alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explore
Matching passage: CVE-2015-1691. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1712.
Near-miss passage: CVE-2015-5949. CWE: CWE-119. CVSS: 6.800000190734863. VideoLAN VLC media player 2.2.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted 3GP file, which triggers the freeing of arbitrary pointers.
Query: risk of Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Gzip.
Matching passage: CVE-2015-2642. CWE: UNKNOWN. CVSS: 4.400000095367432. Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Gzip.
Near-miss passage: CVE-2015-2599. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the RDBMS Scheduler component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors.
Query: discovery using Cloud Account
Matching passage: T1087.004 Cloud Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. With authenticated access there are several tools that can be used to find accounts. The <code>Get-MsolRoleMember</code> PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365.(Citation: Microsoft msolrolemember)(Citation: GitHub Raindance) The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command <code>az ad user list</code> will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018) The AWS command <code>aws iam list-users</code> may be used to obtain a list of users in the current account while <code>aws iam list-roles</code> can obtain IAM roles that have a specified path prefix.(Citation: AWS List Roles)(Citation: AWS List Users) In GCP, <code>gcloud iam service-accounts list</code> and <code>gcloud projects get-iam-policy</code> may be used to obtain a listing of service accounts and users in a project.(Citation: Google Cloud - IAM Servie Accounts List API)
Near-miss passage: T1087.001 Local Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. Commands such as <code>net user</code> and <code>net localgroup</code> of the [Net](https://attack.mitre.org/software/S0039) utility and <code>id</code> and <code>groups</code> on macOS and Linux can list local users and groups.(Citation: Mandiant APT1)(Citation: id man page)(Citation: groups man page) On Linux, local users can also be enumerated through the use of the <code>/etc/passwd</code> file. On macOS, the <code>dscl . list /Users</code> command can be used to enumerate local accounts. On ESXi servers, the `esxcli system account list` command can list local user accounts.(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)
Query: alert when Detects the recovery of files from backups via "wbadmin.exe". Attackers can restore sensitive files such as NTDS.DIT or
Matching passage: Sigma rule: Detects the recovery of files from backups via "wbadmin.exe". Attackers can restore sensitive files such as NTDS.DIT or. Logsource: windows / process_creation. Rule: title: File Recovery From Backup Via Wbadmin.EXE id: 6fe4aa1e-0531-4510-8be2-782154b73b48 related: - id: 84972c80-251c-4c3a-9079-4f00aad93938 type: derived status: test description: 'Detects the recovery of files from backups via "wbadmin.exe". Attackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials. ' references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery - https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/ author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2024-05-10 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wbadmin.exe - OriginalFileName: WBADMIN.EXE selection_cli: CommandLine|contains|all: - ' recovery' - recoveryTarget - itemtype:File condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution.. Logsource: windows / process_creation. Rule: title: Proxy Execution Via Wuauclt.EXE id: af77cf95-c469-471c-b6a0-946c685c4798 related: - id: ba1bb0cb-73da-42de-ad3a-de10c643a5d0 type: obsolete - id: d7825193-b70a-48a4-b992-8b5b3015cc11 type: obsolete status: test description: Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution. references: - https://dtm.uk/wuauclt/ - https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/ author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Florian Roth (Nextron Systems), Sreeman, FPT.EagleEye Team date: 2020-10-12 modified: 2023-11-11 tags: - attack.stealth - attack.t1218 - attack.execution logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wuauclt.exe - OriginalFileName: wuauclt.exe selection_cli: CommandLine|contains|all: - UpdateDeploymentProvider - RunHandlerComServer filter_main_generic: CommandLine|contains: ' /UpdateDeploymentProvider UpdateDeploymentProvider.dll ' filter_main_wuaueng: CommandLine|contains: ' wuaueng.dll ' filter_main_uus: CommandLine|contains: - :\Windows\UUS\Packages\Preview\amd64\updatedeploy.dll /ClassId - :\Windows\UUS\amd64\UpdateDeploy.dll /ClassId filter_main_winsxs: CommandLine|contains|all: - :\Windows\WinSxS\ - '\UpdateDeploy.dll /ClassId ' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: SOC runbook when seeing Outbound C2 pattern associated with Keychain
Matching passage: Playbook for T1555.001 Keychain. 1) Validate alert telemetry against T1555.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: credential access. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, w
Near-miss passage: Playbook for T1555.004 Windows Credential Manager. Different response path focused on credential access.
Query: threat report mentioning Steganography
Matching passage: T1001.002 Steganography. Tactics: command and control. Description: Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.
