alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects LSASS process access requests from a source process with the "dump" keyword in its image name. in logs
Matching passage: Sigma rule: Detects LSASS process access requests from a source process with the "dump" keyword in its image name.. Logsource: windows / process_access. Rule: title: LSASS Memory Access by Tool With Dump Keyword In Name id: 9bd012ee-0dff-44d7-84a0-aa698cfd87a3 status: test description: Detects LSASS process access requests from a source process with the "dump" keyword in its image name. references: - https://twitter.com/_xpn_/status/1491557187168178176 - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz author: Florian Roth (Nextron Systems) date: 2022-02-10 modified: 2023-11-29 tags: - attack.credential-access - attack.t1003.001 - attack.s0002 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe SourceImage|contains: dump GrantedAccess|endswith: - '10' - '30' - '50' - '70' - '90' - B0 - D0 - F0 - '18' - '38' - '58' - '78' - '98' - B8 - D8 - F8 - 1A - 3A - 5A - 7A - 9A - BA - DA - FA - '0x14C2' - FF condition: selection falsepositives: - Rare programs that contain the word dump in their name and access lsass level: high
Near-miss passage: Sigma rule: Detects creation of WMI event subscription persistence method. Logsource: windows / wmi_event. Rule: title: WMI Event Subscription id: 0f06a3a5-6a09-413f-8743-e6cf35561297 status: test description: Detects creation of WMI event subscription persistence method references: - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-19-wmievent-wmieventfilter-activity-detected - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-20-wmievent-wmieventconsumer-activity-detected - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-21-wmievent-wmieventconsumertofilter-activity-detected author: Tom Ueltschi (@c_APT_ure) date: 2019-01-12 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.003 logsource: product: windows category: wmi_event detection: selection: EventID: - 19 - 20 - 21 condition: selection falsepositives: - Exclude legitimate (vetted) use of WMI event subscription in your network level: medium
Query: how to detect Web Shell
Matching passage: T1505.003 Web Shell. Tactics: persistence. Description: Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.(Citation: volexity_0day_sophos_FW) In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. [China Chopper](https://attack.mitre.org/software/S0020) Web shell client).(Citation: Lee 2013)
Near-miss passage: T1505.006 vSphere Installation Bundles. Tactics: persistence. Description: Adversaries may abuse vSphere Installation Bundles (VIBs) to establish persistent access to ESXi hypervisors. VIBs are collections of files used for software distribution and virtual system management in VMware environments. Since ESXi uses an in-memory filesystem where changes made to most files are stored in RAM rather than in persistent storage, these modifications are lost after a reboot. However, VIBs can be used to create startup tasks, apply custom firewall rules, or deploy binaries that persist across reboots. Typically, administrators use VIBs for updates and system maintenance. VIBs can be broken down into three components:(Citation: VMware VIBs) * VIB payload: a `.vgz` archive containing the directories and files to be created and executed on boot when the VIBs are loaded. * Signature file: verifies the host acceptance level of a VIB, indicating what testing and validation has been done by VMware or its partners before publication of a VIB. By default, ESXi hosts require a minimum acceptance level of PartnerSupported for VIB installation, meaning the VIB is published by a trusted VMware partner. However, privileged users can change the default acceptance level using the `esxcli` command line interface. Additionally, VIBs are able to be installed regardless of acceptance level by using the <code> esxcli software vib install --force</code> command. * XML descriptor file: a configuration file containing associated VIB metadata, such as the name of the VIB and its dependencies. Adversaries may leverage malicious VIB packages to maintain persistent access to ESXi hypervisors, allowing system changes to be executed upon each bootup of ESXi – such as using `esxcli` to enable firewall rules for backdoor traffic, creating listeners on hard coded ports, and executing backdoors.(Citation: Google Cloud Threat Intelligence ESXi VIBs 2022) Adversaries may also masquerade their malicious VIB files as PartnerSupported by modifying the XML descriptor file.(Citation: Googl
Query: exploit The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP AAM 11.4.0 before 11.5.3 HF2 and
Matching passage: CVE-2015-3628. CWE: CWE-264. CVSS: 9.0. The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP AAM 11.4.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.3.0, BIG-IP GTM 11.3.0 before 11.6.0 HF6, BIG-IP PSM 11.3.0 through 11.4.1, Enterprise Manager 3.1.0 through 3.1.1, BIG-IQ Cloud and Security 4.0.0 through 4.5.0, BIG-IQ Device 4.2.0 through 4.5.0, and BIG-IQ ADC 4.5.0 allows remote authenticated users with the "Resource Administrator" role to gain privileges via an iCall (1) script or (2) handler in a SOAP request to iControl/iControlPortal.cgi.
