alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Multiple failed authentications followed by Stripped Payloads
Matching passage: T1027.008 Stripped Payloads. Tactics: stealth. Description: Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information. Scripts and executables may contain variables names and other strings that help developers document code functionality. Symbols are often created by an operating system’s `linker` when executable payloads are compiled. Reverse engineers use these symbols and strings to analyze code and to identify functionality in payloads.(Citation: Mandiant golang stripped binaries explanation)(Citation: intezer stripped binaries elf files 2018) Adversaries may use stripped payloads in order to make malware analysis more difficult. For example, compilers and other tools may provide features to remove or obfuscate strings and symbols. Adversaries have also used stripped payload formats, such as run-only AppleScripts, a compiled and stripped version of [AppleScript](https://attack.mitre.org/techniques/T1059/002), to evade detection and analysis. The lack of human-readable information may directly hinder detection and analysis of payloads.(Citation: SentinelLabs reversing run-only applescripts 2021)
Near-miss passage: T1027.004 Compile After Delivery. Tactics: stealth. Description: Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe(Citation: ATTACK IQ), csc.exe, or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018) Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a [Phishing](https://attack.mitre.org/techniques/T1566). Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.(Citation: TrendMicro WindowsAppMac)
Query: vulnerability: Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::thaw function, which allows remote attack
Matching passage: CVE-2015-1592. CWE: CWE-74. CVSS: 7.5. Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::thaw function, which allows remote attackers to include and execute arbitrary local Perl files and possibly execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-0169. CWE: CWE-74. CVSS: 4.0. IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to inject arguments via unspecified vectors.
Query: mitigate Polymorphic Code
Matching passage: T1027.014 Polymorphic Code. Tactics: stealth. Description: Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection. Polymorphic code is a type of software capable of changing its runtime footprint during code execution.(Citation: polymorphic-blackberry) With each execution of the software, the code is mutated into a different version of itself that achieves the same purpose or objective as the original. This functionality enables the malware to evade traditional signature-based defenses, such as antivirus and antimalware tools.(Citation: polymorphic-sentinelone) Other obfuscation techniques can be used in conjunction with polymorphic code to accomplish the intended effects, including using mutation engines to conduct actions such as [Software Packing](https://attack.mitre.org/techniques/T1027/002), [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010), or [Encrypted/Encoded File](https://attack.mitre.org/techniques/T1027/013).(Citation: polymorphic-linkedin)(Citation: polymorphic-medium)
Near-miss passage: T1027.016 Junk Code Insertion. Tactics: stealth. Description: Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code that either does not execute, or if it does execute, does not change the functionality of the code. Junk code makes analysis more difficult and time-consuming, as the analyst steps through non-functional code instead of analyzing the main code. It also may hinder detections that rely on static code analysis due to the use of benign functionality, especially when combined with [Compression](https://attack.mitre.org/techniques/T1027/015) or [Software Packing](https://attack.mitre.org/techniques/T1027/002).(Citation: ReasonLabs)(Citation: ReasonLabs Cyberpedia Junk Code) No-Operation (NOP) instructions are an example of dead code commonly used in x86 assembly language. They are commonly used as the 0x90 opcode. When NOPs are added to malware, the disassembler may show the NOP instructions, leading to the analyst needing to step through them.(Citation: ReasonLabs) The use of junk / dead code insertion is distinct from [Binary Padding](https://attack.mitre.org/techniques/T1027/001) because the purpose is to obfuscate the functionality of the code, rather than simply to change the malware’s signature.
Query: how to detect Security Software Discovery
Matching passage: T1518.001 Security Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Example commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), <code>reg query</code> with [Reg](https://attack.mitre.org/software/S0075), <code>dir</code> with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software. Adversaries may also utilize the [Cloud API](https://attack.mitre.org/techniques/T1059/009) to discover cloud-native security software installed on compute infrastructure, such as the AWS CloudWatch agent, Azure VM Agent, and Google Cloud Monitor agent. These agents may collect metrics and logs from the VM, which may be centrally aggregated in a cloud-based monitoring platform.
Near-miss passage: T1518.002 Backup Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of backup software or configurations that are installed on a system. Adversaries may use this information to shape follow-on behaviors, such as [Data Destruction](https://attack.mitre.org/techniques/T1485), [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486). Commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), `reg query` with [Reg](https://attack.mitre.org/software/S0075), `dir` with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for, such as Veeam, Acronis, Dropbox, or Paragon.(Citation: Symantec Play Ransomware 2023)
Query: describe CVE-2015-8670
Matching passage: CVE-2015-8670. CWE: CWE-20. CVSS: 6.5. Huawei LogCenter V100R001C10 could allow an authenticated attacker to add abnormal device information to the log collection module, causing denial of service.
Near-miss passage: CVE-2015-2464. CWE: CWE-20. CVSS: 9.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, Silverlight before 5.1.40728, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allow remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability," a different vulnerability than CVE-2015-2463.
