alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: EDR alert: possible Credential Stuffing (T1110.004)
Matching passage: T1110.004 Credential Stuffing. Tactics: credential access. Description: Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed. The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts. Credential stuffing is a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies. Typically, management services over commonly used ports are used when stuffing credentials. Commonly targeted services include the following: * SSH (22/TCP) * Telnet (23/TCP) * FTP (21/TCP) * NetBIOS / SMB / Samba (139/TCP & 445/TCP) * LDAP (389/TCP) * Kerberos (88/TCP) * RDP / Terminal Services (3389/TCP) * HTTP/HTTP Management Services (80/TCP & 443/TCP) * MSSQL (1433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP) * VNC (5900/TCP) In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018)
Near-miss passage: T1110 Brute Force. Tactics: credential access. Description: Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.(Citation: Dragos Crashoverride 2018) Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), [Account Discovery](https://attack.mitre.org/techniques/T1087), or [Password Policy Discovery](https://attack.mitre.org/techniques/T1201). Adversaries may also combine brute forcing activity with behaviors such as [External Remote Services](https://attack.mitre.org/techniques/T1133) as part of Initial Access. If an adversary guesses the correct password but fails to login to a compromised account due to location-based conditional access policies, they may change their infrastructure until they match the victim’s location and therefore bypass those policies.(Citation: ReliaQuest Health Care Social Engineering Campaign 2024)
Query: describe CVE-2015-7829
Matching passage: CVE-2015-7829. CWE: CWE-119. CVSS: 1.899999976158142. Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows mishandle junctions in the Synchronizer directory, which allows attackers to delete arbitrary files via Adobe Collaboration Sync, a related issue to CVE-2015-2428.
Near-miss passage: CVE-2015-0307. CWE: CWE-119. CVSS: 8.5. Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via unspecified vectors.
Query: vulnerability: Race condition in the AsyncPaintWaitEvent::AsyncPaintWaitEvent function in Mozilla Firefox before 37.0.2 allows remote attackers to execute arbitrary code or cause a denial of serv
Matching passage: CVE-2015-2706. CWE: CWE-362. CVSS: 6.800000190734863. Race condition in the AsyncPaintWaitEvent::AsyncPaintWaitEvent function in Mozilla Firefox before 37.0.2 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted plugin that does not properly complete initialization.
Near-miss passage: CVE-2015-7550. CWE: CWE-362. CVSS: 5.5. The keyctl_read_key function in security/keys/keyctl.c in the Linux kernel before 4.3.4 does not properly use a semaphore, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted application that leverages a race condition between keyctl_revoke and keyctl_read calls.
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Detects PowerShell scripts to set the ACL to a file in the Windows folder. Logsource: windows / ps_script. Rule: title: PowerShell Set-Acl On Windows Folder - PsScript id: 3bf1d859-3a7e-44cb-8809-a99e066d3478 related: - id: cae80281-ef23-44c5-873b-fd48d2666f49 type: derived - id: 0944e002-e3f6-4eb5-bf69-3a3067b53d73 type: derived - id: bdeb2cff-af74-4094-8426-724dc937f20a type: derived status: test description: Detects PowerShell scripts to set the ACL to a file in the Windows folder references: - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1505.005/T1505.005.md - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-acl?view=powershell-5.1 author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-07-18 tags: - attack.defense-impairment - attack.t1222 logsource: product: windows category: ps_script definition: bade5735-5ab0-4aa7-a642-a11be0e40872 detection: selection_cmdlet: ScriptBlockText|contains|all: - 'Set-Acl ' - '-AclObject ' selection_paths: ScriptBlockText|contains: - -Path "C:\Windows - -Path "C:/Windows - -Path 'C:\Windows - -Path 'C:/Windows - -Path C:\\Windows - -Path C:/Windows - -Path $env:windir - -Path "$env:windir - -Path '$env:windir selection_permissions: ScriptBlockText|contains: - FullControl - Allow condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH". Logsource: windows / process_creation. Rule: title: Add Windows Capability Via PowerShell Cmdlet id: b36d01a3-ddaf-4804-be18-18a6247adfcd related: - id: 155c7fd5-47b4-49b2-bbeb-eb4fab335429 type: similar status: test description: Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others. references: - https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=powershell - https://www.virustotal.com/gui/file/af1c82237b6e5a3a7cdbad82cc498d298c67845d92971bada450023d1335e267/content author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-22 modified: 2023-05-09 tags: - attack.execution logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cmdlet: CommandLine|contains: Add-WindowsCapability selection_capa: CommandLine|contains: OpenSSH. condition: all of selection_* falsepositives: - Legitimate usage of the capabilities by administrators or users. Add additional filters accordingly. level: medium
Query: CVE similar to CVE-2015-5239
Matching passage: CVE-2015-5239. CWE: CWE-835. CVSS: 6.5. Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, which triggers an infinite loop.
