alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: actor TTPs: Acquire Infrastructure
Matching passage: T1583 Acquire Infrastructure. Tactics: resource development. Description: Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost.(Citation: Free Trial PurpleUrchin) Additionally, botnets are available for rent or purchase. Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090), including from residential proxy services.(Citation: amnesty_nso_pegasus)(Citation: FBI Proxies Credential Stuffing)(Citation: Mandiant APT29 Microsoft 365 2022) Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.
Near-miss passage: T1583.004 Server. Tactics: resource development. Description: Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, such as watering hole operations in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), enabling [Phishing](https://attack.mitre.org/techniques/T1566) operations, or facilitating [Command and Control](https://attack.mitre.org/tactics/TA0011). Instead of compromising a third-party [Server](https://attack.mitre.org/techniques/T1584/004) or renting a [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may opt to configure and run their own servers in support of operations. Free trial periods of cloud servers may also be abused.(Citation: Free Trial PurpleUrchin)(Citation: Freejacked) Adversaries may only need a lightweight setup if most of their activities will take place using online infrastructure. Or, they may need to build extensive infrastructure if they want to test, communicate, and control other aspects of their activities on their own systems.(Citation: NYTStuxnet)
Query: write Sigma for Detects when an Okta user session starts where the user is behind an anonymising proxy service.
Matching passage: Sigma rule: Detects when an Okta user session starts where the user is behind an anonymising proxy service.. Logsource: okta / okta. Rule: title: Okta User Session Start Via An Anonymising Proxy Service id: bde30855-5c53-4c18-ae90-1ff79ebc9578 status: test description: Detects when an Okta user session starts where the user is behind an anonymising proxy service. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection author: kelnage date: 2023-09-07 modified: 2026-04-27 tags: - attack.defense-impairment - attack.t1685 logsource: product: okta service: okta detection: selection: eventType: user.session.start securityContext.isProxy: 'true' condition: selection falsepositives: - If a user requires an anonymising proxy due to valid justifications. level: high
Near-miss passage: Sigma rule: Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.. Logsource: azure / riskdetection. Rule: title: Malicious IP Address Sign-In Suspicious id: 36440e1c-5c22-467a-889b-593e66498472 status: test description: Indicates sign-in from a malicious IP address known to be malicious at time of sign-in. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malicious-ip-address - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-07 tags: - attack.t1090 - attack.command-and-control logsource: product: azure service: riskdetection detection: selection: riskEventType: suspiciousIPAddress condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Query: Persistence mechanism resembling Malicious File
Matching passage: T1204.002 Malicious File. Tactics: execution. Description: An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001). Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.(Citation: Mandiant Trojanized Windows 10) Adversaries may employ various forms of [Masquerading](https://attack.mitre.org/techniques/T1036) and [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it.(Citation: Password Protected Word Docs) While [Malicious File](https://attack.mitre.org/techniques/T1204/002) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534).
Near-miss passage: T1204.003 Malicious Image. Tactics: execution. Description: Adversaries may rely on a user running a malicious image to facilitate execution. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored. Backdoored images may be uploaded to a public repository via [Upload Malware](https://attack.mitre.org/techniques/T1608/001), and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container.(Citation: Summit Route Malicious AMIs) Adversaries may also name images a certain way to increase the chance of users mistakenly deploying an instance or container from the image (ex: [Match Legitimate Resource Name or Location](https://attack.mitre.org/techniques/T1036/005)).(Citation: Aqua Security Cloud Native Threat Report June 2021)
Query: CVE similar to CVE-2015-0277
Matching passage: CVE-2015-0277. CWE: CWE-284. CVSS: 6.0. The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users' accounts via a crafted SAML assertion. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6254 for lack of validation for the Destination attribute in a Response element in a SAML assertion.
Near-miss passage: CVE-2015-6984. CWE: CWE-284. CVSS: 8.800000190734863. libarchive in Apple OS X before 10.11.1 allows attackers to write to arbitrary files via a crafted app that conducts an unspecified symlink attack.
Query: exploit ONOS before 1.5.0 when using the ifwd app allows remote attackers to cause a denial of service (NULL pointer dereference and switch disconnect) by sending two Ethernet frames with 
Matching passage: CVE-2015-7516. CWE: CWE-476. CVSS: 7.5. ONOS before 1.5.0 when using the ifwd app allows remote attackers to cause a denial of service (NULL pointer dereference and switch disconnect) by sending two Ethernet frames with ether_type Jumbo Frame (0x8870).