Query: patch priority for CVE-2015-0440
Matching passage: CVE-2015-0440. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle Knowledge component in Oracle Right Now Service Cloud 8.2.3.10.1 and 8.4.7.2 allows remote attackers to affect integrity via unknown vectors related to Information Manager Console.
Near-miss passage: CVE-2015-8830. CWE: UNKNOWN. CVSS: 7.800000190734863. Integer overflow in the aio_setup_single_vector function in fs/aio.c in the Linux kernel 4.0 allows local users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec. NOTE: this vulnerability exists because of a CVE-2012-6701 regression.
Query: exploit Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.26, 4.0.28, 4.1.36, and 4.2.28 allows local users to affect availab
Matching passage: CVE-2015-0418. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.26, 4.0.28, 4.1.36, and 4.2.28 allows local users to affect availability via unknown vectors related to Core, a different vulnerability than CVE-2015-0377.
Near-miss passage: CVE-2015-0365. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Siebel Core - Server Infrastructure component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Security.
Query: rule covering Detects execution of "AdPlus.exe", a binary that is part of the Windows SDK that can be used as a LOLBIN in order to dum
Matching passage: Sigma rule: Detects execution of "AdPlus.exe", a binary that is part of the Windows SDK that can be used as a LOLBIN in order to dum. Logsource: windows / process_creation. Rule: title: Potential Adplus.EXE Abuse id: 2f869d59-7f6a-4931-992c-cce556ff2d53 status: test description: Detects execution of "AdPlus.exe", a binary that is part of the Windows SDK that can be used as a LOLBIN in order to dump process memory and execute arbitrary commands. references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Adplus/ - https://twitter.com/nas_bench/status/1534916659676422152 - https://twitter.com/nas_bench/status/1534915321856917506 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-09 modified: 2023-06-23 tags: - attack.execution - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \adplus.exe - OriginalFileName: Adplus.exe selection_cli: CommandLine|contains: - ' -hang ' - ' -pn ' - ' -pmn ' - ' -p ' - ' -po ' - ' -c ' - ' -sc ' condition: all of selection_* falsepositives: - Legitimate usage of Adplus for debugging purposes level: high
Near-miss passage: Sigma rule: Detects wannacry killswitch domain dns queries. Logsource: dns. Rule: title: Wannacry Killswitch Domain id: 3eaf6218-3bed-4d8a-8707-274096f12a18 status: test description: Detects wannacry killswitch domain dns queries references: - https://www.mandiant.com/resources/blog/wannacry-ransomware-campaign author: Mike Wade date: 2020-09-16 modified: 2022-03-24 tags: - attack.command-and-control - attack.t1071.001 logsource: category: dns detection: selection: query: - ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.testing - ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.test - ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.com - ayylmaotjhsstasdfasdfasdfasdfasdfasdfasdf.com - iuqssfsodp9ifjaposdfjhgosurijfaewrwergwea.com condition: selection falsepositives: - Analyst testing level: high
Query: vulnerability: Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Ex
Matching passage: CVE-2015-0043. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-6287. CWE: CWE-399. CVSS: 5.0. Cisco Web Security Appliance (WSA) 8.0.6-078 and 8.0.6-115 allows remote attackers to cause a denial of service (service outage) via a flood of TCP traffic that leads to DNS resolution delays, aka Bug IDs CSCur32005 and CSCur07907.
Query: describe CVE-2015-5860
Matching passage: CVE-2015-5860. CWE: CWE-200. CVSS: 5.0. The CFNetwork HTTPProtocol component in Apple iOS before 9 mishandles HSTS state, which allows remote attackers to bypass the Safari private-browsing protection mechanism and track users via a crafted web site.
Near-miss passage: CVE-2015-3058. CWE: CWE-200. CVSS: 5.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to obtain sensitive information from process memory via unspecified vectors.
Query: risk of Mozilla Firefox OS before 2.2 does not require the wifi-manage privilege for reading a Wi-Fi system message, which allows attackers to obtain potentially sensitive information via 
Matching passage: CVE-2015-4494. CWE: CWE-200. CVSS: 4.300000190734863. Mozilla Firefox OS before 2.2 does not require the wifi-manage privilege for reading a Wi-Fi system message, which allows attackers to obtain potentially sensitive information via a crafted app.
Near-miss passage: CVE-2015-0834. CWE: CWE-200. CVSS: 4.300000190734863. The WebRTC subsystem in Mozilla Firefox before 36.0 recognizes turns: and stuns: URIs but accesses the TURN or STUN server without using TLS, which makes it easier for man-in-the-middle attackers to discover credentials by spoofing a server and completing a brute-force attack within a short time window.
Query: describe CVE-2015-8972
Matching passage: CVE-2015-8972. CWE: CWE-119. CVSS: 9.800000190734863. Stack-based buffer overflow in the ValidateMove function in frontend/move.cc in GNU Chess (aka gnuchess) before 6.2.4 might allow context-dependent attackers to execute arbitrary code via a large input, as demonstrated when in UCI mode.
