alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: EDR alert: possible Time Based Checks (T1497.003)
Matching passage: T1497.003 Time Based Checks. Tactics: stealth, discovery. Description: Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. This may include enumerating time-based properties, such as uptime or the system clock. Adversaries may use calls like `GetTickCount` and `GetSystemTimeAsFileTime` to discover if they are operating within a virtual machine or sandbox, or may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.(Citation: ISACA Malware Tricks)
Near-miss passage: T1497.002 User Activity Based Checks. Tactics: stealth, discovery. Description: Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness) Adversaries may search for user activity on the host based on variables such as the speed/frequency of mouse movements and clicks (Citation: Sans Virtual Jan 2016) , browser history, cache, bookmarks, or number of files in common directories such as home or the desktop. Other methods may rely on specific user interaction with the system before the malicious code is activated, such as waiting for a document to close before activating a macro (Citation: Unit 42 Sofacy Nov 2018) or waiting for a user to double click on an embedded image to activate.(Citation: FireEye FIN7 April 2017)
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in unspecified administration pages in the EntityBulkDelete module 7.x-1.0 for Drupal allow remote attackers to inject arbitrary
Matching passage: CVE-2015-4386. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in unspecified administration pages in the EntityBulkDelete module 7.x-1.0 for Drupal allow remote attackers to inject arbitrary web script or HTML via unknown vectors involving creating or editing (1) comments, (2) taxonomy terms, or (3) nodes.
Near-miss passage: CVE-2015-1347. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in client.inc.php in osTicket before 1.9.5.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
Query: weakness Improper Access Control for Register Interface
Matching passage: CWE-1262 Improper Access Control for Register Interface. The product uses memory-mapped I/O registers that act as an interface to hardware functionality from software, but there is improper access control to those registers.
Near-miss passage: CWE-1223 Race Condition for Write-Once Attributes. A write-once register in hardware design is programmable by an untrusted software component earlier than the trusted software component, resulting in a race condition issue.
Query: Sigma rule for Detects commandline operations on shell history files
Matching passage: Sigma rule: Detects commandline operations on shell history files. Logsource: linux / auditd. Rule: title: Suspicious History File Operations - Linux id: eae8ce9f-bde9-47a6-8e79-f20d18419910 status: test description: Detects commandline operations on shell history files references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md author: Mikhail Larin, oscd.community date: 2020-10-17 modified: 2022-11-28 tags: - attack.credential-access - attack.t1552.003 logsource: product: linux service: auditd detection: execve: type: EXECVE history: - .bash_history - .zsh_history - .zhistory - .history - .sh_history - fish_history condition: execve and history falsepositives: - Legitimate administrative activity - Legitimate software, cleaning hist file level: medium
Near-miss passage: Sigma rule: ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file.. Logsource: windows / process_creation. Rule: title: Suspicious ZipExec Execution id: 90dcf730-1b71-4ae7-9ffc-6fcf62bd0132 status: test description: ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file. references: - https://twitter.com/SBousseaden/status/1451237393017839616 - https://github.com/Tylous/ZipExec author: frack113 date: 2021-11-07 modified: 2022-12-25 tags: - attack.execution - attack.stealth - attack.t1218 - attack.t1202 logsource: category: process_creation product: windows detection: run: CommandLine|contains|all: - /generic:Microsoft_Windows_Shell_ZipFolder:filename= - .zip - '/pass:' - '/user:' delete: CommandLine|contains|all: - /delete - Microsoft_Windows_Shell_ZipFolder:filename= - .zip condition: run or delete falsepositives: - Unknown level: medium
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to e. Logsource: windows / file_event. Rule: title: DPAPI Backup Keys And Certificate Export Activity IOC id: 7892ec59-c5bb-496d-8968-e5d210ca3ac4 status: test description: 'Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates. ' references: - https://www.dsinternals.com/en/dpapi-backup-key-theft-auditing/ - https://github.com/MichaelGrafnetter/DSInternals/blob/39ee8a69bbdc1cfd12c9afdd7513b4788c4895d4/Src/DSInternals.Common/Data/DPAPI/DPAPIBackupKey.cs#L28-L32 author: Nounou Mbeiri, Nasreddine Bencherchali (Nextron Systems) date: 2024-06-26 tags: - attack.credential-access - attack.t1555 - attack.t1552.004 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: - ntds_capi_ - ntds_legacy_ - ntds_unknown_ TargetFilename|endswith: - .cer - .key - .pfx - .pvk condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands. Logsource: windows / process_creation. Rule: title: Suspicious Command Patterns In Scheduled Task Creation id: f2c64357-b1d2-41b7-849f-34d2682c0fad status: test description: Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands references: - https://app.any.run/tasks/512c1352-6380-4436-b27d-bb62f0c020d6/ - https://twitter.com/RedDrip7/status/1506480588827467785 - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf author: Florian Roth (Nextron Systems) date: 2022-02-23 modified: 2024-03-19 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_schtasks: Image|endswith: \schtasks.exe CommandLine|contains: '/Create ' selection_pattern_1: CommandLine|contains: - '/sc minute ' - '/ru system ' selection_pattern_2: CommandLine|contains: - cmd /c - cmd /k - cmd /r - 'cmd.exe /c ' - 'cmd.exe /k ' - 'cmd.exe /r ' selection_uncommon: CommandLine|contains: - ' -decode ' - ' -enc ' - ' -w hidden ' - ' bypass ' - ' IEX' - .DownloadData - .DownloadFile - .DownloadString - '/c start /min ' - FromBase64String - mshta http - mshta.exe http selection_anomaly_1: CommandLine|contains: - :\ProgramData\ - :\Temp\ - :\Tmp\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\ - '%AppData%' - '%Temp%' - '%tmp%' selection_anomaly_2: CommandLine|contains: - cscript - curl - wscript condition: selection_schtasks and ( all of selection_pattern_* or selection_uncommon or all of selection_anomaly_* ) falsepositives: - Software installers that run from temporary folders and also install scheduled tasks are expected to generate some false positives level: high
Query: campaign using Fallback Channels
Matching passage: T1008 Fallback Channels. Tactics: command and control. Description: Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.
