alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications. HxTsr.exe is part of Outloo
Matching passage: Sigma rule: HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications. HxTsr.exe is part of Outloo. Logsource: windows / process_creation. Rule: title: Potential Fake Instance Of Hxtsr.EXE Executed id: 4e762605-34a8-406d-b72e-c1a089313320 status: test description: 'HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications. HxTsr.exe is part of Outlook apps, because it resides in a hidden "WindowsApps" subfolder of "C:\Program Files". Any instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe ' references: - Internal Research author: Sreeman date: 2020-04-17 modified: 2024-02-08 tags: - attack.stealth - attack.t1036 logsource: product: windows category: process_creation detection: selection: Image|endswith: \hxtsr.exe filter_main_hxtsr: Image|contains: :\program files\windowsapps\microsoft.windowscommunicationsapps_ Image|endswith: \hxtsr.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.. Logsource: windows / process_creation. Rule: title: ETW Trace Evasion Activity id: a238b5d0-ce2d-4414-a676-7a531b3d13d6 status: test description: 'Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion. ' references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil - https://abuse.io/lockergoga.txt - https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 author: '@neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community' date: 2019-03-22 modified: 2022-06-28 tags: - attack.stealth - attack.defense-impairment - attack.t1070 - attack.t1685 - car.2016-04-002 logsource: category: process_creation product: windows detection: selection_clear_1: CommandLine|contains|all: - cl - /Trace selection_clear_2: CommandLine|contains|all: - clear-log - /Trace selection_disable_1: CommandLine|contains|all: - sl - /e:false selection_disable_2: CommandLine|contains|all: - set-log - /e:false selection_disable_3: CommandLine|contains|all: - logman - update - trace - --p - -ets selection_pwsh_remove: CommandLine|contains: Remove-EtwTraceProvider selection_pwsh_set: CommandLine|contains|all: - Set-EtwTraceProvider - '0x11' condition: 1 of selection_* falsepositives: - Unknown level: high
Query: vulnerability: EMC RSA Archer GRC 5.x before 5.5.3 allows remote authenticated users to bypass intended access restrictions, and read or modify Discussion Forum Fields messages, via unspecified v
Matching passage: CVE-2015-4542. CWE: CWE-264. CVSS: 6.5. EMC RSA Archer GRC 5.x before 5.5.3 allows remote authenticated users to bypass intended access restrictions, and read or modify Discussion Forum Fields messages, via unspecified vectors.
Near-miss passage: CVE-2015-2284. CWE: CWE-264. CVSS: 10.0. userlogin.jsp in SolarWinds Firewall Security Manager (FSM) before 6.6.5 HotFix1 allows remote attackers to gain privileges and execute arbitrary code via unspecified vectors, related to client session handling.
Query: vulnerability: Intel McAfee ePolicy Orchestrator (ePO) 4.x through 4.6.9 and 5.x through 5.1.2 does not validate server names and Certification Authority names in X.509 certificates from SSL serv
Matching passage: CVE-2015-2859. CWE: CWE-310. CVSS: 5.800000190734863. Intel McAfee ePolicy Orchestrator (ePO) 4.x through 4.6.9 and 5.x through 5.1.2 does not validate server names and Certification Authority names in X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Near-miss passage: CVE-2015-1453. CWE: CWE-310. CVSS: 5.0. The qm class in Fortinet FortiClient 5.2.3.091 for Android uses a hardcoded encryption key of FoRtInEt!AnDrOiD, which makes it easier for attackers to obtain passwords and possibly other sensitive data by leveraging the key to decrypt data in the Shared Preferences.
Query: vulnerability: Sandbox detection evasion vulnerability in hardware appliances in McAfee (now Intel Security) Advanced Threat Defense (MATD) 3.4.2.32 and earlier allows attackers to detect the san
Matching passage: CVE-2015-8986. CWE: CWE-254. CVSS: 5.5. Sandbox detection evasion vulnerability in hardware appliances in McAfee (now Intel Security) Advanced Threat Defense (MATD) 3.4.2.32 and earlier allows attackers to detect the sandbox environment, then bypass proper malware detection resulting in failure to detect a malware file (false-negative) via specially crafted malware.
