alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: Buffer overflow in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK 
Matching passage: CVE-2015-6678. CWE: CWE-119. CVSS: 10.0. Buffer overflow in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-6676.
Near-miss passage: CVE-2015-3955. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in Hospira LifeCare PCA Infusion System 5.0 and earlier, and possibly other versions, allows remote attackers to execute arbitrary code via unspecified vectors.
Query: SIEM correlation: execution activity consistent with Deploy Container
Matching passage: T1610 Deploy Container. Tactics: execution. Description: Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment. In Kubernetes environments, an adversary may attempt to deploy a privileged or vulnerable container into a specific node in order to [Escape to Host](https://attack.mitre.org/techniques/T1611) and access other containers running on the node. (Citation: AppSecco Kubernetes Namespace Breakout 2020) Containers can be deployed by various means, such as via Docker's <code>create</code> and <code>start</code> APIs or via a web application such as the Kubernetes dashboard or Kubeflow. (Citation: Docker Container)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) In Kubernetes environments, containers may be deployed through workloads such as ReplicaSets or DaemonSets, which can allow containers to be deployed across multiple nodes.(Citation: Kubernetes Workload Management) Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts)
Near-miss passage: T1675 ESXi Administration Command. Tactics: execution. Description: Adversaries may abuse ESXi administration services to execute commands on guest machines hosted within an ESXi virtual environment. Persistent background services on ESXi-hosted VMs, such as the VMware Tools Daemon Service, allow for remote management from the ESXi server. The tools daemon service runs as `vmtoolsd.exe` on Windows guest operating systems, `vmware-tools-daemon` on macOS, and `vmtoolsd ` on Linux.(Citation: Broadcom VMware Tools Services) Adversaries may leverage a variety of tools to execute commands on ESXi-hosted VMs – for example, by using the vSphere Web Services SDK to programmatically execute commands and scripts via APIs such as `StartProgramInGuest`, `ListProcessesInGuest`, `ListFileInGuest`, and `InitiateFileTransferFromGuest`.(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023)(Citation: Broadcom Running Guest OS Operations) This may enable follow-on behaviors on the guest VMs, such as [File and Directory Discovery](https://attack.mitre.org/techniques/T1083), [Data from Local System](https://attack.mitre.org/techniques/T1005), or [OS Credential Dumping](https://attack.mitre.org/techniques/T1003).
Query: campaign using Runtime Data Manipulation
Matching passage: T1565.003 Runtime Data Manipulation. Tactics: impact. Description: Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating runtime data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Adversaries may alter application binaries used to display data in order to cause runtime manipulations. Adversaries may also conduct [Change Default File Association](https://attack.mitre.org/techniques/T1546/001) and [Masquerading](https://attack.mitre.org/techniques/T1036) to cause a similar effect. The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Near-miss passage: T1565.001 Stored Data Manipulation. Tactics: impact. Description: Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Query: vulnerability: The Control and Provisioning functionality in Cisco Mobility Services Engine (MSE) 10.0(0.1) allows remote authenticated users to obtain sensitive information by reading log files,
Matching passage: CVE-2015-4263. CWE: CWE-200. CVSS: 4.0. The Control and Provisioning functionality in Cisco Mobility Services Engine (MSE) 10.0(0.1) allows remote authenticated users to obtain sensitive information by reading log files, aka Bug ID CSCut36851.
Near-miss passage: CVE-2015-1776. CWE: CWE-200. CVSS: 6.199999809265137. Apache Hadoop 2.6.x encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials file on disk when the Intermediate data encryption feature is enabled, which allows local users to obtain sensitive information by reading the file.
Query: stealth using LC_MAIN Hijacking
Matching passage: T1149 LC_MAIN Hijacking. Tactics: stealth. Description: **This technique has been deprecated and should no longer be used.** As of OS X 10.8, mach-O binaries introduced a new header called LC_MAIN that points to the binary’s entry point for execution. Previously, there were two headers to achieve this same effect: LC_THREAD and LC_UNIXTHREAD (Citation: Prolific OSX Malware History). The entry point for a binary can be hijacked so that initial execution flows to a malicious addition (either another section or a code cave) and then goes back to the initial entry point so that the victim doesn’t know anything was different (Citation: Methods of Mac Malware Persistence). By modifying a binary in this way, application whitelisting can be bypassed because the file name or application path is still the same.
