alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Lateral movement indicators for Hide Infrastructure
Matching passage: T1665 Hide Infrastructure. Tactics: command and control. Description: Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure. This can be accomplished by identifying and filtering traffic from defensive tools,(Citation: TA571) masking malicious domains to obfuscate the true destination from both automated scanning tools and security researchers,(Citation: Schema-abuse)(Citation: Facad1ng)(Citation: Browser-updates) and otherwise hiding malicious artifacts to delay discovery and prolong the effectiveness of adversary infrastructure that could otherwise be identified, blocked, or taken down entirely. C2 networks may include the use of [Proxy](https://attack.mitre.org/techniques/T1090) or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections. For example, an adversary may use a virtual private cloud to spoof their IP address to closer align with a victim's IP address ranges. This may also bypass security measures relying on geolocation of the source IP address.(Citation: sysdig)(Citation: Orange Residential Proxies) Adversaries may also attempt to filter network traffic in order to evade defensive tools in numerous ways, including blocking/redirecting common incident responder or security appliance user agents.(Citation: mod_rewrite)(Citation: SocGholish-update) Filtering traffic based on IP and geo-fencing may also avoid automated sandboxing or researcher activity (i.e., [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)).(Citation: TA571)(Citation: mod_rewrite) Hiding C2 infrastructure may also be supported by [Resource Development](https://attack.mitre.org/tactics/TA0042) activities such as [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) and [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584). For example, using widely trusted hosting services or domains such as prominent URL shortening providers or marketing ser
Near-miss passage: T1573.001 Symmetric Cryptography. Tactics: command and control. Description: Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.
Query: patch priority for CVE-2015-7465
Matching passage: CVE-2015-7465. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service (JRS) 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Near-miss passage: CVE-2015-2770. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the command line page in Websense TRITON V-Series appliances before 8.0.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Query: risk of Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3, 6.3.1, 6.3.2, 6.3.3, 6.3.4, and 6.3.5 allows remote
Matching passage: CVE-2015-0368. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3, 6.3.1, 6.3.2, 6.3.3, 6.3.4, and 6.3.5 allows remote attackers to affect availability via unknown vectors related to Security.
Near-miss passage: CVE-2015-2049. CWE: UNKNOWN. CVSS: 9.0. Unrestricted file upload vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension.
Query: detect Detects Obfuscated use of Environment Variables to execute PowerShell in logs
Matching passage: Sigma rule: Detects Obfuscated use of Environment Variables to execute PowerShell. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation VAR+ Launcher - PowerShell id: 0adfbc14-0ed1-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of Environment Variables to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|re: cmd.{0,5}(?:/c|/r)(?:\s|)"set\s[a-zA-Z]{3,6}.*(?:\{\d\}){1,}\\"\s+?-f(?:.*\)){1,}.*" condition: selection_4104 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of a file with a suspicious extension in the public folder, which could indicate potential maliciou. Logsource: windows / file_event. Rule: title: Suspicious Binaries and Scripts in Public Folder id: b447f7de-1e53-4cbf-bfb4-f1f6d0b04e4e status: experimental description: Detects the creation of a file with a suspicious extension in the public folder, which could indicate potential malicious activity. references: - https://intel.thedfirreport.com/events/view/30032 - https://intel.thedfirreport.com/eventReports/view/70 - https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/ author: The DFIR Report date: 2025-01-23 tags: - attack.execution - attack.t1204 logsource: category: file_event product: windows detection: selection: TargetFilename|contains: :\Users\Public\ TargetFilename|endswith: - .bat - .dll - .exe - .hta - .js - .ps1 - .vbe - .vbs condition: selection falsepositives: - Administrators deploying legitimate binaries to public folders. level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_public_folder_extension/info.yml
Query: CVE similar to CVE-2015-8003
Matching passage: CVE-2015-8003. CWE: CWE-399. CVSS: 6.800000190734863. MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not throttle file uploads, which allows remote authenticated users to have unspecified impact via multiple file uploads.
Near-miss passage: CVE-2015-1740. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1735, CVE-2015-1744, CVE-2015-1745, and CVE-2015-1766.
Query: patch priority for CVE-2015-6852
Matching passage: CVE-2015-6852. CWE: CWE-200. CVSS: 4.300000190734863. Directory traversal vulnerability in the API in EMC Secure Remote Services Virtual Edition 3.x before 3.10 allows remote authenticated users to read log files via a crafted parameter.
Near-miss passage: CVE-2015-1147. CWE: CWE-200. CVSS: 5.0. Open Directory Client in Apple OS X before 10.10.3 sends unencrypted password-change requests in certain circumstances involving missing certificates, which allows remote attackers to obtain sensitive information by sniffing the network.
