alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: indicators of Archive via Utility
Matching passage: T1560.001 Archive via Utility. Tactics: collection. Description: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport. Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as <code>tar</code> on Linux and macOS or <code>zip</code> on Windows systems. On Windows, <code>diantz</code> or <code> makecab</code> may be used to package collected files into a cabinet (.cab) file. <code>diantz</code> may also be used to download and compress files from remote locations (i.e. [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002)).(Citation: diantz.exe_lolbas) <code>xcopy</code> on Windows can copy files and directories with a variety of options. Additionally, adversaries may use [certutil](https://attack.mitre.org/software/S0160) to Base64 encode collected data before exfiltration. Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.(Citation: 7zip Homepage)(Citation: WinRAR Homepage)(Citation: WinZip Homepage)
Near-miss passage: T1560 Archive Collected Data. Tactics: collection. Description: An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.(Citation: DOJ GRU Indictment Jul 2018) Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender. Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.
Query: vulnerability: Heap-based buffer overflow in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image.
Matching passage: CVE-2015-0848. CWE: CWE-119. CVSS: 6.800000190734863. Heap-based buffer overflow in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image.
Near-miss passage: CVE-2015-3828. CWE: CWE-119. CVSS: 10.0. The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM), which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted 3GPP metadata, aka internal bug 20923261, a related issue to CVE-2015-3826.
Query: describe CVE-2015-9409
Matching passage: CVE-2015-9409. CWE: CWE-352. CVSS: 6.5. The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php.
Near-miss passage: CVE-2015-8379. CWE: CWE-352. CVSS: 8.800000190734863. CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.
Query: vulnerability: Multiple SQL injection vulnerabilities in the Web-Dorado ECommerce WD (com_ecommercewd) component 1.2.5 for Joomla! allow remote attackers to execute arbitrary SQL commands via the
Matching passage: CVE-2015-2562. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in the Web-Dorado ECommerce WD (com_ecommercewd) component 1.2.5 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) search_category_id, (2) sort_order, or (3) filter_manufacturer_ids in a displayproducts action to index.php.
Near-miss passage: CVE-2015-6516. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in cygnux.org sysPass 1.0.9 and earlier allows remote authenticated users to execute arbitrary SQL commands via the search parameter to ajax/ajax_search.php.
Query: risk of The kernel-invoked coredump processor in Automatic Bug Reporting Tool (ABRT) does not properly check the ownership of files before writing core dumps to them, which allows local us
Matching passage: CVE-2015-3142. CWE: CWE-200. CVSS: 4.699999809265137. The kernel-invoked coredump processor in Automatic Bug Reporting Tool (ABRT) does not properly check the ownership of files before writing core dumps to them, which allows local users to obtain sensitive information by leveraging write permissions to the working directory of a crashed application.
Near-miss passage: CVE-2015-4515. CWE: CWE-200. CVSS: 4.300000190734863. Mozilla Firefox before 42.0, when NTLM v1 is enabled for HTTP authentication, allows remote attackers to obtain sensitive hostname information by constructing a crafted web site that sends an NTLM request and reads the Workstation field of an NTLM type 3 message.
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in IBM InfoSphere Master Data Management (MDM) - Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 allow remote authenticate
Matching passage: CVE-2015-7423. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in IBM InfoSphere Master Data Management (MDM) - Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 107771.
Near-miss passage: CVE-2015-1435. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in my little forum before 2.3.4 allows remote attackers to inject arbitrary web script or HTML via the back parameter to index.php.
Query: Sigma rule for Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission gr
Matching passage: Sigma rule: Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission gr. Logsource: windows / ps_script. Rule: title: AD Groups Or Users Enumeration Using PowerShell - ScriptBlock id: 88f0884b-331d-403d-a3a1-b668cf035603 status: test description: 'Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md author: frack113 date: 2021-12-15 modified: 2022-12-25 tags: - attack.discovery - attack.t1069.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: test_2: ScriptBlockText|contains: get-ADPrincipalGroupMembership test_7: ScriptBlockText|contains|all: - get-aduser - '-f ' - '-pr ' - DoesNotRequirePreAuth condition: 1 of test_* falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects when a user downloads a file by using CertOC.exe. Logsource: windows / process_creation. Rule: title: File Download via CertOC.EXE id: 70ad0861-d1fe-491c-a45f-fa48148a300d related: - id: b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a type: similar status: test description: Detects when a user downloads a file by using CertOC.exe references: - https://lolbas-project.github.io/lolbas/Binaries/Certoc/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-05-16 modified: 2023-10-18 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certoc.exe - OriginalFileName: CertOC.exe selection_cli: CommandLine|contains|all: - -GetCACAPS - http condition: all of selection* falsepositives: - Unknown level: medium
Query: vulnerability: The CryptoKey interface implementation in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 lacks status checking, which allows attackers to have an unspecified impact v
Matching passage: CVE-2015-7200. CWE: CWE-17. CVSS: 7.5. The CryptoKey interface implementation in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 lacks status checking, which allows attackers to have an unspecified impact via vectors related to a cryptographic key.