Near-miss passage: CVE-2015-3283. CWE: CWE-264. CVSS: 6.800000190734863. OpenAFS before 1.6.13 allows remote attackers to spoof bos commands via unspecified vectors.
Query: ATT&CK technique for Exfiltration to Code Repository
Matching passage: T1567.001 Exfiltration to Code Repository. Tactics: exfiltration. Description: Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection. Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network.
Near-miss passage: T1567.002 Exfiltration to Cloud Storage. Tactics: exfiltration. Description: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet. Examples of cloud storage services include Dropbox and Google Docs. Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service.
Query: risk of Cross-site scripting (XSS) vulnerability in Brother MFC-J4410DW printer with firmware before L allows remote attackers to inject arbitrary web script or HTML via the url parameter 
Matching passage: CVE-2015-1056. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Brother MFC-J4410DW printer with firmware before L allows remote attackers to inject arbitrary web script or HTML via the url parameter to general/status.html and possibly other pages.
Near-miss passage: CVE-2015-1888. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Content Navigator 2.0.2 before 2.0.2-ICN-FP007 and 2.0.3 before 2.0.3-ICN-FP003, as used in Content Manager, FileNet Content Manager, Content Foundation, Content Manager OnDemand, and other products, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: detection rule: Detects disabling Windows Defender PUA protection
Matching passage: Sigma rule: Detects disabling Windows Defender PUA protection. Logsource: windows / registry_set. Rule: title: Disable PUA Protection on Windows Defender id: 8ffc5407-52e3-478f-9596-0a7371eafe13 status: test description: Detects disabling Windows Defender PUA protection references: - https://www.tenforums.com/tutorials/32236-enable-disable-microsoft-defender-pua-protection-windows-10-a.html author: Austin Songer @austinsonger date: 2021-08-04 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Policies\Microsoft\Windows Defender\PUAProtection Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or unde. Logsource: windows / process_creation. Rule: title: Suspicious Double Extension File Execution id: 1cdd9a09-06c9-4769-99ff-626e2b3991b8 related: - id: 5e6a80c8-2d45-4633-9ef4-fa2671a39c5c type: similar status: stable description: Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns references: - https://blu3-team.blogspot.com/2019/06/misleading-extensions-xlsexe-docexe.html - https://twitter.com/blackorbird/status/1140519090961825792 - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems) date: 2019-06-26 modified: 2025-05-30 tags: - attack.initial-access - attack.t1566.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - ' .exe' - ______.exe - .doc.exe - .doc.js - .docx.exe - .docx.js - .gif.exe - .jpeg.exe - .jpg.exe - .mkv.exe - .mov.exe - .mp3.exe - .mp4.exe - .pdf.exe - .pdf.js - .png.exe - .ppt.exe - .ppt.js - .pptx.exe - .pptx.js - .rtf.exe - .rtf.js - .svg.exe - .txt.exe - .txt.js - .xls.exe - .xls.js - .xlsx.exe - .xlsx.js - ⠀⠀⠀⠀⠀⠀.exe CommandLine|contains: - ' .exe' - ______.exe - .doc.exe - .doc.js - .docx.exe - .docx.js - .gif.exe - .jpeg.exe - .jpg.exe - .mkv.exe - .mov.exe - .mp3.exe - .mp4.exe - .pdf.exe - .pdf.js - .png.exe - .ppt.exe - .ppt.js - .pptx.exe - .pptx.js - .rtf.exe - .rtf.js - .svg.exe - .txt.exe - .txt.js - .xls.exe - .xls.js - .xlsx.exe - .xlsx.js - ⠀⠀⠀⠀⠀⠀.exe condition: selection falsepositives: - Unknown level: high
Query: alert when Detects the use of PSAttack PowerShell hack tool
