alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: mitigate User Activity Based Checks
Matching passage: T1497.002 User Activity Based Checks. Tactics: stealth, discovery. Description: Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness) Adversaries may search for user activity on the host based on variables such as the speed/frequency of mouse movements and clicks (Citation: Sans Virtual Jan 2016) , browser history, cache, bookmarks, or number of files in common directories such as home or the desktop. Other methods may rely on specific user interaction with the system before the malicious code is activated, such as waiting for a document to close before activating a macro (Citation: Unit 42 Sofacy Nov 2018) or waiting for a user to double click on an embedded image to activate.(Citation: FireEye FIN7 April 2017)
Near-miss passage: T1497 Virtualization/Sandbox Evasion. Tactics: stealth, discovery. Description: Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness) Adversaries may use several methods to accomplish [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) such as checking for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) or other system artifacts associated with analysis or virtualization. Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment. Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.(Citation: Unit 42 Pirpi July 2015)
Query: CVE similar to CVE-2015-2270
Matching passage: CVE-2015-2270. CWE: CWE-17. CVSS: 4.300000190734863. lib/moodlelib.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4, when the theme uses the blocks-regions feature, establishes the course state at an incorrect point in the login-validation process, which allows remote attackers to obtain sensitive course information via unspecified vectors.
Near-miss passage: CVE-2015-3183. CWE: CWE-17. CVSS: 5.0. The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.
Query: write Sigma for Detects PowerShell scripts that utilize native PowerShell Identity modules to request Kerberos tickets. This behavior is
Matching passage: Sigma rule: Detects PowerShell scripts that utilize native PowerShell Identity modules to request Kerberos tickets. This behavior is. Logsource: windows / ps_script. Rule: title: Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlock id: a861d835-af37-4930-bcd6-5b178bfb54df related: - id: caa9a802-8bd8-4b9e-a5cd-4d6221670219 type: similar status: test description: 'Detects PowerShell scripts that utilize native PowerShell Identity modules to request Kerberos tickets. This behavior is typically seen during a Kerberos or silver ticket attack. A successful execution will output the SPNs for the endpoint in question. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1558.003/T1558.003.md#atomic-test-4---request-a-single-ticket-via-powershell - https://learn.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8.1 author: frack113 date: 2021-12-28 modified: 2025-11-18 tags: - attack.credential-access - attack.t1558.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - System.IdentityModel.Tokens.KerberosRequestorSecurityToken - .GetRequest() condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when a user manipulates with Firmward Password on MacOS. NOTE - this command has been disabled on silicon-based. Logsource: macos / process_creation. Rule: title: Suspicious MacOS Firmware Activity id: 7ed2c9f7-c59d-4c82-a7e2-f859aa676099 status: test description: Detects when a user manipulates with Firmward Password on MacOS. NOTE - this command has been disabled on silicon-based apple computers. references: - https://github.com/usnistgov/macos_security/blob/932a51f3e819dd3e02ebfcf3ef433cfffafbe28b/rules/os/os_firmware_password_require.yaml - https://www.manpagez.com/man/8/firmwarepasswd/ - https://support.apple.com/guide/security/firmware-password-protection-sec28382c9ca/web author: Austin Songer @austinsonger date: 2021-09-30 modified: 2022-10-09 tags: - attack.impact logsource: category: process_creation product: macos detection: selection1: Image: /usr/sbin/firmwarepasswd CommandLine|contains: - setpasswd - full - delete - check condition: selection1 falsepositives: - Legitimate administration activities level: medium
Query: describe CVE-2015-7285
Matching passage: CVE-2015-7285. CWE: CWE-287. CVSS: 5.800000190734863. CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 do not require authentication from Alarm Receiving Center (ARC) servers, which allows man-in-the-middle attackers to bypass intended access restrictions via a spoofed HSxx response.
