alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: campaign using Reduce Key Space
Matching passage: T1600.001 Reduce Key Space. Tactics: defense impairment. Description: Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.(Citation: Cisco Synful Knock Evolution) Adversaries can weaken the encryption software on a compromised network device by reducing the key size used by the software to convert plaintext to ciphertext (e.g., from hundreds or thousands of bytes to just a couple of bytes). As a result, adversaries dramatically reduce the amount of effort needed to decrypt the protected information without the key. Adversaries may modify the key size used and other encryption parameters using specialized commands in a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) introduced to the system through [Modify System Image](https://attack.mitre.org/techniques/T1601) to change the configuration of the device. (Citation: Cisco Blog Legacy Device Attacks)
Near-miss passage: T1600.002 Disable Crypto Hardware. Tactics: defense impairment. Description: Adversaries disable a network device’s dedicated hardware encryption, which may enable them to leverage weaknesses in software encryption in order to reduce the effort involved in collecting, manipulating, and exfiltrating transmitted data. Many network devices such as routers, switches, and firewalls, perform encryption on network traffic to secure transmission across networks. Often, these devices are equipped with special, dedicated encryption hardware to greatly increase the speed of the encryption process as well as to prevent malicious tampering. When an adversary takes control of such a device, they may disable the dedicated hardware, for example, through use of [Modify System Image](https://attack.mitre.org/techniques/T1601), forcing the use of software to perform encryption on general processors. This is typically used in conjunction with attacks to weaken the strength of the cipher in software (e.g., [Reduce Key Space](https://attack.mitre.org/techniques/T1600/001)). (Citation: Cisco Blog Legacy Device Attacks)
Query: describe CVE-2015-6486
Matching passage: CVE-2015-6486. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-0780. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in the GetReRequestData method of the GetStoredResult class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Query: telemetry for T1037.001
Matching passage: T1037.001 Logon Script (Windows). Tactics: persistence, privilege escalation. Description: Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.(Citation: TechNet Logon Scripts) This is done via adding a path to a script to the <code>HKCU\Environment\UserInitMprLogonScript</code> Registry key.(Citation: Hexacorn Logon Scripts) Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
Near-miss passage: T1037.003 Network Logon Script. Tactics: persistence, privilege escalation. Description: Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence. Network logon scripts can be assigned using Active Directory or Group Policy Objects.(Citation: Petri Logon Script AD) These logon scripts run with the privileges of the user they are assigned to. Depending on the systems within the network, initializing one of these scripts could apply to more than one or potentially all systems. Adversaries may use these scripts to maintain persistence on a network. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
Query: containment actions for Suspicious Exfiltration to Cloud Storage execution detected on endpoint
Matching passage: Playbook for T1567.002 Exfiltration to Cloud Storage. 1) Validate alert telemetry against T1567.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: exfiltration. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet. Examples of cloud storage services include Dropbox and Google Docs. Exfiltration to these cloud storage services can provide a significant amount of cove
Near-miss passage: Playbook for T1567 Exfiltration Over Web Service. Different response path focused on exfiltration.
Query: describe CVE-2015-1953
Matching passage: CVE-2015-1953. CWE: CWE-119. CVSS: 7.800000190734863. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965.
Near-miss passage: CVE-2015-3662. CWE: CWE-119. CVSS: 6.800000190734863. QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3661, CVE-2015-3663, CVE-2015-3666, CVE-2015-3667, and CVE-2015-3668.
Query: CVE similar to CVE-2015-3798
Matching passage: CVE-2015-3798. CWE: CWE-119. CVSS: 7.5. The TRE library in Libc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows context-dependent attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted regular expression, a different vulnerability than CVE-2015-3796 and CVE-2015-3797.
Near-miss passage: CVE-2015-9126. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, possible buffer overflow when processing 1X circuit service message.
