alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects suspicious ways to use the "DumpMinitool.exe" binary. Logsource: windows / process_creation. Rule: title: Suspicious DumpMinitool Execution id: eb1c4225-1c23-4241-8dd4-051389fde4ce status: test description: Detects suspicious ways to use the "DumpMinitool.exe" binary references: - https://twitter.com/mrd0x/status/1511415432888131586 - https://twitter.com/mrd0x/status/1511489821247684615 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/DumpMinitool/ author: Florian Roth (Nextron Systems) date: 2022-04-06 modified: 2023-04-12 tags: - attack.credential-access - attack.stealth - attack.t1036 - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \DumpMinitool.exe - \DumpMinitool.x86.exe - \DumpMinitool.arm64.exe - OriginalFileName: - DumpMinitool.exe - DumpMinitool.x86.exe - DumpMinitool.arm64.exe filter_folder: Image|contains: - \Microsoft Visual Studio\ - \Extensions\ susp_flags: CommandLine|contains: .txt cmd_has_flags: CommandLine|contains: - ' Full' - ' Mini' - ' WithHeap' filter_cmd_misses_flags: CommandLine|contains: --dumpType condition: selection and ( ( not filter_folder ) or susp_flags or ( cmd_has_flags and not filter_cmd_misses_flags ) ) falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects use of WSReset.exe to bypass User Account Control (UAC). Adversaries use this technique to execute privileged pr. Logsource: windows / process_creation. Rule: title: Bypass UAC via WSReset.exe id: d797268e-28a9-49a7-b9a8-2f5039011c5c related: - id: bdc8918e-a1d5-49d1-9db7-ea0fd91aa2ae type: obsolete status: test description: Detects use of WSReset.exe to bypass User Account Control (UAC). Adversaries use this technique to execute privileged processes. references: - https://eqllib.readthedocs.io/en/latest/analytics/532b5ed4-7930-11e9-8f5c-d46d6d62a49e.html - https://lolbas-project.github.io/lolbas/Binaries/Wsreset/ - https://www.activecyber.us/activelabs/windows-uac-bypass - https://twitter.com/ReaQta/status/1222548288731217921 author: E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community, Florian Roth date: 2019-10-24 modified: 2022-05-13 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \wsreset.exe filter: - Image|endswith: \conhost.exe - OriginalFileName: CONHOST.EXE condition: selection and not filter falsepositives: - Unknown sub processes of Wsreset.exe level: high
Query: describe CVE-2015-6006
Matching passage: CVE-2015-6006. CWE: CWE-119. CVSS: 7.5. The AddUserFinding implementation in Medicomp MEDCIN Engine 2.22.20153.x before 2.22.20153.226 might allow remote attackers to execute arbitrary code or cause a denial of service (integer truncation and heap-based buffer overflow) via a crafted packet on port 8190.
Near-miss passage: CVE-2015-8098. CWE: CWE-119. CVSS: 9.800000190734863. F5 BIG-IP APM 11.4.1 before 11.4.1 HF9, 11.5.x before 11.5.3, and 11.6.0 before 11.6.0 HF4 allow remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors related to processing a Citrix Remote Desktop connection through a virtual server configured with a remote desktop profile, aka an "Out-of-bounds memory vulnerability."
Query: describe CVE-2015-7181
Matching passage: CVE-2015-7181. CWE: CWE-119. CVSS: 7.5. The sec_asn1d_parse_leaf function in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, improperly restricts access to an unspecified data structure, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data, related to a "use-after-poison" issue.
Near-miss passage: CVE-2015-3702. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3700, and CVE-2015-3701.
Query: risk of JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension.
Matching passage: CVE-2015-7341. CWE: CWE-434. CVSS: 8.800000190734863. JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension.
Near-miss passage: CVE-2015-6000. CWE: CWE-434. CVSS: 8.800000190734863. Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.3.0 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in test/logo/.