Near-miss passage: CVE-2015-7850. CWE: CWE-835. CVSS: 6.5. ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (infinite loop or crash) by pointing the key file at the log file.
Query: CVE similar to CVE-2015-5496
Matching passage: CVE-2015-5496. CWE: CWE-264. CVSS: 5.0. The pass2pdf module for Drupal does not restrict access to generated PDF files, which allows remote attackers to obtain user passwords via unspecified vectors.
Near-miss passage: CVE-2015-4287. CWE: CWE-264. CVSS: 5.0. Cisco Firepower Extensible Operating System 1.1(1.86) on Firepower 9000 devices allows remote attackers to bypass intended access restrictions and obtain sensitive device information by visiting an unspecified web page, aka Bug ID CSCuu82230.
Query: write Sigma for Detects plugged/unplugged USB devices
Matching passage: Sigma rule: Detects plugged/unplugged USB devices. Logsource: windows / driver-framework. Rule: title: USB Device Plugged id: 1a4bd6e3-4c6e-405d-a9a3-53a116e341d4 status: test description: Detects plugged/unplugged USB devices references: - https://df-stream.com/2014/01/the-windows-7-event-log-and-usb-device/ - https://www.techrepublic.com/article/how-to-track-down-usb-flash-drive-usage-in-windows-10s-event-viewer/ author: Florian Roth (Nextron Systems) date: 2017-11-09 modified: 2021-11-30 tags: - attack.initial-access - attack.t1200 logsource: product: windows service: driver-framework definition: Requires enabling and collection of the Microsoft-Windows-DriverFrameworks-UserMode/Operational eventlog detection: selection: EventID: - 2003 - 2100 - 2102 condition: selection falsepositives: - Legitimate administrative activity level: low
Near-miss passage: Sigma rule: Detects certificate creation with template allowing risk permission subject and risky EKU. Logsource: windows / security. Rule: title: ADCS Certificate Template Configuration Vulnerability with Risky EKU id: bfbd3291-de87-4b7c-88a2-d6a5deb28668 status: test description: Detects certificate creation with template allowing risk permission subject and risky EKU references: - https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf author: Orlinum , BlueDefenZer date: 2021-11-17 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.credential-access logsource: product: windows service: security definition: Certificate services loaded a template would trigger event ID 4898 and certificate Services template was updated would trigger event ID 4899. A risk permission seems to be coming if template contain specific flag with risky EKU. detection: selection10: EventID: 4898 TemplateContent|contains: - 1.3.6.1.5.5.7.3.2 - 1.3.6.1.5.2.3.4 - 1.3.6.1.4.1.311.20.2.2 - 2.5.29.37.0 selection11: TemplateContent|contains: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT selection20: EventID: 4899 NewTemplateContent|contains: - 1.3.6.1.5.5.7.3.2 - 1.3.6.1.5.2.3.4 - 1.3.6.1.4.1.311.20.2.2 - 2.5.29.37.0 selection21: NewTemplateContent|contains: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT condition: (selection10 and selection11) or (selection20 and selection21) falsepositives: - Administrator activity - Proxy SSL certificate with subject modification - Smart card enrollement level: high
Query: Sigma YAML for windows / ps_module
Matching passage: Sigma rule: Detects Obfuscated Powershell via use Clip.exe in Scripts. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation Via Use Clip - PowerShell Module id: ebdf49d8-b89c-46c9-8fdf-2c308406f6bd related: - id: db92dd33-a3ad-49cf-8c2c-608c3e30ace0 type: derived status: test description: Detects Obfuscated Powershell via use Clip.exe in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-09 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|re: (?i)echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?e`?) condition: selection_4103 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects command execution via ScreenConnect RMM. Logsource: windows / application. Rule: title: Remote