alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Network Device Authentication
Matching passage: T1556.004 Network Device Authentication. Tactics: defense impairment, persistence, credential access. Description: Adversaries may use [Patch System Image](https://attack.mitre.org/techniques/T1601/001) to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices. [Modify System Image](https://attack.mitre.org/techniques/T1601) may include implanted code to the operating system for network devices to provide access for adversaries using a specific password. The modification includes a specific password which is implanted in the operating system image via the patch. Upon authentication attempts, the inserted code will first check to see if the user input is the password. If so, access is granted. Otherwise, the implanted code will pass the credentials on for verification of potentially valid credentials.(Citation: Mandiant - Synful Knock)
Near-miss passage: T1556.001 Domain Controller Authentication. Tactics: defense impairment, persistence, credential access. Description: Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts. Malware may be used to inject false credentials into the authentication process on a domain controller with the intent of creating a backdoor used to access any user’s account and/or credentials (ex: [Skeleton Key](https://attack.mitre.org/software/S0007)). Skeleton key works through a patch on an enterprise domain controller authentication process (LSASS) with credentials that adversaries may use to bypass the standard authentication system. Once patched, an adversary can use the injected password to successfully authenticate as any domain user account (until the the skeleton key is erased from memory by a reboot of the domain controller). Authenticated access may enable unfettered access to hosts and/or resources within single-factor authentication environments.(Citation: Dell Skeleton)
Query: Sigma rule for Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a dump file is moved o
Matching passage: Sigma rule: Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a dump file is moved o. Logsource: windows / process_creation. Rule: title: Potential SysInternals ProcDump Evasion id: 79b06761-465f-4f88-9ef2-150e24d3d737 status: test description: Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a dump file is moved or copied to a different name references: - https://twitter.com/mrd0x/status/1480785527901204481 author: Florian Roth (Nextron Systems) date: 2022-01-11 modified: 2023-05-09 tags: - attack.stealth - attack.t1036 - attack.t1003.001 - attack.credential-access logsource: category: process_creation product: windows detection: selection_1: CommandLine|contains: - copy procdump - move procdump selection_2: CommandLine|contains|all: - 'copy ' - '.dmp ' CommandLine|contains: - 2.dmp - lsass - out.dmp selection_3: CommandLine|contains: - copy lsass.exe_ - move lsass.exe_ condition: 1 of selection_* falsepositives: - False positives are expected in cases in which ProcDump just gets copied to a different directory without any renaming level: high
Near-miss passage: Sigma rule: Detects a WMI backdoor in Exchange Transport Agents via WMI event filters. Logsource: windows / process_creation. Rule: title: WMI Backdoor Exchange Transport Agent id: 797011dc-44f4-4e6f-9f10-a8ceefbe566b status: test description: Detects a WMI backdoor in Exchange Transport Agents via WMI event filters references: - https://twitter.com/cglyer/status/1182389676876980224 - https://twitter.com/cglyer/status/1182391019633029120 author: Florian Roth (Nextron Systems) date: 2019-10-11 modified: 2023-02-08 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.003 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \EdgeTransport.exe filter_conhost: Image: C:\Windows\System32\conhost.exe filter_oleconverter: Image|startswith: C:\Program Files\Microsoft\Exchange Server\ Image|endswith: \Bin\OleConverter.exe condition: selection and not 1 of filter_* falsepositives: - Unknown level: critical
Query: hunt for Exfiltration Over C2 Channel activity
Matching passage: T1041 Exfiltration Over C2 Channel. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
Near-miss passage: T1011.001 Exfiltration Over Bluetooth. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel. Adversaries may choose to do this if they have sufficient access and proximity. Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Query: detect Detects NetNTLM downgrade attack in logs
