alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: campaign using ROMMONkit
Matching passage: T1542.004 ROMMONkit. Tactics: stealth, persistence. Description: Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect. (Citation: Cisco Synful Knock Evolution)(Citation: Cisco Blog Legacy Device Attacks) ROMMON is a Cisco network device firmware that functions as a boot loader, boot image, or boot helper to initialize hardware and software when the platform is powered on or reset. Similar to [TFTP Boot](https://attack.mitre.org/techniques/T1542/005), an adversary may upgrade the ROMMON image locally or remotely (for example, through TFTP) with adversary code and restart the device in order to overwrite the existing ROMMON image. This provides adversaries with the means to update the ROMMON to gain persistence on a system in a way that may be difficult to detect.
Near-miss passage: T1542.005 TFTP Boot. Tactics: stealth, persistence. Description: Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images. Adversaries may manipulate the configuration on the network device specifying use of a malicious TFTP server, which may be used in conjunction with [Modify System Image](https://attack.mitre.org/techniques/T1601) to load a modified image on device startup or reset. The unauthorized image allows adversaries to modify device configuration, add malicious capabilities to the device, and introduce backdoors to maintain control of the network device while minimizing detection through use of a standard functionality. This technique is similar to [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) and may result in the network device running a modified image. (Citation: Cisco Blog Legacy Device Attacks)
Query: vulnerability: Cross-site scripting (XSS) vulnerability in InfoSphere Data Architect (IDA), as distributed in IBM Rational Software Architect 8.5 through 9.5, Rational Software Architect for WebS
Matching passage: CVE-2015-7439. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in InfoSphere Data Architect (IDA), as distributed in IBM Rational Software Architect 8.5 through 9.5, Rational Software Architect for WebSphere Software (RSA4WS) 8.5 through 9.5, and Rational Software Architect RealTime (RSART) 8.5 through 9.5, allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-2870. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability on Chiyu BF-630, BF-630W, and BF-660C fingerprint access-control devices allows remote attackers to inject arbitrary web script or HTML via a SCRIPT element.
Query: vulnerability: The photo-decoder implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Win
Matching passage: CVE-2015-0076. CWE: CWE-200. CVSS: 4.300000190734863. The photo-decoder implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly initialize memory for rendering of JXR images, which allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "JPEG XR Parser Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-3754. CWE: CWE-200. CVSS: 4.300000190734863. The private-browsing implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8 does not prevent caching of HTTP authentication credentials, which makes it easier for remote attackers to track users via a crafted web site.
Query: risk of The SAP Management Console in SAP NetWeaver 7.40 allows remote attackers to obtain sensitive information via the ReadProfile parameters, aka SAP Security Note 2091768.
Matching passage: CVE-2015-2817. CWE: CWE-200. CVSS: 5.0. The SAP Management Console in SAP NetWeaver 7.40 allows remote attackers to obtain sensitive information via the ReadProfile parameters, aka SAP Security Note 2091768.
Near-miss passage: CVE-2015-7208. CWE: CWE-200. CVSS: 5.0. Mozilla Firefox before 43.0 stores cookies containing vertical tab characters, which allows remote attackers to obtain sensitive information by reading HTTP Cookie headers.
Query: exploit WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application cras
Matching passage: CVE-2015-5811. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-1495. CWE: CWE-119. CVSS: 6.800000190734863. Multiple stack-based buffer overflows in Motorola Scanner SDK allow remote attackers to execute arbitrary code via a crafted string to the Open method in (1) IOPOSScanner.ocx or (2) IOPOSScale.ocx.
Query: Persistence mechanism resembling Transport Agent
Matching passage: T1505.002 Transport Agent. Tactics: persistence. Description: Adversaries may abuse Microsoft transport agents to establish persistent access to systems. Microsoft Exchange transport agents can operate on email messages passing through the transport pipeline to perform various tasks such as filtering spam, filtering malicious attachments, journaling, or adding a corporate signature to the end of all outgoing emails.(Citation: Microsoft TransportAgent Jun 2016)(Citation: ESET LightNeuron May 2019) Transport agents can be written by application developers and then compiled to .NET assemblies that are subsequently registered with the Exchange server. Transport agents will be invoked during a specified stage of email processing and carry out developer defined tasks. Adversaries may register a malicious transport agent to provide a persistence mechanism in Exchange Server that can be triggered by adversary-specified email events.(Citation: ESET LightNeuron May 2019) Though a malicious transport agent may be invoked for all emails passing through the Exchange transport pipeline, the agent can be configured to only carry out specific tasks in response to adversary defined criteria. For example, the transport agent may only carry out an action like copying in-transit attachments and saving them for later exfiltration if the recipient email address matches an entry on a list provided by the adversary.
