alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry
Matching passage: Sigma rule: Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry. Logsource: windows / registry_set. Rule: title: Enable LM Hash Storage id: c420410f-c2d8-4010-856b-dffe21866437 related: - id: 98dedfdd-8333-49d4-9f23-d7018cccae53 type: similar status: test description: 'Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases. ' references: - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a - https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password - https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-12-15 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: System\CurrentControlSet\Control\Lsa\NoLMHash Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects PAExec default named pipe. Logsource: windows / pipe_created. Rule: title: PUA - PAExec Default Named Pipe id: f6451de4-df0a-41fa-8d72-b39f54a08db5 status: test description: Detects PAExec default named pipe references: - https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/efa17a600b43c897b4b7463cc8541daa1987eeb4/Command%20and%20Control/C2-NamedPipe.md - https://github.com/poweradminllc/PAExec author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-26 tags: - attack.execution - attack.t1569.002 logsource: category: pipe_created product: windows definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName|startswith: \PAExec condition: selection falsepositives: - Unknown level: medium
Query: write Sigma for Detects powershell scripts that import modules from suspicious directories
Matching passage: Sigma rule: Detects powershell scripts that import modules from suspicious directories. Logsource: windows / process_creation. Rule: title: Import PowerShell Modules From Suspicious Directories - ProcCreation id: c31364f7-8be6-4b77-8483-dd2b5a7b69a3 related: - id: 21f9162c-5f5d-4b01-89a8-b705bd7d10ab type: similar status: test description: Detects powershell scripts that import modules from suspicious directories references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-10 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - Import-Module "$Env:Temp\ - Import-Module '$Env:Temp\ - Import-Module $Env:Temp\ - Import-Module "$Env:Appdata\ - Import-Module '$Env:Appdata\ - Import-Module $Env:Appdata\ - Import-Module C:\Users\Public\ - ipmo "$Env:Temp\ - ipmo '$Env:Temp\ - ipmo $Env:Temp\ - ipmo "$Env:Appdata\ - ipmo '$Env:Appdata\ - ipmo $Env:Appdata\ - ipmo C:\Users\Public\ condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer). Logsource: windows / image_load. Rule: title: Potential Iviewers.DLL Sideloading id: 4c21b805-4dd7-469f-b47d-7383a8fcb437 status: test description: Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer) references: - https://www.secureworks.com/research/shadowpad-malware-analysis author: X__Junior (Nextron Systems) date: 2023-03-21 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \iviewers.dll filter: ImageLoaded|startswith: - C:\Program Files (x86)\Windows Kits\ - C:\Program Files\Windows Kits\ condition: selection and not filter falsepositives: - Unknown level: high
Query: detection rule: Detects RunDLL32.exe spawning explorer.exe as child, which is very uncommon, often observes Gamarue spawning the explore
Matching passage: Sigma rule: Detects RunDLL32.exe spawning explorer.exe as child, which is very uncommon, often observes Gamarue spawning the explore. Logsource: windows / process_creation. Rule: title: RunDLL32 Spawning Explorer id: caa06de8-fdef-4c91-826a-7f9e163eef4b status: test description: Detects RunDLL32.exe spawning explorer.exe as child, which is very uncommon, often observes Gamarue spawning the explorer.exe process in an unusual way references: - https://redcanary.com/blog/intelligence-insights-november-2021/ author: elhoim, CD_ROM_ date: 2022-04-27 modified: 2022-05-25 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \rundll32.exe Image|endswith: \explorer.exe filter: ParentCommandLine|contains: \shell32.dll,Control_RunDLL condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects unsigned module load by ClickOnce application.. Logsource: windows / image_load. Rule: title: Unsigned Module Loaded by ClickOnce Application id: 060d5ad4-3153-47bb-8382-43e5e29eda92 status: test description: Detects unsigned module load by ClickOnce application. references: - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5 author: '@SerkinValery' date: 2023-06-08 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection_path: Image|contains: \AppData\Local\Apps\2.0\ selection_sig_status: - Signed: 'false' - SignatureStatus: Expired condition: all of selection_* falsepositives: - Unlikely level: medium
Query: exploit The host memory mapping path feature in the NVIDIA GPU graphics driver R346 before 346.87 and R352 before 352.41 for Linux and R352 before 352.46 for GRID vGPU and vSGA does not pr
Matching passage: CVE-2015-5053. CWE: CWE-284. CVSS: 10.0. The host memory mapping path feature in the NVIDIA GPU graphics driver R346 before 346.87 and R352 before 352.41 for Linux and R352 before 352.46 for GRID vGPU and vSGA does not properly restrict access to third-party device IO memory, which allows attackers to gain privileges, cause a denial of service (resource consumption), or possibly have unspecified other impact via unknown vectors related to the follow_pfn kernel-mode API call.
