alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR in logs
Matching passage: Sigma rule: Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR. Logsource: rpc_firewall / application. Rule: title: Remote Server Service Abuse for Lateral Movement id: 10018e73-06ec-46ec-8107-9172f1e04ff2 status: test description: Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SCMR.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.lateral-movement - attack.execution - attack.t1569.002 logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:367abb81-9844-35f1-ad32-98f038001003' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 367abb81-9844-35f1-ad32-98f038001003 condition: selection falsepositives: - Administrative tasks on remote services level: high
Near-miss passage: Sigma rule: Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file. Logsource: windows / file_event. Rule: title: HackTool - NPPSpy Hacktool Usage id: cad1fe90-2406-44dc-bd03-59d0b58fe722 status: test description: Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003/T1003.md#atomic-test-2---credential-dumping-with-nppspy - https://twitter.com/0gtweet/status/1465282548494487554 author: Florian Roth (Nextron Systems) date: 2021-11-29 modified: 2024-06-27 tags: - attack.credential-access logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \NPPSpy.txt - \NPPSpy.dll condition: selection falsepositives: - Unknown level: high
Query: adversary uses System Checks
Matching passage: T1497.001 System Checks. Tactics: stealth, discovery. Description: Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness) Specific checks will vary based on the target and/or adversary, but may involve behaviors such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047), [PowerShell](https://attack.mitre.org/techniques/T1059/001), [System Information Discovery](https://attack.mitre.org/techniques/T1082), and [Query Registry](https://attack.mitre.org/techniques/T1012) to obtain system information and search for VME artifacts. Adversaries may search for VME artifacts in memory, processes, file system, hardware, and/or the Registry. Adversaries may use scripting to automate these checks into one script and then have the program exit if it determines the system to be a virtual environment. Checks could include generic system properties such as host/domain name and samples of network traffic. Adversaries may also check the network adapters addresses, CPU core count, and available memory/drive size. Once executed, malware may also use [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) to check if it was saved in a folder or file with unexpected or even analysis-related naming artifacts such as `malware`, `sample`, or `hash`. Other common checks may enumerate services running that are unique to these applications, installed programs on the
Near-miss passage: T1497.003 Time Based Checks. Tactics: stealth, discovery. Description: Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. This may include enumerating time-based properties, such as uptime or the system clock. Adversaries may use calls like `GetTickCount` and `GetSystemTimeAsFileTime` to discover if they are operating within a virtual machine or sandbox, or may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.(Citation: ISACA Malware Tricks)
Query: EDR alert: possible SNMP (MIB Dump) (T1602.001)
Matching passage: T1602.001 SNMP (MIB Dump). Tactics: collection. Description: Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP). The MIB is a configuration repository that stores variable information accessible via SNMP in the form of object identifiers (OID). Each OID identifies a variable that can be read or set and permits active management tasks, such as configuration changes, through remote modification of these variables. SNMP can give administrators great insight in their systems, such as, system information, description of hardware, physical location, and software packages(Citation: SANS Information Security Reading Room Securing SNMP Securing SNMP). The MIB may also contain device operational information, including running configuration, routing table, and interface details. Adversaries may use SNMP queries to collect MIB content directly from SNMP-managed devices in order to collect network information that allows the adversary to build network maps and facilitate future targeted exploitation.(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks)
Near-miss passage: T1602.002 Network Device Configuration Dump. Tactics: collection. Description: Adversaries may access network configuration files to collect sensitive data about the device and the network. The network configuration is a file containing parameters that determine the operation of the device. The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset. Adversaries can inspect the configuration files to reveal information about the target network and its layout, the network device and its software, or identifying legitimate accounts and credentials for later use. Adversaries can use common management tools and protocols, such as Simple Network Management Protocol (SNMP) and Smart Install (SMI), to access network configuration files.(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks) These tools may be used to query specific data from a configuration repository or configure the device to export the configuration for later analysis.
Query: exploit Unspecified vulnerability in IBM WebSphere Commerce 7.0.0.6 through 7.0.0.9 allows remote authenticated users to obtain sensitive personal information via unknown vectors.
Matching passage: CVE-2015-4980. CWE: CWE-200. CVSS: 4.0. Unspecified vulnerability in IBM WebSphere Commerce 7.0.0.6 through 7.0.0.9 allows remote authenticated users to obtain sensitive personal information via unknown vectors.
Near-miss passage: CVE-2015-5045. CWE: CWE-200. CVSS: 3.299999952316284. The Administration and Reporting tool in IBM Rational License Key Server (RLKS) before 8.1.4.9 iFix 04 allows local users to obtain sensitive information via unspecified vectors. IBM X-Force ID: 106938.
Query: secure coding against Context Switching Race Condition
Matching passage: CWE-368 Context Switching Race Condition. A product performs a series of non-atomic actions to switch between contexts that cross privilege or other security boundaries, but a race condition allows an attacker to modify or misrepresent the product's behavior during the switch.
