alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: explain T1070.007 Clear Network Connection History and Configurations
Matching passage: T1070.007 Clear Network Connection History and Configurations. Tactics: stealth. Description: Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations. Configuration settings as well as various artifacts that highlight connection history may be created on a system and/or in application logs from behaviors that require network connections, such as [Remote Services](https://attack.mitre.org/techniques/T1021) or [External Remote Services](https://attack.mitre.org/techniques/T1133). Defenders may use these artifacts to monitor or otherwise analyze network connections created by adversaries. Network connection history may be stored in various locations. For example, RDP connection history may be stored in Windows Registry values under (Citation: Microsoft RDP Removal): * <code>HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default</code> * <code>HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers</code> Windows may also store information about recent RDP connections in files such as <code>C:\Users\\%username%\Documents\Default.rdp</code> and `C:\Users\%username%\AppData\Local\Microsoft\Terminal Server Client\Cache\`.(Citation: Moran RDPieces) Similarly, macOS and Linux hosts may store information highlighting connection history in system logs (such as those stored in `/Library/Logs` and/or `/var/log/`).(Citation: Apple Culprit Access)(Citation: FreeDesktop Journal)(Citation: Apple Unified Log Analysis Remote Login and Screen Sharing) Malicious network connections may also require changes to third-party applications or network configuration settings, such as [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1686) or tampering to enable [Proxy](https://attack.mitre.org/techniques/T1090). Adversaries may delete or modify this data to conceal indicators and/or impede defensive analysis.
Near-miss passage: T1070 Indicator Removal. Tactics: stealth. Description: Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior. Artifacts such as command histories, log entries, or file metadata may be altered in ways that align with expected user or system activity. Location, format, and type of artifact (such as command or login history) are often platform-specific, allowing adversaries to tailor modifications that minimize suspicion. These actions may not prevent detection entirely but can delay recognition of malicious activity or reduce the fidelity of alerts by making events appear benign or consistent with routine operations. Additionally, selectively removed or modified artifacts may still be recoverable through deeper forensic analysis, though their absence or alteration can complicate timeline reconstruction and attribution.
Query: describe CVE-2015-2139
Matching passage: CVE-2015-2139. CWE: CWE-200. CVSS: 4.0. HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote authenticated users to obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2015-5403.
Near-miss passage: CVE-2015-4980. CWE: CWE-200. CVSS: 4.0. Unspecified vulnerability in IBM WebSphere Commerce 7.0.0.6 through 7.0.0.9 allows remote authenticated users to obtain sensitive personal information via unknown vectors.
Query: Suspicious Transfer Data to Cloud Account execution detected on endpoint
Matching passage: T1537 Transfer Data to Cloud Account. Tactics: exfiltration. Description: Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service. A defender who is monitoring for large transfers to outside the cloud environment through normal file transfers or over command and control channels may not be watching for data transfers to another account within the same cloud provider. Such transfers may utilize existing cloud provider APIs and the internal address space of the cloud provider to blend into normal traffic or avoid data transfers over external network interfaces.(Citation: TLDRSec AWS Attacks) Adversaries may also use cloud-native mechanisms to share victim data with adversary-controlled cloud accounts, such as creating anonymous file sharing links or, in Azure, a shared access signature (SAS) URI.(Citation: Microsoft Azure Storage Shared Access Signature) Incidents have been observed where adversaries have created backups of cloud instances and transferred them to separate accounts.(Citation: DOJ GRU Indictment Jul 2018)
Near-miss passage: T1048 Exfiltration Over Alternative Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and/or obfuscate these alternate channels. [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048) can be done using various common operating system utilities such as [Net](https://attack.mitre.org/software/S0039)/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016) On macOS and Linux <code>curl</code> may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.(Citation: 20 macOS Common Tools and Techniques) Many IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or [Cloud API](https://attack.mitre.org/techniques/T1059/009).
Query: risk of Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Cont
Matching passage: CVE-2015-6420. CWE: CWE-502. CVSS: 9.800000190734863. Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
Near-miss passage: CVE-2015-5164. CWE: CWE-502. CVSS: 7.199999809265137. The Qpid server on Red Hat Satellite 6 does not properly restrict message types, which allows remote authenticated users with administrative access on a managed content host to execute arbitrary code via a crafted message, related to a pickle processing problem in pulp.
Query: patch priority for CVE-2015-1878
Matching passage: CVE-2015-1878. CWE: CWE-264. CVSS: 6.800000190734863. Thales nShield Connect hardware models 500, 1500, 6000, 500+, 1500+, and 6000+ before 11.72 allows physically proximate attackers to sign arbitrary data with previously loaded signing keys, extract the device identification key [KNETI] and impersonate the nShield Connect device on a network, affect the integrity and confidentiality of newly created keys, and potentially cause other unspecified impacts using previously loaded keys by connecting to the USB port on the front panel.
