alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: mitigate Golden Ticket
Matching passage: T1558.001 Golden Ticket. Tactics: credential access. Description: Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TGT), also known as a golden ticket.(Citation: AdSecurity Kerberos GT Aug 2015) Golden tickets enable adversaries to generate authentication material for any account in Active Directory.(Citation: CERT-EU Golden Ticket Protection) Using a golden ticket, adversaries are then able to request ticket granting service (TGS) tickets, which enable access to specific resources. Golden tickets require adversaries to interact with the Key Distribution Center (KDC) in order to obtain TGS.(Citation: ADSecurity Detecting Forged Tickets) The KDC service runs all on domain controllers that are part of an Active Directory domain. KRBTGT is the Kerberos Key Distribution Center (KDC) service account and is responsible for encrypting and signing all Kerberos tickets.(Citation: ADSecurity Kerberos and KRBTGT) The KRBTGT password hash may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) and privileged access to a domain controller.
Near-miss passage: T1558 Steal or Forge Kerberos Tickets. Tactics: credential access. Description: Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder) Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access. On Windows, the built-in <code>klist</code> utility can be used to list and analyze cached Kerberos tickets.(Citation: Microsoft Klist)
Query: risk of Janitza UMG 508, 509, 511, 604, and 605 devices allow remote attackers to obtain sensitive network-connection information via a request to UDP port (1) 1234 or (2) 1235.
Matching passage: CVE-2015-3969. CWE: CWE-200. CVSS: 5.0. Janitza UMG 508, 509, 511, 604, and 605 devices allow remote attackers to obtain sensitive network-connection information via a request to UDP port (1) 1234 or (2) 1235.
Near-miss passage: CVE-2015-7427. CWE: CWE-200. CVSS: 5.0. IBM DataPower Gateway appliances with firmware 6.x before 6.0.0.17, 6.0.1.x before 6.0.1.17, 7.x before 7.0.0.10, 7.1.0.x before 7.1.0.7, and 7.2.x before 7.2.0.1 do not set the secure flag for unspecified cookies in an https session, which makes it easier for remote attackers to capture these cookies by intercepting their transmission within an http session.
Query: detection rule: Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p.
Matching passage: Sigma rule: Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p.. Logsource: windows / process_creation. Rule: title: DLL Execution via Rasautou.exe id: cd3d1298-eb3b-476c-ac67-12847de55813 status: test description: Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p. references: - https://lolbas-project.github.io/lolbas/Binaries/Rasautou/ - https://github.com/fireeye/DueDLLigence - https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html author: Julia Fomina, oscd.community date: 2020-10-09 tags: - attack.stealth - attack.t1218 logsource: product: windows category: process_creation definition: Since options '-d' and '-p' were removed in Windows 10 this rule is relevant only for Windows before 10. And as Windows 7 doesn't log command line in 4688 by default, to detect this attack you need Sysmon 1 configured or KB3004375 installed for command-line auditing (https://support.microsoft.com/en-au/help/3004375/microsoft-security-advisory-update-to-improve-windows-command-line-aud) detection: selection_img: - Image|endswith: \rasautou.exe - OriginalFileName: rasdlui.exe selection_cli: CommandLine|contains|all: - ' -d ' - ' -p ' condition: all of selection* falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "CCleanerReactivator.dll". Logsource: windows / image_load. Rule: title: Potential CCleanerReactivator.DLL Sideloading id: 3735d5ac-d770-4da0-99ff-156b180bc600 status: test description: Detects potential DLL sideloading of "CCleanerReactivator.dll" references: - https://lab52.io/blog/2344-2/ author: X__Junior date: 2023-07-13 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \CCleanerReactivator.dll filter_main_path: Image|startswith: - C:\Program Files\CCleaner\ - C:\Program Files (x86)\CCleaner\ Image|endswith: \CCleanerReactivator.exe condition: selection and not 1 of filter_main_* falsepositives: - False positives could occur from other custom installation paths. Apply additional filters accordingly. level: medium