Near-miss passage: CVE-2015-7554. CWE: CWE-254. CVSS: 9.800000190734863. The _TIFFVGetField function in tif_dir.c in libtiff 4.0.6 allows attackers to cause a denial of service (invalid memory write and crash) or possibly have unspecified other impact via crafted field data in an extension tag in a TIFF image.
Query: incident response steps for SIEM correlation: persistence activity consistent with Authentication Package
Matching passage: Playbook for T1547.002 Authentication Package. 1) Validate alert telemetry against T1547.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: persistence, privilege escalation. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system.(Citation: MSDN Authentication Packages) Adversaries can use the autostart mechanism provided by LS
Near-miss passage: Playbook for T1547.007 Re-opened Applications. Different response path focused on persistence, privilege escalation.
Query: describe CVE-2015-0877
Matching passage: CVE-2015-0877. CWE: UNKNOWN. CVSS: 7.5. Unrestricted file upload vulnerability in app/lib/mlf.pl in C-BOARD Moyuku before 1.03b3 allows remote attackers to execute arbitrary code by uploading a file with a \0 character in its name.
Near-miss passage: CVE-2015-0464. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, and 6.3.6 allows remote attackers to affect confidentiality via unknown vectors related to Security.
Query: CWE for External Initialization of Trusted Variables or Data Stores
Matching passage: CWE-454 External Initialization of Trusted Variables or Data Stores. The product initializes critical internal variables or data stores using inputs that can be modified by untrusted actors.
Near-miss passage: CWE-830 Inclusion of Web Functionality from an Untrusted Source. The product includes web functionality (such as a web widget) from another domain, which causes it to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source.
Query: ATT&CK technique for Group Policy Preferences
Matching passage: T1552.006 Group Policy Preferences. Tactics: credential access. Description: Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts.(Citation: Microsoft GPP 2016) These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public).(Citation: Microsoft GPP Key) The following tools and scripts can be used to gather and decrypt the password file from Group Policy Preference XML files: * Metasploit’s post exploitation module: <code>post/windows/gather/credentials/gpp</code> * Get-GPPPassword(Citation: Obscuresecurity Get-GPPPassword) * gpprefdecrypt.py On the SYSVOL share, adversaries may use the following command to enumerate potential GPP XML files: <code>dir /s * .xml</code>
Near-miss passage: T1552.005 Cloud Instance Metadata API. Tactics: credential access. Description: Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data. Most cloud service providers support a Cloud Instance Metadata API which is a service provided to running virtual instances that allows applications to access information about the running virtual instance. Available information generally includes name, security group, and additional metadata including sensitive data such as credentials and UserData scripts that may contain additional secrets. The Instance Metadata API is provided as a convenience to assist in managing applications and is accessible by anyone who can access the instance.(Citation: AWS Instance Metadata API) A cloud metadata API has been used in at least one high profile compromise.(Citation: Krebs Capital One August 2019) If adversaries have a presence on the running virtual instance, they may query the Instance Metadata API directly to identify credentials that grant access to additional resources. Additionally, adversaries may exploit a Server-Side Request Forgery (SSRF) vulnerability in a public facing web proxy that allows them to gain access to the sensitive information via a request to the Instance Metadata API.(Citation: RedLock Instance Metadata API 2018) The de facto standard across cloud service providers is to host the Instance Metadata API at <code>http[:]//169.254.169.254</code>.
Query: incident response steps for Lateral movement indicators for IP Addresses
Matching passage: Playbook for T1590.005 IP Addresses. 1) Validate alert telemetry against T1590.005. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: reconnaissance. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may gather the victim's IP addresses that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses. Information about assigned IP addresses may include a variety of details, such as which IP addresses are in use. IP addresses may also enable an adversary to derive other details about a victim, such as organizationa
Near-miss passage: Playbook for T1590.002 DNS. Different response path focused on reconnaissance.
Query: vulnerability: Memory leak in Cisco Headend System Release allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, aka Bug ID CSCus91838.
Matching passage: CVE-2015-4227. CWE: CWE-399. CVSS: 7.800000190734863. Memory leak in Cisco Headend System Release allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, aka Bug ID CSCus91838.
