alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. Thes in logs
Matching passage: Sigma rule: The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. Thes. Logsource: windows / ps_script. Rule: title: Suspicious Get-ADReplAccount id: 060c3ef1-fd0a-4091-bf46-e7d625f60b73 status: test description: 'The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation. ' references: - https://www.powershellgallery.com/packages/DSInternals - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.006/T1003.006.md#atomic-test-2---run-dsinternals-get-adreplaccount author: frack113 date: 2022-02-06 tags: - attack.credential-access - attack.t1003.006 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Get-ADReplAccount - '-All ' - '-Server ' condition: selection falsepositives: - Legitimate PowerShell scripts level: medium
Near-miss passage: Sigma rule: Detects execution of "Tpmvscmgr.exe" to create a new virtual smart card.. Logsource: windows / process_creation. Rule: title: New Virtual Smart Card Created Via TpmVscMgr.EXE id: c633622e-cab9-4eaa-bb13-66a1d68b3e47 status: test description: Detects execution of "Tpmvscmgr.exe" to create a new virtual smart card. references: - https://learn.microsoft.com/en-us/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-15 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \tpmvscmgr.exe OriginalFileName: TpmVscMgr.exe selection_cli: CommandLine|contains: create condition: all of selection_* falsepositives: - Legitimate usage by an administrator level: medium
Query: vulnerability: Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown ve
Matching passage: CVE-2015-6014. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2015-4808, CVE-2015-6013, CVE-2015-6015, and CVE-2016-0432. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this issue is a stack-based buffer overflow in Oracle Outside In 8.5.2 and earlier, which allows remote attackers to execute arbitrary code via a crafted DOC file.
Near-miss passage: CVE-2015-6538. CWE: UNKNOWN. CVSS: 9.800000190734863. The login page in Epiphany Cardio Server 3.3, 4.0, and 4.1 mishandles authentication requests, which allows remote attackers to conduct LDAP injection attacks, and consequently bypass intended access restrictions, via a crafted URL.
Query: vulnerability: Microsoft Internet Explorer 6 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."
Matching passage: CVE-2015-1661. CWE: CWE-264. CVSS: 4.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."
Near-miss passage: CVE-2015-4505. CWE: CWE-264. CVSS: 6.599999904632568. updater.exe in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows allows local users to write to arbitrary files by conducting a junction attack and waiting for an update operation by the Mozilla Maintenance Service.
Query: patch priority for CVE-2015-2073
Matching passage: CVE-2015-2073. CWE: CWE-22. CVSS: 7.5. The File RepositoRy Server (FRS) CORBA listener in SAP BussinessObjects Edge 4.0 allows remote attackers to read arbitrary files via a full pathname, aka SAP Note 2018682.
Near-miss passage: CVE-2015-1396. CWE: CWE-22. CVSS: 7.5. A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file. NOTE: this issue exists because of an incomplete fix for CVE-2015-1196.
Query: containment actions for Outbound C2 pattern associated with Protocol Tunneling
Matching passage: Playbook for T1572 Protocol Tunneling. 1) Validate alert telemetry against T1572. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: command and control. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to
Near-miss passage: Playbook for T1043 Commonly Used Port. Different response path focused on command and control.
Query: vulnerability: OpenGL in Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a cr
Matching passage: CVE-2015-7065. CWE: CWE-119. CVSS: 6.800000190734863. OpenGL in Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Near-miss passage: CVE-2015-5917. CWE: CWE-119. CVSS: 5.0. The glob implementation in tnftpd (formerly lukemftpd), as used in Apple OS X before 10.11, allows remote attackers to cause a denial of service (memory consumption and daemon outage) via a STAT command containing a crafted pattern, as demonstrated by multiple instances of the {..,..,..}/* substring.
Query: vulnerability: Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via crafted packe
Matching passage: CVE-2015-7236. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via crafted packets, involving a PMAP_CALLIT code.
Near-miss passage: CVE-2015-0449. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect integrity via unknown vectors related to Console.