Query: detect Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands in logs
Matching passage: Sigma rule: Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands. Logsource: linux / auditd. Rule: title: Unix Shell Configuration Modification id: a94cdd87-6c54-4678-a6cc-2814ffe5a13d related: - id: e74e15cc-c4b6-4c80-b7eb-dfe49feb7fe9 type: obsolete status: test description: Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands triggered when a new shell is opened. references: - https://objective-see.org/blog/blog_0x68.html - https://web.archive.org/web/20221204161143/https://www.glitch-cat.com/p/green-lambert-and-attack - https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat author: Peter Matkovski, IAI date: 2023-03-06 modified: 2023-03-15 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.004 logsource: product: linux service: auditd detection: selection: type: PATH name: - /etc/shells - /etc/profile - /etc/profile.d/* - /etc/bash.bashrc - /etc/bashrc - /etc/zsh/zprofile - /etc/zsh/zshrc - /etc/zsh/zlogin - /etc/zsh/zlogout - /etc/csh.cshrc - /etc/csh.login - /root/.bashrc - /root/.bash_profile - /root/.profile - /root/.zshrc - /root/.zprofile - /home/*/.bashrc - /home/*/.zshrc - /home/*/.bash_profile - /home/*/.zprofile - /home/*/.profile - /home/*/.bash_login - /home/*/.bash_logout - /home/*/.zlogin - /home/*/.zlogout condition: selection falsepositives: - Admin or User activity are expected to generate some false positives level: medium
Near-miss passage: Sigma rule: Detects "RegAsm.exe" initiating a network connection to public IP adresses. Logsource: windows / network_connection. Rule: title: RegAsm.EXE Initiating Network Connection To Public IP id: 0531e43a-d77d-47c2-b89f-5fe50321c805 status: test description: Detects "RegAsm.exe" initiating a network connection to public IP adresses references: - https://app.any.run/tasks/ec207948-4916-47eb-a0f4-4c6abb2e7668/ - https://research.splunk.com/endpoint/07921114-6db4-4e2e-ae58-3ea8a52ae93f/ - https://lolbas-project.github.io/lolbas/Binaries/Regasm/ author: frack113 date: 2024-04-25 tags: - attack.stealth - attack.t1218.009 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: \regasm.exe filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-4229
Matching passage: CVE-2015-4229. CWE: CWE-200. CVSS: 5.0. The web framework in Cisco Unified Communications Domain Manager 8.1(4)ER1 allows remote attackers to obtain sensitive information by visiting a bvsmweb URL, aka Bug ID CSCuq22589.
Near-miss passage: CVE-2015-5092. CWE: CWE-200. CVSS: 5.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2014-8450, CVE-2015-4449, CVE-2015-4450, CVE-2015-5088, and CVE-2015-5089.
Query: patch priority for CVE-2015-1467
Matching passage: CVE-2015-1467. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in Translations in Fork CMS before 3.8.6 allow remote authenticated users to execute arbitrary SQL commands via the (1) language[] or (2) type[] parameter to private/en/locale/index.
Near-miss passage: CVE-2015-1428. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1) remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or (2) remote authenticated users to execute arbitrary SQL commands via the value_id parameter in a save_value action to backend/main.php.
Query: CVE similar to CVE-2015-5477
Matching passage: CVE-2015-5477. CWE: CWE-19. CVSS: 7.800000190734863. named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
Near-miss passage: CVE-2015-2255. CWE: CWE-19. CVSS: 5.900000095367432. Huawei AR1220 routers with software before V200R005SPH006 allow remote attackers to cause a denial of service (board reset) via vectors involving a large amount of traffic from the GE port to the FE port.