Near-miss passage: CVE-2015-8792. CWE: CWE-119. CVSS: 5.300000190734863. The KaxInternalBlock::ReadData function in libMatroska before 1.4.4 allows context-dependent attackers to obtain sensitive information from process heap memory via crafted EBML lacing, which triggers an invalid memory access.
Query: risk of NetApp OnCommand System Manager 8.3.x before 8.3.2 allows remote authenticated users to execute arbitrary code via unspecified vectors.
Matching passage: CVE-2015-8322. CWE: UNKNOWN. CVSS: 8.800000190734863. NetApp OnCommand System Manager 8.3.x before 8.3.2 allows remote authenticated users to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-4919. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Monitoring and Diagnostics SEC.
Query: risk of Unrestricted file upload vulnerability in h5ai before 0.25.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it v
Matching passage: CVE-2015-3203. CWE: UNKNOWN. CVSS: 7.5. Unrestricted file upload vulnerability in h5ai before 0.25.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the directory specified by the href parameter.
Near-miss passage: CVE-2015-2369. CWE: UNKNOWN. CVSS: 6.900000095367432. Untrusted search path vulnerability in Windows Media Device Manager in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .rtf file, aka "DLL Planting Remote Code Execution Vulnerability."
Query: indicators of Regsvcs/Regasm
Matching passage: T1218.009 Regsvcs/Regasm. Tactics: stealth. Description: Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) assemblies. Both are binaries that may be digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm) Both utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: <code>[ComRegisterFunction]</code> or <code>[ComUnregisterFunction]</code> respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute. (Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm)
Near-miss passage: T1218.001 Compiled HTML File. Tactics: stealth. Description: Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program) A custom CHM file containing embedded payloads could be delivered to a victim then triggered by [User Execution](https://attack.mitre.org/techniques/T1204). CHM execution may also bypass application application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe. (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017)
Query: rule covering Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a
Matching passage: Sigma rule: Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a. Logsource: windows / file_event. Rule: title: NTDS.DIT Creation By Uncommon Process id: 11b1ed55-154d-4e82-8ad7-83739298f720 related: - id: 4e7050dd-e548-483f-b7d6-527ab4fa784d type: similar status: test description: Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a suspicious directory references: - https://stealthbits.com/blog/extracting-password-hashes-from-the-ntds-dit-file/ - https://adsecurity.org/?p=2398 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-01-11 modified: 2022-07-14 tags: - attack.credential-access - attack.t1003.002 - attack.t1003.003 logsource: product: windows category: file_event detection: selection_ntds: TargetFilename|endswith: \ntds.dit selection_process_img: Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - \wsl.exe - \wt.exe selection_process_paths: Image|contains: - \AppData\ - \Temp\ - \Public\ - \PerfLogs\ condition: selection_ntds and 1 of selection_process_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when a user is added to a privileged role.. Logsource: azure / auditlogs. Rule: title: User Added To Privilege Role id: 49a268a4-72f4-4e38-8a7b-885be690c5b5 status: test description: Detects when a user is added to a privileged role. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H' date: 2022-08-06 tags: - attack.persistence - attack.initial-access - attack.privilege-escalation - attack.stealth - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: properties.message: - Add eligible member (permanent) - Add eligible member (eligible) condition: selection falsepositives: - Legtimate administrator actions of adding members from a role level: high
Query: CWE for ASP.NET Misconfiguration: Missing Custom Error Page
Matching passage: CWE-12 ASP.NET Misconfiguration: Missing Custom Error Page. An ASP .NET application must enable custom error pages in order to prevent attackers from mining information from the framework's built-in responses.
Near-miss passage: CWE-909 Missing Initialization of Resource. The product does not initialize a critical resource.
Query: describe CVE-2015-2520
Matching passage: CVE-2015-2520. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-9028. CWE: CWE-119. CVSS: 7.800000190734863. In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a cryptographic routine.
Query: patch priority for CVE-2015-2039
Matching passage: CVE-2015-2039. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Acobot Live Chat & Contact Form plugin 2.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or (2) conduct cross-site scripting (XSS) attacks via the acobot_token parameter in the acobot page to wp-admin/options-general.php.
Near-miss passage: CVE-2015-9233. CWE: CWE-352. CVSS: 8.800000190734863. The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cp_contactformpp.php and cp_contactformpp_admin_int_list.inc.php.
Query: risk of Cross-site request forgery (CSRF) vulnerability on Actiontec GT784WN modems with firmware before NCS01-1.0.13 allows remote attackers to hijack the authentication or intranet conne
Matching passage: CVE-2015-2905. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability on Actiontec GT784WN modems with firmware before NCS01-1.0.13 allows remote attackers to hijack the authentication or intranet connectivity of arbitrary users.
Near-miss passage: CVE-2015-6973. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password via a crafted request to user-password.jsp, (2) add users via a crafted request to user-create.jsp, (3) edit server settings or (4) disable SSL on the server via a crafted request to server-props.jsp, or (5) add clients via a crafted request to plugins/clientcontrol/permitted-clients.jsp.