Query: CVE similar to CVE-2015-1063
Matching passage: CVE-2015-1063. CWE: UNKNOWN. CVSS: 7.800000190734863. CoreTelephony in Apple iOS before 8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and device restart) via a Class 0 SMS message.
Near-miss passage: CVE-2015-3623. CWE: UNKNOWN. CVSS: 6.400000095367432. XML external entity (XXE) vulnerability in QlikTech Qlikview before 11.20 SR12 allows remote attackers to conduct server-side request forgery (SSRF) attacks and read arbitrary files via crafted XML data in a request to AccessPoint.aspx.
Query: exploit The USAA Mobile Banking application before 7.10.1 for Android displays the most recently-used screen before prompting the user for login, which might allow physically proximate use
Matching passage: CVE-2015-1314. CWE: CWE-200. CVSS: 2.0999999046325684. The USAA Mobile Banking application before 7.10.1 for Android displays the most recently-used screen before prompting the user for login, which might allow physically proximate users to obtain banking account numbers and balances.
Near-miss passage: CVE-2015-6127. CWE: CWE-200. CVSS: 4.300000190734863. Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows remote attackers to read arbitrary files via a crafted .mcl file, aka "Windows Media Center Information Disclosure Vulnerability."
Query: explain CWE-683
Matching passage: CWE-683 Function Call With Incorrect Order of Arguments. The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order, leading to resultant weaknesses.
Near-miss passage: CWE-317 Cleartext Storage of Sensitive Information in GUI. The product stores sensitive information in cleartext within the GUI.
Query: EDR alert: possible Firmware Corruption (T1495)
Matching passage: T1495 Firmware Corruption. Tactics: impact. Description: Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying the availability to use the devices and/or the system.(Citation: Symantec Chernobyl W95.CIH) Firmware is software that is loaded and executed from non-volatile memory on hardware devices in order to initialize and manage device functionality. These devices may include the motherboard, hard drive, or video cards. In general, adversaries may manipulate, overwrite, or corrupt firmware in order to deny the use of the system or devices. For example, corruption of firmware responsible for loading the operating system for network devices may render the network devices inoperable.(Citation: dhs_threat_to_net_devices)(Citation: cisa_malware_orgs_ukraine) Depending on the device, this attack may also result in [Data Destruction](https://attack.mitre.org/techniques/T1485).
Near-miss passage: T1486 Data Encrypted for Impact. Tactics: impact. Description: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.(Citation: US-CERT Ransomware 2016)(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017)(Citation: US-CERT SamSam 2018) In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted (and often renamed and/or tagged with specific file markers). Adversaries may need to first employ other behaviors, such as [File and Directory Permissions Modification](https://attack.mitre.org/techniques/T1222) or [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529), in order to unlock and/or gain access to manipulate these files.(Citation: CarbonBlack Conti July 2020) In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.(Citation: US-CERT NotPetya 2017) Adversaries may also encrypt virtual machines hosted on ESXi or other hypervisors.(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021) To maximize impact on the target organization, malware designed for encrypting data may have worm-like features to propagate across a network by leveraging other attack techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017) Encryption malware may also leverage [Internal Defacement](https:
Query: alert when Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with S
Matching passage: Sigma rule: Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with S. Logsource: windows / process_creation. Rule: title: Potential Privilege Escalation To LOCAL SYSTEM id: 207b0396-3689-42d9-8399-4222658efc99 related: - id: 8834e2f7-6b4b-4f09-8906-d2276470ee23 type: similar status: test description: Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with SYSTEM Privileges references: - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec - https://www.poweradmin.com/paexec/ - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-05-22 modified: 2024-03-05 tags: - attack.resource-development - attack.t1587.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|windash: - ' -s cmd' - ' -s -i cmd' - ' -i -s cmd' - ' -s pwsh' - ' -s -i pwsh' - ' -i -s pwsh' - ' -s powershell' - ' -s -i powershell' - ' -i -s powershell' filter_main_exclude_coverage: CommandLine|contains: - paexec - PsExec - accepteula condition: selection and not 1 of filter_main_* falsepositives: - Weird admins that rename their tools - Software companies that bundle PsExec/PAExec with their software and rename it, so that it is less embarrassing level: high
Near-miss passage: Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / file_event. Rule: title: Anydesk Temporary Artefact id: 0b9ad457-2554-44c1-82c2-d56a99c42377 status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows author: frack113 date: 2022-02-11 modified: 2024-07-20 tags: - attack.command-and-control - attack.t1219.002 logsource: category: file_event product: windows detection: selection: TargetFilename|contains: - \AppData\Roaming\AnyDesk\user.conf - \AppData\Roaming\AnyDesk\system.conf condition: selection falsepositives: - Legitimate use level: medium regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_anydesk_artefact/info.yml
Query: CVE similar to CVE-2015-9059
Matching passage: CVE-2015-9059. CWE: CWE-77. CVSS: 9.800000190734863. picocom before 2.0 has a command injection vulnerability in the 'send and receive file' command because the command line is executed by /bin/sh unsafely.