Near-miss passage: CVE-2015-5998. CWE: CWE-287. CVSS: 10.0. Impero Education Pro before 5105 relies on the -1|AUTHENTICATE\x02PASSWORD string for authentication, which allows remote attackers to execute arbitrary programs via an encrypted command.
Query: CVE similar to CVE-2015-1065
Matching passage: CVE-2015-1065. CWE: CWE-119. CVSS: 5.400000095367432. Multiple buffer overflows in iCloud Keychain in Apple iOS before 8.2 and Apple OS X through 10.10.2 allow man-in-the-middle attackers to execute arbitrary code by modifying the client-server data stream during keychain recovery.
Near-miss passage: CVE-2015-2153. CWE: CWE-119. CVSS: 5.0. The rpki_rtr_pdu_print function in print-rpki-rtr.c in the TCP printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via a crafted header length in an RPKI-RTR Protocol Data Unit (PDU).
Query: CVE similar to CVE-2015-7409
Matching passage: CVE-2015-7409. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.6 allows remote authenticated users to inject arbitrary web script or HTML via an unspecified field.
Near-miss passage: CVE-2015-0714. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Cisco Finesse Server 10.0(1), 10.5(1), 10.6(1), and 11.0(1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCut53595.
Query: patch priority for CVE-2015-2347
Matching passage: CVE-2015-2347. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote attackers to inject arbitrary web script or HTML via the command XML element in the req parameter to flexdata.action in (1) common/, (2) monitor/, or (3) psnpm/ or the (4) module XML element in the req parameter to flexdata.action in monitor/.
Near-miss passage: CVE-2015-8353. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary web script or HTML via the object_name parameter in a rs-object_role_edit page to wp-admin/admin.php.
Query: CWE for Reflection Attack in an Authentication Protocol
Matching passage: CWE-301 Reflection Attack in an Authentication Protocol. Simple authentication protocols are subject to reflection attacks if a malicious user can use the target machine to impersonate a trusted user.
Near-miss passage: CWE-286 Incorrect User Management. The product does not properly manage a user within its environment.
Query: CVE similar to CVE-2015-10064
Matching passage: CVE-2015-10064. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in VictorFerraresi pokemon-database-php. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The patch is named dd0e1e6cdf648d6a3deff441f515bcb1d7573d68. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218455.
Near-miss passage: CVE-2015-4654. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the EQ Event Calendar component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to eqfullevent.
Query: alert when Detects suspicious sub processes of web server processes
Matching passage: Sigma rule: Detects suspicious sub processes of web server processes. Logsource: linux / process_creation. Rule: title: Linux Webshell Indicators id: 818f7b24-0fba-4c49-a073-8b755573b9c7 status: test description: Detects suspicious sub processes of web server processes references: - https://www.acunetix.com/blog/articles/web-shells-101-using-php-introduction-web-shells-part-2/ - https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-10-15 modified: 2022-12-28 tags: - attack.persistence - attack.t1505.003 logsource: product: linux category: process_creation detection: selection_general: ParentImage|endswith: - /httpd - /lighttpd - /nginx - /apache2 - /node - /caddy selection_tomcat: ParentCommandLine|contains|all: - /bin/java - tomcat selection_websphere: ParentCommandLine|contains|all: - /bin/java - websphere sub_processes: Image|endswith: - /whoami - /ifconfig - /ip - /bin/uname - /bin/cat - /bin/crontab - /hostname - /iptables - /netstat - /pwd - /route condition: 1 of selection_* and sub_processes falsepositives: - Web applications that invoke Linux command line tools level: high
Near-miss passage: Sigma rule: An attacker can use the SID history attribute to gain additional privileges.. Logsource: windows / security. Rule: title: Addition of SID History to Active Directory Object id: 2632954e-db1c-49cb-9936-67d1ef1d17d2 status: stable description: An attacker can use the SID history attribute to gain additional privileges. references: - https://adsecurity.org/?p=1772 author: Thomas Patzke, @atc_project (improvements) date: 2017-02-19 tags: - attack.persistence - attack.privilege-escalation - attack.stealth - attack.t1134.005 logsource: product: windows service: security detection: selection1: EventID: - 4765 - 4766 selection2: EventID: 4738 selection3: SidHistory: - '-' - '%%1793' filter_null: SidHistory: null condition: selection1 or (selection2 and not selection3 and not filter_null) falsepositives: - Migration of an account into a new domain level: medium
Query: describe CVE-2015-2633
Matching passage: CVE-2015-2633. CWE: UNKNOWN. CVSS: 3.5999999046325684. Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 12.1.0.1 and 12.2.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Ops Center.