Near-miss passage: T1505.001 SQL Stored Procedures. Tactics: persistence. Description: Adversaries may abuse SQL stored procedures to establish persistent access to systems. SQL Stored Procedures are code that can be saved and reused so that database users do not waste time rewriting frequently used SQL queries. Stored procedures can be invoked via SQL statements to the database using the procedure name or via defined events (e.g. when a SQL server application is started/restarted). Adversaries may craft malicious stored procedures that can provide a persistence mechanism in SQL database servers.(Citation: NetSPI Startup Stored Procedures)(Citation: Kaspersky MSSQL Aug 2019) To execute operating system commands through SQL syntax the adversary may have to enable additional functionality, such as xp_cmdshell for MSSQL Server.(Citation: NetSPI Startup Stored Procedures)(Citation: Kaspersky MSSQL Aug 2019)(Citation: Microsoft xp_cmdshell 2017) Microsoft SQL Server can enable common language runtime (CLR) integration. With CLR integration enabled, application developers can write stored procedures using any .NET framework language (e.g. VB .NET, C#, etc.).(Citation: Microsoft CLR Integration 2017) Adversaries may craft or modify CLR assemblies that are linked to stored procedures since these CLR assemblies can be made to execute arbitrary commands.(Citation: NetSPI SQL Server CLR)
Query: exploit The media_server component in Android allows remote attackers to cause a denial of service via a crafted application.
Matching passage: CVE-2015-1526. CWE: CWE-190. CVSS: 5.5. The media_server component in Android allows remote attackers to cause a denial of service via a crafted application.
Near-miss passage: CVE-2015-8982. CWE: CWE-190. CVSS: 8.100000381469727. Integer overflow in the strxfrm function in the GNU C Library (aka glibc or libc6) before 2.21 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow.
Query: exploit The SSL layer of the HTTPS service in Siemens RuggedCom ROS before 4.2.0 and ROX II does not properly implement CBC padding, which makes it easier for man-in-the-middle attackers t
Matching passage: CVE-2015-5537. CWE: CWE-312. CVSS: 4.300000190734863. The SSL layer of the HTTPS service in Siemens RuggedCom ROS before 4.2.0 and ROX II does not properly implement CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a different vulnerability than CVE-2014-3566.
Near-miss passage: CVE-2015-1931. CWE: CWE-312. CVSS: 5.5. IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR1 FP10, 7 R1 before SR3 FP10, 7 before SR9 FP10, 6 R1 before SR8 FP7, 6 before SR16 FP7, and 5.0 before SR16 FP13 stores plaintext information in memory dumps, which allows local users to obtain sensitive information by reading a file.
Query: alert when Detects commands that indicate a Raccine removal from an end system. Raccine is a free ransomware protection tool.
