alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: SOC runbook when seeing Suspicious DCSync execution detected on endpoint
Matching passage: Playbook for T1003.006 DCSync. 1) Validate alert telemetry against T1003.006. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: credential access. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) (Citation: Wine API samlib.dll) to simulate the replication process from a remote domain controller using a technique called DCSync. Members of
Near-miss passage: Playbook for T1003.003 NTDS. Different response path focused on credential access.
Query: exploit In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear, and Small Cell SoC FSM9055, MDM9206, MDM9607, MD
Matching passage: CVE-2015-9224. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear, and Small Cell SoC FSM9055, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, and SDX20, lack of input Validation in QURTK_write() can cause potential buffer overflow.
Near-miss passage: CVE-2015-5577. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5575, CVE-2015-5578, CVE-2015-5580, CVE-2015-5582, CVE-2015-5588, and CVE-2015-6677.
Query: describe CVE-2015-5704
Matching passage: CVE-2015-5704. CWE: CWE-77. CVSS: 7.800000190734863. scripts/licensecheck.pl in devscripts before 2.15.7 allows local users to execute arbitrary shell commands.
Near-miss passage: CVE-2015-5003. CWE: CWE-77. CVSS: 8.5. The portal in IBM Tivoli Monitoring (ITM) 6.2.2 through FP9, 6.2.3 through FP5, and 6.3.0 before FP7 allows remote authenticated users to execute arbitrary commands by leveraging Take Action view authority and providing crafted input.
Query: exploit bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid character in the name of a cab file.
Matching passage: CVE-2015-8917. CWE: CWE-476. CVSS: 7.5. bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid character in the name of a cab file.
Near-miss passage: CVE-2015-9215. CWE: CWE-476. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, MDM9635M, and SD 810, improper input validation can cause a null pointer dereference in USB bootloader find_ep() function.
Query: vulnerability: Microsoft XML Core Services (aka MSXML) 3.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted DTD, aka "MSXML3 Same Origin Pol
Matching passage: CVE-2015-1646. CWE: CWE-264. CVSS: 4.300000190734863. Microsoft XML Core Services (aka MSXML) 3.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted DTD, aka "MSXML3 Same Origin Policy SFB Vulnerability."
Near-miss passage: CVE-2015-3027. CWE: CWE-264. CVSS: 5.0. Clang in LLVM, as used in Apple Xcode before 6.3, performs incorrect register allocation in a way that triggers stack storage for stack cookie pointers, which might allow context-dependent attackers to bypass a stack-guard protection mechanism via crafted input to an affected C program.
Query: patch priority for CVE-2015-1765
Matching passage: CVE-2015-1765. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to read the browser history via a crafted web site.
Near-miss passage: CVE-2015-4194. CWE: CWE-200. CVSS: 5.0. The web-based administrative interface in Cisco WebEx Meeting Center provides different error messages for failed login attempts depending on whether the username exists or corresponds to a privileged account, which allows remote attackers to enumerate account names and obtain sensitive information via a series of requests, aka Bug ID CSCuf28861.
Query: Suspicious SSH execution detected on endpoint
Matching passage: T1021.004 SSH. Tactics: lateral movement. Description: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user. SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. On ESXi, SSH can be enabled either directly on the host (e.g., via `vim-cmd hostsvc/enable_ssh`) or via vCenter.(Citation: Sygnia ESXi Ransomware 2025)(Citation: TrendMicro ESXI Ransomware)(Citation: Sygnia Abyss Locker 2025) The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password. In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to login as that user (i.e., [SSH Authorized Keys](https://attack.mitre.org/techniques/T1098/004)).
Near-miss passage: T1021.007 Cloud Services. Tactics: lateral movement. Description: Adversaries may log into accessible cloud services within a compromised environment using [Valid Accounts](https://attack.mitre.org/techniques/T1078) that are synchronized with or federated to on-premises user identities. The adversary may then perform management actions or access cloud-hosted resources as the logged-on user. Many enterprises federate centrally managed user identities to cloud services, allowing users to login with their domain credentials in order to access the cloud control plane. Similarly, adversaries may connect to available cloud services through the web console or through the cloud command line interface (CLI) (e.g., [Cloud API](https://attack.mitre.org/techniques/T1059/009)), using commands such as <code>Connect-AZAccount</code> for Azure PowerShell, <code>Connect-MgGraph</code> for Microsoft Graph PowerShell, and <code>gcloud auth login</code> for the Google Cloud CLI. In some cases, adversaries may be able to authenticate to these services via [Application Access Token](https://attack.mitre.org/techniques/T1550/001) instead of a username and password.
Query: actor TTPs: Unsecured Credentials
Matching passage: T1552 Unsecured Credentials. Tactics: credential access. Description: Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Shell History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)).(Citation: Brining MimiKatz to Unix)
Near-miss passage: T1552.008 Chat Messages. Tactics: credential access. Description: Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels. Rather than accessing the stored chat logs (i.e., [Credentials In Files](https://attack.mitre.org/techniques/T1552/001)), adversaries may directly access credentials within these services on the user endpoint, through servers hosting the services, or through administrator portals for cloud hosted services. Adversaries may also compromise integration tools like Slack Workflows to automatically search through messages to extract user credentials. These credentials may then be abused to perform follow-on activities such as lateral movement or privilege escalation (Citation: Slack Security Risks).
