alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Rule to detect the Hybrid Connection Manager service installation.
Matching passage: Sigma rule: Rule to detect the Hybrid Connection Manager service installation.. Logsource: windows / security. Rule: title: HybridConnectionManager Service Installation id: 0ee4d8a5-4e67-4faf-acfa-62a78457d1f2 status: test description: Rule to detect the Hybrid Connection Manager service installation. references: - https://twitter.com/Cyb3rWard0g/status/1381642789369286662 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2021-04-12 modified: 2022-10-09 tags: - attack.persistence - attack.t1554 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceName: HybridConnectionManager ServiceFileName|contains: HybridConnectionManager condition: selection falsepositives: - Legitimate use of Hybrid Connection Manager via Azure function apps. level: high
Near-miss passage: Sigma rule: Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR. Logsource: rpc_firewall / application. Rule: title: Remote Encrypting File System Abuse id: 5f92fff9-82e2-48eb-8fc1-8b133556a551 status: test description: Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR references: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36942 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-EFSR.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.lateral-movement logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:df1941c5-fe89-4e79-bf10-463657acf44d or c681d488-d850-11d0-8c52-00c04fd90f7e' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: - df1941c5-fe89-4e79-bf10-463657acf44d - c681d488-d850-11d0-8c52-00c04fd90f7e condition: selection falsepositives: - Legitimate usage of remote file encryption level: high
Query: exploit The WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain administrator privileges via an iv_membership_update_user_settings action to wp-admin/admin-a
Matching passage: CVE-2015-4038. CWE: CWE-264. CVSS: 6.5. The WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain administrator privileges via an iv_membership_update_user_settings action to wp-admin/admin-ajax.php.
Near-miss passage: CVE-2015-6779. CWE: CWE-264. CVSS: 4.300000190734863. PDFium, as used in Google Chrome before 47.0.2526.73, does not properly restrict use of chrome: URLs, which allows remote attackers to bypass intended scheme restrictions via a crafted PDF document, as demonstrated by a document with a link to a chrome://settings URL.
Query: risk of SQL injection vulnerability in the login page in Epiphany Cardio Server 3.3 allows remote attackers to execute arbitrary SQL commands via a crafted URL.
Matching passage: CVE-2015-6537. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in the login page in Epiphany Cardio Server 3.3 allows remote attackers to execute arbitrary SQL commands via a crafted URL.
Near-miss passage: CVE-2015-7682. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allow remote administrators to execute arbitrary SQL commands via the (1) select_invitaion_code_bulk_option or (2) invi_del_id parameter in the pie-invitation-codes page to wp-admin/admin.php.
Query: rule covering Detects when storage bucket is enumerated in Google Cloud.
Matching passage: Sigma rule: Detects when storage bucket is enumerated in Google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud Storage Buckets Enumeration id: e2feb918-4e77-4608-9697-990a1aaf74c3 status: test description: Detects when storage bucket is enumerated in Google Cloud. references: - https://cloud.google.com/storage/docs/json_api/v1/buckets author: Austin Songer @austinsonger date: 2021-08-14 modified: 2022-10-09 tags: - attack.discovery logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name: - storage.buckets.list - storage.buckets.listChannels condition: selection falsepositives: - Storage Buckets being enumerated may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Storage Buckets enumerated from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Near-miss passage: Sigma rule: Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly". Logsource: windows / process_creation. Rule: title: Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call id: 9c0295ce-d60d-40bd-bd74-84673b7592b1 related: - id: 62b7ccc9-23b4-471e-aa15-6da3663c4d59 type: similar status: test description: Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly" references: - https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/mal_revil.yar - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/ - https://learn.microsoft.com/en-us/dotnet/api/system.appdomain.load?view=net-7.0 author: pH-T (Nextron Systems) date: 2022-03-01 