Near-miss passage: CVE-2015-2051. CWE: CWE-77. CVSS: 8.800000190734863. The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.
Query: Sigma rule for Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.
Matching passage: Sigma rule: Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.. Logsource: windows / process_creation. Rule: title: Mstsc.EXE Execution From Uncommon Parent id: ff3b6b39-e765-42f9-bb2c-ea6761e0e0f6 status: test description: Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations. references: - https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/ - https://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-18 tags: - attack.lateral-movement logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \brave.exe - \CCleanerBrowser.exe - \chrome.exe - \chromium.exe - \firefox.exe - \iexplore.exe - \microsoftedge.exe - \msedge.exe - \opera.exe - \vivaldi.exe - \whale.exe - \outlook.exe selection_img: - Image|endswith: \mstsc.exe - OriginalFileName: mstsc.exe condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects file write event from/to a fake recycle bin folder that is often used as a staging directory for malware. Logsource: windows / file_event. Rule: title: Suspicious File Creation Activity From Fake Recycle.Bin Folder id: cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca related: - id: 5ce0f04e-3efc-42af-839d-5b3a543b76c0 type: derived status: test description: Detects file write event from/to a fake recycle bin folder that is often used as a staging directory for malware references: - https://www.mandiant.com/resources/blog/infected-usb-steal-secrets - https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/ author: X__Junior (Nextron Systems) date: 2023-07-12 modified: 2023-12-11 tags: - attack.persistence - attack.stealth logsource: category: file_event product: windows detection: selection: - Image|contains: - RECYCLERS.BIN\ - RECYCLER.BIN\ - TargetFilename|contains: - RECYCLERS.BIN\ - RECYCLER.BIN\ condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_recycle_bin_fake_exec/info.yml
Query: containment actions for Suspicious Indicator Removal execution detected on endpoint
Matching passage: Playbook for T1070 Indicator Removal. 1) Validate alert telemetry against T1070. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior. Artifacts such as command hist
Near-miss passage: Playbook for T1070.004 File Deletion. Different response path focused on stealth.
Query: vulnerability: win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Se
Matching passage: CVE-2015-0003. CWE: CWE-476. CVSS: 6.900000095367432. win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-9111. CWE: CWE-476. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, in a QTEE syscall handler, an untrusted pointer dereference can occur.
Query: Sigma YAML for aws / cloudtrail
Matching passage: Sigma rule: Detects an instance of an SES identity being deleted via the "DeleteIdentity" event. This may be an indicator of an adve. Logsource: aws / cloudtrail. Rule: title: SES Identity Has Been Deleted id: 20f754db-d025-4a8f-9d74-e0037e999a9a status: test description: Detects an instance of an SES identity being deleted via the "DeleteIdentity" event. This may be an indicator of an adversary removing the account that carried out suspicious or malicious activities references: - https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/ author: Janantha Marasinghe date: 2022-12-13 modified: 2022-12-28 tags: - attack.stealth - attack.t1070 logsource: product: aws service: cloudtrail detection: selection: eventSource: ses.amazonaws.com eventName: DeleteIdentity condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via COMPRESS OBFUSCATION. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module id: 7034cbbb-cc55-4dc2-8dad-36c0b942e8f1 related: - id: 20e5497e-331c-4cd5-8d36-935f6e2a9a07 type: derived status: test description: Detects Obfuscated Powershell via COMPRESS OBFUSCATION references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|contains|all: - new-object - text.encoding]::ascii Payload|contains: - system.io.compression.deflatestream - system.io.streamreader Payload|endswith: readtoend condition: selection_4103 falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-0107
Matching passage: CVE-2015-0107. CWE: CWE-22. CVSS: 6.5. IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7.1 through 7.1.1.8 and 7.2 and Maximo Asset Management and Maximo Industry Solutions 7.1 through 7.1.1.8, 7.5 before 7.5.0.7 IFIX003, and 7.6 before 7.6.0.0 IFIX002 allow remote authenticated users to conduct directory traversal attacks via unspecified vectors.
Near-miss passage: CVE-2015-3309. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. (dot dot) in the path parameter of HTTP API requests. NOTE: This vulnerability is due to an incomplete fix to CVE-2015-3297.