alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege in logs
Matching passage: Sigma rule: Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege. Logsource: windows / driver_load. Rule: title: Vulnerable WinRing0 Driver Load id: 1a42dfa6-6cb2-4df9-9b48-295be477e835 status: test description: Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege escalation references: - https://github.com/xmrig/xmrig/tree/master/bin/WinRing0 - https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/ author: Florian Roth (Nextron Systems) date: 2022-07-26 modified: 2024-11-23 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: product: windows category: driver_load detection: selection: - Hashes|contains: IMPHASH=D41FA95D4642DC981F10DE36F4DC8CD7 - ImageLoaded|endswith: - \WinRing0x64.sys - \WinRing0.sys - \WinRing0.dll - \WinRing0x64.dll - \winring00x64.sys condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of Dsacls to grant over permissive permissions. Logsource: windows / process_creation. Rule: title: Potentially Over Permissive Permissions Granted Using Dsacls.EXE id: 01c42d3c-242d-4655-85b2-34f1739632f7 status: test description: Detects usage of Dsacls to grant over permissive permissions references: - https://ss64.com/nt/dsacls.html - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771151(v=ws.11) author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-20 modified: 2023-02-04 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \dsacls.exe - OriginalFileName: DSACLS.EXE selection_flag: CommandLine|contains: ' /G ' selection_permissions: CommandLine|contains: - GR - GE - GW - GA - WP - WD condition: all of selection_* falsepositives: - Legitimate administrators granting over permissive permissions to users level: medium
Query: Suspicious Network Topology execution detected on endpoint
Matching passage: T1590.004 Network Topology. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's network topology that can be used during targeting. Information about network topologies may include a variety of details, including the physical and/or logical arrangement of both external-facing and internal network environments. This information may also include specifics regarding network devices (gateways, routers, etc.) and other infrastructure. Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about network topologies may also be exposed to adversaries via online or other accessible data sets (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: DNS Dumpster) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Near-miss passage: T1590.006 Network Security Appliances. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's network security appliances that can be used during targeting. Information about network security appliances may include a variety of details, such as the existence and specifics of deployed firewalls, content filters, and proxies/bastion hosts. Adversaries may also target information about victim network-based intrusion detection systems (NIDS) or other appliances related to defensive cybersecurity operations. Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598).(Citation: Nmap Firewalls NIDS) Information about network security appliances may also be exposed to adversaries via online or other accessible data sets (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Query: exploit The Disk Images component in Apple iOS before 9.1 and OS X before 10.11.1 misparses images, which allows attackers to execute arbitrary code or cause a denial of service (memory co
Matching passage: CVE-2015-6995. CWE: CWE-119. CVSS: 6.800000190734863. The Disk Images component in Apple iOS before 9.1 and OS X before 10.11.1 misparses images, which allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app.
Near-miss passage: CVE-2015-8520. CWE: CWE-119. CVSS: 9.800000190734863. Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability than CVE-2015-8519, CVE-2015-8521, and CVE-2015-8522.
Query: discovery using Device Driver Discovery
Matching passage: T1652 Device Driver Discovery. Tactics: discovery. Description: Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) or other defenses (e.g., [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)), as well as potential exploitable vulnerabilities (e.g., [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)). Many OS utilities may provide information about local device drivers, such as `driverquery.exe` and the `EnumDeviceDrivers()` API function on Windows.(Citation: Microsoft Driverquery)(Citation: Microsoft EnumDeviceDrivers) Information about device drivers (as well as associated services, i.e., [System Service Discovery](https://attack.mitre.org/techniques/T1007)) may also be available in the Registry.(Citation: Microsoft Registry Drivers) On Linux/macOS, device drivers (in the form of kernel modules) may be visible within `/dev` or using utilities such as `lsmod` and `modinfo`.(Citation: Linux Kernel Programming)(Citation: lsmod man)(Citation: modinfo man)
Near-miss passage: T1069.002 Domain Groups. Tactics: discovery. Description: Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators. Commands such as <code>net group /domain</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscacheutil -q group</code> on macOS, and <code>ldapsearch</code> on Linux can list domain-level groups.
