alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Persistence mechanism resembling Native API
Matching passage: T1106 Native API. Tactics: execution. Description: Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.(Citation: NT API Windows)(Citation: Linux Kernel API) These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations. Adversaries may abuse these OS API functions as a means of executing behaviors. Similar to [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system. Native API functions (such as <code>NtCreateProcess</code>) may be directed invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries.(Citation: OutFlank System Calls)(Citation: CyberBit System Calls)(Citation: MDSec System Calls) For example, functions such as the Windows API <code>CreateProcess()</code> or GNU <code>fork()</code> will allow programs and scripts to start other processes.(Citation: Microsoft CreateProcess)(Citation: GNU Fork) This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.(Citation: Microsoft Win32)(Citation: LIBC)(Citation: GLIBC) Higher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.(Citation: Microsoft NET)(Citation: Apple Core Services)(Citation: MACOS Cocoa)(Citation: macOS Foundation) Adversaries may use assembly to directly or in-directly invoke syscalls
Near-miss passage: T1204.001 Malicious Link. Tactics: execution. Description: An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002). Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203). Links may also lead users to download files that require execution via [Malicious File](https://attack.mitre.org/techniques/T1204/002).
Query: patch priority for CVE-2015-8107
Matching passage: CVE-2015-8107. CWE: CWE-134. CVSS: 7.800000190734863. Format string vulnerability in GNU a2ps 4.14 allows remote attackers to execute arbitrary code.
Near-miss passage: CVE-2015-2894. CWE: CWE-134. CVSS: 5.300000190734863. Format string vulnerability in the up.time client in Idera Uptime Infrastructure Monitor 6.0 and 7.2 allows remote attackers to cause a denial of service (application crash) via format string specifiers.
Query: vulnerability: IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to read certain administrative files 
Matching passage: CVE-2015-1883. CWE: CWE-200. CVSS: 4.0. IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to read certain administrative files via crafted use of an automated-maintenance policy stored procedure.
Near-miss passage: CVE-2015-6161. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Browser ASLR Bypass."
Query: patch priority for CVE-2015-0144
Matching passage: CVE-2015-0144. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-8916.
Near-miss passage: CVE-2015-1494. CWE: CWE-79. CVSS: 4.300000190734863. The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an mfbfw[*] parameter in an update action to wp-admin/admin-post.php, as demonstrated by the mfbfw[padding] parameter and exploited in the wild in February 2015.
Query: Outbound C2 pattern associated with Malicious Link
Matching passage: T1204.001 Malicious Link. Tactics: execution. Description: An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002). Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203). Links may also lead users to download files that require execution via [Malicious File](https://attack.mitre.org/techniques/T1204/002).
Near-miss passage: T1204 User Execution. Tactics: execution. Description: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of [Phishing](https://attack.mitre.org/techniques/T1566). While [User Execution](https://attack.mitre.org/techniques/T1204) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534). Adversaries may also deceive users into performing actions such as: * Enabling [Remote Access Tools](https://attack.mitre.org/techniques/T1219), allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539)s(Citation: Talos Roblox Scam 2023)(Citation: Krebs Discord Bookmarks 2023) * Downloading and executing malware for [User Execution](https://attack.mitre.org/techniques/T1204) * Coerceing users to copy, paste, and execute malicious code manually(Citation: Reliaquest-execution)(Citation: proofpoint-selfpwn) For example, tech support scams can be facilitated through [Phishing](https://attack.mitre.org/techniques/T1566), vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or [Remote Access Tools](https://attack.mitre.org/techniques/T1219).(Citation: Telephone Attack Delivery)
Query: CVE similar to CVE-2015-2682
Matching passage: CVE-2015-2682. CWE: CWE-17. CVSS: 5.0. Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 allows remote attackers to obtain credentials via a direct request to conf/securitydbData.xml.