Near-miss passage: CVE-2015-4732. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-2590.
Query: secure coding against Only Filtering One Instance of a Special Element
Matching passage: CWE-793 Only Filtering One Instance of a Special Element. The product receives data from an upstream component, but only filters a single instance of a special element before sending it to a downstream component.
Near-miss passage: CWE-424 Improper Protection of Alternate Path. The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.
Query: collection using Email Forwarding Rule
Matching passage: T1114.003 Email Forwarding Rule. Tactics: collection. Description: Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.(Citation: Pfammatter - Hidden Inbox Rules) Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient. These rules may be created through a local email application, a web interface, or by command-line interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2)(Citation: Mac Forwarding Rules) Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more. Adversaries may also hide the rule by making use of the Microsoft Messaging API (MAPI) to modify the rule properties, making it hidden and not visible from Outlook, OWA or most Exchange Administration tools.(Citation: Pfammatter - Hidden Inbox Rules) In some environments, administrators may be able to enable email forwarding rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.(Citation: Microsof
Near-miss passage: T1114.001 Local Email Collection. Tactics: collection. Description: Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files. Outlook stores data locally in offline data files with an extension of .ost. Outlook 2010 and later supports .ost file sizes up to 50GB, while earlier versions of Outlook support up to 20GB.(Citation: Outlook File Sizes) IMAP accounts in Outlook 2013 (and earlier) and POP accounts use Outlook Data Files (.pst) as opposed to .ost, whereas IMAP accounts in Outlook 2016 (and later) use .ost files. Both types of Outlook data files are typically stored in `C:\Users\<username>\Documents\Outlook Files` or `C:\Users\<username>\AppData\Local\Microsoft\Outlook`.(Citation: Microsoft Outlook Files)
Query: risk of The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site sc
Matching passage: CVE-2015-5956. CWE: CWE-79. CVSS: 3.5. The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting (XSS) attacks via a base64 encoded data URI, as demonstrated by the (1) returnUrl parameter to show_rechis.php and the (2) redirect_url parameter to index.php.
Near-miss passage: CVE-2015-1177. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.2.
Query: vulnerability: Cisco Videoscape Policy Resource Manager (PRM) 3.5.4 allows remote attackers to cause a denial of service (CPU and memory consumption, and TCP service outage) via (1) a SYN flood o
Matching passage: CVE-2015-4283. CWE: CWE-399. CVSS: 7.800000190734863. Cisco Videoscape Policy Resource Manager (PRM) 3.5.4 allows remote attackers to cause a denial of service (CPU and memory consumption, and TCP service outage) via (1) a SYN flood or (2) another type of TCP traffic flood, aka Bug IDs CSCuu35104 and CSCuu35128.
Near-miss passage: CVE-2015-4200. CWE: CWE-399. CVSS: 7.800000190734863. Memory leak in the IPv6-to-IPv4 functionality in Cisco IOS 15.3S in the Performance Routing Engine (PRE) module on UBR devices allows remote attackers to cause a denial of service (memory consumption) by triggering an error during CPE negotiation, aka Bug ID CSCug00885.
