alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: secure coding against Improper Neutralization of Multiple Trailing Special Elements
Matching passage: CWE-163 Improper Neutralization of Multiple Trailing Special Elements. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple trailing special elements that could be interpreted in unexpected ways when they are sent to a downstream component.
Near-miss passage: CWE-651 Exposure of WSDL File Containing Sensitive Information. The Web services architecture may require exposing a Web Service Definition Language (WSDL) file that contains information on the publicly accessible services and how callers of these services should interact with them (e.g. what parameters they expect and what types they return).
Query: rule covering Detects the abuse of custom file open handler, executing powershell
Matching passage: Sigma rule: Detects the abuse of custom file open handler, executing powershell. Logsource: windows / registry_set. Rule: title: Custom File Open Handler Executes PowerShell id: 7530b96f-ad8e-431d-a04d-ac85cc461fdc status: test description: Detects the abuse of custom file open handler, executing powershell references: - https://news.sophos.com/en-us/2022/02/01/solarmarker-campaign-used-novel-registry-changes-to-establish-persistence/?cmp=30728 author: CD_R0M_ date: 2022-06-11 modified: 2023-08-17 tags: - attack.stealth - attack.t1202 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: shell\open\command\ Details|contains|all: - powershell - -command condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS e. Logsource: aws / cloudtrail. Rule: title: AWS IAM Backdoor Users Keys id: 0a5177f4-6ca9-44c2-aacf-d3f3d8b6e4d2 status: test description: 'Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS environment. Also with this alert, you can detect a flow of AWS keys in your org. ' references: - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/iam__backdoor_users_keys/main.py author: faloker date: 2020-02-12 modified: 2022-10-09 tags: - attack.persistence - attack.privilege-escalation - attack.t1098 logsource: product: aws service: cloudtrail detection: selection_source: eventSource: iam.amazonaws.com eventName: CreateAccessKey filter: userIdentity.arn|contains: responseElements.accessKey.userName condition: selection_source and not filter falsepositives: - Adding user keys to their own accounts (the filter cannot cover all possible variants of user naming) - AWS API keys legitimate exchange workflows level: medium
Query: CWE for Missing Immutable Root of Trust in Hardware
Matching passage: CWE-1326 Missing Immutable Root of Trust in Hardware. A missing immutable root of trust in the hardware results in the ability to bypass secure boot or execute untrusted or adversarial boot code.
Near-miss passage: CWE-675 Multiple Operations on Resource in Single-Operation Context. The product performs the same operation on a resource two or more times, when the operation should only be applied once.
Query: Outbound C2 pattern associated with Conditional Access Policies
Matching passage: T1556.009 Conditional Access Policies. Tactics: defense impairment, persistence, credential access. Description: Adversaries may disable or modify conditional access policies to enable persistent access to compromised accounts. Conditional access policies are additional verifications used by identity providers and identity and access management systems to determine whether a user should be granted access to a resource. For example, in Entra ID, Okta, and JumpCloud, users can be denied access to applications based on their IP address, device enrollment status, and use of multi-factor authentication.(Citation: Microsoft Conditional Access)(Citation: JumpCloud Conditional Access Policies)(Citation: Okta Conditional Access Policies) In some cases, identity providers may also support the use of risk-based metrics to deny sign-ins based on a variety of indicators. In AWS and GCP, IAM policies can contain `condition` attributes that verify arbitrary constraints such as the source IP, the date the request was made, and the nature of the resources or regions being requested.(Citation: AWS IAM Conditions)(Citation: GCP IAM Conditions) These measures help to prevent compromised credentials from resulting in unauthorized access to data or resources, as well as limit user permissions to only those required. By modifying conditional access policies, such as adding additional trusted IP ranges, removing [Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006) requirements, or allowing additional [Unused/Unsupported Cloud Regions](https://attack.mitre.org/techniques/T1535), adversaries may be able to ensure persistent access to accounts and circumvent defensive measures.
