alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Multiple failed authentications followed by Exploitation for Defense Impairment
Matching passage: T1687 Exploitation for Defense Impairment. Tactics: defense impairment. Description: Adversaries may exploit vulnerabilities in security software, infrastructure, or defensive components to degrade, disable, or otherwise continue to impair their ability to prevent, detect, or respond to malicious activity. Adversaries may exploit a system or application vulnerability to directly interfere with defensive mechanisms. Exploitation occurs when an adversary takes advantage of a programming error in software, services, or the operating system to execute adversary-controlled code, often with the goal of weakening or disabling protections. Vulnerabilities may exist in security tools such as antivirus, endpoint detection and response (EDR), firewalls, or other monitoring solutions. Adversaries may use prior reconnaissance or perform discovery activities (e.g., [Software Discovery](https://attack.mitre.org/techniques/T1518)) to identify defensive tools present in an environment and target them for exploitation. Successful exploitation may allow adversaries to terminate security processes, disable protections, bypass enforcement mechanisms, or reduce the effectiveness of defensive controls. In some cases, vulnerabilities in cloud-based or SaaS infrastructure may also be leveraged to bypass built-in security boundaries or disrupt visibility and enforcement across environments.(Citation: Salesforce zero-day in facebook phishing attack)
Near-miss passage: T1578 Modify Cloud Compute Infrastructure. Tactics: defense impairment. Description: An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots. Permissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure. Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence.(Citation: Mandiant M-Trends 2020)
Query: risk of The kernel in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, aka internal bug 23520714.
Matching passage: CVE-2015-6619. CWE: CWE-264. CVSS: 9.300000190734863. The kernel in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, aka internal bug 23520714.
Near-miss passage: CVE-2015-4351. CWE: CWE-264. CVSS: 4.900000095367432. The Spider Video Player module for Drupal allows remote authenticated users with the "access Spider Video Player administration" permission to delete arbitrary files via a crafted URL.
Query: Sigma YAML for windows / system
Matching passage: Sigma rule: Detects Obfuscated Powershell via Stdin in Scripts. Logsource: windows / system. Rule: title: Invoke-Obfuscation Via Stdin - System id: 487c7524-f892-4054-b263-8a0ace63fc25 status: test description: Detects Obfuscated Powershell via Stdin in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-12 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains|all: - set - '&&' ImagePath|contains: - environment - invoke - input condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential WerFault "ReflectDebugger" registry value abuse for persistence.. Logsource: windows / registry_set. Rule: title: Potential WerFault ReflectDebugger Registry Value Abuse id: 0cf2e1c6-8d10-4273-8059-738778f981ad related: - id: fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd type: derived status: test description: Detects potential WerFault "ReflectDebugger" registry value abuse for persistence. references: - https://cocomelonc.github.io/malware/2022/11/02/malware-pers-18.html - https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/ author: X__Junior date: 2023-05-18 tags: - attack.stealth - attack.t1036.003 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Microsoft\Windows\Windows Error Reporting\Hangs\ReflectDebugger condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-1649
Matching passage: CVE-2015-1649. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps Server 2010 SP2 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Component Use After Free Vulnerability."
Near-miss passage: CVE-2015-5428. CWE: UNKNOWN. CVSS: 7.5. HP Matrix Operating Environment before 7.5.0 allows remote attackers to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2015-5427 and CVE-2015-5429.
Query: rule covering Detects a suspicious execution of a Microsoft HTML Help (HH.exe)
Matching passage: Sigma rule: Detects a suspicious execution of a Microsoft HTML Help (HH.exe). Logsource: windows / process_creation. Rule: title: Suspicious HH.EXE Execution id: e8a95b5e-c891-46e2-b33a-93937d3abc31 status: test description: Detects a suspicious execution of a Microsoft HTML Help (HH.exe) references: - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/ - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7 - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/ - https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37 author: Maxim Pavlunin date: 2020-04-01 modified: 2023-04-12 tags: - attack.execution - attack.initial-access - attack.stealth - attack.t1047 - attack.t1059.001 - attack.t1059.003 - attack.t1059.005 - attack.t1059.007 - attack.t1218 - attack.t1218.001 - attack.t1218.010 - attack.t1218.011 - attack.t1566 - attack.t1566.001 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: HH.exe - Image|endswith: \hh.exe selection_paths: CommandLine|contains: - .application - \AppData\Local\Temp\ - \Content.Outlook\ - \Downloads\ - \Users\Public\ - \Windows\Temp\ condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows t. Logsource: windows / ps_script. Rule: title: Suspicious PowerShell WindowStyle Option id: 313fbb0a-a341-4682-848d-6d6f8c4fab7c status: test description: 'Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.003/T1564.003.md author: frack113, Tim Shelton (fp AWS) date: 2021-10-20 modified: 2023-01-03 tags: - attack.stealth - attack.t1564.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - powershell - WindowStyle - Hidden filter: ScriptBlockText|contains|all: - :\Program Files\Amazon\WorkSpacesConfig\Scripts\ - $PSScriptRoot\Module\WorkspaceScriptModule\WorkspaceScriptModule condition: selection and not filter falsepositives: - Unknown level: medium
Query: telemetry for T1595.002
Matching passage: T1595.002 Vulnerability Scanning. Tactics: reconnaissance. Description: Adversaries may scan victims for vulnerabilities that can be used during targeting. Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit the adversary may seek to use. These scans may also include more broad attempts to [Gather Victim Host Information](https://attack.mitre.org/techniques/T1592) that can be used to identify more commonly known, exploitable vulnerabilities. Vulnerability scans typically harvest running software and version numbers via server banners, listening ports, or other network artifacts.(Citation: OWASP Vuln Scanning) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).