modified: 2023-04-06 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1027 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - OgA6ACgAIgBMACIAKwAiAG8AYQBkACIAKQ - oAOgAoACIATAAiACsAIgBvAGEAZAAiACkA - 6ADoAKAAiAEwAIgArACIAbwBhAGQAIgApA - OgA6ACgAIgBMAG8AIgArACIAYQBkACIAKQ - oAOgAoACIATABvACIAKwAiAGEAZAAiACkA - 6ADoAKAAiAEwAbwAiACsAIgBhAGQAIgApA - OgA6ACgAIgBMAG8AYQAiACsAIgBkACIAKQ - oAOgAoACIATABvAGEAIgArACIAZAAiACkA - 6ADoAKAAiAEwAbwBhACIAKwAiAGQAIgApA - OgA6ACgAJwBMACcAKwAnAG8AYQBkACcAKQ - oAOgAoACcATAAnACsAJwBvAGEAZAAnACkA - 6ADoAKAAnAEwAJwArACcAbwBhAGQAJwApA - OgA6ACgAJwBMAG8AJwArACcAYQBkACcAKQ - oAOgAoACcATABvACcAKwAnAGEAZAAnACkA - 6ADoAKAAnAEwAbwAnACsAJwBhAGQAJwApA - OgA6ACgAJwBMAG8AYQAnACsAJwBkACcAKQ - oAOgAoACcATABvAGEAJwArACcAZAAnACkA - 6ADoAKAAnAEwAbwBhACcAKwAnAGQAJwApA condition: selection falsepositives: - Unlikely level: high
Query: hunt for Cloud Service Hijacking activity
Matching passage: T1496.004 Cloud Service Hijacking. Tactics: impact. Description: Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability. For example, adversaries may leverage email and messaging services, such as AWS Simple Email Service (SES), AWS Simple Notification Service (SNS), SendGrid, and Twilio, in order to send large quantities of spam / [Phishing](https://attack.mitre.org/techniques/T1566) emails and SMS messages.(Citation: Invictus IR DangerDev 2024)(Citation: Permiso SES Abuse 2023)(Citation: SentinelLabs SNS Sender 2024) Alternatively, they may engage in LLMJacking by leveraging reverse proxies to hijack the power of cloud-hosted AI models.(Citation: Sysdig LLMJacking 2024)(Citation: Lacework LLMJacking 2024) In some cases, adversaries may leverage services that the victim is already using. In others, particularly when the service is part of a larger cloud platform, they may first enable the service.(Citation: Sysdig LLMJacking 2024) Leveraging SaaS applications may cause the victim to incur significant financial costs, use up service quotas, and otherwise impact availability.
Near-miss passage: T1496.003 SMS Pumping. Tactics: impact. Description: Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted service availability.(Citation: Twilio SMS Pumping) SMS pumping is a type of telecommunications fraud whereby a threat actor first obtains a set of phone numbers from a telecommunications provider, then leverages a victim’s messaging infrastructure to send large amounts of SMS messages to numbers in that set. By generating SMS traffic to their phone number set, a threat actor may earn payments from the telecommunications provider.(Citation: Twilio SMS Pumping Fraud) Threat actors often use publicly available web forms, such as one-time password (OTP) or account verification fields, in order to generate SMS traffic. These fields may leverage services such as Twilio, AWS SNS, and Amazon Cognito in the background.(Citation: Twilio SMS Pumping)(Citation: AWS RE:Inforce Threat Detection 2024) In response to the large quantity of requests, SMS costs may increase and communication channels may become overwhelmed.(Citation: Twilio SMS Pumping)
Query: write Sigma for Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activit
Matching passage: Sigma rule: Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activit. Logsource: windows / process_creation. Rule: title: Privilege Escalation via Named Pipe Impersonation id: 9bd04a79-dabe-4f1f-a5ff-92430265c96b related: - id: f35c5d71-b489-4e22-a115-f003df287317 type: derived status: test description: Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity. references: - https://www.elastic.co/guide/en/security/current/privilege-escalation-via-named-pipe-impersonation.html author: Tim Rauch, Elastic (idea) date: 2022-09-27 modified: 2022-12-30 tags: - attack.lateral-movement - attack.t1021 logsource: category: process_creation product: windows detection: selection_name: - Image|endswith: - \cmd.exe - \powershell.exe - OriginalFileName: - Cmd.Exe - PowerShell.EXE selection_args: CommandLine|contains|all: - echo - '>' - \\\\.\\pipe\\ condition: all of selection* falsepositives: - Other programs that cause these patterns (please report) level: high