Near-miss passage: T1001.003 Protocol or Service Impersonation. Tactics: command and control. Description: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity. Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.(Citation: ESET Okrum July 2019)(Citation: Malleable-C2-U42)
Query: CVE similar to CVE-2015-0347
Matching passage: CVE-2015-0347. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043.
Near-miss passage: CVE-2015-4435. CWE: UNKNOWN. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-4438, CVE-2015-4441, CVE-2015-4445, CVE-2015-4447, CVE-2015-4451, CVE-2015-4452, CVE-2015-5085, and CVE-2015-5086.
Query: EDR alert: possible SSH Authorized Keys (T1098.004)
Matching passage: T1098.004 SSH Authorized Keys. Tactics: persistence, privilege escalation. Description: Adversaries may modify the SSH <code>authorized_keys</code> file to maintain persistence on a victim host. Linux distributions, macOS, and ESXi hypervisors commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The <code>authorized_keys</code> file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured. This file is usually found in the user's home directory under <code>&lt;user-home&gt;/.ssh/authorized_keys</code> (or, on ESXi, `/etc/ssh/keys-<username>/authorized_keys`).(Citation: SSH Authorized Keys) Users may edit the system’s SSH config file to modify the directives `PubkeyAuthentication` and `RSAAuthentication` to the value `yes` to ensure public key and RSA authentication are enabled, as well as modify the directive `PermitRootLogin` to the value `yes` to enable root authentication via SSH.(Citation: Broadcom ESXi SSH) The SSH config file is usually located under <code>/etc/ssh/sshd_config</code>. Adversaries may modify SSH <code>authorized_keys</code> files directly with scripts or shell commands to add their own adversary-supplied public keys. In cloud environments, adversaries may be able to modify the SSH authorized_keys file of a particular virtual machine via the command line interface or rest API. For example, by using the Google Cloud CLI’s “add-metadata” command an adversary may add SSH keys to a user account.(Citation: Google Cloud Add Metadata)(Citation: Google Cloud Privilege Escalation) Similarly, in Azure, an adversary may update the authorized_keys file of a virtual machine via a PATCH request to the API.(Citation: Azure Update Virtual Machines) This ensures that an adversary possessing the corresponding private key may log in as an existing user via SSH.(Citation: Venafi SSH Key Abuse)(Citation: Cybereason Linux Exim Worm) It may also lead to privilege escalation where the virtual machine or instance has distinct permissions fr
Near-miss passage: T1098 Account Manipulation. Tactics: persistence, privilege escalation. Description: Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078).
Query: vulnerability: Cisco NX-OS 7.1(1)N1(1) on Nexus 5500, 5600, and 6000 devices does not properly validate PDUs in SNMP packets, which allows remote attackers to cause a denial of service (SNMP appl
Matching passage: CVE-2015-6260. CWE: CWE-20. CVSS: 7.5. Cisco NX-OS 7.1(1)N1(1) on Nexus 5500, 5600, and 6000 devices does not properly validate PDUs in SNMP packets, which allows remote attackers to cause a denial of service (SNMP application restart) via a crafted packet, aka Bug ID CSCut84645.
Near-miss passage: CVE-2015-5144. CWE: CWE-20. CVSS: 4.300000190734863. Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator.
Query: detection rule: Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.