Query: detection rule: Detects Bitsadmin connections to domains with uncommon TLDs
Matching passage: Sigma rule: Detects Bitsadmin connections to domains with uncommon TLDs. Logsource: proxy. Rule: title: Bitsadmin to Uncommon TLD id: 9eb68894-7476-4cd6-8752-23b51f5883a7 status: test description: Detects Bitsadmin connections to domains with uncommon TLDs references: - https://twitter.com/jhencinski/status/1102695118455349248 - https://isc.sans.edu/forums/diary/Investigating+Microsoft+BITS+Activity/23281/ author: Florian Roth (Nextron Systems), Tim Shelton date: 2019-03-07 modified: 2023-05-17 tags: - attack.command-and-control - attack.execution - attack.stealth - attack.t1071.001 - attack.persistence - attack.t1197 - attack.s0190 logsource: category: proxy detection: selection: c-useragent|startswith: Microsoft BITS/ falsepositives: cs-host|endswith: - .com - .net - .org - .scdn.co - .sfx.ms condition: selection and not falsepositives falsepositives: - Rare programs that use Bitsadmin and update from regional TLDs e.g. .uk or .ca level: high
Near-miss passage: Sigma rule: Detects suspicious changes to the Windows Defender configuration. Logsource: windows / windefend. Rule: title: Windows Defender Configuration Changes id: 801bd44f-ceed-4eb6-887c-11544633c0aa related: - id: 1321dc4e-a1fe-481d-a016-52c45f0c8b4f type: similar - id: a3ab73f1-bd46-4319-8f06-4b20d0617886 type: similar - id: 91903aba-1088-42ee-b680-d6d94fe002b0 type: similar status: stable description: Detects suspicious changes to the Windows Defender configuration references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide - https://bidouillesecurity.com/disable-windows-defender-in-powershell/#DisableAntiSpyware author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-06 modified: 2023-11-24 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: 5007 NewValue|contains: - '\Windows Defender\DisableAntiSpyware ' - '\Windows Defender\Scan\DisableRemovableDriveScanning ' - '\Windows Defender\Scan\DisableScanningMappedNetworkDrivesForFullScan ' - '\Windows Defender\SpyNet\DisableBlockAtFirstSeen ' - '\Real-Time Protection\SpyNetReporting ' condition: selection falsepositives: - Administrator activity (must be investigated) level: high
Query: exploit The PRNG implementation in the DNS resolver in Mozilla Firefox (aka Fennec) before 37.0 on Android does not properly generate random numbers for query ID values and UDP source port
Matching passage: CVE-2015-0800. CWE: CWE-200. CVSS: 5.0. The PRNG implementation in the DNS resolver in Mozilla Firefox (aka Fennec) before 37.0 on Android does not properly generate random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a related issue to CVE-2012-2808.
Near-miss passage: CVE-2015-6557. CWE: CWE-200. CVSS: 2.0999999046325684. IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 5.5 before 5.5.6.1, 6.3 before 6.3.1.5, 6.4 before 6.4.1.7, and 7.1 before 7.1.2; Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 5.5 before 5.5.1.1, 6.1 before 6.1.3.7, 6.3 before 6.3.1.5, 6.4 before 6.4.1.7, and 7.1 before 7.1.2; and Tivoli Storage FlashCopy Manager 3.1 before 3.1.1.5, 3.2 before 3.2.1.7, and 4.1 before 4.1.2, when application tracing is used, place cleartext passwords in exception messages, which allows physically proximate attackers to obtain sensitive information by reading trace output, a different vulnerability than CVE-2015-4949.
Query: patch priority for CVE-2015-3046
Matching passage: CVE-2015-3046. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-9161, CVE-2015-3049, CVE-2015-3050, CVE-2015-3051, CVE-2015-3052, CVE-2015-3056, CVE-2015-3057, CVE-2015-3070, and CVE-2015-3076.
Near-miss passage: CVE-2015-5689. CWE: CWE-119. CVSS: 6.800000190734863. ghostexp.exe in Ghost Explorer Utility in Symantec Ghost Solutions Suite (GSS) before 3.0 HF2 12.0.0.8010 and Symantec Deployment Solution (DS) before 7.6 HF4 12.0.0.7045 performs improper sign-extend operations before array-element accesses, which allows remote attackers to execute arbitrary code, cause a denial of service (application crash), or possibly obtain sensitive information via a crafted Ghost image.