Near-miss passage: T1595 Active Scanning. Tactics: reconnaissance. Description: Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction. Adversaries may perform different forms of active scanning depending on what information they seek to gather. These scans can also be performed in various ways, including using native features of network protocols such as ICMP.(Citation: Botnet Scan)(Citation: OWASP Fingerprinting) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).
Query: write Sigma for Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh
Matching passage: Sigma rule: Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh. Logsource: linux / process_creation. Rule: title: Execution Of Script Located In Potentially Suspicious Directory id: 30bcce26-51c5-49f2-99c8-7b59e3af36c7 status: test description: Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh", etc. references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.execution logsource: product: linux category: process_creation detection: selection_img: Image|endswith: - /bash - /csh - /dash - /fish - /ksh - /sh - /zsh selection_flag: CommandLine|contains: ' -c ' selection_paths: CommandLine|contains: /tmp/ condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of some potentially unwanted tools such as PsExec, Procdump, etc. (part of the Sysinternals suite). Logsource: windows / registry_set. Rule: title: PUA - Sysinternals Tools Execution - Registry id: c7da8edc-49ae-45a2-9e61-9fd860e4e73d related: - id: 25ffa65d-76d8-4da5-a832-3f2b0136e133 type: derived - id: 9841b233-8df8-4ad7-9133-b0b4402a9014 type: obsolete status: test description: Detects the execution of some potentially unwanted tools such as PsExec, Procdump, etc. (part of the Sysinternals suite) via the creation of the "accepteula" registry key. references: - https://twitter.com/Moti_B/status/1008587936735035392 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-24 modified: 2025-10-26 tags: - attack.resource-development - attack.t1588.002 logsource: product: windows category: registry_set detection: selection: TargetObject|contains: - \Active Directory Explorer - \Handle - \LiveKd - \Process Explorer - \ProcDump - \PsExec - \PsLoglist - \PsPasswd - \SDelete - \Sysinternals TargetObject|endswith: \EulaAccepted condition: selection falsepositives: - Legitimate use of SysInternals tools. Filter the legitimate paths used in your environment level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_pua_sysinternals_susp_execution_via_eula/info.yml
Query: describe CVE-2015-0456
Matching passage: CVE-2015-0456. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.8.0 allows remote attackers to affect integrity via unknown vectors related to Portlet Services.
Near-miss passage: CVE-2015-4876. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote authenticated users to affect integrity via unknown vectors related to Pivot Grid.
Query: exploit Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0
Matching passage: CVE-2015-8058. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-0706. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in Cisco FireSIGHT System Software 5.3.1.1, 5.3.1.2, and 6.0.0 in FireSIGHT Management Center allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted HTTP header, aka Bug IDs CSCut06060, CSCut06056, and CSCus98966.
Query: weakness Premature Release of Resource During Expected Lifetime
Matching passage: CWE-826 Premature Release of Resource During Expected Lifetime. The product releases a resource that is still intended to be used by itself or another actor.
Near-miss passage: CWE-1067 Excessive Execution of Sequential Searches of Data Resource. The product contains a data query against an SQL table or view that is configured in a way that does not utilize an index and may cause sequential searches to be performed.
Query: weakness Missing Support for Security Features in On-chip Fabrics or Buses
Matching passage: CWE-1318 Missing Support for Security Features in On-chip Fabrics or Buses. On-chip fabrics or buses either do not support or are not configured to support privilege separation or other security features, such as access control.
Near-miss passage: CWE-39 Path Traversal: 'C:dirname'. The product accepts input that contains a drive letter or Windows volume letter ('C:dirname') that potentially redirects access to an unintended location or arbitrary file.