Near-miss passage: Sigma rule: Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service. Logsource: windows / process_creation. Rule: title: Suspicious Child Process Of Manage Engine ServiceDesk id: cea2b7ea-792b-405f-95a1-b903ea06458f status: test description: Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service references: - https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/ - https://github.com/horizon3ai/CVE-2022-47966/blob/3a51c6b72ebbd87392babd955a8fbeaee2090b35/CVE-2022-47966.py - https://blog.viettelcybersecurity.com/saml-show-stopper/ author: Florian Roth (Nextron Systems) date: 2023-01-18 modified: 2023-08-29 tags: - attack.command-and-control - attack.t1102 logsource: category: process_creation product: windows detection: selection: ParentImage|contains|all: - \ManageEngine\ServiceDesk\ - \java.exe Image|endswith: - \AppVLP.exe - \bash.exe - \bitsadmin.exe - \calc.exe - \certutil.exe - \cscript.exe - \curl.exe - \forfiles.exe - \mftrace.exe - \mshta.exe - \net.exe - \net1.exe - \notepad.exe - \powershell.exe - \pwsh.exe - \query.exe - \reg.exe - \schtasks.exe - \scrcons.exe - \sh.exe - \systeminfo.exe - \whoami.exe - \wmic.exe - \wscript.exe filter_main_net: Image|endswith: - \net.exe - \net1.exe CommandLine|contains: ' stop' condition: selection and not 1 of filter_main_* falsepositives: - Legitimate sub processes started by Manage Engine ServiceDesk Pro level: high
Query: vulnerability: The addForegroundSprite function in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat a
Matching passage: CVE-2015-6699. CWE: CWE-772. CVSS: 4.300000190734863. The addForegroundSprite function in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to obtain sensitive information from process memory via invalid arguments, a different vulnerability than CVE-2015-6697, CVE-2015-6700, CVE-2015-6701, CVE-2015-6702, CVE-2015-6703, and CVE-2015-6704.
Near-miss passage: CVE-2015-6703. CWE: CWE-772. CVSS: 4.300000190734863. The loadFlashMovie function in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to obtain sensitive information from process memory via invalid arguments, a different vulnerability than CVE-2015-6697, CVE-2015-6699, CVE-2015-6700, CVE-2015-6701, CVE-2015-6702, and CVE-2015-6704.
Query: SIEM correlation: discovery activity consistent with Backup Software Discovery
Matching passage: T1518.002 Backup Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of backup software or configurations that are installed on a system. Adversaries may use this information to shape follow-on behaviors, such as [Data Destruction](https://attack.mitre.org/techniques/T1485), [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486). Commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), `reg query` with [Reg](https://attack.mitre.org/software/S0075), `dir` with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for, such as Veeam, Acronis, Dropbox, or Paragon.(Citation: Symantec Play Ransomware 2023)
Near-miss passage: T1518.001 Security Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Example commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), <code>reg query</code> with [Reg](https://attack.mitre.org/software/S0075), <code>dir</code> with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software. Adversaries may also utilize the [Cloud API](https://attack.mitre.org/techniques/T1059/009) to discover cloud-native security software installed on compute infrastructure, such as the AWS CloudWatch agent, Azure VM Agent, and Google Cloud Monitor agent. These agents may collect metrics and logs from the VM, which may be centrally aggregated in a cloud-based monitoring platform.
Query: risk of OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a cr
Matching passage: CVE-2015-1851. CWE: CWE-200. CVSS: 6.800000190734863. OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command.
Near-miss passage: CVE-2015-5231. CWE: CWE-200. CVSS: 5.5. The service daemon in CRIU does not properly restrict access to non-dumpable processes, which allows local users to obtain sensitive information via (1) process dumps or (2) ptrace access.
Query: weakness Function Call With Incorrect Number of Arguments
Matching passage: CWE-685 Function Call With Incorrect Number of Arguments. The product calls a function, procedure, or routine, but the caller specifies too many arguments, or too few arguments, which may lead to undefined behavior and resultant weaknesses.
Near-miss passage: CWE-372 Incomplete Internal State Distinction. The product does not properly determine which state it is in, causing it to assume it is in state X when in fact it is in state Y, causing it to perform incorrect operations in a security-relevant manner.
Query: vulnerability: Mozilla Firefox before 43.0 does not properly store the properties of unboxed objects, which allows remote attackers to execute arbitrary code via crafted JavaScript variable assig
Matching passage: CVE-2015-7204. CWE: CWE-17. CVSS: 6.800000190734863. Mozilla Firefox before 43.0 does not properly store the properties of unboxed objects, which allows remote attackers to execute arbitrary code via crafted JavaScript variable assignments.
