alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Encoded PowerShell / command-line abuse matching Server
Matching passage: T1584.004 Server. Tactics: resource development. Description: Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control.(Citation: TrendMicro EarthLusca 2022) Instead of purchasing a [Server](https://attack.mitre.org/techniques/T1583/004) or [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may compromise third-party servers in support of operations. Adversaries may also compromise web servers to support watering hole operations, as in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), or email servers to support [Phishing](https://attack.mitre.org/techniques/T1566) operations.
Near-miss passage: T1584.003 Virtual Private Server. Tactics: resource development. Description: Adversaries may compromise third-party Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. Adversaries may compromise VPSs purchased by third-party entities. By compromising a VPS to use as infrastructure, adversaries can make it difficult to physically tie back operations to themselves.(Citation: NSA NCSC Turla OilRig) Compromising a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers as well as that added by the compromised third-party.
Query: exploit Race condition in the nsThreadManager::RegisterCurrentThread function in Mozilla Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a denial of service 
Matching passage: CVE-2015-2715. CWE: CWE-362. CVSS: 6.800000190734863. Race condition in the nsThreadManager::RegisterCurrentThread function in Mozilla Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) by leveraging improper Media Decoder Thread creation at the time of a shutdown.
Near-miss passage: CVE-2015-0654. CWE: CWE-362. CVSS: 7.099999904632568. Race condition in the TLS implementation in MainApp in the management interface in Cisco Intrusion Prevention System (IPS) Software before 7.3(3)E4 allows remote attackers to cause a denial of service (process hang) by establishing many HTTPS sessions, aka Bug ID CSCuq40652.
Query: patch priority for CVE-2015-10022
Matching passage: CVE-2015-10022. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in IISH nlgis2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file scripts/etl/custom_import.pl. The manipulation leads to sql injection. The identifier of the patch is 8bdb6fcf7209584eaf1232437f0f53e735b2b34c. It is recommended to apply a patch to fix this issue. The identifier VDB-217609 was assigned to this vulnerability.
Near-miss passage: CVE-2015-1423. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote administrators to execute arbitrary SQL commands via the (1) jak_delete_log[] or (2) ssp parameter to admin/index.php.
Query: vulnerability: Cisco IOS XE 2.1.0 through 2.2.3 and 2.3.0 on ASR 1000 devices, when NAT Application Layer Gateway is used, allows remote attackers to cause a denial of service (Embedded Services 
Matching passage: CVE-2015-6272. CWE: CWE-399. CVSS: 7.800000190734863. Cisco IOS XE 2.1.0 through 2.2.3 and 2.3.0 on ASR 1000 devices, when NAT Application Layer Gateway is used, allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted H.323 packet, aka Bug ID CSCsx35393, CSCsx07094, and CSCsw93064.
Near-miss passage: CVE-2015-0026. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0022, CVE-2015-0030, CVE-2015-0031, CVE-2015-0036, and CVE-2015-0041.
Query: patch priority for CVE-2015-5082
Matching passage: CVE-2015-5082. CWE: CWE-77. CVSS: 10.0. Endian Firewall before 3.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) NEW_PASSWORD_1 or (2) NEW_PASSWORD_2 parameter to cgi-bin/chpasswd.cgi.
Near-miss passage: CVE-2015-7841. CWE: CWE-77. CVSS: 9.800000190734863. The login page of the server on Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software before V100R003C00SPC602, RH1288 V3 with software before V100R003C00SPC602, RH2288A V2 with software before V100R002C00SPC701, RH1288A V2 with software before V100R002C00SPC502, RH8100 V3 with software before V100R003C00SPC110, CH222 V3 with software before V100R001C00SPC161, CH220 V3 with software before V100R001C00SPC161, and CH121 V3 with software before V100R001C00SPC161 allows remote attackers to bypass access restrictions and enter commands via unspecified parameters, as demonstrated by a "user creation command."
Query: vulnerability: MongoDB before 2.4.13 and 2.6.x before 2.6.8 allows remote attackers to cause a denial of service via a crafted UTF-8 string in a BSON request.
Matching passage: CVE-2015-1609. CWE: CWE-20. CVSS: 5.0. MongoDB before 2.4.13 and 2.6.x before 2.6.8 allows remote attackers to cause a denial of service via a crafted UTF-8 string in a BSON request.
Near-miss passage: CVE-2015-5194. CWE: CWE-20. CVSS: 7.5. The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.
Query: write Sigma for Detects the execution of "hh.exe" to open ".chm" files.