Query: alert when Detects potentially suspicious events involving "GetSigninToken". An adversary using the "aws_consoler" tool can leverag
Matching passage: Sigma rule: Detects potentially suspicious events involving "GetSigninToken". An adversary using the "aws_consoler" tool can leverag. Logsource: aws / cloudtrail. Rule: title: AWS Console GetSigninToken Potential Abuse id: f8103686-e3e8-46f3-be72-65f7fcb4aa53 status: test description: 'Detects potentially suspicious events involving "GetSigninToken". An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credential that help obfuscate which AWS credential is compromised (the original access key) and enables the adversary to pivot from the AWS CLI to console sessions without the need for MFA using the new access key issued in this request. ' references: - https://github.com/NetSPI/aws_consoler - https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/ author: Chester Le Bron (@123Le_Bron) date: 2024-02-26 tags: - attack.lateral-movement - attack.t1021.007 - attack.t1550.001 logsource: product: aws service: cloudtrail detection: selection: eventSource: signin.amazonaws.com eventName: GetSigninToken filter_main_console_ua: userAgent|contains: Jersey/${project.version} condition: selection and not 1 of filter_main_* falsepositives: - GetSigninToken events will occur when using AWS SSO portal to login and will generate false positives if you do not filter for the expected user agent(s), see filter. Non-SSO configured roles would be abnormal and should be investigated. level: medium
Near-miss passage: Sigma rule: Detects the creation of new DLL assembly files by "aspnet_compiler.exe", which could be a sign of "aspnet_compiler" abus. Logsource: windows / file_event. Rule: title: Assembly DLL Creation Via AspNetCompiler id: 4c7f49ee-2638-43bb-b85b-ce676c30b260 related: - id: 9ccba514-7cb6-4c5c-b377-700758f2f120 type: similar - id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622 type: similar - id: a01b8329-5953-4f73-ae2d-aa01e1f35f00 type: similar status: test description: 'Detects the creation of new DLL assembly files by "aspnet_compiler.exe", which could be a sign of "aspnet_compiler" abuse to proxy execution through a build provider. ' references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-14 tags: - attack.execution logsource: product: windows category: file_event detection: selection: Image|endswith: \aspnet_compiler.exe TargetFilename|contains|all: - \Temporary ASP.NET Files\ - \assembly\tmp\ - .dll condition: selection falsepositives: - Legitimate assembly compilation using a build provider level: medium
Query: patch priority for CVE-2015-6274
Matching passage: CVE-2015-6274. CWE: CWE-119. CVSS: 5.0. The IPv4 implementation on Cisco ASR 1000 devices with software 15.5(3)S allows remote attackers to cause a denial of service (ESP QFP CPU consumption) by triggering packet fragmentation and reassembly, aka Bug ID CSCuv71273.
Near-miss passage: CVE-2015-3686. CWE: CWE-119. CVSS: 6.800000190734863. CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3685, CVE-2015-3687, CVE-2015-3688, and CVE-2015-3689.
Query: exploit Buffer overflow in the chat server in KiTTY Portable 0.65.0.2p and earlier allows remote attackers to execute arbitrary code via a long nickname.
Matching passage: CVE-2015-7874. CWE: CWE-120. CVSS: 9.800000190734863. Buffer overflow in the chat server in KiTTY Portable 0.65.0.2p and earlier allows remote attackers to execute arbitrary code via a long nickname.
Near-miss passage: CVE-2015-8126. CWE: CWE-120. CVSS: 7.5. Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.
Query: describe CVE-2015-5281
Matching passage: CVE-2015-5281. CWE: CWE-264. CVSS: 2.5999999046325684. The grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, when used on UEFI systems, allows local users to bypass intended Secure Boot restrictions and execute non-verified code via a crafted (1) multiboot or (2) multiboot2 module in the configuration file or physically proximate attackers to bypass intended Secure Boot restrictions and execute non-verified code via the (3) boot menu.
Near-miss passage: CVE-2015-0528. CWE: CWE-264. CVSS: 7.199999809265137. The RPC daemon in EMC Isilon OneFS 6.5.x and 7.0.x before 7.0.2.13, 7.1.0 before 7.1.0.6, 7.1.1 before 7.1.1.2, and 7.2.0 before 7.2.0.1 allows local users to gain privileges by leveraging an ability to modify system files.
Query: exploit Adobe Photoshop CC before 16.0 (aka 2015.0.0) allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Matching passage: CVE-2015-3109. CWE: CWE-119. CVSS: 10.0. Adobe Photoshop CC before 16.0 (aka 2015.0.0) allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Near-miss passage: CVE-2015-5793. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Query: patch priority for CVE-2015-4650
Matching passage: CVE-2015-4650. CWE: CWE-264. CVSS: 9.800000190734863. Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to gain shell access and execute arbitrary code with root privileges via unspecified vectors.
Near-miss passage: CVE-2015-4351. CWE: CWE-264. CVSS: 4.900000095367432. The Spider Video Player module for Drupal allows remote authenticated users with the "access Spider Video Player administration" permission to delete arbitrary files via a crafted URL.
Query: CVE similar to CVE-2015-7576
Matching passage: CVE-2015-7576. CWE: CWE-254. CVSS: 3.700000047683716. The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.
Near-miss passage: CVE-2015-1281. CWE: CWE-254. CVSS: 4.300000190734863. core/loader/ImageLoader.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly determine the V8 context of a microtask, which allows remote attackers to bypass Content Security Policy (CSP) restrictions by providing an image from an unintended source.