alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: what is T1568.001
Matching passage: T1568.001 Fast Flux DNS. Tactics: command and control. Description: Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly changing IP addresses linked to a single domain resolution. This technique uses a fully qualified domain name, with multiple IP addresses assigned to it which are swapped with high frequency, using a combination of round robin IP addressing and short Time-To-Live (TTL) for a DNS resource record.(Citation: MehtaFastFluxPt1)(Citation: MehtaFastFluxPt2)(Citation: Fast Flux - Welivesecurity) The simplest, "single-flux" method, involves registering and de-registering an addresses as part of the DNS A (address) record list for a single DNS name. These registrations have a five-minute average lifespan, resulting in a constant shuffle of IP address resolution.(Citation: Fast Flux - Welivesecurity) In contrast, the "double-flux" method registers and de-registers an address as part of the DNS Name Server record list for the DNS zone, providing additional resilience for the connection. With double-flux additional hosts can act as a proxy to the C2 host, further insulating the true source of the C2 channel.
Near-miss passage: T1568.003 DNS Calculation. Tactics: command and control. Description: Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address. A IP and/or port number calculation can be used to bypass egress filtering on a C2 channel.(Citation: Meyers Numbered Panda) One implementation of [DNS Calculation](https://attack.mitre.org/techniques/T1568/003) is to take the first three octets of an IP address in a DNS response and use those values to calculate the port for command and control traffic.(Citation: Meyers Numbered Panda)(Citation: Moran 2014)(Citation: Rapid7G20Espionage)
Query: secure coding against Improper Neutralization of Script in Attributes in a Web Page
Matching passage: CWE-83 Improper Neutralization of Script in Attributes in a Web Page. The product does not neutralize or incorrectly neutralizes javascript: or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.
Near-miss passage: CWE-224 Obscured Security-relevant Information by Alternate Name. The product records security-relevant information according to an alternate name of the affected entity, instead of the canonical name.
Query: rule covering Detection use of the command "split" to split files into parts and possible transfer.
Matching passage: Sigma rule: Detection use of the command "split" to split files into parts and possible transfer.. Logsource: macos / process_creation. Rule: title: Split A File Into Pieces id: 7f2bb9d5-6395-4de5-969c-70c11fbe6b12 status: test description: Detection use of the command "split" to split files into parts and possible transfer. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1030/T1030.md author: Igor Fits, Mikhail Larin, oscd.community date: 2020-10-15 modified: 2021-11-27 tags: - attack.exfiltration - attack.t1030 logsource: product: macos category: process_creation detection: selection: Image|endswith: /split condition: selection falsepositives: - Legitimate administrative activity level: low
Near-miss passage: Sigma rule: Detects potentially suspicious CommandLine of electron apps (teams, discord, slack, etc.). This could be a sign of abuse. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Electron Application CommandLine id: 378a05d8-963c-46c9-bcce-13c7657eac99 related: - id: f26eb764-fd89-464b-85e2-dc4a8e6e77b8 type: similar status: test description: Detects potentially suspicious CommandLine of electron apps (teams, discord, slack, etc.). This could be a sign of abuse to proxy execution through a signed binary. references: - https://positive.security/blog/ms-officecmd-rce - https://lolbas-project.github.io/lolbas/Binaries/Teams/ - https://lolbas-project.github.io/lolbas/Binaries/Msedge/ - https://lolbas-project.github.io/lolbas/Binaries/msedgewebview2/ - https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf - https://chromium.googlesource.com/chromium/chromium/+/master/content/public/common/content_switches.cc author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-09-05 modified: 2023-11-09 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \chrome.exe - \code.exe - \discord.exe - \GitHubDesktop.exe - \keybase.exe - \msedge_proxy.exe - \msedge.exe - \msedgewebview2.exe - \msteams.exe - \slack.exe - \Teams.exe - OriginalFileName: - chrome.exe - code.exe - discord.exe - GitHubDesktop.exe - keybase.exe - msedge_proxy.exe - msedge.exe - msedgewebview2.exe - msteams.exe - slack.exe - Teams.exe selection_cli: CommandLine|contains: - --browser-subprocess-path - --gpu-launcher - --renderer-cmd-prefix - --utility-cmd-prefix condition: all of selection_* falsepositives: - Legitimate usage for debugging purposes level: medium
Query: write Sigma for Detects execution of the bash shell with the interactive flag "-i".