Query: rule covering Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility
Matching passage: Sigma rule: Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility. Logsource: windows / process_creation. Rule: title: HackTool - RedMimicry Winnti Playbook Execution id: 95022b85-ff2a-49fa-939a-d7b8f56eeb9b status: test description: Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility references: - https://redmimicry.com/posts/redmimicry-winnti/ author: Alexander Rausch date: 2020-06-24 modified: 2023-03-01 tags: - attack.execution - attack.stealth - attack.t1106 - attack.t1059.003 - attack.t1218.011 logsource: product: windows category: process_creation detection: selection: Image|endswith: - \rundll32.exe - \cmd.exe CommandLine|contains: - gthread-3.6.dll - \Windows\Temp\tmp.bat - sigcmm-2.4.dll condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when the file "passwd" or "shadow" is copied from tmp path. Logsource: linux / process_creation. Rule: title: Copy Passwd Or Shadow From TMP Path id: fa4aaed5-4fe0-498d-bbc0-08e3346387ba status: test description: Detects when the file "passwd" or "shadow" is copied from tmp path references: - https://blogs.blackberry.com/ - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144 author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-01-31 tags: - attack.credential-access - attack.t1552.001 logsource: product: linux category: process_creation detection: selection_img: Image|endswith: /cp selection_path: CommandLine|contains: /tmp/ selection_file: CommandLine|contains: - passwd - shadow condition: all of selection_* falsepositives: - Unknown level: high
Query: incident response steps for EDR alert: possible Regsvcs/Regasm (T1218.009)
Matching passage: Playbook for T1218.009 Regsvcs/Regasm. 1) Validate alert telemetry against T1218.009. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) assemblies. Both are binaries that may be digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm) Both utiliti
Near-miss passage: Playbook for T1218.003 CMSTP. Different response path focused on stealth.
Query: risk of Buffer overflow in an unspecified DLL in Schneider Electric Pelco DS-NVs before 7.8.90 allows remote attackers to execute arbitrary code via unspecified vectors.
Matching passage: CVE-2015-0982. CWE: CWE-120. CVSS: 7.5. Buffer overflow in an unspecified DLL in Schneider Electric Pelco DS-NVs before 7.8.90 allows remote attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-10065. CWE: CWE-120. CVSS: 9.800000190734863. A vulnerability classified as critical was found in AenBleidd FiND. This vulnerability affects the function init_result of the file validator/my_validator.cpp. The manipulation leads to buffer overflow. The patch is identified as ee2eef34a83644f286c9adcaf30437f92e9c48f1. It is recommended to apply a patch to fix this issue. VDB-218458 is the identifier assigned to this vulnerability.
Query: patch priority for CVE-2015-7879
Matching passage: CVE-2015-7879. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authenticated users with permission to create or edit a stickynote to inject arbitrary web script or HTML via note text on the admin listing page.
Near-miss passage: CVE-2015-6037. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in Microsoft Excel Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps 2010 SP2, Excel Web App 2010 SP2, Office Web Apps Server 2013 SP1, and SharePoint Foundation 2013 SP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka "Microsoft Office Web Apps XSS Spoofing Vulnerability."
Query: exploit Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2(0.793), 1.3(0.876), 1.4(0.109), 2.0(0.147), and 2.0(0.169) allows r
Matching passage: CVE-2015-4267. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2(0.793), 1.3(0.876), 1.4(0.109), 2.0(0.147), and 2.0(0.169) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus09940.
Near-miss passage: CVE-2015-3950. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in XZERES 442SR OS on 442SR wind turbines allows remote attackers to hijack the authentication of admins for requests that select a different default admin user via a GET request.
Query: exploit In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 410/12, SD 617, SD 650/52, SD 800, SD 808, and SD 810, missing of return value check i
Matching passage: CVE-2015-9173. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 410/12, SD 617, SD 650/52, SD 800, SD 808, and SD 810, missing of return value check in memscpy can cause memory corruption in TQS App.
Near-miss passage: CVE-2015-6145. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6146.