Near-miss passage: CWE-268 Privilege Chaining. Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.
Query: Lateral movement indicators for Data Obfuscation
Matching passage: T1001 Data Obfuscation. Tactics: command and control. Description: Adversaries may obfuscate command and control traffic to make it more difficult to detect.(Citation: Bitdefender FunnyDream Campaign November 2020) Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Near-miss passage: T1001.002 Steganography. Tactics: command and control. Description: Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.
Query: risk of Use-after-free vulnerability in the my_login function in DBD::mysql before 4.033_01 allows attackers to have unspecified impact by leveraging a call to mysql_errno after a failure 
Matching passage: CVE-2015-8949. CWE: CWE-416. CVSS: 9.800000190734863. Use-after-free vulnerability in the my_login function in DBD::mysql before 4.033_01 allows attackers to have unspecified impact by leveraging a call to mysql_errno after a failure of my_login.
Near-miss passage: CVE-2015-5095. CWE: CWE-416. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-4448, CVE-2015-5099, CVE-2015-5101, CVE-2015-5111, CVE-2015-5113, and CVE-2015-5114.
Query: detect Detects suspicious addition to BitLocker related registry keys via the reg.exe utility in logs
Matching passage: Sigma rule: Detects suspicious addition to BitLocker related registry keys via the reg.exe utility. Logsource: windows / process_creation. Rule: title: Suspicious Reg Add BitLocker id: 0e0255bf-2548-47b8-9582-c0955c9283f5 status: test description: Detects suspicious addition to BitLocker related registry keys via the reg.exe utility references: - https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/ author: frack113 date: 2021-11-15 modified: 2022-09-09 tags: - attack.impact - attack.t1486 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - REG - ADD - \SOFTWARE\Policies\Microsoft\FVE - /v - /f CommandLine|contains: - EnableBDEWithNoTPM - UseAdvancedStartup - UseTPM - UseTPMKey - UseTPMKeyPIN - RecoveryKeyMessageSource - UseTPMPIN - RecoveryKeyMessage condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential. Logsource: windows / ps_script. Rule: title: Create Volume Shadow Copy with Powershell id: afd12fed-b0ec-45c9-a13d-aa86625dac81 status: test description: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1&viewFallbackFrom=powershell-7 author: frack113 date: 2022-01-12 tags: - attack.credential-access - attack.t1003.003 - attack.ds0005 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Win32_ShadowCopy - ).Create( - ClientAccessible condition: selection falsepositives: - Legitimate PowerShell scripts level: high
Query: CVE similar to CVE-2015-4553
Matching passage: CVE-2015-4553. CWE: CWE-434. CVSS: 8.800000190734863. A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell.
Near-miss passage: CVE-2015-9341. CWE: CWE-434. CVSS: 7.5. The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files.
Query: risk of The Proxy Mobile IPv6 (PMIPv6) component in the CDMA implementation on Cisco ASR 5000 devices with software 19.0.M0.60737 allows remote attackers to cause a denial of service (hamg
Matching passage: CVE-2015-6340. CWE: CWE-119. CVSS: 5.0. The Proxy Mobile IPv6 (PMIPv6) component in the CDMA implementation on Cisco ASR 5000 devices with software 19.0.M0.60737 allows remote attackers to cause a denial of service (hamgr process restart) via a crafted header in a PMIPv6 packet, aka Bug ID CSCuv63280.
Near-miss passage: CVE-2015-8614. CWE: CWE-119. CVSS: 7.300000190734863. Multiple stack-based buffer overflows in the (1) conv_jistoeuc, (2) conv_euctojis, and (3) conv_sjistoeuc functions in codeconv.c in Claws Mail before 3.13.1 allow remote attackers to have unspecified impact via a crafted email, involving Japanese character set conversion.
Query: describe CVE-2015-6454
Matching passage: CVE-2015-6454. CWE: UNKNOWN. CVSS: 5.0. Everest PeakHMI before 8.7.0.2, when the video server is used, allows remote attackers to cause a denial of service (incorrect pointer dereference and daemon crash) via a crafted packet.
Near-miss passage: CVE-2015-2029. CWE: UNKNOWN. CVSS: 4.300000190734863. Session fixation vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote attackers to hijack web sessions via a session identifier.
Query: risk of Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name.
Matching passage: CVE-2015-7528. CWE: CWE-200. CVSS: 5.300000190734863. Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name.
Near-miss passage: CVE-2015-3764. CWE: CWE-200. CVSS: 4.300000190734863. Notification Center in Apple OS X before 10.10.5 does not properly remove dismissed notifications, which allows attackers to read arbitrary notifications via a crafted app.
Query: risk of The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors.
Matching passage: CVE-2015-9347. CWE: CWE-79. CVSS: 6.099999904632568. The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors.