Near-miss passage: CVE-2015-6735. CWE: CWE-17. CVSS: 5.0. The reset functionality in the TimedMediaHandler extension for MediaWiki does not create a new transcode, which allows remote attackers to cause a denial of service (transcode deletion) by resetting a transcode.
Query: alert when Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with uncommon Addinroot or Pipelineroo
Matching passage: Sigma rule: Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with uncommon Addinroot or Pipelineroo. Logsource: windows / process_creation. Rule: title: Uncommon AddinUtil.EXE CommandLine Execution id: 4f2cd9b6-4a17-440f-bb2a-687abb65993a status: test description: 'Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with uncommon Addinroot or Pipelineroot paths. An adversary may execute AddinUtil.exe with uncommon Addinroot/Pipelineroot paths that point to the adversaries Addins.Store payload. ' references: - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri) date: 2023-09-18 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \addinutil.exe - OriginalFileName: AddInUtil.exe selection_cli: CommandLine|contains: - '-AddInRoot:' - '-PipelineRoot:' filter_main_addinroot: CommandLine|contains: - -AddInRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA - -AddInRoot:C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA - -PipelineRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA - -PipelineRoot:C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects potentially suspicious execution of the Qemu utility in a Windows environment. Threat actors have leveraged this. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Usage Of Qemu id: 5fc297ae-25b6-488a-8f25-cc12ac29b744 status: test description: 'Detects potentially suspicious execution of the Qemu utility in a Windows environment. Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky. ' references: - https://securelist.com/network-tunneling-with-qemu/111803/ - https://www.qemu.org/docs/master/system/invocation.html#hxtool-5 author: Muhammad Faisal (@faisalusuf), Hunter Juhan (@threatHNTR) date: 2024-06-03 tags: - attack.command-and-control - attack.t1090 - attack.t1572 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - -m 1M - -m 2M - -m 3M CommandLine|contains|all: - restrict=off - '-netdev ' - connect= - -nographic filter_main_normal_usecase: CommandLine|contains: - ' -cdrom ' - ' type=virt ' - ' -blockdev ' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: SOC runbook when seeing Encoded PowerShell / command-line abuse matching Build Image on Host
Matching passage: Playbook for T1612 Build Image on Host. 1) Validate alert telemetry against T1612. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. A remote <code>build</code> request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or local registry and then builds a custom image upon it.(Citation: Docker Build Image) An
Near-miss passage: Playbook for T1564.001 Hidden Files and Directories. Different response path focused on stealth.
Query: Sigma YAML for windows / dns-client
Matching passage: Sigma rule: Detects DNS queries for subdomains related to "Put.io" sharing website.. Logsource: windows / dns-client. Rule: title: DNS Query To Put.io - DNS Client id: 8b69fd42-9dad-4674-abef-7fdef43ef92a status: test description: Detects DNS queries for subdomains related to "Put.io" sharing website. references: - https://darkatlas.io/blog/medusa-ransomware-group-opsec-failure author: Omar Khaled (@beacon_exe) date: 2024-08-23 tags: - attack.command-and-control logsource: product: windows service: dns-client definition: 'Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events.' detection: selection: EventID: 3008 QueryName|contains: - api.put.io - upload.put.io condition: selection falsepositives: - Legitimate DNS queries and usage of Put.io level: medium
Near-miss passage: Sigma rule: Attackers may leverage fsutil to enumerated connected drives.. Logsource: windows / process_creation. Rule: title: Fsutil Drive Enumeration id: 63de06b9-a385-40b5-8b32-73f2b9ef84b6 status: test description: Attackers may leverage fsutil to enumerated connected drives. references: - Turla has used fsutil fsinfo drives to list connected drives. - https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/discovery_peripheral_device.toml author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' date: 2022-03-29 modified: 2022-07-14 tags: - attack.discovery - attack.t1120 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \fsutil.exe - OriginalFileName: fsutil.exe selection_cli: CommandLine|contains: drives condition: all of selection_* falsepositives: - Certain software or administrative tasks may trigger false positives. level: low
Query: weakness Authentication Bypass by Capture-replay
Matching passage: CWE-294 Authentication Bypass by Capture-replay. A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
Near-miss passage: CWE-829 Inclusion of Functionality from Untrusted Control Sphere. The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
Query: what is T1595.002
Matching passage: T1595.002 Vulnerability Scanning. Tactics: reconnaissance. Description: Adversaries may scan victims for vulnerabilities that can be used during targeting. Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit the adversary may seek to use. These scans may also include more broad attempts to [Gather Victim Host Information](https://attack.mitre.org/techniques/T1592) that can be used to identify more commonly known, exploitable vulnerabilities. Vulnerability scans typically harvest running software and version numbers via server banners, listening ports, or other network artifacts.(Citation: OWASP Vuln Scanning) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).