Access Tool - ScreenConnect Command Execution id: 076ebe48-cc05-4d8f-9d41-89245cd93a14 related: - id: b1f73849-6329-4069-bc8f-78a604bb8b23 type: similar status: test description: Detects command execution via ScreenConnect RMM references: - https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling - https://github.com/SigmaHQ/sigma/pull/4467 author: Ali Alwashali date: 2023-10-10 tags: - attack.execution - attack.t1059.003 logsource: service: application product: windows detection: selection: Provider_Name: ScreenConnect EventID: 200 Data|contains: Executed command of length condition: selection falsepositives: - Legitimate use of ScreenConnect level: low
Query: SIEM correlation: privilege escalation activity consistent with Abuse Elevation Control Mechanism
Matching passage: T1548 Abuse Elevation Control Mechanism. Tactics: privilege escalation. Description: Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.(Citation: TechNet How UAC Works)(Citation: sudo man page 2018) An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.(Citation: OSX Keydnap malware)(Citation: Fortinet Fareit)
Near-miss passage: T1548.001 Setuid and Setgid. Tactics: privilege escalation. Description: An adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user’s context. On Linux or macOS, when the setuid or setgid bits are set for an application binary, the application will run with the privileges of the owning user or group respectively.(Citation: setuid man page) Normally an application is run in the current user’s context, regardless of which user or group owns the application. However, there are instances where programs need to be executed in an elevated context to function properly, but the user running them may not have the specific required privileges. Instead of creating an entry in the sudoers file, which must be done by root, any user can specify the setuid or setgid flag to be set for their own applications (i.e. [Linux and Mac Permissions](https://attack.mitre.org/techniques/T1222/002)). The <code>chmod</code> command can set these bits with bitmasking, <code>chmod 4777 [file]</code> or via shorthand naming, <code>chmod u+s [file]</code>. This will enable the setuid bit. To enable the setgid bit, <code>chmod 2775</code> and <code>chmod g+s</code> can be used. Adversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future.(Citation: OSX Keydnap malware) This abuse is often part of a "shell escape" or other actions to bypass an execution environment with restricted permissions. Alternatively, adversaries may choose to find and target vulnerable binaries with the setuid or setgid bits already enabled (i.e. [File and Directory Discovery](https://attack.mitre.org/techniques/T1083)). The setuid and setguid bits are indicated with an "s" instead of an "x" when viewing a file's attributes via <code>ls -l</code>. The <code>find</code> command can also be used to search for such files. For example, <code>find / -perm +4000 2>/dev/null</code> can be used to find files with setuid set an
Query: describe CVE-2015-5408
Matching passage: CVE-2015-5408. CWE: UNKNOWN. CVSS: 6.0. HP CentralView Fraud Risk Management 11.1, 11.2, and 11.3; CentralView Revenue Leakage Control 4.1, 4.2, and 4.3; CentralView Dealer Performance Audit 2.0 and 2.1; CentralView Credit Risk Control 2.1, 2.2, and 2.3; CentralView Roaming Fraud Control 2.1, 2.2, and 2.3; and CentralView Subscription Fraud Prevention 2.0 and 2.1 allow remote attackers to obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2015-5406 and CVE-2015-5407.
Near-miss passage: CVE-2015-0814. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Query: exploit SQL injection vulnerability in the EQ Event Calendar component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to eqfullevent.
Matching passage: CVE-2015-4654. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the EQ Event Calendar component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to eqfullevent.