Matching passage: Sigma rule: Detects NetNTLM downgrade attack. Logsource: windows / security. Rule: title: NetNTLM Downgrade Attack id: d3abac66-f11c-4ed0-8acb-50cc29c97eed related: - id: d67572a0-e2ec-45d6-b8db-c100d14b8ef2 type: derived status: test description: Detects NetNTLM downgrade attack references: - https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks author: Florian Roth (Nextron Systems), wagga date: 2018-03-20 modified: 2022-10-09 tags: - attack.persistence - attack.defense-impairment - attack.t1685 - attack.t1112 logsource: product: windows service: security definition: 'Requirements: Audit Policy : Object Access > Audit Registry (Success)' detection: selection: EventID: 4657 ObjectName|contains|all: - \REGISTRY\MACHINE\SYSTEM - ControlSet - \Control\Lsa ObjectValueName: - LmCompatibilityLevel - NtlmMinClientSec - RestrictSendingNTLMTraffic condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of the lesser known remote execution tool named CsExec a PsExec alternative. Logsource: windows / process_creation. Rule: title: PUA - CsExec Execution id: d08a2711-ee8b-4323-bdec-b7d85e892b31 status: test description: Detects the use of the lesser known remote execution tool named CsExec a PsExec alternative references: - https://github.com/malcomvetter/CSExec - https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/ author: Florian Roth (Nextron Systems) date: 2022-08-22 modified: 2023-02-21 tags: - attack.resource-development - attack.t1587.001 - attack.execution - attack.t1569.002 logsource: category: process_creation product: windows detection: selection: Image|endswith: \csexec.exe selection_pe: Description: csexec condition: 1 of selection* falsepositives: - Unknown level: high
Query: alert when Detects when an Okta user session starts where the user is behind an anonymising proxy service.
Matching passage: Sigma rule: Detects when an Okta user session starts where the user is behind an anonymising proxy service.. Logsource: okta / okta. Rule: title: Okta User Session Start Via An Anonymising Proxy Service id: bde30855-5c53-4c18-ae90-1ff79ebc9578 status: test description: Detects when an Okta user session starts where the user is behind an anonymising proxy service. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection author: kelnage date: 2023-09-07 modified: 2026-04-27 tags: - attack.defense-impairment - attack.t1685 logsource: product: okta service: okta detection: selection: eventType: user.session.start securityContext.isProxy: 'true' condition: selection falsepositives: - If a user requires an anonymising proxy due to valid justifications. level: high
Near-miss passage: Sigma rule: Detects exploitation attempt using the JNDI-Exploit-Kit. Logsource: webserver. Rule: title: JNDIExploit Pattern id: 412d55bc-7737-4d25-9542-5b396867ce55 status: test description: Detects exploitation attempt using the JNDI-Exploit-Kit references: - https://github.com/pimps/JNDI-Exploit-Kit - https://web.archive.org/web/20231015205935/https://githubmemory.com/repo/FunctFan/JNDIExploit author: Florian Roth (Nextron Systems) date: 2021-12-12 modified: 2022-12-25 tags: - attack.initial-access - attack.t1190 logsource: category: webserver detection: keywords: - /Basic/Command/Base64/ - /Basic/ReverseShell/ - /Basic/TomcatMemshell - /Basic/JettyMemshell - /Basic/WeblogicMemshell - /Basic/JBossMemshell - /Basic/WebsphereMemshell - /Basic/SpringMemshell - /Deserialization/URLDNS/ - /Deserialization/CommonsCollections1/Dnslog/ - /Deserialization/CommonsCollections2/Command/Base64/ - /Deserialization/CommonsBeanutils1/ReverseShell/ - /Deserialization/Jre8u20/TomcatMemshell - /TomcatBypass/Dnslog/ - /TomcatBypass/Command/ - /TomcatBypass/ReverseShell/ - /TomcatBypass/TomcatMemshell - /TomcatBypass/SpringMemshell - /GroovyBypass/Command/ - /WebsphereBypass/Upload/ condition: keywords falsepositives: - Legitimate apps the use these paths level: high
Query: incident response steps for Multiple failed authentications followed by Network Topology
Matching passage: Playbook for T1590.004 Network Topology. 1) Validate alert telemetry against T1590.004. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: reconnaissance. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may gather information about the victim's network topology that can be used during targeting. Information about network topologies may include a variety of details, including the physical and/or logical arrangement of both external-facing and internal network environments. This information may also include specifics regarding network devices (gateways, routers, etc.) and other infrastr
Near-miss passage: Playbook for T1590.003 Network Trust Dependencies. Different response path focused on reconnaissance.