Matching passage: Sigma rule: Detects execution of the bash shell with the interactive flag "-i".. Logsource: linux / process_creation. Rule: title: Bash Interactive Shell id: 6104e693-a7d6-4891-86cb-49a258523559 status: test description: Detects execution of the bash shell with the interactive flag "-i". references: - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet - https://www.revshells.com/ - https://linux.die.net/man/1/bash author: '@d4ns4n_' date: 2023-04-07 tags: - attack.execution logsource: category: process_creation product: linux detection: selection: Image|endswith: /bash CommandLine|contains: ' -i ' condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands. Such behavior may be associate. Logsource: linux / process_creation. Rule: title: Vim GTFOBin Abuse - Linux id: 7ab8f73a-fcff-428b-84aa-6a5ff7877dea status: test description: 'Detects the use of "vim" and it''s siblings commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. ' references: - https://gtfobins.github.io/gtfobins/vi/ - https://gtfobins.github.io/gtfobins/vim/ - https://gtfobins.github.io/gtfobins/rvim/ - https://gtfobins.github.io/gtfobins/vimdiff/ author: Nasreddine Bencherchali (Nextron Systems), Luc Génaux date: 2022-12-28 modified: 2026-06-05 tags: - attack.execution - attack.discovery - attack.t1059 - attack.t1083 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: - /rvim - /vi - /vim - /vimdiff CommandLine|contains: - ' --cmd ' - ' -c' selection_cli: CommandLine|contains: - :!/ - :!$ - :!.. - ':lua ' - ':py ' - :shell - /bin/bash - /bin/dash - /bin/fish - /bin/sh - /bin/csh - /bin/ksh - /bin/zsh - /bin/tmux condition: all of selection_* falsepositives: - Unknown level: high
Query: ATT&CK technique for Time Providers
Matching passage: T1547.003 Time Providers. Tactics: persistence, privilege escalation. Description: Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.(Citation: Microsoft W32Time Feb 2018) W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients.(Citation: Microsoft TimeProvider) Time providers are implemented as dynamic-link libraries (DLLs) that are registered in the subkeys of `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders\`.(Citation: Microsoft TimeProvider) The time provider manager, directed by the service control manager, loads and starts time providers listed and enabled under this key at system startup and/or whenever parameters are changed.(Citation: Microsoft TimeProvider) Adversaries may abuse this architecture to establish persistence, specifically by creating a new arbitrarily named subkey pointing to a malicious DLL in the `DllName` value. Administrator privileges are required for time provider registration, though execution will run in context of the Local Service account.(Citation: Github W32Time Oct 2017)
Near-miss passage: T1547.007 Re-opened Applications. Tactics: persistence, privilege escalation. Description: Adversaries may modify plist files to automatically run an application when a user logs in. When a user logs out or restarts via the macOS Graphical User Interface (GUI), a prompt is provided to the user with a checkbox to "Reopen windows when logging back in".(Citation: Re-Open windows on Mac) When selected, all applications currently open are added to a property list file named <code>com.apple.loginwindow.[UUID].plist</code> within the <code>~/Library/Preferences/ByHost</code> directory.(Citation: Methods of Mac Malware Persistence)(Citation: Wardle Persistence Chapter) Applications listed in this file are automatically reopened upon the user’s next logon. Adversaries can establish [Persistence](https://attack.mitre.org/tactics/TA0003) by adding a malicious application path to the <code>com.apple.loginwindow.[UUID].plist</code> file to execute payloads when a user logs in.