Query: patch priority for CVE-2015-8753
Matching passage: CVE-2015-8753. CWE: CWE-264. CVSS: 9.100000381469727. SAP Afaria 7.0.6001.5 allows remote attackers to bypass authorization checks and wipe or lock mobile devices via a crafted request, related to "Insecure signature," aka SAP Security Note 2134905.
Near-miss passage: CVE-2015-1644. CWE: CWE-264. CVSS: 7.199999809265137. Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Windows MS-DOS Device Name Vulnerability."
Query: Sigma rule for Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channel
Matching passage: Sigma rule: Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channel. Logsource: firewall. Rule: title: Cleartext Protocol Usage id: d7fb8f0e-bd5f-45c2-b467-19571c490d7e status: stable description: 'Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels. Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access. ' references: - https://www.cisecurity.org/controls/cis-controls-list/ - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf author: Alexandr Yampolskyi, SOC Prime, Tim Shelton date: 2019-03-26 modified: 2022-10-10 tags: - attack.credential-access logsource: category: firewall detection: selection: dst_port: - 8080 - 21 - 80 - 23 - 50000 - 1521 - 27017 - 3306 - 1433 - 11211 - 15672 - 5900 - 5901 - 5902 - 5903 - 5904 selection_allow1: action: - forward - accept - 2 selection_allow2: blocked: 'false' condition: selection and 1 of selection_allow* falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects SILENTTRINITY stager dll loading activity. Logsource: windows / image_load. Rule: title: HackTool - SILENTTRINITY Stager DLL Load id: 75c505b1-711d-4f68-a357-8c3fe37dbf2d related: - id: 03552375-cc2c-4883-bbe4-7958d5a980be type: derived status: test description: Detects SILENTTRINITY stager dll loading activity references: - https://github.com/byt3bl33d3r/SILENTTRINITY author: Aleksey Potapov, oscd.community date: 2019-10-22 modified: 2023-02-17 tags: - attack.command-and-control - attack.t1071 logsource: category: image_load product: windows detection: selection: Description|contains: st2stager condition: selection falsepositives: - Unlikely level: high
Query: vulnerability: The guest portal in Cisco Identity Services Engine (ISE) 3300 1.2(0.899) does not restrict access to uploaded HTML documents, which allows remote attackers to obtain sensitive info
Matching passage: CVE-2015-6266. CWE: CWE-287. CVSS: 5.0. The guest portal in Cisco Identity Services Engine (ISE) 3300 1.2(0.899) does not restrict access to uploaded HTML documents, which allows remote attackers to obtain sensitive information from customized documents via a direct request, aka Bug ID CSCuo78045.
Near-miss passage: CVE-2015-2880. CWE: CWE-287. CVSS: 8.800000190734863. TRENDnet WiFi Baby Cam TV-IP743SIC has a password of admin for the backdoor root account.
Query: exploit PDFium, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
Matching passage: CVE-2015-1225. CWE: CWE-119. CVSS: 5.0. PDFium, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
Near-miss passage: CVE-2015-1859. CWE: CWE-119. CVSS: 6.800000190734863. Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted ICO image.