Query: CVE similar to CVE-2015-5534
Matching passage: CVE-2015-5534. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Oxwall before 1.8 allow remote attackers to hijack the authentication of administrators for requests that (1) put the website under maintenance via the maintenance_enable parameter or (2) conduct cross-site scripting (XSS) attacks via the maintenance_text parameter to admin/pages/maintenance.
Near-miss passage: CVE-2015-4586. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Alcatel-Lucent CellPipe 7130 RG 5Ae.M2013 HOL with firmware 1.0.0.20h.HOL allows remote attackers to hijack the authentication of administrators for requests that create a user account via an add_user action in a request to password.cmd.
Query: adversary uses Device Driver Discovery
Matching passage: T1652 Device Driver Discovery. Tactics: discovery. Description: Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) or other defenses (e.g., [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)), as well as potential exploitable vulnerabilities (e.g., [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)). Many OS utilities may provide information about local device drivers, such as `driverquery.exe` and the `EnumDeviceDrivers()` API function on Windows.(Citation: Microsoft Driverquery)(Citation: Microsoft EnumDeviceDrivers) Information about device drivers (as well as associated services, i.e., [System Service Discovery](https://attack.mitre.org/techniques/T1007)) may also be available in the Registry.(Citation: Microsoft Registry Drivers) On Linux/macOS, device drivers (in the form of kernel modules) may be visible within `/dev` or using utilities such as `lsmod` and `modinfo`.(Citation: Linux Kernel Programming)(Citation: lsmod man)(Citation: modinfo man)
Near-miss passage: T1069 Permission Groups Discovery. Tactics: discovery. Description: Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions. Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.(Citation: CrowdStrike BloodHound April 2018)
Query: indicators of Query Public AI Services
Matching passage: T1682 Query Public AI Services. Tactics: reconnaissance. Description: Adversaries may query publicly accessible artificial intelligence (AI) services, such as large language models (LLMs), to support targeting and operations. In addition to searching websites or databases directly (i.e., [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), adversaries may use AI services to synthesize, aggregate, and analyze publicly available information at scale. This may include identifying individuals or organizations to target, researching organizational structures and personnel, identifying technologies used by target organizations, researching business relationships to develop plausible pretexts for [Social Engineering](https://attack.mitre.org/techniques/T1684) approaches, identifying contact information for use in [Phishing](https://attack.mitre.org/techniques/T1566) or [Phishing for Information](https://attack.mitre.org/techniques/T1598), or gathering derogatory or sensitive information about individuals that may be used for extortion or coercion.(Citation: MSFT-AI)(Citation: GTIG AI Threat Tracker) Information gathered through AI services may be leveraged for other behaviors, such as establishing operational resources (i.e., [Generate Content](https://attack.mitre.org/techniques/T1683) or [Establish Accounts](https://attack.mitre.org/techniques/T1585). For obtaining access to AI tools and services, see [Artificial Intelligence](https://attack.mitre.org/techniques/T1588/007).
Near-miss passage: T1590.005 IP Addresses. Tactics: reconnaissance. Description: Adversaries may gather the victim's IP addresses that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses. Information about assigned IP addresses may include a variety of details, such as which IP addresses are in use. IP addresses may also enable an adversary to derive other details about a victim, such as organizational size, physical location(s), Internet service provider, and or where/how their publicly-facing infrastructure is hosted. Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about assigned IP addresses may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Query: describe CVE-2015-1318
Matching passage: CVE-2015-1318. CWE: CWE-264. CVSS: 7.199999809265137. The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a crafted usr/share/apport/apport file in a namespace (container).