Query: EDR alert: possible Dylib Hijacking (T1574.004)
Matching passage: T1574.004 Dylib Hijacking. Tactics: stealth, execution. Description: Adversaries may execute their own payloads by placing a malicious dynamic library (dylib) with an expected name in a path a victim application searches at runtime. The dynamic loader will try to find the dylibs based on the sequential order of the search paths. Paths to dylibs may be prefixed with <code>@rpath</code>, which allows developers to use relative paths to specify an array of search paths used at runtime based on the location of the executable. Additionally, if weak linking is used, such as the <code>LC_LOAD_WEAK_DYLIB</code> function, an application will still execute even if an expected dylib is not present. Weak linking enables developers to run an application on multiple macOS versions as new APIs are added. Adversaries may gain execution by inserting malicious dylibs with the name of the missing dylib in the identified path.(Citation: Wardle Dylib Hijack Vulnerable Apps)(Citation: Wardle Dylib Hijacking OSX 2015)(Citation: Github EmpireProject HijackScanner)(Citation: Github EmpireProject CreateHijacker Dylib) Dylibs are loaded into an application's address space allowing the malicious dylib to inherit the application's privilege level and resources. Based on the application, this could result in privilege escalation and uninhibited network access. This method may also evade detection from security products since the execution is masked under a legitimate process.(Citation: Writing Bad Malware for OSX)(Citation: wardle artofmalware volume1)(Citation: MalwareUnicorn macOS Dylib Injection MachO)
Near-miss passage: T1574 Hijack Execution Flow. Tactics: stealth, execution. Description: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Remote.exe is part of WinDbg in the Windows SDK and can be used for AWL bypass and running remote files.. Logsource: windows / process_creation. Rule: title: Use of Remote.exe id: 4eddc365-79b4-43ff-a9d7-99422dc34b93 status: test description: Remote.exe is part of WinDbg in the Windows SDK and can be used for AWL bypass and running remote files. references: - https://blog.thecybersecuritytutor.com/Exeuction-AWL-Bypass-Remote-exe-LOLBin/ - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Remote/ author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io date: 2022-06-02 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \remote.exe - OriginalFileName: remote.exe condition: selection falsepositives: - Approved installs of Windows SDK with Debugging Tools for Windows (WinDbg). level: medium
Near-miss passage: Sigma rule: Detects programs that connect to known malware callback ports based on statistical analysis from two different sandbox s. Logsource: windows / network_connection. Rule: title: Potentially Suspicious Malware Callback Communication id: 4b89abaa-99fe-4232-afdd-8f9aa4d20382 related: - id: 6d8c3d20-a5e1-494f-8412-4571d716cf5c type: similar status: test description: 'Detects programs that connect to known malware callback ports based on statistical analysis from two different sandbox system databases ' references: - https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo author: Florian Roth (Nextron Systems) date: 2017-03-19 modified: 2024-03-12 tags: - attack.persistence - attack.command-and-control - attack.t1571 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationPort: - 100 - 198 - 200 - 243 - 473 - 666 - 700 - 743 - 777 - 1443 - 1515 - 1777 - 1817 - 1904 - 1960 - 2443 - 2448 - 3360 - 3675 - 3939 - 4040 - 4433 - 4438 - 4443 - 4444 - 4455 - 5445 - 5552 - 5649 - 6625 - 7210 - 7777 - 8143 - 8843 - 9631 - 9943 - 10101 - 12102 - 12103 - 12322 - 13145 - 13394 - 13504 - 13505 - 13506 - 13507 - 14102 - 14103 - 14154 - 49180 - 65520 - 65535 filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 filter_optional_sys_directories: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Query: risk of XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.
Matching passage: CVE-2015-7241. CWE: CWE-611. CVSS: 9.800000190734863. XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.
Near-miss passage: CVE-2015-0194. CWE: CWE-611. CVSS: 6.5. XML External Entity (XXE) vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and IBM Sterling File Gateway 2.1 and 2.2 allows remote attackers to read arbitrary files via a crafted XML data.
Query: exploit Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Ex
Matching passage: CVE-2015-1741. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1752.
Near-miss passage: CVE-2015-0023. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0025.
Query: patch priority for CVE-2015-2785
Matching passage: CVE-2015-2785. CWE: CWE-119. CVSS: 7.5. The GIF encoder in Byzanz allows remote attackers to cause a denial of service (out-of-bounds heap write and crash) or possibly execute arbitrary code via a crafted Byzanz debug data recording (ByzanzRecording file) to the byzanz-playback command.
Near-miss passage: CVE-2015-9036. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, an incorrect length is used to clear a memory buffer resulting in adjacent memory getting corrupted.
Query: detection rule: Identifies when a service principal is created in Azure.