Query: CVE similar to CVE-2015-1790
Matching passage: CVE-2015-1790. CWE: UNKNOWN. CVSS: 5.0. The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a PKCS#7 blob that uses ASN.1 encoding and lacks inner EncryptedContent data.
Near-miss passage: CVE-2015-4796. CWE: UNKNOWN. CVSS: 9.0. Unspecified vulnerability in the Java VM component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2, when running on Windows, allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-4888.
Query: CVE similar to CVE-2015-6622
Matching passage: CVE-2015-6622. CWE: CWE-200. CVSS: 5.0. The Native Frameworks Library in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23905002.
Near-miss passage: CVE-2015-4990. CWE: CWE-200. CVSS: 4.0. The portal in IBM Tealeaf Customer Experience before 8.7.1.8818, 8.8 before 8.8.0.9026, 9.0.0, 9.0.0A, 9.0.1 before 9.0.1.1083, 9.0.1A before 9.0.1.5073, 9.0.2 before 9.0.2.1095, and 9.0.2A before 9.0.2.5144 allows local users to discover credentials by leveraging privileges during an unspecified connection type.
Query: exploit Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition.
Matching passage: CVE-2015-0503. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition.
Near-miss passage: CVE-2015-2591. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the PeopleSoft Enterprise Portal - Interaction Hub component in Oracle PeopleSoft Products 9.1.00 allows remote authenticated users to affect integrity via unknown vectors related to Enterprise Portal.
Query: indicators of Web Services
Matching passage: T1583.006 Web Services. Tactics: resource development. Description: Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)), [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567), or [Phishing](https://attack.mitre.org/techniques/T1566). Using common services, such as those offered by Google, GitHub, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: FireEye APT29)(Citation: Hacker News GitHub Abuse 2024) By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.
Near-miss passage: T1583.002 DNS Server. Tactics: resource development. Description: Adversaries may set up their own Domain Name System (DNS) servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: [Application Layer Protocol](https://attack.mitre.org/techniques/T1071)). Instead of hijacking existing DNS servers, adversaries may opt to configure and run their own DNS servers in support of operations. By running their own DNS servers, adversaries can have more control over how they administer server-side DNS C2 traffic ([DNS](https://attack.mitre.org/techniques/T1071/004)). With control over a DNS server, adversaries can configure DNS applications to provide conditional responses to malware and, generally, have more flexibility in the structure of the DNS-based C2 channel.(Citation: Unit42 DNS Mar 2019)
Query: exploit GNOME NetworkManager allows remote attackers to cause a denial of service (IPv6 traffic disruption) via a crafted MTU value in an IPv6 Router Advertisement (RA) message, a differen
Matching passage: CVE-2015-0272. CWE: UNKNOWN. CVSS: 5.0. GNOME NetworkManager allows remote attackers to cause a denial of service (IPv6 traffic disruption) via a crafted MTU value in an IPv6 Router Advertisement (RA) message, a different vulnerability than CVE-2015-8215.
Near-miss passage: CVE-2015-8580. CWE: UNKNOWN. CVSS: 6.800000190734863. Multiple use-after-free vulnerabilities in the (1) Print method and (2) App object handling in Foxit Reader before 7.2.2 and Foxit PhantomPDF before 7.2.2 allow remote attackers to execute arbitrary code via a crafted PDF document.