Query: detection engineering for Network Device Firewall
Matching passage: T1686.002 Network Device Firewall. Tactics: defense impairment. Description: Adversaries may disable network device-based firewall mechanisms entirely or add, delete, or modify particular rules in order to bypass controls limiting network usage. Adversaries may obtain access to devices such as routers, switches, or other perimeter/network devices and change access control lists (ACLs), security zones, or policy rules to permit otherwise blocked traffic. For example, adversaries may add new network firewall rules to allow access to all internal network subnets without restrictions. Allowing access to internal network subsets may enable unrestricted inbound/outbound connectivity or open paths for command and control and lateral movement. Adversaries may obtain access to network device management interfaces via [Valid Accounts](https://attack.mitre.org/techniques/T1078) or by exploiting vulnerabilities. In some cases, threat actors may target firewalls and other network infrastructure that are exposed to the internet by leveraging weaknesses in public-facing applications ([Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).(Citation: CVE-2024-55591 Detail) Adversaries may also modify host networking configurations that indirectly manipulate system firewalls, such as adjusting interface bandwidth or network connection request thresholds.
Near-miss passage: T1686 Disable or Modify System Firewall. Tactics: defense impairment. Description: Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gathered sufficient privileges, they can tamper with firewall services, policies, or rule sets to remove restrictions on inbound or outbound traffic. For example, this may include turning off firewall profiles, altering existing rules to permit previously blocked ports or protocols, or adding new rules that create covert communication paths (e.g., adding a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port.(Citation: change_rdp_port_conti) Adversaries may disable or modify firewalls using different behaviors, depending on the platform. For example, in ESXi, firewall rules may be modified directly via the esxcli (e.g., via esxcli network firewall set) or via the vCenter user interface.(Citation: Broadcom ESXi Firewall)(Citation: Trellix Rnasomhouse 2024)
Query: Sigma rule for Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations s
Matching passage: Sigma rule: Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations s. Logsource: windows / registry_set. Rule: title: ClickOnce Trust Prompt Tampering id: ac9159cc-c364-4304-8f0a-d63fc1a0aabb status: test description: Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet. references: - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5 - https://learn.microsoft.com/en-us/visualstudio/deployment/how-to-configure-the-clickonce-trust-prompt-behavior author: '@SerkinValery, Nasreddine Bencherchali (Nextron Systems)' date: 2023-06-12 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel\ TargetObject|endswith: - \Internet - \LocalIntranet - \MyComputer - \TrustedSites - \UntrustedSites Details: Enabled condition: selection falsepositives: - Legitimate internal requirements. level: medium
Near-miss passage: Sigma rule: Detects when changes are made to the SSH certificate configuration of the organization.. Logsource: github / audit. Rule: title: Github SSH Certificate Configuration Changed id: 2f575940-d85e-4ddc-af13-17dad6f1a0ef status: test description: Detects when changes are made to the SSH certificate configuration of the organization. references: - https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-git-access-to-your-organizations-repositories/about-ssh-certificate-authorities - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#ssh_certificate_authority author: Romain Gaillard (@romain-gaillard) date: 2024-07-29 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.stealth - attack.t1078.004 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action: - ssh_certificate_authority.create - ssh_certificate_requirement.disable condition: selection falsepositives: - Allowed administrative activities. level: medium
Query: Sigma rule for Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin pr
Matching passage: Sigma rule: Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin pr. Logsource: windows / process_creation. Rule: title: Writing Of Malicious Files To The Fonts Folder id: ae9b0bd7-8888-4606-b444-0ed7410cb728 status: test description: Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ author: Sreeman date: 2020-04-21 modified: 2022-03-08 tags: - attack.stealth - attack.t1211 - attack.t1059 - attack.persistence - attack.execution logsource: product: windows category: process_creation detection: selection_1: CommandLine|contains: - echo - copy - type - file createnew - cacls selection_2: CommandLine|contains: C:\Windows\Fonts\ selection_3: CommandLine|contains: - .sh - .exe - .dll - .bin - .bat - .cmd - .js - .msh - .reg - .scr - .ps - .vb - .jar - .pl - '.inf' - .cpl - .hta - .msi - .vbs condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36). Logsource: windows / file_event. Rule: title: UAC Bypass Using NTFS Reparse Point - File id: 7fff6773-2baa-46de-a24a-b6eec1aba2d1 status: test description: Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: C:\Users\ TargetFilename|endswith: \AppData\Local\Temp\api-ms-win-core-kernel32-legacy-l1.DLL condition: selection falsepositives: - Unknown level: high