Query: describe CVE-2015-2330
Matching passage: CVE-2015-2330. CWE: CWE-295. CVSS: 7.5. Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies.
Near-miss passage: CVE-2015-1777. CWE: CWE-295. CVSS: 5.900000095367432. rhnreg_ks in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Gluster Storage 2.1 and Enterprise Linux (RHEL) 5, 6, and 7 does not properly validate hostnames in X.509 certificates from SSL servers, which allows remote attackers to prevent system registration via a man-in-the-middle attack.
Query: CVE similar to CVE-2015-4448
Matching passage: CVE-2015-4448. CWE: CWE-416. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5095, CVE-2015-5099, CVE-2015-5101, CVE-2015-5111, CVE-2015-5113, and CVE-2015-5114.
Near-miss passage: CVE-2015-3075. CWE: CWE-416. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3053, CVE-2015-3054, CVE-2015-3055, and CVE-2015-3059.
Query: write Sigma for Detects enumeration of local or remote network services.
Matching passage: Sigma rule: Detects enumeration of local or remote network services.. Logsource: macos / process_creation. Rule: title: MacOS Network Service Scanning id: 84bae5d4-b518-4ae0-b331-6d4afd34d00f status: test description: Detects enumeration of local or remote network services. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md author: Alejandro Ortuno, oscd.community date: 2020-10-21 modified: 2021-11-27 tags: - attack.discovery - attack.t1046 logsource: category: process_creation product: macos detection: selection_1: Image|endswith: - /nc - /netcat selection_2: Image|endswith: - /nmap - /telnet filter: CommandLine|contains: l condition: (selection_1 and not filter) or selection_2 falsepositives: - Legitimate administration activities level: low
Near-miss passage: Sigma rule: Detects attempts to remove Windows Defender configurations using the 'MpPreference' cmdlet. Logsource: windows / process_creation. Rule: title: Tamper Windows Defender Remove-MpPreference id: 07e3cb2c-0608-410d-be4b-1511cb1a0448 related: - id: ae2bdd58-0681-48ac-be7f-58ab4e593458 type: similar status: test description: Detects attempts to remove Windows Defender configurations using the 'MpPreference' cmdlet references: - https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-controlled-folder-access-event-search/ba-p/2326088 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: process_creation detection: selection_remove: CommandLine|contains: Remove-MpPreference selection_tamper: CommandLine|contains: - '-ControlledFolderAccessProtectedFolders ' - '-AttackSurfaceReductionRules_Ids ' - '-AttackSurfaceReductionRules_Actions ' - '-CheckForSignaturesBeforeRunningScan ' condition: all of selection_* falsepositives: - Legitimate PowerShell scripts level: high
Query: Sigma rule for Commandline to launch powershell with a base64 payload
Matching passage: Sigma rule: Commandline to launch powershell with a base64 payload. Logsource: windows / process_creation. Rule: title: Suspicious Execution of Powershell with Base64 id: fb843269-508c-4b76-8b8d-88679db22ce7 status: test description: Commandline to launch powershell with a base64 payload references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-20---powershell-invoke-known-malicious-cmdlets - https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/ - https://mikefrobbins.com/2017/06/15/simple-obfuscation-with-powershell-using-base64-encoding/ author: frack113 date: 2022-01-02 modified: 2023-01-05 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - ' -e ' - ' -en ' - ' -enc ' - ' -enco' - ' -ec ' filter_encoding: CommandLine|contains: ' -Encoding ' filter_azure: ParentImage|contains: - C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\ - \gc_worker.exe condition: selection and not 1 of filter_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects changes to the PowerShell execution policy in order to bypass signing requirements for script execution. Logsource: windows / registry_set. Rule: title: Potential PowerShell Execution Policy Tampering id: fad91067-08c5-4d1a-8d8c-d96a21b37814 related: - id: cf2e938e-9a3e-4fe8-a347-411642b28a9f type: similar - id: 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180 type: similar - id: 61d0475c-173f-4844-86f7-f3eebae1c66b type: similar status: test description: Detects changes to the PowerShell execution policy in order to bypass signing requirements for script execution references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.3 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-11 modified: 2023-12-14 tags: - attack.defense-impairment logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: - \ShellIds\Microsoft.PowerShell\ExecutionPolicy - \Policies\Microsoft\Windows\PowerShell\ExecutionPolicy Details|contains: - Bypass - Unrestricted filter_main_svchost: Image|contains: - :\Windows\System32\ - :\Windows\SysWOW64\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: credential access using Golden Ticket
Matching passage: T1558.001 Golden Ticket. Tactics: credential access. Description: Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TGT), also known as a golden ticket.(Citation: AdSecurity Kerberos GT Aug 2015) Golden tickets enable adversaries to generate authentication material for any account in Active Directory.(Citation: CERT-EU Golden Ticket Protection) Using a golden ticket, adversaries are then able to request ticket granting service (TGS) tickets, which enable access to specific resources. Golden tickets require adversaries to interact with the Key Distribution Center (KDC) in order to obtain TGS.(Citation: ADSecurity Detecting Forged Tickets) The KDC service runs all on domain controllers that are part of an Active Directory domain. KRBTGT is the Kerberos Key Distribution Center (KDC) service account and is responsible for encrypting and signing all Kerberos tickets.(Citation: ADSecurity Kerberos and KRBTGT) The KRBTGT password hash may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) and privileged access to a domain controller.