Near-miss passage: CVE-2015-4941. CWE: CWE-17. CVSS: 5.300000190734863. IBM WebSphere MQ Light 1.x before 1.0.2 mishandles abbreviated TLS handshakes, which allows remote attackers to cause a denial of service (MQXR service crash) via unspecified vectors.
Query: exploit NetworkExtension in Apple iOS before 8.3 stores credentials in VPN configuration logs, which makes it easier for physically proximate attackers to obtain sensitive information by r
Matching passage: CVE-2015-1109. CWE: CWE-200. CVSS: 2.0999999046325684. NetworkExtension in Apple iOS before 8.3 stores credentials in VPN configuration logs, which makes it easier for physically proximate attackers to obtain sensitive information by reading a log file.
Near-miss passage: CVE-2015-7761. CWE: CWE-200. CVSS: 5.0. Mail in Apple OS X before 10.11 does not properly recognize user preferences, which allows attackers to obtain sensitive information via an unspecified action during the printing of an e-mail message, a different vulnerability than CVE-2015-7760.
Query: write Sigma for Detects blocking of process creations originating from PSExec and WMI commands
Matching passage: Sigma rule: Detects blocking of process creations originating from PSExec and WMI commands. Logsource: windows / windefend. Rule: title: PSExec and WMI Process Creations Block id: 97b9ce1e-c5ab-11ea-87d0-0242ac130003 status: test description: Detects blocking of process creations originating from PSExec and WMI commands references: - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#block-process-creations-originating-from-psexec-and-wmi-commands - https://twitter.com/duff22b/status/1280166329660497920 author: Bhabesh Raj date: 2020-07-14 modified: 2022-12-25 tags: - attack.execution - attack.lateral-movement - attack.t1047 - attack.t1569.002 logsource: product: windows service: windefend definition: 'Requirements:Enabled Block process creations originating from PSExec and WMI commands from Attack Surface Reduction (GUID: d1e49aac-8f56-4280-b9ba-993a6d77406c)' detection: selection: EventID: 1121 ProcessName|endswith: - \wmiprvse.exe - \psexesvc.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Adversaries may look for details about the network configuration and settings of systems they access or through informat. Logsource: windows / process_creation. Rule: title: Firewall Configuration Discovery Via Netsh.EXE id: 0e4164da-94bc-450d-a7be-a4b176179f1f status: test description: Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md#atomic-test-2---list-windows-firewall-rules - https://ss64.com/nt/netsh.html author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' date: 2021-12-07 modified: 2025-10-18 tags: - attack.discovery - attack.t1016 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: CommandLine|contains|all: - netsh - 'show ' - 'firewall ' CommandLine|contains: - 'config ' - 'state ' - 'rule ' - name=all condition: all of selection_* falsepositives: - Administrative activity level: low
Query: weakness Relative Path Traversal
Matching passage: CWE-23 Relative Path Traversal. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as .. that can resolve to a location that is outside of that directory.
Near-miss passage: CWE-546 Suspicious Comment. The code contains comments that suggest the presence of bugs, incomplete functionality, or weaknesses.
Query: Suspicious Silver Ticket execution detected on endpoint
Matching passage: T1558.002 Silver Ticket. Tactics: credential access. Description: Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets.(Citation: ADSecurity Silver Tickets) Silver tickets are more limited in scope in than golden tickets in that they only enable adversaries to access a particular resource (e.g. MSSQL) and the system that hosts the resource; however, unlike golden tickets, adversaries with the ability to forge silver tickets are able to create TGS tickets without interacting with the Key Distribution Center (KDC), potentially making detection more difficult.(Citation: ADSecurity Detecting Forged Tickets) Password hashes for target services may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).
