alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-5003
Matching passage: CVE-2015-5003. CWE: CWE-77. CVSS: 8.5. The portal in IBM Tivoli Monitoring (ITM) 6.2.2 through FP9, 6.2.3 through FP5, and 6.3.0 before FP7 allows remote authenticated users to execute arbitrary commands by leveraging Take Action view authority and providing crafted input.
Near-miss passage: CVE-2015-5080. CWE: CWE-77. CVSS: 9.0. The Management Interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.1 before 10.1.132.8, 10.5 before Build 56.15, and 10.5.e before Build 56.1505.e allows remote authenticated users to execute arbitrary shell commands via shell metacharacters in the filter parameter to rapi/ipsec_logs.
Query: Lateral movement indicators for Search Engines
Matching passage: T1593.002 Search Engines. Tactics: reconnaissance. Description: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes).(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking) Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Valid Accounts](https://attack.mitre.org/techniques/T1078) or [Phishing](https://attack.mitre.org/techniques/T1566)).
Near-miss passage: T1593 Search Open Websites/Domains. Tactics: reconnaissance. Description: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.(Citation: Cyware Social Media)(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking) Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Phishing](https://attack.mitre.org/techniques/T1566)).
Query: actor TTPs: Scripting
Matching passage: T1064 Scripting. Tactics: stealth, execution. Description: **This technique has been deprecated. Please use [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) where appropriate.** Adversaries may use scripts to aid in operations and perform multiple actions that would otherwise be manual. Scripting is useful for speeding up operational tasks and reducing the time required to gain access to critical resources. Some scripting languages may be used to bypass process monitoring mechanisms by directly interacting with the operating system at an API level instead of calling other programs. Common scripting languages for Windows include VBScript and [PowerShell](https://attack.mitre.org/techniques/T1086) but could also be in the form of command-line batch scripts. Scripts can be embedded inside Office documents as macros that can be set to execute when files used in [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) and other types of spearphishing are opened. Malicious embedded macros are an alternative means of execution than software exploitation through [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), where adversaries will rely on macros being allowed or that the user will accept to activate them. Many popular offensive frameworks exist which use forms of scripting for security testers and adversaries alike. Metasploit (Citation: Metasploit_Ref), Veil (Citation: Veil_Ref), and PowerSploit (Citation: Powersploit) are three examples that are popular among penetration testers for exploit and post-compromise operations and include many features for evading defenses. Some adversaries are known to use PowerShell. (Citation: Alperovitch 2014)
Near-miss passage: T1027.004 Compile After Delivery. Tactics: stealth. Description: Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe(Citation: ATTACK IQ), csc.exe, or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018) Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a [Phishing](https://attack.mitre.org/techniques/T1566). Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.(Citation: TrendMicro WindowsAppMac)
Query: weakness Class with Virtual Method without a Virtual Destructor
Matching passage: CWE-1087 Class with Virtual Method without a Virtual Destructor. A class contains a virtual method, but the method does not have an associated virtual destructor.
