alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, 
Matching passage: CVE-2015-9161. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, and SD 810, TOCTOU condition could lead to a buffer overflow in function playready_reader_bind().
Near-miss passage: CVE-2015-5871. CWE: CWE-119. CVSS: 7.199999809265137. IOGraphics in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5872, CVE-2015-5873, and CVE-2015-5890.
Query: SOC alert related to Wi-Fi Discovery
Matching passage: T1016.002 Wi-Fi Discovery. Tactics: discovery. Description: Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. Adversaries may use Wi-Fi information as part of [Account Discovery](https://attack.mitre.org/techniques/T1087), [Remote System Discovery](https://attack.mitre.org/techniques/T1018), and other discovery or [Credential Access](https://attack.mitre.org/tactics/TA0006) activity to support both ongoing and future campaigns. Adversaries may collect various types of information about Wi-Fi networks from hosts. For example, on Windows names and passwords of all Wi-Fi networks a device has previously connected to may be available through `netsh wlan show profiles` to enumerate Wi-Fi names and then `netsh wlan show profile “Wi-Fi name” key=clear` to show a Wi-Fi network’s corresponding password.(Citation: BleepingComputer Agent Tesla steal wifi passwords)(Citation: Malware Bytes New AgentTesla variant steals WiFi credentials)(Citation: Check Point APT35 CharmPower January 2022) Additionally, names and other details of locally reachable Wi-Fi networks can be discovered using calls to `wlanAPI.dll` [Native API](https://attack.mitre.org/techniques/T1106) functions.(Citation: Binary Defense Emotes Wi-Fi Spreader) On Linux, names and passwords of all Wi-Fi-networks a device has previously connected to may be available in files under ` /etc/NetworkManager/system-connections/`.(Citation: Wi-Fi Password of All Connected Networks in Windows/Linux) On macOS, the password of a known Wi-Fi may be identified with ` security find-generic-password -wa wifiname` (requires admin username/password).(Citation: Find Wi-Fi Password on Mac)
Near-miss passage: T1016.001 Internet Connection Discovery. Tactics: discovery. Description: Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using [Ping](https://attack.mitre.org/software/S0097), <code>tracert</code>, and GET requests to websites, or performing initial speed testing to confirm bandwidth. Adversaries may use the results and responses from these requests to determine if the system is capable of communicating with their C2 servers before attempting to connect to them. The results may also be used to identify routes, redirectors, and proxy servers.
Query: detect Detects the modification of Outlook security setting to allow unprompted execution of macros. in logs
Matching passage: Sigma rule: Detects the modification of Outlook security setting to allow unprompted execution of macros.. Logsource: windows / registry_set. Rule: title: Outlook Macro Execution Without Warning Setting Enabled id: e3b50fa5-3c3f-444e-937b-0a99d33731cd status: test description: Detects the modification of Outlook security setting to allow unprompted execution of macros. references: - https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/ - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53 author: '@ScoubiMtl' date: 2021-04-05 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.command-and-control - attack.t1137 - attack.t1008 - attack.t1546 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Outlook\Security\Level Details|contains: '0x00000001' condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the creation of copy of suspicious files (EXE/DLL) to the default GPO storage folder. Logsource: windows / file_event. Rule: title: Suspicious Files in Default GPO Folder id: 5f87308a-0a5b-4623-ae15-d8fa1809bc60 status: test description: Detects the creation of copy of suspicious files (EXE/DLL) to the default GPO storage folder references: - https://redcanary.com/blog/intelligence-insights-november-2021/ author: elhoim date: 2022-04-28 tags: - attack.stealth - attack.t1036.005 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\ TargetFilename|endswith: - .dll - .exe condition: selection falsepositives: - Unknown level: medium
Query: alert when Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location.