Near-miss passage: T1558.004 AS-REP Roasting. Tactics: credential access. Description: Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by [Password Cracking](https://attack.mitre.org/techniques/T1110/002) Kerberos messages.(Citation: Harmj0y Roasting AS-REPs Jan 2017) Preauthentication offers protection against offline [Password Cracking](https://attack.mitre.org/techniques/T1110/002). When enabled, a user requesting access to a resource initiates communication with the Domain Controller (DC) by sending an Authentication Server Request (AS-REQ) message with a timestamp that is encrypted with the hash of their password. If and only if the DC is able to successfully decrypt the timestamp with the hash of the user’s password, it will then send an Authentication Server Response (AS-REP) message that contains the Ticket Granting Ticket (TGT) to the user. Part of the AS-REP message is signed with the user’s password.(Citation: Microsoft Kerberos Preauth 2014) For each account found without preauthentication, an adversary may send an AS-REQ message without the encrypted timestamp and receive an AS-REP message with TGT data which may be encrypted with an insecure algorithm such as RC4. The recovered encrypted data may be vulnerable to offline [Password Cracking](https://attack.mitre.org/techniques/T1110/002) attacks similarly to [Kerberoasting](https://attack.mitre.org/techniques/T1558/003) and expose plaintext credentials. (Citation: Harmj0y Roasting AS-REPs Jan 2017)(Citation: Stealthbits Cracking AS-REP Roasting Jun 2019) An account registered to a domain, with or without special privileges, can be abused to list all domain accounts that have preauthentication disabled by utilizing Windows tools like [PowerShell](https://attack.mitre.org/techniques/T1059/001) with an LDAP filter. Alternatively, the adversary may send an AS-REQ message for each user. If the DC responds without errors, the account does not require preauthentication and the AS-REP message will already contain the encrypted data. (Citation: Harmj0y
Query: vulnerability: The kernel in Apple OS X before 10.10.5 does not properly mount HFS volumes, which allows local users to cause a denial of service via a crafted volume.
Matching passage: CVE-2015-5748. CWE: CWE-17. CVSS: 2.0999999046325684. The kernel in Apple OS X before 10.10.5 does not properly mount HFS volumes, which allows local users to cause a denial of service via a crafted volume.
Near-miss passage: CVE-2015-4620. CWE: CWE-17. CVSS: 7.800000190734863. name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DNSSEC validation, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) by constructing crafted zone data and then making a query for a name in that zone.
Query: Sigma rule for Detects the execution of AdvancedRun utility
Matching passage: Sigma rule: Detects the execution of AdvancedRun utility. Logsource: windows / process_creation. Rule: title: PUA - AdvancedRun Execution id: d2b749ee-4225-417e-b20e-a8d2193cbb84 related: - id: fa00b701-44c6-4679-994d-5a18afa8a707 type: similar status: test description: Detects the execution of AdvancedRun utility references: - https://twitter.com/splinter_code/status/1483815103279603714 - https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3 - https://www.elastic.co/security-labs/operation-bleeding-bear - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/ author: Florian Roth (Nextron Systems) date: 2022-01-20 modified: 2023-02-21 tags: - attack.execution - attack.privilege-escalation - attack.stealth - attack.t1564.003 - attack.t1134.002 - attack.t1059.003 logsource: product: windows category: process_creation detection: selection: - OriginalFileName: AdvancedRun.exe - CommandLine|contains|all: - ' /EXEFilename ' - ' /Run' - CommandLine|contains|all: - ' /WindowState 0' - ' /RunAs ' - ' /CommandLine ' condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advancedrun/info.yml
Near-miss passage: Sigma rule: Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authenticatio. Logsource: kubernetes / audit. Rule: title: Kubernetes Unauthorized or Unauthenticated Access id: 0d933542-1f1f-420d-97d4-21b2c3c492d9 status: test description: 'Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used. This may indicate an attacker attempting to leverage credentials they have obtained. ' references: - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/ - https://www.datadoghq.com/blog/monitor-kubernetes-audit-logs/#monitor-api-authentication-issues author: kelnage date: 2024-04-12 tags: - attack.privilege-escalation logsource: product: kubernetes service: audit detection: selection: responseStatus.code: - 401 - 403 condition: selection falsepositives: - A misconfigured RBAC policy, a mistake by a valid user, or a wider issue with authentication tokens can also generate these errors. level: low
Query: risk of QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of servi
Matching passage: CVE-2015-3661. CWE: CWE-119. CVSS: 6.800000190734863. QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3662, CVE-2015-3663, CVE-2015-3666, CVE-2015-3667, and CVE-2015-3668.