Query: write Sigma for Detects the execution of WMIC with the "format" flag to potentially load local XSL files. Adversaries abuse this functio
Matching passage: Sigma rule: Detects the execution of WMIC with the "format" flag to potentially load local XSL files. Adversaries abuse this functio. Logsource: windows / process_creation. Rule: title: XSL Script Execution Via WMIC.EXE id: 05c36dd6-79d6-4a9a-97da-3db20298ab2d related: - id: 06ce37c2-61ab-4f05-9ff5-b1a96d18ae32 type: similar - id: 8d63dadf-b91b-4187-87b6-34a1114577ea type: similar status: test description: 'Detects the execution of WMIC with the "format" flag to potentially load local XSL files. Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md author: Timur Zinniatullin, oscd.community, Swachchhanda Shrawan Poudel date: 2019-10-21 modified: 2026-01-24 tags: - attack.stealth - attack.t1047 - attack.t1220 - attack.execution - attack.t1059.005 - attack.t1059.007 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe - Hashes|contains: - IMPHASH=1B1A3F43BF37B5BFE60751F2EE2F326E - IMPHASH=37777A96245A3C74EB217308F3546F4C - IMPHASH=9D87C9D67CE724033C0B40CC4CA1B206 - IMPHASH=B12619881D79C3ACADF45E752A58554A - IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00 selection_cmd: CommandLine|contains|windash: '-format:' filter_main_known_format: CommandLine|contains: - Format:List - Format:htable - Format:hform - Format:table - Format:mof - Format:value - Format:rawxml - Format:xml - Format:csv filter_main_remote_operation: CommandLine|contains: - :// - \\\\ condition: all of selection_* and not 1 of filter_main_* falsepositives: - WMIC.exe FP depend on scripts and administrative methods used in the monitored environment. - Static format arguments - https://petri.com/command-line-wmi-part-3 level: medium
Near-miss passage: Sigma rule: Detects the use of the filename DumpStack.log to evade Microsoft Defender. Logsource: windows / process_creation. Rule: title: DumpStack.log Defender Evasion id: 4f647cfa-b598-4e12-ad69-c68dd16caef8 status: test description: Detects the use of the filename DumpStack.log to evade Microsoft Defender references: - https://twitter.com/mrd0x/status/1479094189048713219 author: Florian Roth (Nextron Systems) date: 2022-01-06 modified: 2022-06-17 tags: - attack.defense-impairment logsource: category: process_creation product: windows detection: selection: Image|endswith: \DumpStack.log selection_download: CommandLine|contains: ' -o DumpStack.log' condition: 1 of selection* falsepositives: - Unknown level: critical
Query: describe CVE-2015-8636
Matching passage: CVE-2015-8636. CWE: CWE-119. CVSS: 8.800000190734863. Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8459, CVE-2015-8460, and CVE-2015-8645.
Near-miss passage: CVE-2015-7061. CWE: CWE-119. CVSS: 6.800000190734863. The ASN.1 decoder in Apple OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate, a different vulnerability than CVE-2015-7059 and CVE-2015-7060.
Query: alert when Detects driver load of the Process Hacker tool
Matching passage: Sigma rule: Detects driver load of the Process Hacker tool. Logsource: windows / driver_load. Rule: title: PUA - Process Hacker Driver Load id: 67add051-9ee7-4ad3-93ba-42935615ae8d related: - id: 10cb6535-b31d-4512-9962-513dcbc42cc1 type: similar status: test description: Detects driver load of the Process Hacker tool references: - https://processhacker.sourceforge.io/ author: Florian Roth (Nextron Systems) date: 2022-11-16 modified: 2024-11-23 tags: - attack.persistence - attack.privilege-escalation - cve.2021-21551 - attack.t1543 logsource: category: driver_load product: windows detection: selection: - ImageLoaded|endswith: \kprocesshacker.sys - Hashes|contains: - IMPHASH=821D74031D3F625BCBD0DF08B70F1E77 - IMPHASH=F86759BB4DE4320918615DC06E998A39 - IMPHASH=0A64EEB85419257D0CE32BD5D55C3A18 - IMPHASH=6E7B34DFC017700B1517B230DF6FF0D0 condition: selection falsepositives: - Legitimate use of process hacker or system informer by developers or system administrators level: high
Near-miss passage: Sigma rule: Detects Octopus Scanner Malware.. Logsource: windows / file_event. Rule: title: Octopus Scanner Malware id: 805c55d9-31e6-4846-9878-c34c75054fe9 status: test description: Detects Octopus Scanner Malware. references: - https://securitylab.github.com/research/octopus-scanner-malware-open-source-supply-chain author: NVISO date: 2020-06-09 modified: 2021-11-27 tags: - attack.initial-access - attack.t1195 - attack.t1195.001 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \AppData\Local\Microsoft\Cache134.dat - \AppData\Local\Microsoft\ExplorerSync.db condition: selection falsepositives: - Unknown level: high
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before FP17, 6.2.1 before FP9, and 6.2.2 before FP15, as used in Security 
Matching passage: CVE-2015-1966. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before FP17, 6.2.1 before FP9, and 6.2.2 before FP15, as used in Security Access Manager for Mobile and other products, allow remote attackers to inject arbitrary web script or HTML via a crafted URL, related to the (1) ERROR_DESCRIPTION and (2) TOKEN:RelayState macros.