Near-miss passage: CVE-2015-1464. CWE: CWE-284. CVSS: 6.400000095367432. RT (aka Request Tracker) before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL.
Query: Persistence mechanism resembling Plist File Modification
Matching passage: T1647 Plist File Modification. Tactics: defense impairment. Description: Adversaries may modify property list files (plist files) to enable other malicious activity, while also potentially evading and bypassing system defenses. macOS applications use plist files, such as the <code>info.plist</code> file, to store properties and configuration settings that inform the operating system how to handle the application at runtime. Plist files are structured metadata in key-value pairs formatted in XML based on Apple's Core Foundation DTD. Plist files can be saved in text or binary format.(Citation: fileinfo plist file description) Adversaries can modify key-value pairs in plist files to influence system behaviors, such as hiding the execution of an application (i.e. [Hidden Window](https://attack.mitre.org/techniques/T1564/003)) or running additional commands for persistence (ex: [Launch Agent](https://attack.mitre.org/techniques/T1543/001)/[Launch Daemon](https://attack.mitre.org/techniques/T1543/004) or [Re-opened Applications](https://attack.mitre.org/techniques/T1547/007)). For example, adversaries can add a malicious application path to the `~/Library/Preferences/com.apple.dock.plist` file, which controls apps that appear in the Dock. Adversaries can also modify the <code>LSUIElement</code> key in an application’s <code>info.plist</code> file to run the app in the background. Adversaries can also insert key-value pairs to insert environment variables, such as <code>LSEnvironment</code>, to enable persistence via [Dynamic Linker Hijacking](https://attack.mitre.org/techniques/T1574/006).(Citation: wardle chp2 persistence)(Citation: eset_osx_flashback)
Near-miss passage: T1600.001 Reduce Key Space. Tactics: defense impairment. Description: Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.(Citation: Cisco Synful Knock Evolution) Adversaries can weaken the encryption software on a compromised network device by reducing the key size used by the software to convert plaintext to ciphertext (e.g., from hundreds or thousands of bytes to just a couple of bytes). As a result, adversaries dramatically reduce the amount of effort needed to decrypt the protected information without the key. Adversaries may modify the key size used and other encryption parameters using specialized commands in a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) introduced to the system through [Modify System Image](https://attack.mitre.org/techniques/T1601) to change the configuration of the device. (Citation: Cisco Blog Legacy Device Attacks)
Query: patch priority for CVE-2015-5325
Matching passage: CVE-2015-5325. CWE: CWE-284. CVSS: 7.5. Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3665.
Near-miss passage: CVE-2015-4051. CWE: CWE-284. CVSS: 9.0. Beckhoff IPC Diagnostics before 1.8 does not properly restrict access to functions in /config, which allows remote attackers to cause a denial of service (reboot or shutdown), create arbitrary users, or possibly have unspecified other impact via a crafted request, as demonstrated by a beckhoff.com:service:cxconfig:1#Write SOAP action to /upnpisapi.
Query: CVE similar to CVE-2015-9069
Matching passage: CVE-2015-9069. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, the Secure File System can become corrupted.
Near-miss passage: CVE-2015-9131. CWE: CWE-20. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400, SD 410/12, SD 615/16/SD 415, SD 800, SD 808, and SD 810, lack of input validation in qsee can lead to unauthorized memory access.