Query: Sigma YAML for okta / okta
Matching passage: Sigma rule: Detects when a new admin role assignment is created. Which could be a sign of privilege escalation or persistence. Logsource: okta / okta. Rule: title: Okta Admin Role Assignment Created id: 139bdd4b-9cd7-49ba-a2f4-744d0a8f5d8c status: test description: Detects when a new admin role assignment is created. Which could be a sign of privilege escalation or persistence references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Nikita Khalimonenkov date: 2023-01-19 modified: 2026-04-27 tags: - attack.persistence logsource: product: okta service: okta detection: selection: eventType: iam.resourceset.bindings.add condition: selection falsepositives: - Legitimate creation of a new admin role assignment level: medium
Near-miss passage: Sigma rule: Detects usage of winget to add new potentially suspicious download sources. Logsource: windows / process_creation. Rule: title: Add Potential Suspicious New Download Source To Winget id: c15a46a0-07d4-4c87-b4b6-89207835a83b related: - id: 05ebafc8-7aa2-4bcd-a269-2aec93f9e842 type: similar - id: 81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2 type: similar status: test description: Detects usage of winget to add new potentially suspicious download sources references: - https://learn.microsoft.com/en-us/windows/package-manager/winget/source - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-17 modified: 2023-12-04 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \winget.exe - OriginalFileName: winget.exe selection_cli: CommandLine|contains|all: - 'source ' - 'add ' selection_source_direct_ip: CommandLine|re: ://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} condition: all of selection_* falsepositives: - Unknown level: medium
Query: secure coding against Function Call With Incorrect Number of Arguments
Matching passage: CWE-685 Function Call With Incorrect Number of Arguments. The product calls a function, procedure, or routine, but the caller specifies too many arguments, or too few arguments, which may lead to undefined behavior and resultant weaknesses.
Near-miss passage: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion'). The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Query: exploit The recycle bin feature in the Monster Menus module 7.x-1.21 before 7.x-1.24 for Drupal does not properly remove nodes from view, which allows remote attackers to obtain sensitive 
Matching passage: CVE-2015-8095. CWE: CWE-200. CVSS: 5.0. The recycle bin feature in the Monster Menus module 7.x-1.21 before 7.x-1.24 for Drupal does not properly remove nodes from view, which allows remote attackers to obtain sensitive information via an unspecified URL pattern.
Near-miss passage: CVE-2015-6586. CWE: CWE-200. CVSS: 7.5. The mDNS module in Huawei WLAN AC6005, AC6605, and ACU2 devices with software before V200R006C00SPC100 allows remote attackers to obtain sensitive information by leveraging failure to restrict processing of mDNS unicast queries to the link local network.
Query: Sigma rule for Attackers may leverage fsutil to enumerated connected drives.
Matching passage: Sigma rule: Attackers may leverage fsutil to enumerated connected drives.. Logsource: windows / process_creation. Rule: title: Fsutil Drive Enumeration id: 63de06b9-a385-40b5-8b32-73f2b9ef84b6 status: test description: Attackers may leverage fsutil to enumerated connected drives. references: - Turla has used fsutil fsinfo drives to list connected drives. - https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/discovery_peripheral_device.toml author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' date: 2022-03-29 modified: 2022-07-14 tags: - attack.discovery - attack.t1120 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \fsutil.exe - OriginalFileName: fsutil.exe selection_cli: CommandLine|contains: drives condition: all of selection_* falsepositives: - Certain software or administrative tasks may trigger false positives. level: low
Near-miss passage: Sigma rule: Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location. Logsource: linux / process_creation. Rule: title: Potentially Suspicious Named Pipe Created Via Mkfifo id: 999c3b12-0a8c-40b6-8e13-dd7d62b75c7a related: - id: 9d779ce8-5256-4b13-8b6f-b91c602b43f4 type: derived status: test description: Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location references: - https://dev.to/0xbf/use-mkfifo-to-create-named-pipe-linux-tips-5bbk - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-16 tags: - attack.execution logsource: category: process_creation product: linux detection: selection: Image|endswith: /mkfifo CommandLine|contains: ' /tmp/' condition: selection falsepositives: - Unknown level: medium
Query: detection rule: This rule detects a suspicious crash of the Microsoft Malware Protection Engine