Query: alert when Detects WebDav DownloadCradle
Matching passage: Sigma rule: Detects WebDav DownloadCradle. Logsource: proxy. Rule: title: Windows WebDAV User Agent id: e09aed7a-09e0-4c9a-90dd-f0d52507347e status: test description: Detects WebDav DownloadCradle references: - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html author: Florian Roth (Nextron Systems) date: 2018-04-06 modified: 2021-11-27 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent|startswith: Microsoft-WebDAV-MiniRedir/ cs-method: GET condition: selection falsepositives: - Administrative scripts that download files from the Internet - Administrative scripts that retrieve certain website contents - Legitimate WebDAV administration level: high
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "wwlib.dll". Logsource: windows / image_load. Rule: title: Potential WWlib.DLL Sideloading id: e2e01011-5910-4267-9c3b-4149ed5479cf status: test description: Detects potential DLL sideloading of "wwlib.dll" references: - https://twitter.com/WhichbufferArda/status/1658829954182774784 - https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/ - https://securelist.com/apt-luminousmoth/103332/ author: X__Junior (Nextron Systems) date: 2023-05-18 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \wwlib.dll filter_main_path: Image|startswith: - C:\Program Files (x86)\Microsoft Office\ - C:\Program Files\Microsoft Office\ Image|endswith: \winword.exe ImageLoaded|startswith: - C:\Program Files (x86)\Microsoft Office\ - C:\Program Files\Microsoft Office\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-5661
Matching passage: CVE-2015-5661. CWE: CWE-200. CVSS: 4.300000190734863. The SAND STUDIO AirDroid application 1.1.0 and earlier for Android mishandles implicit intents, which allows attackers to obtain sensitive information via a crafted application.
Near-miss passage: CVE-2015-6632. CWE: CWE-200. CVSS: 5.0. libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24346430.
Query: write Sigma for Detects when an account was created and deleted in a short period of time.
Matching passage: Sigma rule: Detects when an account was created and deleted in a short period of time.. Logsource: azure / auditlogs. Rule: title: Account Created And Deleted Within A Close Time Frame id: 6f583da0-3a90-4566-a4ed-83c09fe18bbf status: test description: Detects when an account was created and deleted in a short period of time. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#short-lived-accounts author: Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton date: 2022-08-11 modified: 2022-08-18 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 logsource: product: azure service: auditlogs detection: selection: properties.message: - Add user - Delete user Status: Success condition: selection falsepositives: - Legit administrative action level: high
Near-miss passage: Sigma rule: Detects when an attacker or tool disables the Windows Defender service (WinDefend) via the registry. Logsource: windows / registry_set. Rule: title: Windows Defender Service Disabled - Registry id: e1aa95de-610a-427d-b9e7-9b46cfafbe6a status: test description: Detects when an attacker or tool disables the Windows Defender service (WinDefend) via the registry references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://gist.github.com/anadr/7465a9fde63d41341136949f14c21105 author: Ján Trenčanský, frack113, AlertIQ, Nasreddine Bencherchali date: 2022-08-01 modified: 2024-03-25 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: \Services\WinDefend\Start Details: DWORD (0x00000004) condition: selection falsepositives: - Administrator actions level: high
Query: Lateral movement indicators for Digital Certificates
Matching passage: T1587.003 Digital Certificates. Tactics: resource development. Description: Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA). Adversaries may create self-signed SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) if added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)). After creating a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control.
Near-miss passage: T1587.002 Code Signing Certificates. Tactics: resource development. Description: Adversaries may create self-signed code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is. Prior to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may develop self-signed code signing certificates for use in operations.
Query: risk of Basware Banking (Maksuliikenne) 8.90.07.X does not properly prevent access to private keys, which allows remote attackers to spoof communications with banks via unspecified vectors
Matching passage: CVE-2015-6747. CWE: CWE-200. CVSS: 5.0. Basware Banking (Maksuliikenne) 8.90.07.X does not properly prevent access to private keys, which allows remote attackers to spoof communications with banks via unspecified vectors. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 due to different vulnerability types. NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-6746.
Near-miss passage: CVE-2015-7991. CWE: CWE-200. CVSS: 5.0. The Web Dispatcher service in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to read web dispatcher and security trace files and possibly obtain passwords via unspecified vectors, aka SAP Security Note 2148854.
Query: describe CVE-2015-8801
Matching passage: CVE-2015-8801. CWE: CWE-254. CVSS: 2.9000000953674316. Race condition in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6 MP5 allows local users to bypass intended restrictions on USB file transfer by conducting filesystem operations before the SEP device manager recognizes a new USB device.
Near-miss passage: CVE-2015-1266. CWE: CWE-254. CVSS: 5.0. content/browser/webui/content_web_ui_controller_factory.cc in Google Chrome before 43.0.2357.130 does not properly consider the scheme in determining whether a URL is associated with a WebUI SiteInstance, which allows remote attackers to bypass intended access restrictions via a similar URL, as demonstrated by use of http://gpu when there is a WebUI class for handling chrome://gpu requests.
Query: vulnerability: The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1,
Matching passage: CVE-2015-5070. CWE: CWE-200. CVSS: 3.0999999046325684. The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensitive filesystem is used, allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5069.