Query: describe CVE-2015-6402
Matching passage: CVE-2015-6402. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the management interface on Cisco EPC3928 devices with EDVA 5.5.10, 5.5.11, and 5.7.1 allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCux24935.
Near-miss passage: CVE-2015-1373. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inject arbitrary web script or HTML via the (1) action parameter in a search request, (2) username in a login request, which is not properly handled when logging the event, or (3) page title in an insert action.
Query: CVE similar to CVE-2015-5150
Matching passage: CVE-2015-5150. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authenticated users to inject arbitrary web script or HTML via the (1) query parameter in the run_query_editor_query module to CustomReportHandler.do, (2) compAcct parameter to jsp/ResetADPwd.jsp, or (3) redirectTo parameter to jsp/CacheScreenWidth.jsp.
Near-miss passage: CVE-2015-9294. CWE: CWE-79. CVSS: 6.099999904632568. The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.
Query: patch priority for CVE-2015-4588
Matching passage: CVE-2015-4588. CWE: CWE-119. CVSS: 6.800000190734863. Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted "run-length count" in an image in a WMF file.
Near-miss passage: CVE-2015-5799. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Query: risk of Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX003, and 7.6.0 before 7.6.0.1 IFIX001; Maximo Asset Managemen
Matching passage: CVE-2015-4944. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX003, and 7.6.0 before 7.6.0.1 IFIX001; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX003 and 7.6.0 before 7.6.0.1 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-9311. CWE: CWE-79. CVSS: 6.099999904632568. The newstatpress plugin before 1.0.6 for WordPress has reflected XSS.
Query: risk of Unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle Fusion Middleware 10.1.3.4.2 and 11.1.1.7 allows remote authenticated users to 
Matching passage: CVE-2015-0399. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle Fusion Middleware 10.1.3.4.2 and 11.1.1.7 allows remote authenticated users to affect confidentiality via unknown vectors related to Analytics Web General.
Near-miss passage: CVE-2015-3038. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043.
Query: detect Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs in logs
Matching passage: Sigma rule: Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs. Logsource: windows / process_creation. Rule: title: HackTool - SharpEvtMute Execution id: bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c related: - id: 49329257-089d-46e6-af37-4afce4290685 type: similar status: test description: Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs references: - https://github.com/bats3c/EvtMute author: Florian Roth (Nextron Systems) date: 2022-09-07 modified: 2023-02-14 tags: - attack.defense-impairment - attack.t1685.001 logsource: product: windows category: process_creation detection: selection: - Image|endswith: \SharpEvtMute.exe - Description: SharpEvtMute - CommandLine|contains: - '--Filter "rule ' - --Encoded --Filter \" condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded. Logsource: windows / system. Rule: title: DHCP Server Error Failed Loading the CallOut DLL id: 75edd3fd-7146-48e5-9848-3013d7f0282c status: test description: This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded references: - https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html - https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx - https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx author: Dimitrios Slamaris, @atc_project (fix) date: 2017-05-15 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows service: system detection: selection: EventID: - 1031 - 1032 - 1034 Provider_Name: Microsoft-Windows-DHCP-Server condition: selection falsepositives: - Unknown level: high
Query: exploit Stack-based buffer overflow on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices through B FRN 15.003 allows remote attackers to execute arbitrary code via
Matching passage: CVE-2015-6490. CWE: CWE-119. CVSS: 9.800000190734863. Stack-based buffer overflow on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices through B FRN 15.003 allows remote attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-5931. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 9.0.1 and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-3 and APPLE-SA-2015-10-21-5.
Query: CVE similar to CVE-2015-9452
Matching passage: CVE-2015-9452. CWE: CWE-89. CVSS: 9.800000190734863. The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nex_forms_Id parameter.
Near-miss passage: CVE-2015-1013. CWE: CWE-89. CVSS: 6.5. OSIsoft PI AF 2.6 and 2.7 and PI SQL for AF 2.1.2.19 do not ensure that the PI SQL (AF) Trusted Users group lacks the Everyone account, which allows remote authenticated users to bypass intended command restrictions via SQL statements.