Matching passage: Sigma rule: Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.. Logsource: azure / auditlogs. Rule: title: Guest User Invited By Non Approved Inviters id: 0b4b72e3-4c53-4d5b-b198-2c58cfef39a9 status: test description: Detects when a user that doesn't have permissions to invite a guest user attempts to invite one. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#things-to-monitor author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H' date: 2022-08-10 tags: - attack.privilege-escalation - attack.initial-access - attack.persistence - attack.stealth - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: properties.message: Invite external user Status: failure condition: selection falsepositives: - A non malicious user is unaware of the proper process level: medium
Near-miss passage: Sigma rule: Detects when the Windows Vulnerable Driver Blocklist is set to disabled. This setting is crucial for preventing the load. Logsource: windows / registry_set. Rule: title: Windows Vulnerable Driver Blocklist Disabled id: d526c60a-e236-4011-b165-831ffa52ab70 related: - id: 22154f0e-5132-4a54-aa78-cc62f6def531 type: similar status: experimental description: 'Detects when the Windows Vulnerable Driver Blocklist is set to disabled. This setting is crucial for preventing the loading of known vulnerable drivers, and its modification may indicate an attempt to bypass security controls. It is often targeted by threat actors to facilitate the installation of malicious or vulnerable drivers, particularly in scenarios involving Endpoint Detection and Response (EDR) bypass techniques. This rule applies to systems that support the Vulnerable Driver Blocklist feature, including Windows 10 version 1903 and later, and Windows Server 2022 and later. Note that this change will require a reboot to take effect, and this rule only detects the registry modification action. ' references: - https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules - https://www.sophos.com/en-us/blog/sharpening-the-knife-gold-blades-strategic-evolution - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-01-26 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Control\CI\Config\VulnerableDriverBlocklistEnable Details: DWORD (0x00000000) condition: selection falsepositives: - Unlikely and should be investigated immediately. level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_vulnerable_driver_blocklist_disable/info.yml
Query: risk of In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a cryptographic routine.
Matching passage: CVE-2015-9028. CWE: CWE-119. CVSS: 7.800000190734863. In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a cryptographic routine.
Near-miss passage: CVE-2015-2785. CWE: CWE-119. CVSS: 7.5. The GIF encoder in Byzanz allows remote attackers to cause a denial of service (out-of-bounds heap write and crash) or possibly execute arbitrary code via a crafted Byzanz debug data recording (ByzanzRecording file) to the byzanz-playback command.
Query: vulnerability: IBM InfoSphere Master Data Management - Collaborative Edition 9.1, 10.1, 11.0 before 11.0.0.0 IF11, 11.3 before 11.3.0.0 IF7, and 11.4 before 11.4.0.4 IF1 does not properly restric
Matching passage: CVE-2015-4958. CWE: CWE-200. CVSS: 3.299999952316284. IBM InfoSphere Master Data Management - Collaborative Edition 9.1, 10.1, 11.0 before 11.0.0.0 IF11, 11.3 before 11.3.0.0 IF7, and 11.4 before 11.4.0.4 IF1 does not properly restrict browser caching, which allows local users to obtain sensitive information by reading cache files.
Near-miss passage: CVE-2015-5288. CWE: CWE-200. CVSS: 6.400000095367432. The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause a denial of service (server crash) or read arbitrary server memory via a "too-short" salt.
Query: how to detect Indicator Removal from Tools
Matching passage: T1027.005 Indicator Removal from Tools. Tactics: stealth. Description: Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems. A good example of this is when malware is detected with a file signature and quarantined by anti-virus software. An adversary who can determine that the malware was quarantined because of its file signature may modify the file to explicitly avoid that signature, and then re-use the malware.
Near-miss passage: T1027.006 HTML Smuggling. Tactics: stealth. Description: Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. HTML documents can store large binary objects known as JavaScript Blobs (immutable data that represents raw bytes) that can later be constructed into file-like objects. Data may also be stored in Data URLs, which enable embedding media type or MIME files inline of HTML documents. HTML5 also introduced a download attribute that may be used to initiate file downloads.(Citation: HTML Smuggling Menlo Security 2020)(Citation: Outlflank HTML Smuggling 2018) Adversaries may deliver payloads to victims that bypass security controls through HTML Smuggling by abusing JavaScript Blobs and/or HTML5 download attributes. Security controls such as web content filters may not identify smuggled malicious files inside of HTML/JS files, as the content may be based on typically benign MIME types such as <code>text/plain</code> and/or <code>text/html</code>. Malicious files or data can be obfuscated and hidden inside of HTML files through Data URLs and/or JavaScript Blobs and can be deobfuscated when they reach the victim (i.e. [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140)), potentially bypassing content filters. For example, JavaScript Blobs can be abused to dynamically generate malicious files in the victim machine and may be dropped to disk by abusing JavaScript functions such as <code>msSaveBlob</code>.(Citation: HTML Smuggling Menlo Security 2020)(Citation: MSTIC NOBELIUM May 2021)(Citation: Outlflank HTML Smuggling 2018)(Citation: nccgroup Smuggling HTA 2017)