Matching passage: Sigma rule: Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location.. Logsource: windows / image_load. Rule: title: Potential RjvPlatform.DLL Sideloading From Non-Default Location id: 0e0bc253-07ed-43f1-816d-e1b220fe8971 status: test description: Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location. references: - https://twitter.com/0gtweet/status/1666716511988330499 author: X__Junior (Nextron Systems) date: 2023-06-09 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \RjvPlatform.dll Image: \SystemResetPlatform.exe filter_main_legit_path: Image|startswith: C:\Windows\System32\SystemResetPlatform\ condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects instances where a GIT service on an OpenCanary node has had Git Clone request.. Logsource: opencanary / application. Rule: title: OpenCanary - GIT Clone Request id: 4fe17521-aef3-4e6a-9d6b-4a7c8de155a8 status: test description: Detects instances where a GIT service on an OpenCanary node has had Git Clone request. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.collection - attack.t1213 logsource: category: application product: opencanary detection: selection: logtype: 16001 condition: selection falsepositives: - Unlikely level: high
Query: exploit Use-after-free vulnerability in content/browser/appcache/appcache_update_job.cc in Google Chrome before 47.0.2526.73 allows remote attackers to execute arbitrary code or cause a de
Matching passage: CVE-2015-6765. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in content/browser/appcache/appcache_update_job.cc in Google Chrome before 47.0.2526.73 allows remote attackers to execute arbitrary code or cause a denial of service by leveraging the mishandling of AppCache update jobs.
Near-miss passage: CVE-2015-7803. CWE: UNKNOWN. CVSS: 6.800000190734863. The phar_get_entry_data function in ext/phar/util.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a .phar file with a crafted TAR archive entry in which the Link indicator references a file that does not exist.
Query: patch priority for CVE-2015-2430
Matching passage: CVE-2015-2430. CWE: CWE-264. CVSS: 9.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow attackers to bypass an application sandbox protection mechanism and perform unspecified filesystem actions via a crafted application, aka "Windows Filesystem Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-8025. CWE: CWE-264. CVSS: 2.0999999046325684. driver/subprocs.c in XScreenSaver before 5.34 does not properly perform an internal consistency check, which allows physically proximate attackers to bypass the lock screen by hot swapping monitors.
Query: Sigma YAML for m365 / threat_management
Matching passage: Sigma rule: Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address. Logsource: m365 / threat_management. Rule: title: Logon from a Risky IP Address id: c191e2fa-f9d6-4ccf-82af-4f2aba08359f status: test description: Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address. references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: Austin Songer @austinsonger date: 2021-08-23 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: Log on from a risky IP address status: success condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.. Logsource: azure / auditlogs. Rule: title: Certificate-Based Authentication Enabled id: c2496b41-16a9-4016-a776-b23f8910dc58 status: test description: Detects when certificate based authentication has been enabled in an Azure Active Directory tenant. references: - https://posts.specterops.io/passwordless-persistence-and-privilege-escalation-in-azure-98a01310be3f - https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/ author: Harjot Shah Singh, '@cyb3rjy0t' date: 2024-03-26 tags: - attack.credential-access - attack.persistence - attack.privilege-escalation - attack.defense-impairment - attack.t1556 logsource: product: azure service: auditlogs detection: selection: OperationName: Authentication Methods Policy Update TargetResources.modifiedProperties|contains: AuthenticationMethodsPolicy condition: selection falsepositives: - Unknown level: medium
Query: Sigma YAML for rpc_firewall / application
Matching passage: Sigma rule: Detects remote RPC calls to modify the registry and possible execute code. Logsource: rpc_firewall / application. Rule: title: Remote Registry Lateral Movement id: 35c55673-84ca-4e99-8d09-e334f3c29539 status: test description: Detects remote RPC calls to modify the registry and possible execute code references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/0fa3191d-bb79-490a-81bd-54c2601b7a78 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RRP.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.lateral-movement - attack.defense-impairment - attack.t1112 - attack.persistence logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:338cd001-2244-31f1-aaaa-900038001003"' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 338cd001-2244-31f1-aaaa-900038001003 OpNum: - 6 - 7 - 8 - 13 - 18 - 19 - 21 - 22 - 23 - 35 condition: selection falsepositives: - Remote administration of registry values level: high