Near-miss passage: CVE-2015-0049. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Query: CVE similar to CVE-2015-4475
Matching passage: CVE-2015-4475. CWE: CWE-119. CVSS: 7.5. The mozilla::AudioSink function in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 mishandles inconsistent sample formats within MP3 audio data, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a malformed file.
Near-miss passage: CVE-2015-9143. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9615, MDM9625, MDM9640, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 600, SD 615/16/SD 415, and SDX20, when reading CDT from eMMC with a very large meta offset (>size of default CDT-array compiled in bootloader) for one of the CDBs, a buffer overflow occurs.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in SearchBlox before 8.2.1 allows remote attackers to inject arbitrary web script or HTML via the menu2 parameter to admin/main.jsp.
Matching passage: CVE-2015-3422. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in SearchBlox before 8.2.1 allows remote attackers to inject arbitrary web script or HTML via the menu2 parameter to admin/main.jsp.
Near-miss passage: CVE-2015-2249. CWE: CWE-79. CVSS: 5.400000095367432. Zimbra Collaboration before 8.6.0 patch5 has XSS.
Query: risk of bitcoind and Bitcoin-Qt prior to 0.10.2 allow attackers to cause a denial of service (disabled functionality such as a client application crash) via an "Easy" attack.
Matching passage: CVE-2015-3641. CWE: UNKNOWN. CVSS: 7.5. bitcoind and Bitcoin-Qt prior to 0.10.2 allow attackers to cause a denial of service (disabled functionality such as a client application crash) via an "Easy" attack.
Near-miss passage: CVE-2015-0395. CWE: UNKNOWN. CVSS: 9.300000190734863. Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
Query: risk of FortiOS 5.0.x before 5.0.12 and 5.2.x before 5.2.4 supports anonymous, export, RC4, and possibly other weak ciphers when using TLS to connect to FortiGuard servers, which allows ma
Matching passage: CVE-2015-2323. CWE: CWE-310. CVSS: 6.400000095367432. FortiOS 5.0.x before 5.0.12 and 5.2.x before 5.2.4 supports anonymous, export, RC4, and possibly other weak ciphers when using TLS to connect to FortiGuard servers, which allows man-in-the-middle attackers to spoof TLS content by modifying packets.
Near-miss passage: CVE-2015-2078. CWE: CWE-310. CVSS: 5.0. The SDK for Komodia Redirector with SSL Digestor, as used in Lavasoft Ad-Aware Web Companion 1.1.885.1766 and Ad-Aware AdBlocker (alpha) 1.3.69.1, Qustodio for Windows, Atom Security, Inc. StaffCop 5.8, and other products, does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers, a different vulnerability than CVE-2015-2077.
Query: describe CVE-2015-1333
Matching passage: CVE-2015-1333. CWE: CWE-119. CVSS: 4.900000095367432. Memory leak in the __key_link_end function in security/keys/keyring.c in the Linux kernel before 4.1.4 allows local users to cause a denial of service (memory consumption) via many add_key system calls that refer to existing keys.
Near-miss passage: CVE-2015-1930. CWE: CWE-119. CVSS: 7.800000190734863. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965.
Query: hunt for Terminal Services DLL activity
Matching passage: T1505.005 Terminal Services DLL. Tactics: persistence. Description: Adversaries may abuse components of Terminal Services to enable persistent access to systems. Microsoft Terminal Services, renamed to Remote Desktop Services in some Windows Server OSs as of 2022, enable remote terminal connections to hosts. Terminal Services allows servers to transmit a full, interactive, graphical user interface to clients via RDP.(Citation: Microsoft Remote Desktop Services) [Windows Service](https://attack.mitre.org/techniques/T1543/003)s that are run as a "generic" process (ex: <code>svchost.exe</code>) load the service's DLL file, the location of which is stored in a Registry entry named <code>ServiceDll</code>.(Citation: Microsoft System Services Fundamentals) The <code>termsrv.dll</code> file, typically stored in `%SystemRoot%\System32\`, is the default <code>ServiceDll</code> value for Terminal Services in `HKLM\System\CurrentControlSet\services\TermService\Parameters\`. Adversaries may modify and/or replace the Terminal Services DLL to enable persistent access to victimized hosts.(Citation: James TermServ DLL) Modifications to this DLL could be done to execute arbitrary payloads (while also potentially preserving normal <code>termsrv.dll</code> functionality) as well as to simply enable abusable features of Terminal Services. For example, an adversary may enable features such as concurrent [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) sessions by either patching the <code>termsrv.dll</code> file or modifying the <code>ServiceDll</code> value to point to a DLL that provides increased RDP functionality.(Citation: Windows OS Hub RDP)(Citation: RDPWrap Github) On a non-server Windows OS this increased functionality may also enable an adversary to avoid Terminal Services prompts that warn/log out users of a system when a new RDP session is created.