Near-miss passage: CVE-2015-5181. CWE: CWE-79. CVSS: 5.400000095367432. The JBoss console in A-MQ allows remote attackers to execute arbitrary JavaScript.
Query: SOC runbook when seeing Encoded PowerShell / command-line abuse matching Local Email Collection
Matching passage: Playbook for T1114.001 Local Email Collection. 1) Validate alert telemetry against T1114.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: collection. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files. Outlook stores data locally in offline data files with an extension of .ost. Outlook 2010 and later supports .ost file sizes up to 50GB, while earlier versions of Outlook support up to 20GB.(Citation: Ou
Near-miss passage: Playbook for T1114.002 Remote Email Collection. Different response path focused on collection.
Query: risk of The bpf_int_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 4.0.6 allows local users to cause a denial of service (system crash) by creating a packet
Matching passage: CVE-2015-4700. CWE: CWE-17. CVSS: 4.900000095367432. The bpf_int_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 4.0.6 allows local users to cause a denial of service (system crash) by creating a packet filter and then loading crafted BPF instructions that trigger late convergence by the JIT compiler.
Near-miss passage: CVE-2015-5605. CWE: CWE-17. CVSS: 5.0. The regular-expression implementation in Google V8, as used in Google Chrome before 44.0.2403.89, mishandles interrupts, which allows remote attackers to cause a denial of service (application crash) via crafted JavaScript code, as demonstrated by an error in garbage collection during allocation of a stack-overflow exception message.
Query: CVE similar to CVE-2015-8635
Matching passage: CVE-2015-8635. CWE: UNKNOWN. CVSS: 8.800000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
Near-miss passage: CVE-2015-5564. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, and CVE-2015-5565.
Query: adversary uses Clear Linux or Mac System Logs
Matching passage: T1685.006 Clear Linux or Mac System Logs. Tactics: defense impairment. Description: Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the `/var/log/` directory. Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs) * `/var/log/messages:`: General and system-related messages * `/var/log/secure or /var/log/auth.log`: Authentication logs * `/var/log/utmp or /var/log/wtmp`: Login records * `/var/log/kern.log`: Kernel logs * `/var/log/cron.log`: Crond logs * `/var/log/maillog`: Mail server logs * `/var/log/httpd/`: Web server access and error logs
Near-miss passage: T1685 Disable or Modify Tools. Tactics: defense impairment. Description: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.(Citation: SCADAfence_ransomware) In addition to directly targeting tools, adversaries may block or manipulate indicators and telemetry used for detection. This includes maliciously disabling or redirecting sensors such as Event Tracing for Windows (ETW), modifying event log configurations (e.g., redirecting Security logs), or interfering with logging pipelines and forwarding mechanisms (e.g., SIEM ingestion).(Citation: Microsoft Lamin Sept 2017)(Citation: ETW Palantir) More advanced techniques include leveraging legitimate drivers or debugging mechanisms to render tools non-functional, bypassing anti-tampering protections, and targeting specific defenses such as Sysmon or cloud monitoring agents. Adversaries may also disrupt broader defensive operations, including update mechanisms, logging infrastructure (e.g., syslog), or event aggregation, further degrading an organization’s ability to detect and respond to malicious activity.(Citation: Cocomazzi FIN7 Reboot)