Query: patch priority for CVE-2015-9274
Matching passage: CVE-2015-9274. CWE: CWE-125. CVSS: 6.5. HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service (invalid read of two bytes and application crash) because of GPOS and GSUB table mishandling, related to hb-ot-layout-gpos-table.hh, hb-ot-layout-gsub-table.hh, and hb-ot-layout-gsubgpos-private.hh.
Near-miss passage: CVE-2015-8920. CWE: CWE-125. CVSS: 5.5. The _ar_read_header function in archive_read_support_format_ar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds stack read) via a crafted ar file.
Query: patch priority for CVE-2015-7186
Matching passage: CVE-2015-7186. CWE: CWE-200. CVSS: 4.300000190734863. Mozilla Firefox before 42.0 on Android allows user-assisted remote attackers to bypass the Same Origin Policy and trigger (1) a download or (2) cached profile-data reading via a file: URL in a saved HTML document.
Near-miss passage: CVE-2015-4527. CWE: CWE-200. CVSS: 7.800000190734863. Directory traversal vulnerability in EMC Avamar Server 7.x before 7.1.2 and Avamar Virtual Addition (AVE) 7.x before 7.1.2 allows remote attackers to read arbitrary files by using the Avamar Desktop/Laptop client interface to send crafted parameters.
Query: risk of server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the jav
Matching passage: CVE-2015-2913. CWE: CWE-200. CVSS: 5.900000095367432. server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values, which makes it easier for remote attackers to predict a value by determining the internal state of the PRNG in this class.
Near-miss passage: CVE-2015-5015. CWE: CWE-200. CVSS: 5.0. IBM WebSphere Commerce Enterprise 7.0.0.9 and 8.x before Feature Pack 8 allows remote attackers to obtain sensitive information via a crafted REST URL.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the expansion or decompression of cabinet files from potentially suspicious or uncommon locations, e.g. seen in. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Cabinet File Expansion id: 9f107a84-532c-41af-b005-8d12a607639f status: test description: Detects the expansion or decompression of cabinet files from potentially suspicious or uncommon locations, e.g. seen in Iranian MeteorExpress related attacks references: - https://labs.sentinelone.com/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll - https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/ author: Bhabesh Raj, X__Junior (Nextron Systems) date: 2021-07-30 modified: 2024-11-13 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_cmd: Image|endswith: \expand.exe CommandLine|contains|windash: '-F:' selection_folders_1: CommandLine|contains: - :\Perflogs\ - :\ProgramData - :\Users\Public\ - :\Windows\Temp\ - \Admin$\ - \AppData\Local\Temp\ - \AppData\Roaming\ - \C$\ - \Temporary Internet selection_folders_2: - CommandLine|contains|all: - :\Users\ - \Favorites\ - CommandLine|contains|all: - :\Users\ - \Favourites\ - CommandLine|contains|all: - :\Users\ - \Contacts\ filter_optional_dell: ParentImage: C:\Program Files (x86)\Dell\UpdateService\ServiceShell.exe CommandLine|contains: C:\ProgramData\Dell\UpdateService\Temp\ condition: selection_cmd and 1 of selection_folders_* and not 1 of filter_optional_* falsepositives: - System administrator Usage level: medium
Near-miss passage: Sigma rule: Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration. Logsource: windows / dns_query. Rule: title: DNS Query To Ufile.io id: 1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b related: - id: 090ffaad-c01a-4879-850c-6d57da98452d type: similar status: test description: Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration references: - https://thedfirreport.com/2021/12/13/diavol-ransomware/ author: yatinwad, TheDFIRReport date: 2022-06-23 modified: 2023-09-18 tags: - attack.exfiltration - attack.t1567.002 logsource: product: windows category: dns_query detection: selection: QueryName|contains: ufile.io condition: selection falsepositives: - DNS queries for "ufile" are not malicious by nature necessarily. Investigate the source to determine the necessary actions to take level: low
Query: CVE similar to CVE-2015-2827
Matching passage: CVE-2015-2827. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in CA Spectrum 9.2.x and 9.3.x before 9.3 H02 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-7459. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108355.