Near-miss passage: CVE-2015-9072. CWE: CWE-476. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall.
Query: risk of Integer overflow in the stagefright::SampleTable::isValid function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to exec
Matching passage: CVE-2015-4480. CWE: CWE-189. CVSS: 9.300000190734863. Integer overflow in the stagefright::SampleTable::isValid function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via crafted MPEG-4 video data with H.264 encoding.
Near-miss passage: CVE-2015-6819. CWE: CWE-189. CVSS: 7.5. Multiple integer underflows in the ff_mjpeg_decode_frame function in libavcodec/mjpegdec.c in FFmpeg before 2.7.2 allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data.
Query: risk of In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M,
Matching passage: CVE-2015-9198. CWE: CWE-191. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, and SDX20, integer underflow vulnerability in function qsee_register_log_buff may lead to arbitrary writing of secure memory.
Near-miss passage: CVE-2015-9167. CWE: CWE-191. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, and SD 820A, in an EMM command, an integer underflow can occur.
Query: indicators of Multi-Factor Authentication Interception
Matching passage: T1111 Multi-Factor Authentication Interception. Tactics: credential access. Description: Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms. If a smart card is used for multi-factor authentication, then a keylogger will need to be used to obtain the password associated with a smart card during normal use. With both an inserted card and access to the smart card password, an adversary can connect to a network resource using the infected system to proxy the authentication with the inserted hardware token. (Citation: Mandiant M Trends 2011) Adversaries may also employ a keylogger to similarly target other hardware tokens, such as RSA SecurID. Capturing token input (including a user's personal identification code) may provide temporary access (i.e. replay the one-time passcode until the next value rollover) as well as possibly enabling adversaries to reliably predict future authentication values (given access to both the algorithm and any seed values used to generate appended temporary codes). (Citation: GCN RSA June 2011) Other methods of MFA may be intercepted and used by an adversary to authenticate. It is common for one-time codes to be sent via out-of-band communications (email, SMS). If the device and/or service is not secured, then it may be vulnerable to interception. Service providers can also be targeted: for example, an adversary may compromise an SMS messaging service in order to steal MFA codes sent to users’ phones.(Citation: Okta Scatter Swine 2022)
Near-miss passage: T1558.002 Silver Ticket. Tactics: credential access. Description: Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets.(Citation: ADSecurity Silver Tickets) Silver tickets are more limited in scope in than golden tickets in that they only enable adversaries to access a particular resource (e.g. MSSQL) and the system that hosts the resource; however, unlike golden tickets, adversaries with the ability to forge silver tickets are able to create TGS tickets without interacting with the Key Distribution Center (KDC), potentially making detection more difficult.(Citation: ADSecurity Detecting Forged Tickets) Password hashes for target services may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).
Query: containment actions for Lateral movement indicators for Social Media Accounts
Matching passage: Playbook for T1585.001 Social Media Accounts. 1) Validate alert telemetry against T1585.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: resource development. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may create and cultivate social media accounts that can be used during targeting. Adversaries can create social media accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) For operations incorporating
Near-miss passage: Playbook for T1585.003 Cloud Accounts. Different response path focused on resource development.