Matching passage: Sigma rule: This rule detects a suspicious crash of the Microsoft Malware Protection Engine. Logsource: windows / application. Rule: title: Microsoft Malware Protection Engine Crash id: 545a5da6-f103-4919-a519-e9aec1026ee4 related: - id: 6c82cf5c-090d-4d57-9188-533577631108 type: similar status: test description: This rule detects a suspicious crash of the Microsoft Malware Protection Engine references: - https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5 - https://technet.microsoft.com/en-us/library/security/4022344 author: Florian Roth (Nextron Systems) date: 2017-05-09 modified: 2023-04-14 tags: - attack.stealth - attack.defense-impairment - attack.t1211 - attack.t1685 logsource: product: windows service: application detection: selection: Provider_Name: Application Error EventID: 1000 Data|contains|all: - MsMpEng.exe - mpengine.dll condition: selection falsepositives: - MsMpEng might crash if the "C:\" partition is full level: high
Near-miss passage: Sigma rule: Detects the execution of a renamed version of the Plink binary. Logsource: windows / process_creation. Rule: title: Renamed Plink Execution id: 1c12727d-02bf-45ff-a9f3-d49806a3cf43 status: test description: Detects the execution of a renamed version of the Plink binary references: - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - https://the.earth.li/~sgtatham/putty/0.58/htmldoc/Chapter7.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-06 modified: 2023-02-03 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: Plink - CommandLine|contains|all: - ' -l forward' - ' -P ' - ' -R ' filter: Image|endswith: \plink.exe condition: selection and not filter falsepositives: - Unknown level: high
Query: Sigma rule for Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which mig
Matching passage: Sigma rule: Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which mig. Logsource: azure / signinlogs. Rule: title: User Access Blocked by Azure Conditional Access id: 9a60e676-26ac-44c3-814b-0c2a8b977adf status: test description: 'Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts. ' references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts author: AlertIQ date: 2021-10-10 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.persistence - attack.credential-access - attack.initial-access - attack.stealth - attack.t1110 - attack.t1078.004 logsource: product: azure service: signinlogs detection: selection: ResultType: 53003 condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow ". Logsource: windows / process_creation. Rule: title: Remote File Download Via Findstr.EXE id: 587254ee-a24b-4335-b3cd-065c0f1f4baa related: - id: bf6c39fc-e203-45b9-9538-05397c1b4f3f type: obsolete status: test description: 'Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Findstr/ - https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/ - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) date: 2020-10-05 modified: 2024-03-05 tags: - attack.credential-access - attack.command-and-control - attack.stealth - attack.t1218 - attack.t1564.004 - attack.t1552.001 - attack.t1105 logsource: category: process_creation product: windows detection: selection_findstr: - CommandLine|contains: findstr - Image|endswith: findstr.exe - OriginalFileName: FINDSTR.EXE selection_cli_download_1: CommandLine|contains|windash: ' -v ' selection_cli_download_2: CommandLine|contains|windash: ' -l ' selection_cli_download_3: CommandLine|contains: \\\\ condition: selection_findstr and all of selection_cli_download_* falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-7943
Matching passage: CVE-2015-7943. CWE: CWE-601. CVSS: 6.099999904632568. Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7.x-1.x before 7.x-1.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3233.
Near-miss passage: CVE-2015-4668. CWE: CWE-601. CVSS: 6.099999904632568. Open redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirurl parameter.
Query: describe CVE-2015-7217
Matching passage: CVE-2015-7217. CWE: CWE-119. CVSS: 4.300000190734863. The gdk-pixbuf configuration in Mozilla Firefox before 43.0 on Linux GNOME platforms incorrectly enables the TGA decoder, which allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted Truevision TGA image.
Near-miss passage: CVE-2015-1495. CWE: CWE-119. CVSS: 6.800000190734863. Multiple stack-based buffer overflows in Motorola Scanner SDK allow remote attackers to execute arbitrary code via a crafted string to the Open method in (1) IOPOSScanner.ocx or (2) IOPOSScale.ocx.
Query: CWE for Insertion of Sensitive Information into Log File
Matching passage: CWE-532 Insertion of Sensitive Information into Log File. The product writes sensitive information to a log file.
Near-miss passage: CWE-234 Failure to Handle Missing Parameter. If too few arguments are sent to a function, the function will still pop the expected number of arguments from the stack. Potentially, a variable number of arguments could be exhausted in a function as well.