Near-miss passage: T1001.003 Protocol or Service Impersonation. Tactics: command and control. Description: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity. Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.(Citation: ESET Okrum July 2019)(Citation: Malleable-C2-U42)
Query: Sigma rule for Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Si
Matching passage: Sigma rule: Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Si. Logsource: windows / security. Rule: title: Local User Creation id: 66b6be3d-55d0-4f47-9855-d69df21740ea status: test description: 'Detects local user creation on Windows servers, which shouldn''t happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs. ' references: - https://patrick-bareiss.com/detecting-local-user-creation-in-ad-with-sigma/ author: Patrick Bareiss date: 2019-04-18 modified: 2021-01-17 tags: - attack.persistence - attack.t1136.001 logsource: product: windows service: security detection: selection: EventID: 4720 condition: selection falsepositives: - Domain Controller Logs - Local accounts managed by privileged account management tools level: low
Near-miss passage: Sigma rule: Detects CSExec service installation and execution events. Logsource: windows / system. Rule: title: CSExec Service Installation id: a27e5fa9-c35e-4e3d-b7e0-1ce2af66ad12 status: test description: Detects CSExec service installation and execution events references: - https://github.com/malcomvetter/CSExec author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-07 tags: - attack.execution - attack.t1569.002 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ServiceName: csexecsvc - ImagePath|endswith: \csexecsvc.exe condition: all of selection_* falsepositives: - Unknown level: medium
Query: exploit The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service (integer underflow, assertion failure, and application exit) via a sin
Matching passage: CVE-2015-7218. CWE: CWE-189. CVSS: 5.0. The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service (integer underflow, assertion failure, and application exit) via a single-byte header frame that triggers incorrect memory allocation.
Near-miss passage: CVE-2015-4496. CWE: CWE-189. CVSS: 9.300000190734863. Multiple integer overflows in libstagefright in Mozilla Firefox before 38.0 allow remote attackers to execute arbitrary code via crafted sample metadata in an MPEG-4 video file, a related issue to CVE-2015-1538.
Query: risk of Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allows remote attackers to read arbitrary files via a full pathn
Matching passage: CVE-2015-5471. CWE: CWE-22. CVSS: 5.300000190734863. Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter.
Near-miss passage: CVE-2015-7603. CWE: CWE-22. CVSS: 7.800000190734863. Directory traversal vulnerability in Konica Minolta FTP Utility 1.0 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in a RETR command.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming). Logsource: windows / process_creation. Rule: title: Renamed Sysinternals Sdelete Execution id: c1d867fe-8d95-4487-aab4-e53f2d339f90 status: test description: Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming) references: - https://learn.microsoft.com/en-us/sysinternals/downloads/sdelete - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md author: Florian Roth (Nextron Systems) date: 2022-09-06 modified: 2026-06-29 tags: - attack.impact - attack.t1485 logsource: category: process_creation product: windows detection: selection: OriginalFileName: sdelete.exe filter: Image|endswith: - \sdelete.exe - \sdelete64.exe - \sdelete64a.exe condition: selection and not filter falsepositives: - System administrator usage level: high
Near-miss passage: Sigma rule: Identifies when a device or device configuration in azure is modified or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Device or Configuration Modified or Deleted id: 46530378-f9db-4af9-a9e5-889c177d3881 status: test description: Identifies when a device or device configuration in azure is modified or deleted. references: - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory author: Austin Songer @austinsonger date: 2021-09-03 modified: 2022-10-09 tags: - attack.impact - attack.t1485 - attack.t1565.001 logsource: product: azure service: activitylogs detection: selection: properties.message: - Delete device - Delete device configuration - Update device - Update device configuration condition: selection falsepositives: - Device or device configuration being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Device or device configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: write Sigma for Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.
Matching passage: Sigma rule: Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.. Logsource: windows / process_creation. Rule: title: SQLite Chromium Profile Data DB Access id: 24c77512-782b-448a-8950-eddb0785fc71 status: test description: Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing. references: - https://github.com/redcanaryco/atomic-red-team/blob/84d9edaaaa2c5511144521b0e4af726d1c7276ce/atomics/T1539/T1539.md#atomic-test-2---steal-chrome-cookies-windows - https://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/ author: TropChaud date: 2022-12-19 modified: 2023-01-19 tags: - attack.credential-access - attack.t1539 - attack.t1555.003 - attack.collection - attack.t1005 logsource: category: process_creation product: windows detection: selection_sql: - Product: SQLite - Image|endswith: - \sqlite.exe - \sqlite3.exe selection_chromium: CommandLine|contains: - \User Data\ - \Opera Software\ - \ChromiumViewer\ selection_data: CommandLine|contains: - Login Data - Cookies - Web Data - History - Bookmarks condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via Stdin in Scripts. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation Via Stdin - PowerShell Module id: c72aca44-8d52-45ad-8f81-f96c4d3c755e related: - id: 86b896ba-ffa1-4fea-83e3-ee28a4c915c7 type: derived status: test description: Detects Obfuscated Powershell via Stdin in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-12 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|re: (?i)(set).*&&\s?set.*(environment|invoke|\$?\{?input).*&&.*" condition: selection_4103 falsepositives: - Unknown level: high
Query: exploit Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended calendar-viewing restrictions via unspecified vectors, a different vulnerability than CVE-20
Matching passage: CVE-2015-8484. CWE: CWE-264. CVSS: 5.400000095367432. Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended calendar-viewing restrictions via unspecified vectors, a different vulnerability than CVE-2015-8485, CVE-2015-8486, and CVE-2016-1152.