Near-miss passage: T1595.003 Wordlist Scanning. Tactics: reconnaissance. Description: Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques. While this technique employs similar methods to [Brute Force](https://attack.mitre.org/techniques/T1110), its goal is the identification of content and infrastructure rather than the discovery of valid credentials. Wordlists used in these scans may contain generic, commonly used names and file extensions or terms specific to a particular software. Adversaries may also create custom, target-specific wordlists using data gathered from other Reconnaissance techniques (ex: [Gather Victim Org Information](https://attack.mitre.org/techniques/T1591), or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)). For example, adversaries may use web content discovery tools such as Dirb, DirBuster, and GoBuster and generic or custom wordlists to enumerate a website’s pages and directories.(Citation: ClearSky Lebanese Cedar Jan 2021) This can help them to discover old, vulnerable pages or hidden administrative portals that could become the target of further operations (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [Brute Force](https://attack.mitre.org/techniques/T1110)). As cloud storage solutions typically use globally unique names, adversaries may also use target-specific wordlists and tools such as s3recon and GCPBucketBrute to enumerate public and private buckets on cloud infrastructure.(Citation: S3Recon GitHub)(Citation: GCPBucketBrute) Once storage objects are discovered, adversaries may leverage [Data from Cloud Storage](https://attack.mitre.org/techniques/T1530) to access valuable information that can be exfiltrated or used to escalate privileges and move laterally.
Query: describe CVE-2015-6545
Matching passage: CVE-2015-6545. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in ajax.php in Cerb before 7.0.4 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via a saveWorkerPeek action.
Near-miss passage: CVE-2015-6660. CWE: CWE-352. CVSS: 6.800000190734863. The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks."
Query: detection engineering for Windows Remote Management
Matching passage: T1021.006 Windows Remote Management. Tactics: lateral movement. Description: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services).(Citation: Microsoft WinRM) It may be called with the `winrm` command or by any number of programs such as PowerShell.(Citation: Jacobsen 2014) WinRM can be used as a method of remotely interacting with [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).(Citation: MSDN WMI)
Near-miss passage: T1021 Remote Services. Tactics: lateral movement. Description: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user. In an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP).(Citation: SSH Secure Shell)(Citation: TechNet Remote Desktop Services) They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain, or management platforms for internal virtualization environments such as VMware vCenter. Legitimate applications (such as [Software Deployment Tools](https://attack.mitre.org/techniques/T1072) and other administrative programs) may utilize [Remote Services](https://attack.mitre.org/techniques/T1021) to access remote hosts. For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management. ARD leverages a blend of protocols, including [VNC](https://attack.mitre.org/techniques/T1021/005) to send the screen and control buffers and [SSH](https://attack.mitre.org/techniques/T1021/004) for secure file transfer.(Citation: Remote Management MDM macOS)(Citation: Kickstart Apple Remote Desktop commands)(Citation: Apple Remote Desktop Admin Guide 3.3) Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement. In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.(Citation: FireEye 2019 Apple Remote Desktop)(
Query: risk of Cisco Mobility Services Engine (MSE) 8.0(110.0) allows remote authenticated users to discover the passwords of arbitrary users by (1) reading log files or (2) using an unspecified 
Matching passage: CVE-2015-0673. CWE: CWE-200. CVSS: 4.0. Cisco Mobility Services Engine (MSE) 8.0(110.0) allows remote authenticated users to discover the passwords of arbitrary users by (1) reading log files or (2) using an unspecified GUI feature, aka Bug ID CSCut24792.
Near-miss passage: CVE-2015-5383. CWE: CWE-200. CVSS: 7.5. Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.
Query: risk of Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.
Matching passage: CVE-2015-4895. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.
Near-miss passage: CVE-2015-8818. CWE: UNKNOWN. CVSS: 5.5. The cpu_physical_memory_write_rom_internal function in exec.c in QEMU (aka Quick Emulator) does not properly skip MMIO regions, which allows local privileged guest users to cause a denial of service (guest crash) via unspecified vectors.
Query: patch priority for CVE-2015-2029
Matching passage: CVE-2015-2029. CWE: UNKNOWN. CVSS: 4.300000190734863. Session fixation vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote attackers to hijack web sessions via a session identifier.
Near-miss passage: CVE-2015-4792. CWE: UNKNOWN. CVSS: 1.7000000476837158. Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4802.