Near-miss passage: T1556.002 Password Filter DLL. Tactics: defense impairment, persistence, credential access. Description: Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated. Windows password filters are password policy enforcement mechanisms for both domain and local accounts. Filters are implemented as DLLs containing a method to validate potential passwords against password policies. Filter DLLs can be positioned on local computers for local accounts and/or domain controllers for domain accounts. Before registering new passwords in the Security Accounts Manager (SAM), the Local Security Authority (LSA) requests validation from each registered filter. Any potential changes cannot take effect until every registered filter acknowledges validation. Adversaries can register malicious password filters to harvest credentials from local computers and/or entire domains. To perform proper validation, filters must receive plain-text credentials from the LSA. A malicious password filter would receive these plain-text credentials every time a password request is made.(Citation: Carnal Ownage Password Filters Sept 2013)
Query: write Sigma for Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility
Matching passage: Sigma rule: Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility. Logsource: macos / process_creation. Rule: title: Potential Persistence Via PlistBuddy id: 65d506d3-fcfe-4071-b4b2-bcefe721bbbb status: test description: Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility references: - https://redcanary.com/blog/clipping-silver-sparrows-wings/ - https://www.manpagez.com/man/8/PlistBuddy/ author: Sohan G (D4rkCiph3r) date: 2023-02-18 tags: - attack.privilege-escalation - attack.persistence - attack.t1543.001 - attack.t1543.004 logsource: category: process_creation product: macos detection: selection: Image|endswith: /PlistBuddy CommandLine|contains|all: - RunAtLoad - 'true' CommandLine|contains: - LaunchAgents - LaunchDaemons condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages. Logsource: windows / ps_script. Rule: title: Unsigned AppX Installation Attempt Using Add-AppxPackage - PsScript id: 975b2262-9a49-439d-92a6-0709cccdf0b2 related: - id: 37651c2a-42cd-4a69-ae0d-22a4349aa04a type: similar - id: 9a025188-6f2d-42f8-bb2f-d3a83d24a5af type: similar status: test description: Detects usage of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages references: - https://learn.microsoft.com/en-us/windows/msix/package/unsigned-package - https://twitter.com/WindowsDocs/status/1620078135080325122 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-31 tags: - attack.persistence - attack.stealth logsource: product: windows category: ps_script definition: Script Block Logging must be enable detection: selection_cmdlet: ScriptBlockText|contains: - 'Add-AppPackage ' - 'Add-AppxPackage ' selection_flag: ScriptBlockText|contains: ' -AllowUnsigned' condition: all of selection_* falsepositives: - Installation of unsigned packages for testing purposes level: medium
Query: patch priority for CVE-2015-0760
Matching passage: CVE-2015-0760. CWE: CWE-20. CVSS: 4.0. The IKEv1 implementation in Cisco ASA Software 7.x, 8.0.x, 8.1.x, and 8.2.x before 8.2.2.13 allows remote authenticated users to bypass XAUTH authentication via crafted IKEv1 packets, aka Bug ID CSCus47259.
Near-miss passage: CVE-2015-8735. CWE: CWE-20. CVSS: 5.5. The get_value function in epan/dissectors/packet-btatt.c in the Bluetooth Attribute (aka BT ATT) dissector in Wireshark 2.0.x before 2.0.1 uses an incorrect integer data type, which allows remote attackers to cause a denial of service (invalid write operation and application crash) via a crafted packet.
Query: weakness Command Shell in Externally Accessible Directory
Matching passage: CWE-553 Command Shell in Externally Accessible Directory. A possible shell file exists in /cgi-bin/ or other accessible directories. This is extremely dangerous and can be used by an attacker to execute commands on the web server.
Near-miss passage: CWE-598 Use of HTTP Request With Sensitive Query String. The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.
Query: secure coding against Loop Condition Value Update within the Loop
Matching passage: CWE-1095 Loop Condition Value Update within the Loop. The product uses a loop with a control flow condition based on a value that is updated within the body of the loop.
Near-miss passage: CWE-424 Improper Protection of Alternate Path. The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.