Near-miss passage: CVE-2015-9181. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, and SD 835, in a crypto API function, a buffer over-read can occur.
Query: CVE similar to CVE-2015-2847
Matching passage: CVE-2015-2847. CWE: CWE-284. CVSS: 5.0. Honeywell Tuxedo Touch before 5.2.19.0_VA relies on client-side authentication involving JavaScript, which allows remote attackers to bypass intended access restrictions by removing USERACCT requests from the client-server data stream.
Near-miss passage: CVE-2015-0119. CWE: CWE-284. CVSS: 7.5. FastBack Mount in IBM Tivoli Storage Manager FastBack 6.1.x before 6.1.11.1 allows remote attackers to execute arbitrary code by connecting to the Mount port.
Query: Sigma rule for Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'
Matching passage: Sigma rule: Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'. Logsource: windows / registry_set. Rule: title: COM Hijack via Sdclt id: 07743f65-7ec9-404a-a519-913db7118a8d status: test description: Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute' references: - http://blog.sevagas.com/?Yet-another-sdclt-UAC-bypass - https://www.exploit-db.com/exploits/47696 author: Omkar Gudhate date: 2020-09-27 modified: 2023-09-28 tags: - attack.persistence - attack.privilege-escalation - attack.t1546 - attack.t1548 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Software\Classes\Folder\shell\open\command\DelegateExecute condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential LethalHTA technique where the "mshta.exe" is spawned by an "svchost.exe" process. Logsource: windows / process_creation. Rule: title: Potential LethalHTA Technique Execution id: ed5d72a6-f8f4-479d-ba79-02f6a80d7471 status: test description: Detects potential LethalHTA technique where the "mshta.exe" is spawned by an "svchost.exe" process references: - https://codewhitesec.blogspot.com/2018/07/lethalhta.html author: Markus Neis date: 2018-06-07 modified: 2023-02-07 tags: - attack.stealth - attack.t1218.005 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \svchost.exe Image|endswith: \mshta.exe condition: selection falsepositives: - Unknown level: high
Query: alert when Detects execution of WinRAR in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a proc
Matching passage: Sigma rule: Detects execution of WinRAR in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a proc. Logsource: windows / process_creation. Rule: title: Winrar Compressing Dump Files id: 1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc related: - id: ec570e53-4c76-45a9-804d-dc3f355ff7a7 type: similar status: test description: Detects execution of WinRAR in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration. references: - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/ author: Florian Roth (Nextron Systems) date: 2022-01-04 modified: 2023-09-12 tags: - attack.collection - attack.t1560.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \rar.exe - \winrar.exe - Description: Command line RAR selection_extension: CommandLine|contains: - .dmp - .dump - .hdmp condition: all of selection_* falsepositives: - Legitimate use of WinRAR with a command line in which ".dmp" or ".dump" appears accidentally - Legitimate use of WinRAR to compress WER ".dmp" files for troubleshooting level: medium
Near-miss passage: Sigma rule: Detects the disabling of the Windows Defender eventlog as seen in relation to Lockbit 3.0 infections. Logsource: windows / registry_set. Rule: title: Disabled Windows Defender Eventlog id: fcddca7c-b9c0-4ddf-98da-e1e2d18b0157 status: test description: Detects the disabling of the Windows Defender eventlog as seen in relation to Lockbit 3.0 infections references: - https://twitter.com/WhichbufferArda/status/1543900539280293889/photo/2 author: Florian Roth (Nextron Systems) date: 2022-07-04 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\Enabled Details: DWORD (0x00000000) condition: selection falsepositives: - Other Antivirus software installations could cause Windows to disable that eventlog (unknown) level: high