Near-miss passage: CVE-2015-5956. CWE: CWE-79. CVSS: 3.5. The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting (XSS) attacks via a base64 encoded data URI, as demonstrated by the (1) returnUrl parameter to show_rechis.php and the (2) redirect_url parameter to index.php.
Query: CVE similar to CVE-2015-4487
Matching passage: CVE-2015-4487. CWE: CWE-119. CVSS: 7.5. The nsTSubstring::ReplacePrep function in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, related to an "overflow."
Near-miss passage: CVE-2015-6146. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6145.
Query: exploit Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allow remote attackers to cause a denial of service (memory corruption and device cra
Matching passage: CVE-2015-6492. CWE: CWE-119. CVSS: 7.5. Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allow remote attackers to cause a denial of service (memory corruption and device crash) via a crafted HTTP request.
Near-miss passage: CVE-2015-6122. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: exploit fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1132, CVE-201
Matching passage: CVE-2015-1131. CWE: CWE-20. CVSS: 7.199999809265137. fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1132, CVE-2015-1133, CVE-2015-1134, and CVE-2015-1135.
Near-miss passage: CVE-2015-0228. CWE: CWE-20. CVSS: 5.0. The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function.
Query: CVE similar to CVE-2015-1906
Matching passage: CVE-2015-1906. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-8606. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.x before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Locale or (2) FailedLoginCount parameter to admin/security/EditForm/field/Members/item/new/ItemEditForm.
Query: risk of The multi-block feature in the ssl3_write_bytes function in s3_pkt.c in OpenSSL 1.0.2 before 1.0.2a on 64-bit x86 platforms with AES NI support does not properly handle certain non
Matching passage: CVE-2015-0290. CWE: CWE-17. CVSS: 5.0. The multi-block feature in the ssl3_write_bytes function in s3_pkt.c in OpenSSL 1.0.2 before 1.0.2a on 64-bit x86 platforms with AES NI support does not properly handle certain non-blocking I/O cases, which allows remote attackers to cause a denial of service (pointer corruption and application crash) via unspecified vectors.
Near-miss passage: CVE-2015-2042. CWE: CWE-17. CVSS: 4.599999904632568. net/rds/sysctl.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table, which allows local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry.
Query: detect Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks. in logs
Matching passage: Sigma rule: Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.. Logsource: rpc_firewall / application. Rule: title: Possible DCSync Attack id: 56fda488-113e-4ce9-8076-afc2457922c3 status: test description: Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks. references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47?redirectedfrom=MSDN - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-DRSR.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.t1033 - attack.discovery logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes, enable DRSR UUID (e3514235-4b06-11d1-ab04-00c04fc2dcd2) for "dangerous" opcodes (not 0,1 or 12) only from trusted IPs (DCs)' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: e3514235-4b06-11d1-ab04-00c04fc2dcd2 filter: OpNum: - 0 - 1 - 12 condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of the RunXCmd tool to execute commands with System or TrustedInstaller accounts. Logsource: windows / process_creation. Rule: title: PUA - RunXCmd Execution id: 93199800-b52a-4dec-b762-75212c196542 status: test description: Detects the use of the RunXCmd tool to execute commands with System or TrustedInstaller accounts references: - https://www.d7xtech.com/free-software/runx/ - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/ author: Florian Roth (Nextron Systems) date: 2022-01-24 modified: 2023-02-14 tags: - attack.execution - attack.t1569.002 - attack.s0029 logsource: category: process_creation product: windows detection: selection_account: CommandLine|contains: - ' /account=system ' - ' /account=ti ' selection_exec: CommandLine|contains: /exec= condition: all of selection_* falsepositives: - Legitimate use by administrators level: high
Query: write Sigma for Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and
Matching passage: Sigma rule: Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and. Logsource: windows / process_creation. Rule: title: HackTool - TruffleSnout Execution id: 69ca006d-b9a9-47f5-80ff-ecd4d25d481a status: test description: Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and targeted low noise enumeration. references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1482/T1482.md - https://github.com/dsnezhkov/TruffleSnout - https://github.com/dsnezhkov/TruffleSnout/blob/7c2f22e246ef704bc96c396f66fa854e9ca742b9/TruffleSnout/Docs/USAGE.md author: frack113 date: 2022-08-20 modified: 2023-02-13 tags: - attack.discovery - attack.t1482 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: TruffleSnout.exe - Image|endswith: \TruffleSnout.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when an user assumed another user account.. Logsource: onelogin / onelogin.events. Rule: title: OneLogin User Assumed Another User id: 62fff148-278d-497e-8ecd-ad6083231a35 status: test description: Detects when an user assumed another user account. references: - https://developers.onelogin.com/api-docs/1/events/event-resource author: Austin Songer @austinsonger date: 2021-10-12 modified: 2022-12-25 tags: - attack.impact logsource: product: onelogin service: onelogin.events detection: selection: event_type_id: 3 condition: selection falsepositives: - Unknown level: low