Query: risk of The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #AC 
Matching passage: CVE-2015-5307. CWE: CWE-399. CVSS: 4.900000095367432. The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #AC (aka Alignment Check) exceptions, related to svm.c and vmx.c.
Near-miss passage: CVE-2015-0742. CWE: CWE-399. CVSS: 5.0. The Protocol Independent Multicast (PIM) application in Cisco Adaptive Security Appliance (ASA) Software 9.2(0.0), 9.2(0.104), 9.2(3.1), 9.2(3.4), 9.3(1.105), 9.3(2.100), 9.4(0.115), 100.13(0.21), 100.13(20.3), 100.13(21.9), and 100.14(1.1) does not properly implement multicast-forwarding registration, which allows remote attackers to cause a denial of service (forwarding outage) via a crafted multicast packet, aka Bug ID CSCus74398.
Query: describe CVE-2015-10085
Matching passage: CVE-2015-10085. CWE: CWE-404. CVSS: 7.5. A vulnerability was found in GoPistolet. It has been declared as problematic. This vulnerability affects unknown code of the component MTA. The manipulation leads to denial of service. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as b91aa4674d460993765884e8463c70e6d886bc90. It is recommended to apply a patch to fix this issue. VDB-221506 is the identifier assigned to this vulnerability.
Near-miss passage: CVE-2015-10002. CWE: CWE-404. CVSS: 5.5. A vulnerability classified as problematic has been found in Kiddoware Kids Place. This affects the Home Button Protection. A repeated pressing of the button causes a local denial of service. It is recommended to upgrade the affected component.
Query: describe CVE-2015-4510
Matching passage: CVE-2015-4510. CWE: CWE-362. CVSS: 6.800000190734863. Race condition in the WorkerPrivate::NotifyFeatures function in Mozilla Firefox before 41.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) by leveraging improper interaction between shared workers and the IndexedDB implementation.
Near-miss passage: CVE-2015-1865. CWE: CWE-362. CVSS: 5.099999904632568. fts.c in coreutils 8.4 allows local users to delete arbitrary files.
Query: campaign using Match Legitimate Resource Name or Location
Matching passage: T1036.005 Match Legitimate Resource Name or Location. Tactics: stealth. Description: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: `svchost.exe`). Alternatively, a Windows Registry key may be given a close approximation to a key used by a legitimate program. In containerized environments, a threat actor may create a resource in a trusted namespace or one that matches the naming convention of a container pod or cluster.(Citation: Aquasec Kubernetes Backdoor 2023)
Near-miss passage: T1036.002 Right-to-Left Override. Tactics: stealth. Description: Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign. RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse. For example, a Windows screensaver executable named <code>March 25 \u202Excod.scr</code> will display as <code>March 25 rcs.docx</code>. A JavaScript file named <code>photo_high_re\u202Egnp.js</code> will be displayed as <code>photo_high_resj.png</code>.(Citation: Infosecinstitute RTLO Technique) Adversaries may abuse the RTLO character as a means of tricking a user into executing what they think is a benign file type. A common use of this technique is with [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001)/[Malicious File](https://attack.mitre.org/techniques/T1204/002) since it can trick both end users and defenders if they are not aware of how their tools display and render the RTLO character. Use of the RTLO character has been seen in many targeted intrusion attempts and criminal activity.(Citation: Trend Micro PLEAD RTLO)(Citation: Kaspersky RTLO Cyber Crime) RTLO can be used in the Windows Registry as well, where regedit.exe displays the reversed characters but the command line tool reg.exe does not by default.