Near-miss passage: T1564.011 Ignore Process Interrupts. Tactics: stealth. Description: Adversaries may evade defensive mechanisms by executing commands that hide from process interrupt signals. Many operating systems use signals to deliver messages to control process behavior. Command interpreters often include specific commands/flags that ignore errors and other hangups, such as when the user of the active session logs off.(Citation: Linux Signal Man) These interrupt signals may also be used by defensive tools and/or analysts to pause or terminate specified running processes. Adversaries may invoke processes using `nohup`, [PowerShell](https://attack.mitre.org/techniques/T1059/001) `-ErrorAction SilentlyContinue`, or similar commands that may be immune to hangups.(Citation: nohup Linux Man)(Citation: Microsoft PowerShell SilentlyContinue) This may enable malicious commands and malware to continue execution through system events that would otherwise terminate its execution, such as users logging off or the termination of its C2 network connection. Hiding from process interrupt signals may allow malware to continue execution, but unlike [Trap](https://attack.mitre.org/techniques/T1546/005) this does not establish [Persistence](https://attack.mitre.org/tactics/TA0003) since the process will not be re-invoked once actually terminated.
Query: describe CVE-2015-7517
Matching passage: CVE-2015-7517. CWE: CWE-89. CVSS: 9.800000190734863. Multiple SQL injection vulnerabilities in the Double Opt-In for Download plugin before 2.0.9 for WordPress allow remote attackers to execute arbitrary SQL commands via the ver parameter to (1) class-doifd-download.php or (2) class-doifd-landing-page.php in public/includes/.
Near-miss passage: CVE-2015-3423. CWE: CWE-89. CVSS: 8.800000190734863. Multiple SQL injection vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) ctrl, (2) h____%2427, (3) h____%2439, (4) param0, (5) param1, (6) param2, (7) param3, (8) param4, (9) filter_INSERT_COUNT, (10) filter_MINOR_FALLOUT, (11) filter_UPDATE_COUNT, (12) sort, or (13) sessid parameter.
Query: CVE similar to CVE-2015-7936
Matching passage: CVE-2015-7936. CWE: CWE-352. CVSS: 7.5. Cross-site request forgery (CSRF) vulnerability in Motorola Solutions MOSCAD IP Gateway allows remote attackers to hijack the authentication of administrators for requests that modify a password.
Near-miss passage: CVE-2015-6517. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in phpLiteAdmin 1.1 allows remote attackers to hijack the authentication of users for requests that drop database tables via the droptable parameter to phpliteadmin.php.
Query: patch priority for CVE-2015-4291
Matching passage: CVE-2015-4291. CWE: CWE-399. CVSS: 7.800000190734863. Cisco IOS XE 2.x before 2.4.3 and 2.5.x before 2.5.1 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted series of fragmented (1) IPv4 or (2) IPv6 packets, aka Bug ID CSCtd72617.
Near-miss passage: CVE-2015-7944. CWE: CWE-399. CVSS: 7.5. The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2, when used in SSL mode, allows remote attackers to cause a denial of service (resource consumption) via SSL parameter renegotiation.