Matching passage: Sigma rule: Detects the execution of "hh.exe" to open ".chm" files.. Logsource: windows / process_creation. Rule: title: HH.EXE Execution id: 68c8acb4-1b60-4890-8e82-3ddf7a6dba84 status: test description: Detects the execution of "hh.exe" to open ".chm" files. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.001/T1218.001.md - https://eqllib.readthedocs.io/en/latest/analytics/b25aa548-7937-11e9-8f5c-d46d6d62a49e.html - https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37 author: E.M. Anhaus (originally from Atomic Blue Detections, Dan Beavin), oscd.community date: 2019-10-24 modified: 2023-12-11 tags: - attack.stealth - attack.t1218.001 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: HH.exe - Image|endswith: \hh.exe selection_cli: CommandLine|contains: .chm condition: all of selection_* falsepositives: - False positives are expected with legitimate ".CHM" level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hh_chm_execution/info.yml
Near-miss passage: Sigma rule: Detects creation of a file named "wpbbin" in the "%systemroot%\system32\" directory. Which could be indicative of UEFI b. Logsource: windows / file_event. Rule: title: UEFI Persistence Via Wpbbin - FileCreation id: e94b9ddc-eec5-4bb8-8a58-b9dc5f4e185f status: test description: Detects creation of a file named "wpbbin" in the "%systemroot%\system32\" directory. Which could be indicative of UEFI based persistence method references: - https://grzegorztworek.medium.com/using-uefi-to-inject-executable-files-into-bitlocker-protected-drives-8ff4ca59c94c - https://persistence-info.github.io/Data/wpbbin.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-18 tags: - attack.persistence - attack.stealth - attack.t1542.001 logsource: product: windows category: file_event detection: selection: TargetFilename: C:\Windows\System32\wpbbin.exe condition: selection falsepositives: - Legitimate usage of the file by hardware manufacturer such as lenovo (Thanks @0gtweet for the tip) level: high
Query: patch priority for CVE-2015-5995
Matching passage: CVE-2015-5995. CWE: CWE-264. CVSS: 9.800000190734863. Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 and Tenda N3 Wireless N150 devices allow remote attackers to obtain administrative access via a certain admin substring in an HTTP Cookie header.
Near-miss passage: CVE-2015-6034. CWE: CWE-264. CVSS: 6.900000095367432. EPSON Network Utility 4.10 uses weak permissions (Everyone: Full Control) for eEBSVC.exe, which allows local users to gain privileges via a Trojan horse file.
Query: describe CVE-2015-4899
Matching passage: CVE-2015-4899. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.0.1 and 3.1.2 allows remote attackers to affect confidentiality via unknown vectors related to Security.
Near-miss passage: CVE-2015-8068. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: describe CVE-2015-1308
Matching passage: CVE-2015-1308. CWE: CWE-200. CVSS: 4.300000190734863. kde-workspace 4.2.0 and plasma-workspace before 5.1.95 allows remote attackers to obtain input events, and consequently obtain passwords, by leveraging access to the X server when the screen is locked.
Near-miss passage: CVE-2015-3184. CWE: CWE-200. CVSS: 5.0. mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name.
Query: exploit Mount Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, a
Matching passage: CVE-2015-1769. CWE: CWE-264. CVSS: 6.599999904632568. Mount Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 mishandles symlinks, which allows physically proximate attackers to execute arbitrary code by connecting a crafted USB device, aka "Mount Manager Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-8370. CWE: CWE-264. CVSS: 7.400000095367432. Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get function in lib/crypto.c, which trigger an "Off-by-two" or "Out of bounds overwrite" memory error.
Query: Persistence mechanism resembling Launch Agent
Matching passage: T1543.001 Launch Agent. Tactics: persistence, privilege escalation. Description: Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in <code>/System/Library/LaunchAgents</code>, <code>/Library/LaunchAgents</code>, and <code>~/Library/LaunchAgents</code>.(Citation: AppleDocs Launch Agent Daemons)(Citation: OSX Keydnap malware) (Citation: Antiquated Mac Malware) Property list files use the <code>Label</code>, <code>ProgramArguments </code>, and <code>RunAtLoad</code> keys to identify the Launch Agent's name, executable location, and execution time.(Citation: OSX.Dok Malware) Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks. Launch Agents can also be executed using the [Launchctl](https://attack.mitre.org/techniques/T1569/001) command. Adversaries may install a new Launch Agent that executes at login by placing a .plist file into the appropriate folders with the <code>RunAtLoad</code> or <code>KeepAlive</code> keys set to <code>true</code>.(Citation: Sofacy Komplex Trojan)(Citation: Methods of Mac Malware Persistence) The Launch Agent name may be disguised by using a name from the related operating system or benign software. Launch Agents are created with user level privileges and execute with user level permissions.(Citation: OSX Malware Detection)(Citation: OceanLotus for OS X)
Near-miss passage: T1543 Create or Modify System Process. Tactics: persistence, privilege escalation. Description: Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services.(Citation: TechNet Services) On macOS, launchd processes known as [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001) are run to finish system initialization and load user specific parameters.(Citation: AppleDocs Launch Agent Daemons) Adversaries may install new services, daemons, or agents that can be configured to execute at startup or a repeatable interval in order to establish persistence. Similarly, adversaries may modify existing services, daemons, or agents to achieve the same effect. Services, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges. Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges.(Citation: OSX Malware Detection)
Query: explain CWE-1084
Matching passage: CWE-1084 Invokable Control Element with Excessive File or Data Access Operations. A function or method contains too many operations that utilize a data manager or file resource.