Near-miss passage: CVE-2015-5148. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in LivelyCart 1.2.0 allows remote attackers to execute arbitrary SQL commands via the search_query parameter to product/search.
Query: exploit The Parse_wave function in arm-wt-22k/lib_src/eas_mdls.c in the Sonivox DLS-to-EAS converter in Android before 5.1.1 LMY48I does not reject a negative value for a certain size fiel
Matching passage: CVE-2015-3836. CWE: CWE-189. CVSS: 10.0. The Parse_wave function in arm-wt-22k/lib_src/eas_mdls.c in the Sonivox DLS-to-EAS converter in Android before 5.1.1 LMY48I does not reject a negative value for a certain size field, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted XMF data, aka internal bug 21132860.
Near-miss passage: CVE-2015-4479. CWE: CWE-189. CVSS: 10.0. Multiple integer overflows in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allow remote attackers to execute arbitrary code via a crafted saio chunk in MPEG-4 video data.
Query: explain T1518.001 Security Software Discovery
Matching passage: T1518.001 Security Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Example commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), <code>reg query</code> with [Reg](https://attack.mitre.org/software/S0075), <code>dir</code> with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software. Adversaries may also utilize the [Cloud API](https://attack.mitre.org/techniques/T1059/009) to discover cloud-native security software installed on compute infrastructure, such as the AWS CloudWatch agent, Azure VM Agent, and Google Cloud Monitor agent. These agents may collect metrics and logs from the VM, which may be centrally aggregated in a cloud-based monitoring platform.
Near-miss passage: T1518.002 Backup Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of backup software or configurations that are installed on a system. Adversaries may use this information to shape follow-on behaviors, such as [Data Destruction](https://attack.mitre.org/techniques/T1485), [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486). Commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), `reg query` with [Reg](https://attack.mitre.org/software/S0075), `dir` with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for, such as Veeam, Acronis, Dropbox, or Paragon.(Citation: Symantec Play Ransomware 2023)
Query: patch priority for CVE-2015-7921
Matching passage: CVE-2015-7921. CWE: CWE-255. CVSS: 9.100000381469727. The FTP server in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 has hardcoded credentials, which makes it easier for remote attackers to bypass authentication by leveraging knowledge of these credentials.
Near-miss passage: CVE-2015-7280. CWE: CWE-255. CVSS: 9.800000190734863. The web administration interface on ReadyNet WRT300N-DD devices with firmware 1.0.26 has a default password of admin for the admin account, which allows remote attackers to obtain administrative privileges by leveraging a LAN session.
Query: Sigma rule for Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute
Matching passage: Sigma rule: Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Scrobj.dll COM Hijacking id: fe20dda1-6f37-4379-bbe0-a98d400cae90 status: test description: Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1546.015/T1546.015.md author: frack113 date: 2022-08-20 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: InprocServer32\(Default) Details: C:\WINDOWS\system32\scrobj.dll condition: selection falsepositives: - Legitimate use of the dll. level: medium
Near-miss passage: Sigma rule: Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.. Logsource: windows / registry_set. Rule: title: Microsoft Office Protected View Disabled id: a5c7a43f-6009-4a8c-80c5-32abf1c53ecc related: - id: 7c637634-c95d-4bbf-b26c-a82510874b34 type: obsolete status: test description: Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/ - https://yoroi.company/research/cyber-criminal-espionage-operation-insists-on-italian-manufacturing/ - https://admx.help/HKCU/software/policies/microsoft/office/16.0/excel/security/protectedview author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-06-08 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_set detection: selection_path: TargetObject|contains|all: - \SOFTWARE\Microsoft\Office\ - \Security\ProtectedView\ selection_values_1: Details: DWORD (0x00000001) TargetObject|endswith: - \DisableAttachementsInPV - \DisableInternetFilesInPV - \DisableIntranetCheck - \DisableUnsafeLocationsInPV selection_values_0: Details: DWORD (0x00000000) TargetObject|endswith: - \enabledatabasefileprotectedview - \enableforeigntextfileprotectedview condition: selection_path and 1 of selection_values_* falsepositives: - Unlikely level: high