Matching passage: Sigma rule: Identifies when a service principal is created in Azure.. Logsource: azure / auditlogs. Rule: title: Azure Service Principal Created id: 0ddcff6d-d262-40b0-804b-80eb592de8e3 status: test description: Identifies when a service principal is created in Azure. references: - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory - https://analyticsrules.exchange/analyticrules/79566f41-df67-4e10-a703-c38a6213afd8/ author: Austin Songer @austinsonger date: 2021-09-02 modified: 2026-04-30 tags: - attack.stealth logsource: product: azure service: auditlogs detection: selection: operationName: Add service principal condition: selection falsepositives: - Service principal being created may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Service principal created from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects the execution of format.com with an uncommon filesystem selection that could indicate a defense evasion activity. Logsource: windows / process_creation. Rule: title: Uncommon FileSystem Load Attempt By Format.com id: 9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60 status: test description: 'Detects the execution of format.com with an uncommon filesystem selection that could indicate a defense evasion activity in which "format.com" is used to load malicious DLL files or other programs. ' references: - https://twitter.com/0gtweet/status/1477925112561209344 - https://twitter.com/wdormann/status/1478011052130459653?s=20 author: Florian Roth (Nextron Systems) date: 2022-01-04 modified: 2024-05-13 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: Image|endswith: \format.com CommandLine|contains: '/fs:' filter_main_known_fs: CommandLine|contains: - /fs:exFAT - /fs:FAT - /fs:NTFS - /fs:ReFS - /fs:UDF condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: Persistence mechanism resembling Customer Relationship Management Software
Matching passage: T1213.004 Customer Relationship Management Software. Tactics: collection. Description: Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable information. CRM software is used to assist organizations in tracking and managing customer interactions, as well as storing customer data. Once adversaries gain access to a victim organization, they may mine CRM software for customer data. This may include personally identifiable information (PII) such as full names, emails, phone numbers, and addresses, as well as additional details such as purchase histories and IT support interactions. By collecting this data, an adversary may be able to send personalized [Phishing](https://attack.mitre.org/techniques/T1566) emails, engage in SIM swapping, or otherwise target the organization’s customers in ways that enable financial gain or the compromise of additional organizations.(Citation: Bleeping Computer US Cellular Hack 2022)(Citation: Bleeping Computer Mint Mobile Hack 2021)(Citation: Bleeping Computer Bank Hack 2020) CRM software may be hosted on-premises or in the cloud. Information stored in these solutions may vary based on the specific instance or environment. Examples of CRM software include Microsoft Dynamics 365, Salesforce, Zoho, Zendesk, and HubSpot.
Near-miss passage: T1213.001 Confluence. Tactics: collection. Description: Adversaries may leverage Confluence repositories to mine valuable information. Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as: * Policies, procedures, and standards * Physical / logical network diagrams * System architecture diagrams * Technical system documentation * Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)) * Work / project schedules * Source code snippets * Links to network shares and other internal resources
Query: vulnerability: Cisco Headend System Release allows remote attackers to read temporary script files or archive files, and consequently obtain sensitive information, via a crafted header in an HTTP
Matching passage: CVE-2015-0745. CWE: CWE-200. CVSS: 5.0. Cisco Headend System Release allows remote attackers to read temporary script files or archive files, and consequently obtain sensitive information, via a crafted header in an HTTP request, aka Bug ID CSCus44909.
Near-miss passage: CVE-2015-9194. CWE: CWE-200. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 425, SD 427, SD 430, SD 435, SD 450, SD 617, SD 625, SD 650/52, SD 800, SD 845, and Snapdragon_High_Med_2016, during module load at TZ Startup, memory statically allocated by modules was not being properly set to zero first. Allowing the module to execute without reset gives it access to information from previous app thus leading to information exposure.
Query: exploit Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange Server 6 and OX AppSuite before 7.4.2-rev43, 7.6.0-rev38, and 7.6.1-rev21.
Matching passage: CVE-2015-1588. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange Server 6 and OX AppSuite before 7.4.2-rev43, 7.6.0-rev38, and 7.6.1-rev21.
Near-miss passage: CVE-2015-6588. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in login-fsp.html in MODX Revolution before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING.
Query: vulnerability: Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to gain privileges via a
Matching passage: CVE-2015-0062. CWE: CWE-264. CVSS: 7.199999809265137. Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to gain privileges via a crafted application that leverages incorrect impersonation handling in a process that uses the SeAssignPrimaryTokenPrivilege privilege, aka "Windows Create Process Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-1878. CWE: CWE-264. CVSS: 6.800000190734863. Thales nShield Connect hardware models 500, 1500, 6000, 500+, 1500+, and 6000+ before 11.72 allows physically proximate attackers to sign arbitrary data with previously loaded signing keys, extract the device identification key [KNETI] and impersonate the nShield Connect device on a network, affect the integrity and confidentiality of newly created keys, and potentially cause other unspecified impacts using previously loaded keys by connecting to the USB port on the front panel.