Query: Sigma rule for Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication
Matching passage: Sigma rule: Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication. Logsource: webserver. Rule: title: Suspicious Windows Strings In URI id: 9f6a34b4-2688-4eb7-a7f5-e39fef573d0e status: test description: Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication references: - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-06 modified: 2023-01-02 tags: - attack.persistence - attack.exfiltration - attack.t1505.003 logsource: category: webserver detection: selection: cs-uri-query|contains: - =C:/Users - =C:/Program%20Files - =C:/Windows - =C%3A%5CUsers - =C%3A%5CProgram%20Files - =C%3A%5CWindows condition: selection falsepositives: - Legitimate application and websites that use windows paths in their URL level: high
Near-miss passage: Sigma rule: Detects inline execution of PowerShell code from a file. Logsource: windows / process_creation. Rule: title: Powershell Inline Execution From A File id: ee218c12-627a-4d27-9e30-d6fb2fe22ed2 status: test description: Detects inline execution of PowerShell code from a file references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=50 author: frack113 date: 2022-12-25 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: process_creation detection: selection_exec: CommandLine|contains: - 'iex ' - 'Invoke-Expression ' - 'Invoke-Command ' - 'icm ' selection_read: CommandLine|contains: - 'cat ' - 'get-content ' - 'type ' selection_raw: CommandLine|contains: ' -raw' condition: all of selection_* falsepositives: - Unknown level: medium
Query: detect Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploitin in logs
Matching passage: Sigma rule: Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploitin. Logsource: linux / sshd. Rule: title: Suspicious OpenSSH Daemon Error id: e76b413a-83d0-4b94-8e4c-85db4a5b8bdc status: test description: Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts references: - https://github.com/openssh/openssh-portable/blob/c483a5c0fb8e8b8915fad85c5f6113386a4341ca/ssherr.c - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/sshd_rules.xml author: Florian Roth (Nextron Systems) date: 2017-06-30 modified: 2021-11-27 tags: - attack.initial-access - attack.t1190 logsource: product: linux service: sshd detection: keywords: - unexpected internal error - unknown or unsupported key type - invalid certificate signing key - invalid elliptic curve value - incorrect signature - error in libcrypto - unexpected bytes remain after decoding - 'fatal: buffer_get_string: bad string' - 'Local: crc32 compensation attack' - bad client public DH value - Corrupted MAC on input condition: keywords falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence. Logsource: windows / file_delete. Rule: title: IIS WebServer Access Logs Deleted id: 3eb8c339-a765-48cc-a150-4364c04652bf related: - id: 0649be4a-aeb0-45b0-b89e-7f1668f6d9c0 type: similar status: test description: Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence references: - https://www.elastic.co/guide/en/security/current/webserver-access-logs-deleted.html author: Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-09-16 modified: 2023-02-15 tags: - attack.stealth - attack.t1070 logsource: category: file_delete product: windows detection: selection: TargetFilename|contains: \inetpub\logs\LogFiles\ TargetFilename|endswith: .log condition: selection falsepositives: - During uninstallation of the IIS service - During log rotation level: medium
Query: patch priority for CVE-2015-0291
Matching passage: CVE-2015-0291. CWE: UNKNOWN. CVSS: 5.0. The sigalgs implementation in t1_lib.c in OpenSSL 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) by using an invalid signature_algorithms extension in the ClientHello message during a renegotiation.
Near-miss passage: CVE-2015-2545. CWE: UNKNOWN. CVSS: 7.800000190734863. Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted EPS image, aka "Microsoft Office Malformed EPS File Vulnerability."