Near-miss passage: T1558.005 Ccache Files. Tactics: credential access. Description: Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having to re-enter credentials. The <code>/etc/krb5.conf</code> configuration file and the <code>KRB5CCNAME</code> environment variable are used to set the storage location for ccache entries. On Linux, credentials are typically stored in the `/tmp` directory with a naming format of `krb5cc_%UID%` or `krb5.ccache`. On macOS, ccache entries are stored by default in memory with an `API:{uuid}` naming scheme. Typically, users interact with ticket storage using <code>kinit</code>, which obtains a Ticket-Granting-Ticket (TGT) for the principal; <code>klist</code>, which lists obtained tickets currently held in the credentials cache; and other built-in binaries.(Citation: Kerberos GNU/Linux)(Citation: Binary Defense Kerberos Linux) Adversaries can collect tickets from ccache files stored on disk and authenticate as the current user without their password to perform [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003) attacks. Adversaries can also use these tickets to impersonate legitimate users with elevated privileges to perform [Privilege Escalation](https://attack.mitre.org/tactics/TA0004). Tools like Kekeo can also be used by adversaries to convert ccache files to Windows format for further [Lateral Movement](https://attack.mitre.org/tactics/TA0008). On macOS, adversaries may use open-source tools or the Kerberos framework to interact with ccache files and extract TGTs or Service Tickets via lower-level APIs.(Citation: SpectorOps Bifrost Kerberos macOS 2019)(Citation: Linux Kerberos Tickets)(Citation: Brining MimiKatz to Unix)(Citation: Kekeo)
Query: describe CVE-2015-5782
Matching passage: CVE-2015-5782. CWE: CWE-200. CVSS: 4.300000190734863. ImageIO in Apple iOS before 8.4.1 and OS X before 10.10.5 does not properly initialize an unspecified data structure, which allows remote attackers to obtain sensitive information from process memory via a crafted TIFF image.
Near-miss passage: CVE-2015-1932. CWE: CWE-200. CVSS: 5.0. IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 and WebSphere Virtual Enterprise before 7.0.0.7 allow remote attackers to obtain potentially sensitive information about the proxy-server software by reading the HTTP Via header.
Query: describe CVE-2015-4935
Matching passage: CVE-2015-4935. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a different vulnerability than CVE-2015-4931, CVE-2015-4932, CVE-2015-4933, and CVE-2015-4934.
Near-miss passage: CVE-2015-3797. CWE: CWE-119. CVSS: 7.5. The TRE library in Libc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows context-dependent attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted regular expression, a different vulnerability than CVE-2015-3796 and CVE-2015-3798.
Query: patch priority for CVE-2015-6696
Matching passage: CVE-2015-6696. CWE: CWE-787. CVSS: 6.800000190734863. Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-6698.
Near-miss passage: CVE-2015-8658. CWE: CWE-787. CVSS: 8.800000190734863. Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (uninitialized pointer dereference and memory corruption) via crafted MPEG-4 data, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, CVE-2015-8455, CVE-2015-8652, CVE-2015-8654, CVE-2015-8656, CVE-2015-8657, and CVE-2015-8820.
Query: describe CVE-2015-3120
Matching passage: CVE-2015-3120. CWE: CWE-704. CVSS: 10.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-3119, CVE-2015-3121, CVE-2015-3122, and CVE-2015-4433.
Near-miss passage: CVE-2015-5219. CWE: CWE-704. CVSS: 7.5. The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in the web interface in Airties RT-210 allow remote attackers to inject arbitrary web script or HTML via the (1) ddns_domainame 
Matching passage: CVE-2015-4679. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the web interface in Airties RT-210 allow remote attackers to inject arbitrary web script or HTML via the (1) ddns_domainame or (2) ddns_account parameter to ddns.stm.
Near-miss passage: CVE-2015-4413. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the new_fb_sign_button function in nextend-facebook-connect.php in Nextend Facebook Connect plugin before 1.5.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter.
Query: indicators of Exfiltration Over Bluetooth
Matching passage: T1011.001 Exfiltration Over Bluetooth. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel. Adversaries may choose to do this if they have sufficient access and proximity. Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Near-miss passage: T1011 Exfiltration Over Other Network Medium. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel. Adversaries may choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.