Matching passage: Sigma rule: Detects commands that indicate a Raccine removal from an end system. Raccine is a free ransomware protection tool.. Logsource: windows / process_creation. Rule: title: Raccine Uninstall id: a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc status: test description: Detects commands that indicate a Raccine removal from an end system. Raccine is a free ransomware protection tool. references: - https://github.com/Neo23x0/Raccine author: Florian Roth (Nextron Systems) date: 2021-01-21 modified: 2022-10-09 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection1: CommandLine|contains|all: - 'taskkill ' - RaccineSettings.exe selection2: CommandLine|contains|all: - reg.exe - delete - Raccine Tray selection3: CommandLine|contains|all: - schtasks - /DELETE - Raccine Rules Updater condition: 1 of selection* falsepositives: - Legitimate deinstallation by administrative staff level: high
Near-miss passage: Sigma rule: Detects a potentially suspicious powershell script executions from temporary folder. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Powershell Script Execution From Temp Folder id: a6a39bdb-935c-4f0a-ab77-35f4bbf44d33 status: test description: Detects a potentially suspicious powershell script executions from temporary folder references: - https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/ author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton date: 2021-07-14 modified: 2026-02-17 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - \Windows\Temp - \Temporary Internet - \AppData\Local\Temp - \AppData\Roaming\Temp - '%TEMP%' - '%TMP%' - '%LocalAppData%\Temp' filter_optional_vscode: CommandLine|contains: -WindowStyle hidden -Verb runAs filter_optional_amazon_ec2: CommandLine|contains: \Windows\system32\config\systemprofile\AppData\Local\Temp\Amazon\EC2-Windows\ filter_optional_generic: CommandLine|contains: - ' >' - Out-File - ConvertTo-Json filter_optional_chocolatey_installer: ParentImage: - C:\Windows\System32\Msiexec.exe - C:\Windows\SysWOW64\Msiexec.exe Image|endswith: \powershell.exe CommandLine|contains|all: - -NoProfile -ExecutionPolicy Bypass -Command - AppData\Local\Temp\ - Install-Chocolatey.ps1 condition: selection and not 1 of filter_optional_* falsepositives: - Administrative scripts level: medium
Query: describe CVE-2015-1996
Matching passage: CVE-2015-1996. CWE: CWE-200. CVSS: 2.0999999046325684. IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not prevent caching of HTTPS responses, which allows physically proximate attackers to obtain sensitive local-cache information by leveraging an unattended workstation.
Near-miss passage: CVE-2015-7484. CWE: CWE-200. CVSS: 4.300000190734863. IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1 and 4.0 before 4.0.7 iFix10 allow remote authenticated users with access to lifecycle projects to obtain sensitive information by sending a crafted URL to the Lifecycle Query Engine. IBM X-Force ID: 108619.
Query: indicators of Container Service
Matching passage: T1543.005 Container Service. Tactics: persistence, privilege escalation. Description: Adversaries may create or modify container or container cluster management tools that run as daemons, agents, or services on individual hosts. These include software for creating and managing individual containers, such as Docker and Podman, as well as container cluster node-level agents such as kubelet. By modifying these services, an adversary may be able to achieve persistence or escalate their privileges on a host. For example, by using the `docker run` or `podman run` command with the `restart=always` directive, a container can be configured to persistently restart on the host.(Citation: AquaSec TeamTNT 2023) A user with access to the (rootful) docker command may also be able to escalate their privileges on the host.(Citation: GTFOBins Docker) In Kubernetes environments, DaemonSets allow an adversary to persistently [Deploy Container](https://attack.mitre.org/techniques/T1610)s on all nodes, including ones added later to the cluster.(Citation: Aquasec Kubernetes Attack 2023)(Citation: Kubernetes DaemonSet) Pods can also be deployed to specific nodes using the `nodeSelector` or `nodeName` fields in the pod spec.(Citation: Kubernetes Assigning Pods to Nodes)(Citation: AppSecco Kubernetes Namespace Breakout 2020) Note that containers can also be configured to run as [Systemd Service](https://attack.mitre.org/techniques/T1543/002)s.(Citation: Podman Systemd)(Citation: Docker Systemd)
Near-miss passage: T1543 Create or Modify System Process. Tactics: persistence, privilege escalation. Description: Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services.(Citation: TechNet Services) On macOS, launchd processes known as [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001) are run to finish system initialization and load user specific parameters.(Citation: AppleDocs Launch Agent Daemons) Adversaries may install new services, daemons, or agents that can be configured to execute at startup or a repeatable interval in order to establish persistence. Similarly, adversaries may modify existing services, daemons, or agents to achieve the same effect. Services, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges. Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges.(Citation: OSX Malware Detection)
Query: intelligence brief on T1552
Matching passage: T1552 Unsecured Credentials. Tactics: credential access. Description: Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Shell History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)).(Citation: Brining MimiKatz to Unix)
Near-miss passage: T1552.008 Chat Messages. Tactics: credential access. Description: Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels. Rather than accessing the stored chat logs (i.e., [Credentials In Files](https://attack.mitre.org/techniques/T1552/001)), adversaries may directly access credentials within these services on the user endpoint, through servers hosting the services, or through administrator portals for cloud hosted services. Adversaries may also compromise integration tools like Slack Workflows to automatically search through messages to extract user credentials. These credentials may then be abused to perform follow-on activities such as lateral movement or privilege escalation (Citation: Slack Security Risks).