Near-miss passage: CVE-2015-1361. CWE: CWE-17. CVSS: 6.800000190734863. platform/image-decoders/ImageFrame.h in Blink, as used in Google Chrome before 40.0.2214.91, does not initialize a variable that is used in calls to the Skia SkBitmap::setAlphaType function, which might allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted HTML document, a different vulnerability than CVE-2015-1205.
Query: Sigma rule for Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with co
Matching passage: Sigma rule: Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with co. Logsource: bitbucket / audit. Rule: title: Bitbucket User Login Failure id: 70ed1d26-0050-4b38-a599-92c53d57d45a status: test description: 'Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field. ' references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.credential-access - attack.stealth - attack.t1078.004 - attack.t1110 logsource: product: bitbucket service: audit definition: 'Requirements: "Advance" log level is required to receive these audit events.' detection: selection: auditType.category: Authentication auditType.action: User login failed condition: selection falsepositives: - Legitimate user wrong password attempts. level: medium
Near-miss passage: Sigma rule: Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions). Logsource: windows / process_creation. Rule: title: Suspicious SysAidServer Child id: 60bfeac3-0d35-4302-8efb-1dd16f715bc6 status: test description: Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions) references: - https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/ author: Florian Roth (Nextron Systems) date: 2022-08-26 tags: - attack.lateral-movement - attack.t1210 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \java.exe - \javaw.exe ParentCommandLine|contains: SysAidServer condition: selection falsepositives: - Unknown level: medium
Query: secure coding against Encoding Error
Matching passage: CWE-172 Encoding Error. The product does not properly encode or decode the data, resulting in unexpected values.
Near-miss passage: CWE-863 Incorrect Authorization. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Query: detection rule: Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent rem
Matching passage: Sigma rule: Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent rem. Logsource: linux / auditd. Rule: title: Creation Of An User Account id: 759d0d51-bc99-4b5e-9add-8f5b2c8e7512 status: test description: Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system. references: - https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-understanding_audit_log_files - https://access.redhat.com/articles/4409591#audit-record-types-2 - https://www.youtube.com/watch?v=VmvY5SQm5-Y&ab_channel=M45C07 author: Marie Euler, Pawel Mazur date: 2020-05-18 modified: 2022-12-20 tags: - attack.t1136.001 - attack.persistence logsource: product: linux service: auditd detection: selection_syscall_record_type: type: SYSCALL exe|endswith: /useradd selection_add_user_record_type: type: ADD_USER condition: 1 of selection_* falsepositives: - Admin activity level: medium
Near-miss passage: Sigma rule: Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry. Logsource: windows / registry_set. Rule: title: Enable LM Hash Storage id: c420410f-c2d8-4010-856b-dffe21866437 related: - id: 98dedfdd-8333-49d4-9f23-d7018cccae53 type: similar status: test description: 'Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases. ' references: - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a - https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password - https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-12-15 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: System\CurrentControlSet\Control\Lsa\NoLMHash Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: high
Query: exploit The getHiddenProperty function in bindings/core/v8/V8EventListenerList.h in Blink, as used in Google Chrome before 41.0.2272.76, has a name conflict with the AudioContext class, wh
Matching passage: CVE-2015-1230. CWE: UNKNOWN. CVSS: 7.5. The getHiddenProperty function in bindings/core/v8/V8EventListenerList.h in Blink, as used in Google Chrome before 41.0.2272.76, has a name conflict with the AudioContext class, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via JavaScript code that adds an AudioContext event listener and triggers "type confusion."
Near-miss passage: CVE-2015-2124. CWE: UNKNOWN. CVSS: 7.199999809265137. Unspecified vulnerability in Easy Setup Wizard in HP ThinPro Linux 4.1 through 5.1 and Smart Zero Core 4.3 and 4.4 allows local users to bypass intended access restrictions and gain privileges via unknown vectors.
Query: patch priority for CVE-2015-4887
Matching passage: CVE-2015-4887. CWE: UNKNOWN. CVSS: 6.0. Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to ePerformance.
Near-miss passage: CVE-2015-0421. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in Oracle Java SE 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to the installation process.