Query: CVE similar to CVE-2015-2729
Matching passage: CVE-2015-2729. CWE: CWE-119. CVSS: 5.0. The AudioParamTimeline::AudioNodeInputValue function in the Web Audio implementation in Mozilla Firefox before 39.0 and Firefox ESR 38.x before 38.1 does not properly calculate an oscillator rendering range, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via unspecified vectors.
Near-miss passage: CVE-2015-6492. CWE: CWE-119. CVSS: 7.5. Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allow remote attackers to cause a denial of service (memory corruption and device crash) via a crafted HTTP request.
Query: vulnerability: Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly restrict the availability of Flowplayer, which allows remote attackers to c
Matching passage: CVE-2015-5337. CWE: CWE-79. CVSS: 6.099999904632568. Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly restrict the availability of Flowplayer, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted .swf file.
Near-miss passage: CVE-2015-2850. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in index-login.ant in the ANTlabs InnGate firmware on IG 3100, InnGate 3.01 E, InnGate 3.10 E, InnGate 3.10 M, SG 4, and SSG 4 devices allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
Query: SIEM correlation: initial access activity consistent with Supply Chain Compromise
Matching passage: T1195 Supply Chain Compromise. Tactics: initial access. Description: Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise can take place at any stage of the supply chain including: * Manipulation of development tools * Manipulation of a development environment * Manipulation of source code repositories (public or private) * Manipulation of source code in open-source dependencies * Manipulation of software update/distribution mechanisms * Compromised/infected system images (removable media infected at the factory)(Citation: IBM Storwize)(Citation: Schneider Electric USB Malware) * Replacement of legitimate software with modified versions * Sales of modified/counterfeit products to legitimate distributors * Shipment interdiction While supply chain compromise can impact any component of hardware or software, adversaries looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels.(Citation: Avast CCleaner3 2018)(Citation: Microsoft Dofoil 2018)(Citation: Command Five SK 2011) Adversaries may limit targeting to a desired victim set or distribute malicious software to a broad set of consumers but only follow up with specific victims.(Citation: Symantec Elderwood Sept 2012)(Citation: Avast CCleaner3 2018)(Citation: Command Five SK 2011) Popular open-source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise) In some cases, adversaries may conduct “second-order” supply chain compromises by leveraging the access gained from an initial supply chain compromise to further compromise a software component.(Citation: Krebs 3cx overview 2023) This may allow the threat actor to spread to even more victims.
Near-miss passage: T1195.002 Compromise Software Supply Chain. Tactics: initial access. Description: Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version. Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.(Citation: Avast CCleaner3 2018)(Citation: Command Five SK 2011)
Query: telemetry for T1036.006
Matching passage: T1036.006 Space after Filename. Tactics: stealth. Description: Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system. For example, if there is a Mach-O executable file called <code>evil.bin</code>, when it is double clicked by a user, it will launch Terminal.app and execute. If this file is renamed to <code>evil.txt</code>, then when double clicked by a user, it will launch with the default text editing application (not executing the binary). However, if the file is renamed to <code>evil.txt </code> (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed (Citation: Mac Backdoors are back). Adversaries can use this feature to trick users into double clicking benign-looking files of any format and ultimately executing something malicious.
Near-miss passage: T1036.010 Masquerade Account Name. Tactics: stealth. Description: Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign. This will typically occur during [Create Account](https://attack.mitre.org/techniques/T1136), although accounts may also be renamed at a later date. This may also coincide with [Account Access Removal](https://attack.mitre.org/techniques/T1531) if the actor first deletes an account before re-creating one with the same name.(Citation: Huntress MOVEit 2023) Often, adversaries will attempt to masquerade as service accounts, such as those associated with legitimate software, data backups, or container cluster management.(Citation: Elastic CUBA Ransomware 2022)(Citation: Aquasec Kubernetes Attack 2023) They may also give accounts generic, trustworthy names, such as “admin”, “help”, or “root.”(Citation: Invictus IR Cloud Ransomware 2024) Sometimes adversaries may model account names off of those already existing in the system, as a follow-on behavior to [Account Discovery](https://attack.mitre.org/techniques/T1087). Note that this is distinct from [Impersonation](https://attack.mitre.org/techniques/T1684/001), which describes impersonating specific trusted individuals or organizations, rather than user or service account names.