Near-miss passage: CVE-2015-1244. CWE: CWE-200. CVSS: 5.0. The URLRequest::GetHSTSRedirect function in url_request/url_request.cc in Google Chrome before 42.0.2311.90 does not replace the ws scheme with the wss scheme whenever an HSTS Policy is active, which makes it easier for remote attackers to obtain sensitive information by sniffing the network for WebSocket traffic.
Query: Sigma YAML for windows / image_load
Matching passage: Sigma rule: Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process. This library has been used during ransomware. Logsource: windows / image_load. Rule: title: Load Of RstrtMgr.DLL By A Suspicious Process id: b48492dc-c5ef-4572-8dff-32bc241c15c8 related: - id: 3669afd2-9891-4534-a626-e5cf03810a61 type: derived status: test description: 'Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes. ' references: - https://www.crowdstrike.com/blog/windows-restart-manager-part-1/ - https://www.crowdstrike.com/blog/windows-restart-manager-part-2/ - https://web.archive.org/web/20231221193106/https://www.swascan.com/cactus-ransomware-malware-analysis/ - https://taiwan.postsen.com/business/88601/Hamas-hackers-use-data-destruction-software-BiBi-which-consumes-a-lot-of-processor-resources-to-wipe-Windows-computer-data--iThome.html author: Luc Génaux date: 2023-11-28 tags: - attack.impact - attack.defense-impairment - attack.t1486 - attack.t1685 logsource: category: image_load product: windows detection: selection_img: - ImageLoaded|endswith: \RstrtMgr.dll - OriginalFileName: RstrtMgr.dll selection_folders_1: Image|contains: - :\Perflogs\ - :\Users\Public\ - \Temporary Internet selection_folders_2: - Image|contains|all: - :\Users\ - \Favorites\ - Image|contains|all: - :\Users\ - \Favourites\ - Image|contains|all: - :\Users\ - \Contacts\ condition: selection_img and 1 of selection_folders_* falsepositives: - Processes related to software installation level: high
Near-miss passage: Sigma rule: Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash. Logsource: windows / create_stream_hash. Rule: title: Hidden Executable In NTFS Alternate Data Stream id: b69888d4-380c-45ce-9cf9-d9ce46e67821 status: test description: Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash references: - https://twitter.com/0xrawsec/status/1002478725605273600?s=21 author: Florian Roth (Nextron Systems), @0xrawsec date: 2018-06-03 modified: 2023-02-10 tags: - attack.stealth - attack.s0139 - attack.t1564.004 logsource: product: windows category: create_stream_hash definition: 'Requirements: Sysmon or equivalent configured with Imphash logging' detection: selection: Hash|contains: IMPHASH= filter_main_null: Hash|contains: IMPHASH=00000000000000000000000000000000 condition: selection and not 1 of filter_main_* falsepositives: - This rule isn't looking for any particular binary characteristics. As legitimate installers and programs were seen embedding hidden binaries in their ADS. Some false positives are expected from browser processes and similar. level: medium
Query: exploit The Runtime subsystem in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem acce
Matching passage: CVE-2015-3865. CWE: CWE-264. CVSS: 9.300000190734863. The Runtime subsystem in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23050463.
Near-miss passage: CVE-2015-7051. CWE: CWE-264. CVSS: 9.300000190734863. MobileStorageMounter in Apple iOS before 9.2 and tvOS before 9.1 mishandles the timing of trust-cache loading, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
Query: telemetry for T1552.003
Matching passage: T1552.003 Shell History. Tactics: credential access. Description: Adversaries may search the command history on compromised systems for insecurely stored credentials. On Linux and macOS systems, shells such as Bash and Zsh keep track of the commands users type on the command-line with the "history" utility. Once a user logs out, the history is flushed to the user's history file. For each user, this file resides at the same location: for example, `~/.bash_history` or `~/.zsh_history`. Typically, these files keeps track of the user's last 1000 commands. On Windows, PowerShell has both a command history that is wiped after the session ends, and one that contains commands used in all sessions and is persistent. The default location for persistent history can be found in `%userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt`, but command history can also be accessed with `Get-History`. Command Prompt (CMD) on Windows does not have persistent history.(Citation: Microsoft about_History)(Citation: Medium) Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out. Adversaries can abuse this by looking through the file for potential credentials.(Citation: External to DA, the OS X Way)
Near-miss passage: T1552 Unsecured Credentials. Tactics: credential access. Description: Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Shell History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)).(Citation: Brining MimiKatz to Unix)
Query: patch priority for CVE-2015-9411
Matching passage: CVE-2015-9411. CWE: CWE-79. CVSS: 6.099999904632568. The Postmatic plugin before 1.4.6 for WordPress has XSS.
Near-miss passage: CVE-2015-0967. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in SearchBlox before 8.2 allow remote attackers to inject arbitrary web script or HTML via (1) the search field in plugin/index.html or (2) the title field in the Create Featured Result form in admin/main.jsp.