Query: detection rule: Detects DNS queries for subdomains related to MEGA sharing website
Matching passage: Sigma rule: Detects DNS queries for subdomains related to MEGA sharing website. Logsource: windows / dns-client. Rule: title: DNS Query To MEGA Hosting Website - DNS Client id: 66474410-b883-415f-9f8d-75345a0a66a6 related: - id: 613c03ba-0779-4a53-8a1f-47f914a4ded3 type: similar status: test description: Detects DNS queries for subdomains related to MEGA sharing website references: - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-16 tags: - attack.exfiltration - attack.t1567.002 logsource: product: windows service: dns-client definition: 'Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events.' detection: selection: EventID: 3008 QueryName|contains: userstorage.mega.co.nz condition: selection falsepositives: - Legitimate DNS queries and usage of Mega level: medium
Near-miss passage: Sigma rule: Addition of domains is seldom and should be verified for legitimacy.. Logsource: windows / security. Rule: title: A New Trust Was Created To A Domain id: 0255a820-e564-4e40-af2b-6ac61160335c status: stable description: Addition of domains is seldom and should be verified for legitimacy. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4706 author: Thomas Patzke date: 2019-12-03 modified: 2024-01-16 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: windows service: security detection: selection: EventID: 4706 condition: selection falsepositives: - Legitimate extension of domain structure level: medium
Query: describe CVE-2015-4896
Matching passage: CVE-2015-4896. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.0.34, 4.1.42, 4.2.34, 4.3.32, and 5.0.8, when a VM has the Remote Display feature (RDP) enabled, allows remote attackers to affect availability via unknown vectors related to Core.
Near-miss passage: CVE-2015-0489. CWE: UNKNOWN. CVSS: 1.2000000476837158. Unspecified vulnerability in the Application Management Pack for Oracle E-Business Suite component in Oracle E-Business Suite AMP 121030 and 121020 allows local users to affect confidentiality via vectors related to EBS Plugin.
Query: patch priority for CVE-2015-2973
Matching passage: CVE-2015-2973. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the Welcart plugin before 1.4.18 for WordPress allow remote attackers to inject arbitrary web script or HTML via the usces_referer parameter to (1) classes/usceshop.class.php, (2) includes/edit-form-advanced.php, (3) includes/edit-form-advanced30.php, (4) includes/edit-form-advanced34.php, (5) includes/member_edit_form.php, (6) includes/order_edit_form.php, (7) includes/order_list.php, or (8) includes/usces_item_master_list.php, related to admin.php.
Near-miss passage: CVE-2015-0862. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in the management web UI in the RabbitMQ management plugin before 3.4.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) message details when a message is unqueued, such as headers or arguments; (2) policy names, which are not properly handled when viewing policies; (3) details for AMQP network clients, such as the version; allow remote authenticated administrators to inject arbitrary web script or HTML via (4) user names, (5) the cluster name; or allow RabbitMQ cluster administrators to (6) modify unspecified content.
Query: vulnerability: Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.
Matching passage: CVE-2015-1370. CWE: UNKNOWN. CVSS: 4.300000190734863. Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.
Near-miss passage: CVE-2015-4743. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 12.2.3 allows remote authenticated users to affect confidentiality via unknown vectors related to AD Utilities.
Query: vulnerability: Microsoft Edge allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Edge Information Disclosure Vulnerability."
Matching passage: CVE-2015-6057. CWE: CWE-200. CVSS: 5.0. Microsoft Edge allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Edge Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-2421. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass."
Query: vulnerability: The init_t38_info_conv function in epan/dissectors/packet-t38.c in the T.38 dissector in Wireshark 1.12.x before 1.12.9 does not ensure that a conversation exists, which allows rem
Matching passage: CVE-2015-8716. CWE: CWE-20. CVSS: 5.5. The init_t38_info_conv function in epan/dissectors/packet-t38.c in the T.38 dissector in Wireshark 1.12.x before 1.12.9 does not ensure that a conversation exists, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Near-miss passage: CVE-2015-8670. CWE: CWE-20. CVSS: 6.5. Huawei LogCenter V100R001C10 could allow an authenticated attacker to add abnormal device information to the log collection module, causing denial of service.