Matching passage: Sigma rule: Detects the use of PSAttack PowerShell hack tool. Logsource: windows / ps_script. Rule: title: PowerShell PSAttack id: b7ec41a4-042c-4f31-a5db-d0fcde9fa5c5 status: test description: Detects the use of PSAttack PowerShell hack tool references: - https://adsecurity.org/?p=2921 author: Sean Metcalf (source), Florian Roth (Nextron Systems) date: 2017-03-05 modified: 2022-12-25 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: PS ATTACK!!! condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active d. Logsource: windows / process_creation. Rule: title: Active Directory Database Snapshot Via ADExplorer id: 9212f354-7775-4e28-9c9f-8f0a4544e664 related: - id: ef61af62-bc74-4f58-b49b-626448227652 type: derived status: test description: Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field. references: - https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html - https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer - https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24 - https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/ - https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/ - https://trustedsec.com/blog/adexplorer-on-engagements author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-14 modified: 2025-07-09 tags: - attack.discovery - attack.t1087.002 - attack.t1069.002 - attack.t1482 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \ADExp.exe - \ADExplorer.exe - \ADExplorer64.exe - \ADExplorer64a.exe - OriginalFileName: AdExp - Description: Active Directory Editor - Product: Sysinternals ADExplorer selection_cli: CommandLine|contains: snapshot condition: all of selection_* falsepositives: - Unknown level: medium
Query: actor TTPs: Rogue Domain Controller
Matching passage: T1207 Rogue Domain Controller. Tactics: defense impairment. Description: Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data. DCShadow may be used to create a rogue Domain Controller (DC). DCShadow is a method of manipulating Active Directory (AD) data, including objects and schemas, by registering (or reusing an inactive registration) and simulating the behavior of a DC. (Citation: DCShadow Blog) Once registered, a rogue DC may be able to inject and replicate changes into AD infrastructure for any domain object, including credentials and keys. Registering a rogue DC involves creating a new server and nTDSDSA objects in the Configuration partition of the AD schema, which requires Administrator privileges (either Domain or local to the DC) or the KRBTGT hash. (Citation: Adsecurity Mimikatz Guide) This technique may bypass system logging and security monitors such as security information and event management (SIEM) products (since actions taken on a rogue DC may not be reported to these sensors). (Citation: DCShadow Blog) The technique may also be used to alter and delete replication and other associated metadata to obstruct forensic analysis. Adversaries may also utilize this technique to perform [SID-History Injection](https://attack.mitre.org/techniques/T1134/005) and/or manipulate AD objects (such as accounts, access control lists, schemas) to establish backdoors for Persistence. (Citation: DCShadow Blog)
Near-miss passage: T1556.006 Multi-Factor Authentication. Tactics: defense impairment, persistence, credential access. Description: Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts. Once adversaries have gained access to a network by either compromising an account lacking MFA or by employing an MFA bypass method such as [Multi-Factor Authentication Request Generation](https://attack.mitre.org/techniques/T1621), adversaries may leverage their access to modify or completely disable MFA defenses. This can be accomplished by abusing legitimate features, such as excluding users from Azure AD Conditional Access Policies, registering a new yet vulnerable/adversary-controlled MFA method, or by manually patching MFA programs and configuration files to bypass expected functionality.(Citation: Mandiant APT42)(Citation: Azure AD Conditional Access Exclusions) For example, modifying the Windows hosts file (`C:\windows\system32\drivers\etc\hosts`) to redirect MFA calls to localhost instead of an MFA server may cause the MFA process to fail. If a "fail open" policy is in place, any otherwise successful authentication attempt may be granted access without enforcing MFA. (Citation: Russians Exploit Default MFA Protocol - CISA March 2022) Depending on the scope, goals, and privileges of the adversary, MFA defenses may be disabled for individual accounts or for all accounts tied to a larger group, such as all domain accounts in a victim's network environment.(Citation: Russians Exploit Default MFA Protocol - CISA March 2022)
Query: risk of The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.