Query: indicators of Email Accounts
Matching passage: T1585.002 Email Accounts. Tactics: resource development. Description: Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) Establishing email accounts may also allow adversaries to abuse free services – such as trial periods – to [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) for follow-on purposes.(Citation: Free Trial PurpleUrchin) Adversaries may also take steps to cultivate a persona around the email account, such as through use of [Social Media Accounts](https://attack.mitre.org/techniques/T1585/001), to increase the chance of success of follow-on behaviors. Created email accounts can also be used in the acquisition of infrastructure (ex: [Domains](https://attack.mitre.org/techniques/T1583/001)).(Citation: Mandiant APT1) To decrease the chance of physically tying back operations to themselves, adversaries may make use of disposable email services.(Citation: Trend Micro R980 2016)
Near-miss passage: T1585.003 Cloud Accounts. Tactics: resource development. Description: Adversaries may create accounts with cloud providers that can be used during targeting. Adversaries can use cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, MEGA, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s. Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure. Establishing cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud) Creating [Cloud Accounts](https://attack.mitre.org/techniques/T1585/003) may also require adversaries to establish [Email Accounts](https://attack.mitre.org/techniques/T1585/002) to register with the cloud provider.
Query: risk of Directory traversal vulnerability in BisonWare BisonFTP 3.5 allows remote attackers to read arbitrary files via a ../ (dot dot slash) in a RETR command.
Matching passage: CVE-2015-7602. CWE: CWE-22. CVSS: 7.800000190734863. Directory traversal vulnerability in BisonWare BisonFTP 3.5 allows remote attackers to read arbitrary files via a ../ (dot dot slash) in a RETR command.
Near-miss passage: CVE-2015-5322. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in the Jenkins servlet resources via directory traversal sequences in a request to jnlpJars/.
Query: telemetry for T1092
Matching passage: T1092 Communication Through Removable Media. Tactics: command and control. Description: Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.(Citation: ESET Sednit USBStealer 2014) Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091). Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.
Near-miss passage: T1132 Data Encoding. Tactics: command and control. Description: Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.(Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.
Query: incident response steps for SIEM correlation: collection activity consistent with Data Staged
Matching passage: Playbook for T1074 Data Staged. 1) Validate alert telemetry against T1074. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: collection. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy
Near-miss passage: Playbook for T1074.002 Remote Data Staging. Different response path focused on collection.
Query: patch priority for CVE-2015-10079
Matching passage: CVE-2015-10079. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in juju2143 WalrusIRC 0.0.2. It has been rated as problematic. This issue affects the function parseLinks of the file public/parser.js. The manipulation of the argument text leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 0.0.3 is able to address this issue. The patch is named 45fd885895ae13e8d9b3a71e89d59768914f60af. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220751.
Near-miss passage: CVE-2015-9414. CWE: CWE-79. CVSS: 6.099999904632568. The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter.
Query: describe CVE-2015-2632
Matching passage: CVE-2015-2632. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality via unknown vectors related to 2D.
Near-miss passage: CVE-2015-6051. CWE: UNKNOWN. CVSS: 4.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Internet Explorer Elevation of Privilege Vulnerability."
Query: mitigate Process Hollowing
Matching passage: T1055.012 Process Hollowing. Tactics: stealth, privilege escalation. Description: Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process. Process hollowing is commonly performed by creating a process in a suspended state then unmapping/hollowing its memory, which can then be replaced with malicious code. A victim process can be created with native Windows API calls such as <code>CreateProcess</code>, which includes a flag to suspend the processes primary thread. At this point the process can be unmapped using APIs calls such as <code>ZwUnmapViewOfSection</code> or <code>NtUnmapViewOfSection</code> before being written to, realigned to the injected code, and resumed via <code>VirtualAllocEx</code>, <code>WriteProcessMemory</code>, <code>SetThreadContext</code>, then <code>ResumeThread</code> respectively.(Citation: Leitch Hollowing)(Citation: Elastic Process Injection July 2017) This is very similar to [Thread Local Storage](https://attack.mitre.org/techniques/T1055/005) but creates a new process rather than targeting an existing process. This behavior will likely not result in elevated privileges since the injected process was spawned from (and thus inherits the security context) of the injecting process. However, execution via process hollowing may also evade detection from security products since the execution is masked under a legitimate process.
Near-miss passage: T1055 Process Injection. Tactics: stealth, privilege escalation. Description: Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. There are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific. More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.