Near-miss passage: CVE-2015-5498. CWE: CWE-264. CVSS: 5.0. The Shipwire API module 7.x-1.x before 7.x-1.03 for Drupal does not check the view permission for the shipments overview (admin/shipwire/shipments), which allows remote attackers to obtain sensitive information via a request to the page.
Query: exploit Cross-site scripting (XSS) vulnerability in IBM Rational Team Concert 2.x and 3.x before 3.0.1.6 iFix 5, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated us
Matching passage: CVE-2015-0123. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Rational Team Concert 2.x and 3.x before 3.0.1.6 iFix 5, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-0122.
Near-miss passage: CVE-2015-6488. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the web server on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects usage of the netsh command to open and allow connections to port 3389 (RDP). As seen used by Sarwent Malware. Logsource: windows / process_creation. Rule: title: RDP Connection Allowed Via Netsh.EXE id: 01aeb693-138d-49d2-9403-c4f52d7d3d62 status: test description: Detects usage of the netsh command to open and allow connections to port 3389 (RDP). As seen used by Sarwent Malware references: - https://labs.sentinelone.com/sarwent-malware-updates-command-detonation/ author: Sander Wiebing date: 2020-05-23 modified: 2023-12-11 tags: - attack.defense-impairment - attack.t1686.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: CommandLine|contains|all: - 'firewall ' - 'add ' - 'tcp ' - '3389' CommandLine|contains: - portopening - allow condition: all of selection_* falsepositives: - Legitimate administration activity level: high
Near-miss passage: Sigma rule: Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'r. Logsource: windows / process_creation. Rule: title: Potential Renamed Rundll32 Execution id: 2569ed8c-1147-498a-9b8c-2ad3656b10ed related: - id: 0ba1da6d-b6ce-4366-828c-18826c9de23e type: derived status: test description: Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection references: - https://twitter.com/swisscom_csirt/status/1331634525722521602?s=20 - https://app.any.run/tasks/f74c5157-8508-4ac6-9805-d63fe7b0d399/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-22 modified: 2023-02-03 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: CommandLine|contains: DllRegisterServer filter: Image|endswith: \rundll32.exe condition: selection and not filter falsepositives: - Unlikely level: high
Query: vulnerability: A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file. NOTE: this issue exis
Matching passage: CVE-2015-1396. CWE: CWE-22. CVSS: 7.5. A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file. NOTE: this issue exists because of an incomplete fix for CVE-2015-1196.
Near-miss passage: CVE-2015-2862. CWE: CWE-22. CVSS: 4.0. Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote authenticated users to read arbitrary files via a crafted HTTP request.
Query: vulnerability: IBM WebSphere Message Broker 7 before 7.0.0.8 and 8 before 8.0.0.6 and IBM Integration Bus 9 before 9.0.0.3 and 10 before 10.0.0.0 allow remote attackers to obtain sensitive inform
Matching passage: CVE-2015-7399. CWE: CWE-200. CVSS: 5.300000190734863. IBM WebSphere Message Broker 7 before 7.0.0.8 and 8 before 8.0.0.6 and IBM Integration Bus 9 before 9.0.0.3 and 10 before 10.0.0.0 allow remote attackers to obtain sensitive information about the HTTP server via unspecified vectors.
Near-miss passage: CVE-2015-1111. CWE: CWE-200. CVSS: 5.0. Safari in Apple iOS before 8.3 does not delete Recently Closed Tabs data in response to a history-clearing action, which allows attackers to obtain sensitive information by reading a history file.
Query: playbook for alert: Multiple failed authentications followed by Delay Execution
Matching passage: Playbook for T1678 Delay Execution. 1) Validate alert telemetry against T1678. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may employ various time-based methods to evade detection and analysis. These techniques often exploit system clocks, delays, or timing mechanisms to obscure malicious activity, blend in with benign activity, and avoid scrutiny. Adversaries can perform this behavior within virtualization/sandbox environments or natively on host systems. Adversaries may utilize programmatic `sleep` comma
Near-miss passage: Playbook for T1006 Direct Volume Access. Different response path focused on stealth.