Near-miss passage: CVE-2015-3793. CWE: CWE-264. CVSS: 4.300000190734863. CFPreferences in Apple iOS before 8.4.1 allows attackers to bypass the third-party app-sandbox protection mechanism and read arbitrary managed preferences via a crafted app.
Query: vulnerability: The fasttrap driver in the kernel in Apple OS X before 10.10.5 allows local users to cause a denial of service (resource consumption) via unspecified vectors.
Matching passage: CVE-2015-5747. CWE: CWE-399. CVSS: 4.900000095367432. The fasttrap driver in the kernel in Apple OS X before 10.10.5 allows local users to cause a denial of service (resource consumption) via unspecified vectors.
Near-miss passage: CVE-2015-0775. CWE: CWE-399. CVSS: 5.0. The banner (aka MOTD) implementation in Cisco NX-OS 4.1(2)E1(1f) on Nexus 4000 devices, 5.2(1)SV3(2.1) on Nexus 1000V devices, 6.0(2)N2(2) on Nexus 5000 devices, 6.2(11) on MDS 9000 devices, 6.2(12) on Nexus 7000 devices, 7.0(3) on Nexus 9000 devices, and 7.2(0)ZN(99.67) on Nexus 3000 devices allows remote attackers to cause a denial of service (login process reset) via an unspecified terminal-session request during TELNET session setup, aka Bug IDs CSCuo10554, CSCuu75466, CSCuu75471, CSCuu75484, CSCuu75498, CSCuu77170, and CSCuu77182.
Query: SIEM correlation: impact activity consistent with Stored Data Manipulation
Matching passage: T1565.001 Stored Data Manipulation. Tactics: impact. Description: Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Near-miss passage: T1565.002 Transmitted Data Manipulation. Tactics: impact. Description: Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Manipulation may be possible over a network connection or between system processes where there is an opportunity deploy a tool that will intercept and change information. The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Query: Sigma rule for Detects file being transferred via ScreenConnect RMM
Matching passage: Sigma rule: Detects file being transferred via ScreenConnect RMM. Logsource: windows / application. Rule: title: Remote Access Tool - ScreenConnect File Transfer id: 5d19eb78-5b5b-4ef2-a9f0-4bfa94d58a13 related: - id: b1f73849-6329-4069-bc8f-78a604bb8b23 type: similar status: test description: Detects file being transferred via ScreenConnect RMM references: - https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling - https://github.com/SigmaHQ/sigma/pull/4467 author: Ali Alwashali date: 2023-10-10 tags: - attack.execution - attack.t1059.003 logsource: service: application product: windows detection: selection: Provider_Name: ScreenConnect EventID: 201 Data|contains: Transferred files with action condition: selection falsepositives: - Legitimate use of ScreenConnect level: low
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "ShellDispatch.dll". Logsource: windows / image_load. Rule: title: Potential ShellDispatch.DLL Sideloading id: 844f8eb2-610b-42c8-89a4-47596e089663 status: test description: Detects potential DLL sideloading of "ShellDispatch.dll" references: - https://www.hexacorn.com/blog/2023/06/07/this-lolbin-doesnt-exist/ author: X__Junior (Nextron Systems) date: 2023-06-20 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \ShellDispatch.dll filter_main_legit_path: - ImageLoaded|contains|all: - :\Users\ - \AppData\Local\Temp\ - ImageLoaded|contains: :\Windows\Temp\ condition: selection and not 1 of filter_main_* falsepositives: - Some installers may trigger some false positives level: medium
Query: vulnerability: The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a crafted usr/share/apport/apport file in a namespace (container).
Matching passage: CVE-2015-1318. CWE: CWE-264. CVSS: 7.199999809265137. The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a crafted usr/share/apport/apport file in a namespace (container).
Near-miss passage: CVE-2015-3793. CWE: CWE-264. CVSS: 4.300000190734863. CFPreferences in Apple iOS before 8.4.1 allows attackers to bypass the third-party app-sandbox protection mechanism and read arbitrary managed preferences via a crafted app.