Query: detect Detects usage of system utilities (only grep and egrep for now) to discover security software discovery in logs
Matching passage: Sigma rule: Detects usage of system utilities (only grep and egrep for now) to discover security software discovery. Logsource: linux / process_creation. Rule: title: Security Software Discovery - Linux id: c9d8b7fd-78e4-44fe-88f6-599135d46d60 status: test description: Detects usage of system utilities (only grep and egrep for now) to discover security software discovery references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2022-11-27 tags: - attack.discovery - attack.t1518.001 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /grep - /egrep CommandLine|contains: - nessusd - td-agent - packetbeat - filebeat - auditbeat - osqueryd - cbagentd - falcond condition: selection falsepositives: - Legitimate activities level: low
Near-miss passage: Sigma rule: Detects the execution of powershell scripts with calls to the "Start-NetEventSession" cmdlet. Which allows an attacker t. Logsource: windows / ps_script. Rule: title: Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock id: da34e323-1e65-42db-83be-a6725ac2caa3 status: test description: 'Detects the execution of powershell scripts with calls to the "Start-NetEventSession" cmdlet. Which allows an attacker to start event and packet capture for a network event session. Adversaries may attempt to capture network to gather information over the course of an operation. Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/5f866ca4517e837c4ea576e7309d0891e78080a8/atomics/T1040/T1040.md#atomic-test-16---powershell-network-sniffing - https://github.com/0xsyr0/Awesome-Cybersecurity-Handbooks/blob/7b8935fe4c82cb64d61343de1a8b2e38dd968534/handbooks/10_post_exploitation.md - https://github.com/forgottentq/powershell/blob/9e616363d497143dc955c4fdce68e5c18d28a6cb/captureWindows-Endpoint.ps1#L13 author: frack113 date: 2024-05-12 tags: - attack.credential-access - attack.discovery - attack.t1040 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: Start-NetEventSession condition: selection falsepositives: - Legitimate network diagnostic scripts. level: medium
Query: patch priority for CVE-2015-2815
Matching passage: CVE-2015-2815. CWE: CWE-119. CVSS: 6.5. Buffer overflow in the C_SAPGPARAM function in the NetWeaver Dispatcher in SAP KERNEL 7.00 (7000.52.12.34966) and 7.40 (7400.12.21.30308) allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via unspecified vectors, aka SAP Security Note 2063369.
Near-miss passage: CVE-2015-2427. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Query: vulnerability: The HWP filter in LibreOffice before 4.3.7 and 4.4.x before 4.4.2 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (crash) or possibly execut
Matching passage: CVE-2015-1774. CWE: CWE-787. CVSS: 6.800000190734863. The HWP filter in LibreOffice before 4.3.7 and 4.4.x before 4.4.2 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted HWP document, which triggers an out-of-bounds write.
Near-miss passage: CVE-2015-1641. CWE: CWE-787. CVSS: 7.800000190734863. Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allow remote attackers to execute arbitrary code via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: Sigma YAML for aws / cloudtrail
Matching passage: Sigma rule: Detects changes to the security groups associated with an Elastic Load Balancer (ELB) or Application Load Balancer (ALB). Logsource: aws / cloudtrail. Rule: title: LoadBalancer Security Group Modification id: 7a4409fc-f8ca-45f6-8006-127d779eaad9 status: test description: 'Detects changes to the security groups associated with an Elastic Load Balancer (ELB) or Application Load Balancer (ALB). This can indicate that a misconfiguration allowing more traffic into the system than required, or could indicate that an attacker is attempting to enable new connections into a VPC or subnet controlled by the account. ' references: - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/ author: jamesc-grafana date: 2024-07-11 tags: - attack.initial-access - attack.t1190 logsource: product: aws service: cloudtrail detection: selection: eventSource: elasticloadbalancing.amazonaws.com eventName: - ApplySecurityGroupsToLoadBalancer - SetSecurityGroups condition: selection falsepositives: - Repurposing of an ELB or ALB to serve a different or additional application - Changes to security groups to allow for new services to be deployed level: medium
Near-miss passage: Sigma rule: Detects VBScript content stored into registry keys as seen being used by UNC2452 group. Logsource: windows / registry_set. Rule: title: VBScript Payload Stored in Registry id: 46490193-1b22-4c29-bdd6-5bf63907216f status: test description: Detects VBScript content stored into registry keys as seen being used by UNC2452 group references: - https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ author: Florian Roth (Nextron Systems) date: 2021-03-05 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: Software\Microsoft\Windows\CurrentVersion Details|contains: - 'vbscript:' - 'jscript:' - mshtml, - RunHTMLApplication - Execute( - CreateObject - window.close filter: TargetObject|contains: Software\Microsoft\Windows\CurrentVersion\Run filter_dotnet: Image|endswith: \msiexec.exe TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\ Details|contains: - \Microsoft.NET\Primary Interop Assemblies\Microsoft.mshtml.dll - <\Microsoft.mshtml,fileVersion= - _mshtml_dll_ - <\Microsoft.mshtml,culture= condition: selection and not 1 of filter* falsepositives: - Unknown level: high