Near-miss passage: CVE-2015-4303. CWE: CWE-264. CVSS: 6.5. Cisco TelePresence Video Communication Server (VCS) X8.5.2 allows remote authenticated users to execute arbitrary commands in the context of the nobody user account via an unspecified web-page parameter, aka Bug ID CSCuv12333.
Query: containment actions for SIEM correlation: impact activity consistent with Data Manipulation
Matching passage: Playbook for T1565 Data Manipulation. 1) Validate alert telemetry against T1565. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: impact. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: Sygnia Elephant Beetle Jan 2022) By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making. The type of modification and the impact it will have depends on the target app
Near-miss passage: Playbook for T1565.001 Stored Data Manipulation. Different response path focused on impact.
Query: explain CWE-608
Matching passage: CWE-608 Struts: Non-private Field in ActionForm Class. An ActionForm class contains a field that has not been declared private, which can be accessed without using a setter or getter.
Near-miss passage: CWE-494 Download of Code Without Integrity Check. The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
Query: patch priority for CVE-2015-8781
Matching passage: CVE-2015-8781. CWE: CWE-787. CVSS: 6.5. tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds write) via an invalid number of samples per pixel in a LogL compressed TIFF image, a different vulnerability than CVE-2015-8782.
Near-miss passage: CVE-2015-6696. CWE: CWE-787. CVSS: 6.800000190734863. Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-6698.
Query: Sigma rule for Detects NetSupport Manager service installation on the target system.
Matching passage: Sigma rule: Detects NetSupport Manager service installation on the target system.. Logsource: windows / system. Rule: title: NetSupport Manager Service Install id: 2d510d8d-912b-45c5-b1df-36faa3d8c3f4 status: test description: Detects NetSupport Manager service installation on the target system. references: - http://resources.netsupportsoftware.com/resources/manualpdfs/nsm_manual_uk.pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-31 tags: - attack.persistence logsource: product: windows service: system detection: selection_root: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ImagePath|contains: \NetSupport Manager\client32.exe - ServiceName: Client32 condition: all of selection_* falsepositives: - Legitimate use of the tool level: medium
Near-miss passage: Sigma rule: Detects blocked attempts to change any of Defender's settings such as "Real Time Monitoring" and "Behavior Monitoring". Logsource: windows / windefend. Rule: title: Microsoft Defender Tamper Protection Trigger id: 49e5bc24-8b86-49f1-b743-535f332c2856 status: stable description: Detects blocked attempts to change any of Defender's settings such as "Real Time Monitoring" and "Behavior Monitoring" references: - https://bhabeshraj.com/post/tampering-with-microsoft-defenders-tamper-protection - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide author: Bhabesh Raj, Nasreddine Bencherchali date: 2021-07-05 modified: 2022-12-06 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: 5013 Value|endswith: - \Windows Defender\DisableAntiSpyware - \Windows Defender\DisableAntiVirus - \Windows Defender\Scan\DisableArchiveScanning - \Windows Defender\Scan\DisableScanningNetworkFiles - \Real-Time Protection\DisableRealtimeMonitoring - \Real-Time Protection\DisableBehaviorMonitoring - \Real-Time Protection\DisableIOAVProtection - \Real-Time Protection\DisableScriptScanning condition: selection falsepositives: - Administrator might try to disable defender features during testing (must be investigated) level: high
Query: describe CVE-2015-7892
Matching passage: CVE-2015-7892. CWE: CWE-787. CVSS: 7.800000190734863. Stack-based buffer overflow in the m2m1shot_compat_ioctl32 function in the Samsung m2m1shot driver framework, as used in Samsung S6 Edge, allows local users to have unspecified impact via a large data.buf_out.num_planes value in an ioctl call.
Near-miss passage: CVE-2015-3113. CWE: CWE-787. CVSS: 9.800000190734863. Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.
Query: vulnerability: login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions b
Matching passage: CVE-2015-3179. CWE: CWE-264. CVSS: 3.5. login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions by leveraging access to an unconfirmed suspended account.
Near-miss passage: CVE-2015-0057. CWE: CWE-264. CVSS: 7.199999809265137. win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Query: risk of Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allows remote attackers to cause a denial of service (recursion and performance degradation) via crafted encr
Matching passage: CVE-2015-1672. CWE: CWE-310. CVSS: 5.0. Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allows remote attackers to cause a denial of service (recursion and performance degradation) via crafted encrypted data in an XML document, aka ".NET XML Decryption Denial of Service Vulnerability."
Near-miss passage: CVE-2015-1934. CWE: CWE-310. CVSS: 5.0. IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX002, and 7.6.0 before 7.6.0.1 IFIX001; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX002 and 7.6.0 before 7.6.0.1 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products do not properly encrypt passwords, which makes it easier for context-dependent attackers to determine cleartext passwords by leveraging access to a password file.