Query: detection rule: Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands
Matching passage: Sigma rule: Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands. Logsource: windows / process_creation. Rule: title: PUA - Rclone Execution id: e37db05d-d1f9-49c8-b464-cee1a4b11638 related: - id: a0d63692-a531-4912-ad39-4393325b2a9c type: obsolete - id: cb7286ba-f207-44ab-b9e6-760d82b84253 type: obsolete status: test description: Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc references: - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/ - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a - https://labs.sentinelone.com/egregor-raas-continues-the-chaos-with-cobalt-strike-and-rclone - https://www.splunk.com/en_us/blog/security/darkside-ransomware-splunk-threat-update-and-detections.html author: Bhabesh Raj, Sittikorn S, Aaron Greetham (@beardofbinary) - NCC Group date: 2021-05-10 modified: 2023-03-05 tags: - attack.exfiltration - attack.t1567.002 logsource: product: windows category: process_creation detection: selection_specific_options: CommandLine|contains|all: - '--config ' - '--no-check-certificate ' - ' copy ' selection_rclone_img: - Image|endswith: \rclone.exe - Description: Rsync for cloud storage selection_rclone_cli: CommandLine|contains: - pass - user - copy - sync - config - lsd - remote - ls - mega - pcloud - ftp - ignore-existing - auto-confirm - transfers - multi-thread-streams - 'no-check-certificate ' condition: selection_specific_options or all of selection_rclone_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of "find" binary in a suspicious manner to perform discovery. Logsource: macos / process_creation. Rule: title: Potential Discovery Activity Using Find - MacOS id: 85de3a19-b675-4a51-bfc6-b11a5186c971 related: - id: 8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf type: similar status: test description: Detects usage of "find" binary in a suspicious manner to perform discovery references: - https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-28 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: macos detection: selection: Image|endswith: /find CommandLine|contains: - -perm -4000 - -perm -2000 - -perm 0777 - -perm -222 - -perm -o w - -perm -o x - -perm -u=s - -perm -g=s condition: selection falsepositives: - Unknown level: medium
Query: alert when Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".
Matching passage: Sigma rule: Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".. Logsource: windows / process_creation. Rule: title: Potential Provisioning Registry Key Abuse For Binary Proxy Execution id: 2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25 related: - id: 7f5d1c9a-3e83-48df-95a7-2b98aae6c13c type: similar - id: f9999590-1f94-4a34-a91e-951e47bedefd type: similar - id: 7021255e-5db3-4946-a8b9-0ba7a4644a69 type: similar status: test description: Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe". references: - https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/ - https://twitter.com/0gtweet/status/1674399582162153472 author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel date: 2023-08-08 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: SOFTWARE\Microsoft\Provisioning\Commands\ condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects email exfiltration via powershell cmdlets. Logsource: windows / process_creation. Rule: title: Email Exifiltration Via Powershell id: 312d0384-401c-4b8b-abdf-685ffba9a332 status: test description: Detects email exfiltration via powershell cmdlets references: - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/ - https://github.com/Azure/Azure-Sentinel/blob/7e6aa438e254d468feec061618a7877aa528ee9f/Hunting%20Queries/Microsoft%20365%20Defender/Ransomware/DEV-0270/Email%20data%20exfiltration%20via%20PowerShell.yaml author: Nasreddine Bencherchali (Nextron Systems), Azure-Sentinel (idea) date: 2022-09-09 tags: - attack.exfiltration logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains|all: - Add-PSSnapin - Get-Recipient - -ExpandProperty - EmailAddresses - SmtpAddress - -hidetableheaders condition: selection falsepositives: - Unknown level: high
Query: detect Detects the execution GMER tool based on image and hash fields. in logs