Near-miss passage: CWE-1192 Improper Identifier for IP Block used in System-On-Chip (SOC). The System-on-Chip (SoC) does not have unique, immutable identifiers for each of its components.
Query: rule covering Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or
Matching passage: Sigma rule: Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or. Logsource: windows / process_creation. Rule: title: Potential Persistence Attempt Via Existing Service Tampering id: 38879043-7e1e-47a9-8d46-6bec88e201df status: test description: Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence. references: - https://pentestlab.blog/2020/01/22/persistence-modify-existing-service/ author: Sreeman date: 2020-09-29 modified: 2023-02-04 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1543.003 - attack.t1574.011 logsource: category: process_creation product: windows detection: selection_sc: - CommandLine|contains|all: - 'sc ' - 'config ' - binpath= - CommandLine|contains|all: - 'sc ' - failure - command= selection_reg_img: - CommandLine|contains|all: - 'reg ' - 'add ' - FailureCommand - CommandLine|contains|all: - 'reg ' - 'add ' - ImagePath selection_reg_ext: CommandLine|contains: - .sh - .exe - .dll - .bin$ - .bat - .cmd - .js - .msh$ - .reg$ - .scr - .ps - .vb - .jar - .pl condition: selection_sc or all of selection_reg_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse that feature to establish a reverse shell or pe. Logsource: windows / dns_query. Rule: title: Cloudflared Tunnels Related DNS Requests id: a1d9eec5-33b2-4177-8d24-27fe754d0812 related: - id: 7cd1dcdc-6edf-4896-86dc-d1f19ad64903 type: similar status: test description: 'Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. ' references: - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/ - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-12-20 tags: - attack.command-and-control - attack.t1071.001 - attack.t1572 logsource: category: dns_query product: windows detection: selection: QueryName|endswith: - .v2.argotunnel.com - protocol-v2.argotunnel.com - trycloudflare.com - update.argotunnel.com condition: selection falsepositives: - Legitimate use of cloudflare tunnels will also trigger this. level: medium
Query: risk of Cross-site scripting (XSS) vulnerabilities in Synology Audio Station 5.1 before 5.1-2550 and 5.4 before 5.4-2857 allows remote authenticated attackers to inject arbitrary web scrip
Matching passage: CVE-2015-9104. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerabilities in Synology Audio Station 5.1 before 5.1-2550 and 5.4 before 5.4-2857 allows remote authenticated attackers to inject arbitrary web script or HTML via the album title.
Near-miss passage: CVE-2015-0703. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the administrative web interface in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCus95857.
Query: Sigma rule for Detects suspicious changes to the Windows Defender configuration
Matching passage: Sigma rule: Detects suspicious changes to the Windows Defender configuration. Logsource: windows / windefend. Rule: title: Windows Defender Configuration Changes id: 801bd44f-ceed-4eb6-887c-11544633c0aa related: - id: 1321dc4e-a1fe-481d-a016-52c45f0c8b4f type: similar - id: a3ab73f1-bd46-4319-8f06-4b20d0617886 type: similar - id: 91903aba-1088-42ee-b680-d6d94fe002b0 type: similar status: stable description: Detects suspicious changes to the Windows Defender configuration references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide - https://bidouillesecurity.com/disable-windows-defender-in-powershell/#DisableAntiSpyware author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-06 modified: 2023-11-24 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: 5007 NewValue|contains: - '\Windows Defender\DisableAntiSpyware ' - '\Windows Defender\Scan\DisableRemovableDriveScanning ' - '\Windows Defender\Scan\DisableScanningMappedNetworkDrivesForFullScan ' - '\Windows Defender\SpyNet\DisableBlockAtFirstSeen ' - '\Real-Time Protection\SpyNetReporting ' condition: selection falsepositives: - Administrator activity (must be investigated) level: high
Near-miss passage: Sigma rule: Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted lo. Logsource: windows / process_creation. Rule: title: Bypass UAC via CMSTP id: e66779cc-383e-4224-a3a4-267eeb585c40 status: test description: Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files references: - https://eqllib.readthedocs.io/en/latest/analytics/e584f1a1-c303-4885-8a66-21360c90995b.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.003/T1218.003.md - https://lolbas-project.github.io/lolbas/Binaries/Cmstp/ author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community date: 2019-10-24 modified: 2022-08-30 tags: - attack.privilege-escalation - attack.stealth - attack.t1548.002 - attack.t1218.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmstp.exe - OriginalFileName: CMSTP.EXE selection_cli: CommandLine|contains: - /s - -s - /au - -au - /ni - -ni condition: all of selection* falsepositives: - Legitimate use of cmstp.exe utility by legitimate user level: high