Near-miss passage: Sigma rule: Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples. Logsource: windows / process_creation. Rule: title: HackTool - LocalPotato Execution id: 6bd75993-9888-4f91-9404-e1e4e4e34b77 status: test description: Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples references: - https://www.localpotato.com/localpotato_html/LocalPotato.html - https://github.com/decoder-it/LocalPotato author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-14 modified: 2024-11-23 tags: - attack.privilege-escalation - cve.2023-21746 - attack.stealth logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \LocalPotato.exe selection_cli: CommandLine|contains|all: - .exe -i C:\ - -o Windows\ selection_hash_plain: Hashes|contains: - IMPHASH=E1742EE971D6549E8D4D81115F88F1FC - IMPHASH=DD82066EFBA94D7556EF582F247C8BB5 condition: 1 of selection_* falsepositives: - Unlikely level: high
Query: exploit ImageIO in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vi
Matching passage: CVE-2015-5936. CWE: CWE-119. CVSS: 6.800000190734863. ImageIO in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted metadata in an image, a different vulnerability than CVE-2015-5935, CVE-2015-5937, and CVE-2015-5939.
Near-miss passage: CVE-2015-5579. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5567.
Query: Lateral movement indicators for Hide Artifacts
Matching passage: T1564 Hide Artifacts. Tactics: stealth. Description: Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.(Citation: Sofacy Komplex Trojan)(Citation: Cybereason OSX Pirrit)(Citation: MalwareBytes ADS July 2015) Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation, such as through the use of virtualization technology.(Citation: Sophos Ragnar May 2020)
Near-miss passage: T1564.002 Hidden Users. Tactics: stealth. Description: Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users. In macOS, adversaries can create or modify a user to be hidden through manipulating plist files, folder attributes, and user attributes. To prevent a user from being shown on the login screen and in System Preferences, adversaries can set the userID to be under 500 and set the key value <code>Hide500Users</code> to <code>TRUE</code> in the <code>/Library/Preferences/com.apple.loginwindow</code> plist file.(Citation: Cybereason OSX Pirrit) Every user has a userID associated with it. When the <code>Hide500Users</code> key value is set to <code>TRUE</code>, users with a userID under 500 do not appear on the login screen and in System Preferences. Using the command line, adversaries can use the <code>dscl</code> utility to create hidden user accounts by setting the <code>IsHidden</code> attribute to <code>1</code>. Adversaries can also hide a user’s home folder by changing the <code>chflags</code> to hidden.(Citation: Apple Support Hide a User Account) Adversaries may similarly hide user accounts in Windows. Adversaries can set the <code>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList</code> Registry key value to <code>0</code> for a specific user to prevent that user from being listed on the logon screen.(Citation: FireEye SMOKEDHAM June 2021)(Citation: US-CERT TA18-074A) On Linux systems, adversaries may hide user accounts from the login screen, also referred to as the greeter. The method an adversary may use depends on which Display Manager the distribution is currently using. For example, on an Ubuntu system using the GNOME Display Manger (GDM), accounts may be hidden from the greeter using the <code>gsettings</code> command (ex: <code>sudo -u gdm gsettings se
Query: exploit Cross-site scripting (XSS) vulnerability in Fortinet FortiAuthenticator 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the operation parameter to cert/sce
Matching passage: CVE-2015-1459. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Fortinet FortiAuthenticator 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the operation parameter to cert/scep/.
Near-miss passage: CVE-2015-1179. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in data_point_details.shtm in Mango Automation 2.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dpid, (2) dpxid, or (3) pid parameter.