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects the creation of a new Outlook form which can contain malicious code. Logsource: windows / file_event. Rule: title: Potential Persistence Via Outlook Form id: c3edc6a5-d9d4-48d8-930e-aab518390917 status: test description: Detects the creation of a new Outlook form which can contain malicious code references: - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=76 - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=79 - https://learn.microsoft.com/en-us/office/vba/outlook/concepts/outlook-forms/create-an-outlook-form - https://www.slipstick.com/developer/custom-form/clean-outlooks-forms-cache/ author: Tobias Michalski (Nextron Systems) date: 2021-06-10 modified: 2023-02-22 tags: - attack.persistence - attack.t1137.003 logsource: product: windows category: file_event detection: selection: Image|endswith: \outlook.exe TargetFilename|contains: - \AppData\Local\Microsoft\FORMS\IPM - \Local Settings\Application Data\Microsoft\Forms condition: selection falsepositives: - Legitimate use of outlook forms level: high
Near-miss passage: Sigma rule: Detects suspicious execution of 'Msbuild.exe' by a uncommon parent process. Logsource: windows / process_creation. Rule: title: Suspicious Msbuild Execution By Uncommon Parent Process id: 33be4333-2c6b-44f4-ae28-102cdbde0a31 status: test description: Detects suspicious execution of 'Msbuild.exe' by a uncommon parent process references: - https://app.any.run/tasks/abdf586e-df0c-4d39-89a7-06bf24913401/ - https://www.echotrail.io/insights/search/msbuild.exe author: frack113 date: 2022-11-17 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: - Image|endswith: \MSBuild.exe - OriginalFileName: MSBuild.exe filter_parent: ParentImage|endswith: - \devenv.exe - \cmd.exe - \msbuild.exe - \python.exe - \explorer.exe - \nuget.exe condition: selection and not filter_parent falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-2995
Matching passage: CVE-2015-2995. CWE: CWE-22. CVSS: 6.800000190734863. The RdsLogsEntry servlet in SysAid Help Desk before 15.2 does not properly check file extensions, which allows remote attackers to upload and execute arbitrary files via a NULL byte after the extension, as demonstrated by a .war%00 file.
Near-miss passage: CVE-2015-2970. CWE: CWE-22. CVSS: 6.400000095367432. index.php in LEMON-S PHP Simple Oekaki BBS before 1.21 allows remote attackers to delete arbitrary files via the oekakis parameter.
Query: exploit Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to inject arbitrary
Matching passage: CVE-2015-2544. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."
Near-miss passage: CVE-2015-7777. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in index.php in JosephErnest Void before 2015-10-02 allows remote attackers to inject arbitrary web script or HTML via a crafted URI.
Query: patch priority for CVE-2015-7988
Matching passage: CVE-2015-7988. CWE: UNKNOWN. CVSS: 9.800000190734863. The handle_regservice_request function in mDNSResponder before 625.41.2 allows remote attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via unspecified vectors.
Near-miss passage: CVE-2015-8066. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: alert when Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework
Matching passage: Sigma rule: Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework. Logsource: windows / process_creation. Rule: title: HackTool - Potential Impacket Lateral Movement Activity id: 10c14723-61c7-4c75-92ca-9af245723ad2 related: - id: e31f89f7-36fb-4697-8ab6-48823708353b type: obsolete status: stable description: Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework references: - https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/wmiexec.py - https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/atexec.py - https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/smbexec.py - https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/dcomexec.py - https://www.elastic.co/guide/en/security/current/suspicious-cmd-execution-via-wmi.html author: Ecco, oscd.community, Jonhnathan Ribeiro, Tim Rauch date: 2019-09-03 modified: 2023-02-21 tags: - attack.execution - attack.t1047 - attack.lateral-movement - attack.t1021.003 logsource: category: process_creation product: windows detection: selection_other: ParentImage|endswith: - \wmiprvse.exe - \mmc.exe - \explorer.exe - \services.exe CommandLine|contains|all: - cmd.exe - /Q - /c - \\\\127.0.0.1\\ - '&1' selection_atexec: ParentCommandLine|contains: - svchost.exe -k netsvcs - taskeng.exe CommandLine|contains|all: - cmd.exe - /C - Windows\Temp\ - '&1' condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detect possible persistence using Fax DLL load when service restart. Logsource: windows / registry_set. Rule: title: Change the Fax Dll id: 9e3357ba-09d4-4fbd-a7c5-ad6386314513 status: test description: Detect possible persistence using Fax DLL load when service restart references: - https://twitter.com/dottor_morte/status/1544652325570191361 - https://raw.githubusercontent.com/RiccardoAncarani/talks/master/F-Secure/unorthodox-lateral-movement.pdf author: frack113 date: 2022-07-17 modified: 2022-12-30 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection: TargetObject|contains|all: - \Software\Microsoft\Fax\Device Providers\ - \ImageName filter: Details: '%systemroot%\system32\fxst30.dll' condition: selection and not filter falsepositives: - Unknown level: high
Query: describe CVE-2015-7805
Matching passage: CVE-2015-7805. CWE: CWE-119. CVSS: 9.300000190734863. Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in an AIFF file.
Near-miss passage: CVE-2015-5790. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.