Near-miss passage: T1505 Server Software Component. Tactics: persistence. Description: Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.(Citation: volexity_0day_sophos_FW)
Query: CWE for Missing XML Validation
Matching passage: CWE-112 Missing XML Validation. The product accepts XML from an untrusted source but does not validate the XML against the proper schema.
Near-miss passage: CWE-32 Path Traversal: '...' (Triple Dot). The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '...' (triple dot) sequences that can resolve to a location that is outside of that directory.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the creation of taskmgr.exe process in context of LOCAL_SYSTEM. Logsource: windows / process_creation. Rule: title: Taskmgr as LOCAL_SYSTEM id: 9fff585c-c33e-4a86-b3cd-39312079a65f status: test description: Detects the creation of taskmgr.exe process in context of LOCAL_SYSTEM references: - Internal Research author: Florian Roth (Nextron Systems) date: 2018-03-18 modified: 2022-05-27 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: User|contains: - AUTHORI - AUTORI Image|endswith: \taskmgr.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of system utilities (only grep and egrep for now) to discover security software discovery. Logsource: linux / process_creation. Rule: title: Security Software Discovery - Linux id: c9d8b7fd-78e4-44fe-88f6-599135d46d60 status: test description: Detects usage of system utilities (only grep and egrep for now) to discover security software discovery references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2022-11-27 tags: - attack.discovery - attack.t1518.001 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /grep - /egrep CommandLine|contains: - nessusd - td-agent - packetbeat - filebeat - auditbeat - osqueryd - cbagentd - falcond condition: selection falsepositives: - Legitimate activities level: low
Query: exploit Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Ex
Matching passage: CVE-2015-6066. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6070, CVE-2015-6071, CVE-2015-6074, CVE-2015-6076, and CVE-2015-6087.
Near-miss passage: CVE-2015-7008. CWE: CWE-119. CVSS: 6.800000190734863. FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7009, CVE-2015-7010, and CVE-2015-7018.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-d. Logsource: windows / process_creation. Rule: title: Potential Mpclient.DLL Sideloading Via Defender Binaries id: 7002aa10-b8d4-47ae-b5ba-51ab07e228b9 related: - id: 418dc89a-9808-4b87-b1d7-e5ae0cb6effc type: similar status: test description: Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory. references: - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool author: Bhabesh Raj date: 2022-08-01 modified: 2023-08-04 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: process_creation detection: selection: Image|endswith: - \MpCmdRun.exe - \NisSrv.exe filter_main_known_locations: Image|startswith: - C:\Program Files (x86)\Windows Defender\ - C:\Program Files\Microsoft Security Client\ - C:\Program Files\Windows Defender\ - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: This the exploitation of a NTFS vulnerability as reported without many details via Twitter. Logsource: windows / system. Rule: title: NTFS Vulnerability Exploitation id: f14719ce-d3ab-4e25-9ce6-2899092260b0 status: test description: This the exploitation of a NTFS vulnerability as reported without many details via Twitter references: - https://twitter.com/jonasLyk/status/1347900440000811010 - https://twitter.com/wdormann/status/1347958161609809921 - https://www.bleepingcomputer.com/news/security/windows-10-bug-corrupts-your-hard-drive-on-seeing-this-files-icon/ author: Florian Roth (Nextron Systems) date: 2021-01-11 modified: 2022-12-25 tags: - attack.impact - attack.t1499.001 logsource: product: windows service: system detection: selection: Provider_Name: Ntfs EventID: 55 Origin: File System Driver Description|contains|all: - contains a corrupted file record - The name of the file is "\" condition: selection falsepositives: - Unlikely level: high