Query: detect Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology fo in logs
Matching passage: Sigma rule: Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology fo. Logsource: windows / system. Rule: title: ISATAP Router Address Was Set id: d22df9cd-2aee-4089-93c7-9dc4eae77f2c status: experimental description: 'Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6. In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic. This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment. ' references: - https://www.blackhillsinfosec.com/mitm6-strikes-again-the-dark-side-of-ipv6/ - https://redfoxsec.com/blog/ipv6-dns-takeover/ - https://www.securityhq.com/blog/malicious-isatap-tunneling-unearthed-on-windows-server/ - https://medium.com/@ninnesoturan/detecting-ipv6-dns-takeover-a54a6a88be1f author: hamid date: 2025-10-19 tags: - attack.impact - attack.credential-access - attack.collection - attack.initial-access - attack.privilege-escalation - attack.execution - attack.t1557 - attack.t1565.002 logsource: product: windows service: system detection: selection: EventID: 4100 Provider_Name: Microsoft-Windows-Iphlpsvc filter_main_localhost: IsatapRouter: - 127.0.0.1 - ::1 filter_optional_null: IsatapRouter: null condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate ISATAP router configuration in enterprise environments - IPv6 transition projects and network infrastructure changes - Network administrators configuring dual-stack networking - Automatic ISATAP configuration in some Windows deployments level: medium
Near-miss passage: Sigma rule: Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to. Logsource: windows / process_creation. Rule: title: Potential Mftrace.EXE Abuse id: 3d48c9d3-1aa6-418d-98d3-8fd3c01a564e status: test description: Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to execute arbitrary binaries. references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Mftrace/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-09 modified: 2023-08-03 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \mftrace.exe condition: selection falsepositives: - Legitimate use for tracing purposes level: medium
Query: patch priority for CVE-2015-7288
Matching passage: CVE-2015-7288. CWE: CWE-254. CVSS: 4.300000190734863. CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 allow remote attackers to modify the configuration via a command in an SMS message, as demonstrated by a "4 2" command.
Near-miss passage: CVE-2015-6997. CWE: CWE-254. CVSS: 4.300000190734863. The X.509 certificate-trust implementation in Apple iOS before 9.1 does not recognize that the kSecRevocationRequirePositiveResponse flag implies a revocation-checking requirement, which makes it easier for man-in-the-middle attackers to spoof endpoints by leveraging access to a revoked certificate.
Query: patch priority for CVE-2015-0008
Matching passage: CVE-2015-0008. CWE: CWE-284. CVSS: 8.300000190734863. The UNC implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not include authentication from the server to the client, which allows remote attackers to execute arbitrary code by making crafted data available on a UNC share, as demonstrated by Group Policy data from a spoofed domain controller, aka "Group Policy Remote Code Execution Vulnerability."
Near-miss passage: CVE-2015-9152. CWE: CWE-284. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile IPQ4019, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 800, SD 810, SD 820, SD 820A, SD 835, and Snapdragon_High_Med_2016, modem owned regions are accessible from secure side.
Query: Sigma YAML for windows / appxdeployment-server
Matching passage: Sigma rule: Detects an appx package deployment / installation with the error code "0x80073cff" which indicates that the package didn. Logsource: windows / appxdeployment-server. Rule: title: AppX Package Deployment Failed Due to Signing Requirements id: 898d5fc9-fbc3-43de-93ad-38e97237c344 status: test description: 'Detects an appx package deployment / installation with the error code "0x80073cff" which indicates that the package didn''t meet the signing requirements. ' references: - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/ - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-11 modified: 2025-12-03 tags: - attack.stealth logsource: product: windows service: appxdeployment-server detection: selection: EventID: 401 ErrorCode: '0x80073cff' condition: selection falsepositives: - Legitimate AppX packages not signed by MS used part of an enterprise. level: medium
Near-miss passage: Sigma rule: Detects setting proxy configuration. Logsource: linux / process_creation. Rule: title: Connection Proxy id: 72f4ab3f-787d-495d-a55d-68c2ff46cf4c status: test description: Detects setting proxy configuration author: Ömer Günal date: 2020-06-17 modified: 2022-10-05 tags: - attack.command-and-control - attack.t1090 logsource: product: linux category: process_creation detection: selection: CommandLine|contains: - http_proxy= - https_proxy= condition: selection falsepositives: - Legitimate administration activities level: low
Query: patch priority for CVE-2015-0710
Matching passage: CVE-2015-0710. CWE: CWE-399. CVSS: 6.099999904632568. The Overlay Transport Virtualization (OTV) implementation in Cisco IOS XE 3.10S allows remote attackers to cause a denial of service (device reload) via a series of packets that are considered oversized and trigger improper fragmentation handling, aka Bug IDs CSCup37676 and CSCup30335.
Near-miss passage: CVE-2015-3280. CWE: CWE-399. CVSS: 6.800000190734863. OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service (disk consumption) by deleting instances while in the resize state.
Query: patch priority for CVE-2015-4803
Matching passage: CVE-2015-4803. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4893 and CVE-2015-4911.
Near-miss passage: CVE-2015-7658. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted actionInstanceOf arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.