-47c9-8aea-654c9284d1ae status: test description: Detects the execution of the hdiutil utility in order to create a disk image. references: - https://www.loobins.io/binaries/hdiutil/ - https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/ - https://ss64.com/mac/hdiutil.html author: Omar Khaled (@beacon_exe) date: 2024-08-10 tags: - attack.exfiltration logsource: product: macos category: process_creation detection: selection: Image|endswith: /hdiutil CommandLine|contains: create condition: selection falsepositives: - Legitimate usage of hdiutil by administrators and users. level: medium
Query: vulnerability: The Audio component in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information via a crafted audio file, as demonstrated by ob
Matching passage: CVE-2015-6627. CWE: CWE-200. CVSS: 2.5999999046325684. The Audio component in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information via a crafted audio file, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24211743.
Near-miss passage: CVE-2015-6368. CWE: CWE-200. CVSS: 5.0. Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows remote attackers to read files via a crafted HTTP request, aka Bug ID CSCux10608.
Query: describe CVE-2015-0422
Matching passage: CVE-2015-0422. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, and 6.3.5 allows remote authenticated users to affect confidentiality via unknown vectors related to UI Infrastructure.
Near-miss passage: CVE-2015-1172. CWE: UNKNOWN. CVSS: 7.5. Unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme (aka holding_pattern) 0.6 and earlier for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in an unspecified directory.
Query: write Sigma for Detects usage of "appcmd" to create new global URL rewrite rules. This behaviour has been observed being used by threat
Matching passage: Sigma rule: Detects usage of "appcmd" to create new global URL rewrite rules. This behaviour has been observed being used by threat. Logsource: windows / process_creation. Rule: title: Suspicious IIS URL GlobalRules Rewrite Via AppCmd id: 7c8af9b2-dcae-41a2-a9db-b28c288b5f08 status: test description: Detects usage of "appcmd" to create new global URL rewrite rules. This behaviour has been observed being used by threat actors to add new rules so they can access their webshells. references: - https://twitter.com/malmoeb/status/1616702107242971144 - https://learn.microsoft.com/en-us/answers/questions/739120/how-to-add-re-write-global-rule-with-action-type-r author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-22 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \appcmd.exe - OriginalFileName: appcmd.exe selection_cli: CommandLine|contains|all: - set - config - section:system.webServer/rewrite/globalRules - 'commit:' condition: all of selection_* falsepositives: - Legitimate usage of appcmd to add new URL rewrite rules level: medium
Near-miss passage: Sigma rule: Detects deletion attempts of MacOS Time Machine backups via the native backup utility "tmutil". An adversary may perform. Logsource: macos / process_creation. Rule: title: Time Machine Backup Deletion Attempt Via Tmutil - MacOS id: 452df256-da78-427a-866f-49fa04417d74 status: test description: 'Detects deletion attempts of MacOS Time Machine backups via the native backup utility "tmutil". An adversary may perform this action before launching a ransonware attack to prevent the victim from restoring their files. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine - https://www.loobins.io/binaries/tmutil/ author: Pratinav Chandra date: 2024-05-29 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: macos detection: selection_img: - Image|endswith: /tmutil - CommandLine|contains: tmutil selection_cmd: CommandLine|contains: delete condition: all of selection_* falsepositives: - Legitimate activities level: medium