Query: patch priority for CVE-2015-0345
Matching passage: CVE-2015-0345. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 16 and 11 before Update 5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-4272. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the ccmivr page in Cisco Unified Communications Manager (formerly CallManager) 10.5(2.10000.5) allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug ID CSCut19580.
Query: risk of Multiple stack-based buffer overflows in WebGate eDVR Manager and Control Center allow remote attackers to execute arbitrary code via unspecified vectors to the (1) TCPDiscover or 
Matching passage: CVE-2015-2100. CWE: CWE-787. CVSS: 8.800000190734863. Multiple stack-based buffer overflows in WebGate eDVR Manager and Control Center allow remote attackers to execute arbitrary code via unspecified vectors to the (1) TCPDiscover or (2) TCPDiscover2 function in the WESPDiscovery.WESPDiscoveryCtrl.1 control.
Near-miss passage: CVE-2015-7892. CWE: CWE-787. CVSS: 7.800000190734863. Stack-based buffer overflow in the m2m1shot_compat_ioctl32 function in the Samsung m2m1shot driver framework, as used in Samsung S6 Edge, allows local users to have unspecified impact via a large data.buf_out.num_planes value in an ioctl call.
Query: vulnerability: LINE for Android version 5.0.2 and earlier and LINE for iOS version 5.0.0 and earlier are vulnerable to MITM (man-in-the-middle) attack since the application allows non-SSL/TLS com
Matching passage: CVE-2015-0897. CWE: CWE-924. CVSS: 5.900000095367432. LINE for Android version 5.0.2 and earlier and LINE for iOS version 5.0.0 and earlier are vulnerable to MITM (man-in-the-middle) attack since the application allows non-SSL/TLS communications. As a result, any API may be invoked from a script injected by a MITM (man-in-the-middle) attacker.
Near-miss passage: CVE-2015-2968. CWE: CWE-924. CVSS: 5.900000095367432. LINE@ for Android version 1.0.0 and LINE@ for iOS version 1.0.0 are vulnerable to MITM (man-in-the-middle) attack since the application allows non-SSL/TLS communications. As a result, any API may be invoked from a script injected by a MITM (man-in-the-middle) attacker.
Query: CWE for Explicit Call to Finalize()
Matching passage: CWE-586 Explicit Call to Finalize(). The product makes an explicit call to the finalize() method from outside the finalizer.
Near-miss passage: CWE-528 Exposure of Core Dump File to an Unauthorized Control Sphere. The product generates a core dump file in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.
Query: telemetry for T1573.001
Matching passage: T1573.001 Symmetric Cryptography. Tactics: command and control. Description: Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.
Near-miss passage: T1573 Encrypted Channel. Tactics: command and control. Description: Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Query: EDR alert: possible AutoHotKey & AutoIT (T1059.010)
Matching passage: T1059.010 AutoHotKey & AutoIT. Tactics: execution. Description: Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages that enable users to automate Windows tasks. These automation scripts can be used to perform a wide variety of actions, such as clicking on buttons, entering text, and opening and closing programs.(Citation: AutoIT)(Citation: AutoHotKey) Adversaries may use AHK (`.ahk`) and AutoIT (`.au3`) scripts to execute malicious code on a victim's system. For example, adversaries have used for AHK to execute payloads and other modular malware such as keyloggers. Adversaries have also used custom AHK files containing embedded malware as [Phishing](https://attack.mitre.org/techniques/T1566) payloads.(Citation: Splunk DarkGate) These scripts may also be compiled into self-contained executable payloads (`.exe`).(Citation: AutoIT)(Citation: AutoHotKey)
Near-miss passage: T1059.004 Unix Shell. Tactics: execution. Description: Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) Unix shells can control every aspect of a system, with certain commands requiring elevated privileges. Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems. Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with [SSH](https://attack.mitre.org/techniques/T1021/004). Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence. Some systems, such as embedded devices, lightweight Linux distributions, and ESXi servers, may leverage stripped-down Unix shells via Busybox, a small executable that contains a variety of tools, including a simple shell.