Matching passage: Sigma rule: Detects the execution GMER tool based on image and hash fields.. Logsource: windows / process_creation. Rule: title: HackTool - GMER Rootkit Detector and Remover Execution id: 9082ff1f-88ab-4678-a3cc-5bcff99fc74d status: test description: Detects the execution GMER tool based on image and hash fields. references: - http://www.gmer.net/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-05 modified: 2024-11-23 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \gmer.exe selection_sysmon_hash: Hashes|contains: - MD5=E9DC058440D321AA17D0600B3CA0AB04 - SHA1=539C228B6B332F5AA523E5CE358C16647D8BBE57 - SHA256=E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173 condition: 1 of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actor. Logsource: gcp / google_workspace.login. Rule: title: Google Workspace Government Attack Warning id: eafe6f2b-cfec-4612-aec2-49563c33a087 status: experimental description: Detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actor references: - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging - https://cloud.google.com/logging/docs/audit/understanding-audit-logs - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#gov_attack_warning author: Tom Kluter date: 2026-04-28 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.impact - attack.stealth - attack.t1078 logsource: product: gcp service: google_workspace.login detection: selection: protoPayload.serviceName: login.googleapis.com protoPayload.metadata.event.eventName: gov_attack_warning condition: selection falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-6267
Matching passage: CVE-2015-6267. CWE: CWE-399. CVSS: 7.800000190734863. Cisco IOS XE before 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted L2TP packet, aka Bug IDs CSCsw95722 and CSCsw95496.
Near-miss passage: CVE-2015-0079. CWE: CWE-399. CVSS: 7.800000190734863. The Remote Desktop Protocol (RDP) implementation in Microsoft Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to cause a denial of service (memory consumption and RDP outage) by establishing many RDP sessions that do not properly free allocated memory, aka "Remote Desktop Protocol (RDP) Denial of Service Vulnerability."
Query: exploit In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, IPQ8064, MDM9206, MDM9607, MDM9640, MDM9650, QCA4531, QCA617
Matching passage: CVE-2015-9220. CWE: CWE-190. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, IPQ8064, MDM9206, MDM9607, MDM9640, MDM9650, QCA4531, QCA6174A, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, QCA9558, QCA9880, QCA9886, QCA9980, SD 210/SD 212/SD 205, SD 425, SD 625, SD 810, SD 820, and SDX20, integer overflow occurs when the size of the firmware section is incorrectly encoded in the firmware image.
Near-miss passage: CVE-2015-9219. CWE: CWE-190. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400 and SD 800, an integer overflow to buffer overflow can occur in a DRM API.
Query: indicators of Inhibit System Recovery
Matching passage: T1490 Inhibit System Recovery. Tactics: impact. Description: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) This may deny access to available backups and recovery options. Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of [Data Destruction](https://attack.mitre.org/techniques/T1485) and [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486).(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) Furthermore, adversaries may disable recovery notifications, then corrupt backups.(Citation: disable_notif_synology_ransom) A number of native Windows utilities have been used by adversaries to disable or delete system recovery features: * <code>vssadmin.exe</code> can be used to delete all volume shadow copies on a system - <code>vssadmin.exe delete shadows /all /quiet</code> * [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) can be used to delete volume shadow copies - <code>wmic shadowcopy delete</code> * <code>wbadmin.exe</code> can be used to delete the Windows Backup Catalog - <code>wbadmin.exe delete catalog -quiet</code> * <code>bcdedit.exe</code> can be used to disable automatic Windows recovery features by modifying boot configuration data - <code>bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no</code> * <code>REAgentC.exe</code> can be used to disable Windows Recovery Environment (WinRE) repair/recovery options of an infected system * <code>diskshadow.exe</code> can be used to delete all volume shadow copies on a system - <code>diskshadow delete shadows all</code> (Citation: Diskshadow) (Citation: Crytox Ransomware) On network devices, adversaries may
Near-miss passage: T1491 Defacement. Tactics: impact. Description: Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for [Defacement](https://attack.mitre.org/techniques/T1491) include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of [Defacement](https://attack.mitre.org/techniques/T1491) in order to cause user discomfort, or to pressure compliance with accompanying messages.