Matching passage: CVE-2015-9309. CWE: CWE-352. CVSS: 8.800000190734863. The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.
Near-miss passage: CVE-2015-0807. CWE: CWE-352. CVSS: 6.800000190734863. The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status codes for redirects after a preflight request has occurred, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site, a similar issue to CVE-2014-8638.
Query: weakness Deserialization of Untrusted Data
Matching passage: CWE-502 Deserialization of Untrusted Data. The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Near-miss passage: CWE-324 Use of a Key Past its Expiration Date. The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
Query: patch priority for CVE-2015-5344
Matching passage: CVE-2015-5344. CWE: CWE-19. CVSS: 9.800000190734863. The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
Near-miss passage: CVE-2015-8339. CWE: CWE-19. CVSS: 4.699999809265137. The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly hand back pages to a domain, which might allow guest OS administrators to cause a denial of service (host crash) via unspecified vectors related to domain teardown.
Query: vulnerability: The SAND STUDIO AirDroid application 1.1.0 and earlier for Android mishandles implicit intents, which allows attackers to obtain sensitive information via a crafted application.
Matching passage: CVE-2015-5661. CWE: CWE-200. CVSS: 4.300000190734863. The SAND STUDIO AirDroid application 1.1.0 and earlier for Android mishandles implicit intents, which allows attackers to obtain sensitive information via a crafted application.
Near-miss passage: CVE-2015-6632. CWE: CWE-200. CVSS: 5.0. libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24346430.
Query: vulnerability: The PCo agent in SAP Plant Connectivity (PCo) allows remote attackers to cause a denial of service (memory corruption and agent crash) via crafted xMII requests, aka SAP Security N
Matching passage: CVE-2015-8330. CWE: CWE-119. CVSS: 7.800000190734863. The PCo agent in SAP Plant Connectivity (PCo) allows remote attackers to cause a denial of service (memory corruption and agent crash) via crafted xMII requests, aka SAP Security Note 2238619.
Near-miss passage: CVE-2015-3697. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3698, CVE-2015-3699, CVE-2015-3700, CVE-2015-3701, and CVE-2015-3702.
Query: CWE for Improper Validation of Consistency within Input
Matching passage: CWE-1288 Improper Validation of Consistency within Input. The product receives a complex input with multiple elements or fields that must be consistent with each other, but it does not validate or incorrectly validates that the input is actually consistent.
Near-miss passage: CWE-1328 Security Version Number Mutable to Older Versions. Security-version number in hardware is mutable, resulting in the ability to downgrade (roll-back) the boot firmware to vulnerable code versions.
Query: CVE similar to CVE-2015-6679
Matching passage: CVE-2015-6679. CWE: CWE-200. CVSS: 5.0. Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to bypass the Same Origin Policy and obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-7000. CWE: CWE-200. CVSS: 2.0999999046325684. Notification Center in Apple iOS before 9.1 mishandles changes to "Show on Lock Screen" settings, which allows physically proximate attackers to obtain sensitive information by looking for a (1) Phone or (2) Messages notification on the lock screen soon after a setting was disabled.
Query: exploit The canonpath function in the File::Spec module in PathTools before 3.62, as used in Perl, does not properly preserve the taint attribute of data, which might allow context-depende
Matching passage: CVE-2015-8607. CWE: CWE-20. CVSS: 7.300000190734863. The canonpath function in the File::Spec module in PathTools before 3.62, as used in Perl, does not properly preserve the taint attribute of data, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.
Near-miss passage: CVE-2015-0543. CWE: CWE-20. CVSS: 5.800000190734863. EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.