Near-miss passage: CWE-55 Path Equivalence: '/./' (Single Dot Directory). The product accepts path input in the form of single dot directory exploit ('/./') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Query: Sigma rule for Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)
Matching passage: Sigma rule: Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens). Logsource: windows / process_creation. Rule: title: Renamed BrowserCore.EXE Execution id: 8a4519e8-e64a-40b6-ae85-ba8ad2177559 status: test description: Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens) references: - https://twitter.com/mariuszbit/status/1531631015139102720 author: Max Altgelt (Nextron Systems) date: 2022-06-02 modified: 2023-02-03 tags: - attack.credential-access - attack.stealth - attack.t1528 - attack.t1036.003 logsource: category: process_creation product: windows detection: selection: OriginalFileName: BrowserCore.exe filter_realbrowsercore: Image|endswith: \BrowserCore.exe condition: selection and not 1 of filter_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of a binary from the Linux shared memory directory /dev/shm. This directory is a tmpfs mount backe. Logsource: linux / process_creation. Rule: title: Process Execution From Shared Memory Directory id: 5cd16c8f-44a6-4654-81e7-a84d6db507d4 status: experimental description: 'Detects the execution of a binary from the Linux shared memory directory /dev/shm. This directory is a tmpfs mount backed entirely by RAM and is abused by attackers for fileless malware staging because files written there never touch physical disk and may evade disk-based detection. ' references: - https://www.sysdig.com/blog/containers-read-only-fileless-malware - https://unfinished.bike/fun-with-the-new-bpfdoor-2023 - https://asiapacificdefencereporter.com/wp-content/uploads/2023/08/Final-CRWD-2023-Threat-Hunting-Report.pdf - https://www.crowdstrike.com/en-us/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/ - https://www.linkedin.com/posts/avradeep_malware-apt-infostealer-activity-7373203959697719296-JR-7 - https://www.stormshield.com/news/orbit-analysis-of-a-linux-dedicated-malware/ author: Stan Beukers date: 2026-06-20 tags: - attack.stealth - attack.execution - attack.t1027.011 logsource: category: process_creation product: linux detection: selection: Image|startswith: /dev/shm/ condition: selection falsepositives: - Unlikely in production environments; some container runtimes or IPC frameworks may use /dev/shm for inter-process communication but should not spawn executables. level: high
Query: describe CVE-2015-0317
Matching passage: CVE-2015-0317. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-0319.
Near-miss passage: CVE-2015-7799. CWE: UNKNOWN. CVSS: 4.900000095367432. The slhc_init function in drivers/net/slip/slhc.c in the Linux kernel through 4.2.3 does not ensure that certain slot numbers are valid, which allows local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted PPPIOCSMAXCID ioctl call.
Query: vulnerability: Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to bypass inten
Matching passage: CVE-2015-7469. CWE: CWE-264. CVSS: 4.300000190734863. Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to bypass intended read-only restrictions by leveraging a JazzGuest role.
Near-miss passage: CVE-2015-1170. CWE: CWE-264. CVSS: 7.199999809265137. The NVIDIA Display Driver R304 before 309.08, R340 before 341.44, R343 before 345.20, and R346 before 347.52 does not properly validate local client impersonation levels when performing a "kernel administrator check," which allows local users to gain administrator privileges via unspecified API calls.
Query: detection rule: Detects the creation of a process via the Windows task manager. This might be an attempt to bypass UAC
Matching passage: Sigma rule: Detects the creation of a process via the Windows task manager. This might be an attempt to bypass UAC. Logsource: windows / process_creation. Rule: title: New Process Created Via Taskmgr.EXE id: 3d7679bd-0c00-440c-97b0-3f204273e6c7 status: test description: Detects the creation of a process via the Windows task manager. This might be an attempt to bypass UAC references: - https://twitter.com/ReneFreingruber/status/1172244989335810049 author: Florian Roth (Nextron Systems) date: 2018-03-13 modified: 2024-01-18 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \taskmgr.exe filter_main_generic: Image|endswith: - :\Windows\System32\mmc.exe - :\Windows\System32\resmon.exe - :\Windows\System32\Taskmgr.exe condition: selection and not 1 of filter_main_* falsepositives: - Administrative activity level: low
Near-miss passage: Sigma rule: Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfus. Logsource: windows / process_creation. Rule: title: HackTool - HandleKatz LSASS Dumper Execution id: ca621ba5-54ab-4035-9942-d378e6fcde3c status: test description: Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same references: - https://github.com/codewhitesec/HandleKatz author: Florian Roth (Nextron Systems) date: 2022-08-18 modified: 2024-11-23 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection_loader_img: Image|endswith: \loader.exe CommandLine|contains: '--pid:' selection_loader_imphash: Hashes|contains: - IMPHASH=38D9E015591BBFD4929E0D0F47FA0055 - IMPHASH=0E2216679CA6E1094D63322E3412D650 selection_flags: CommandLine|contains|all: - '--pid:' - '--outfile:' CommandLine|contains: - .dmp - lsass - .obf - dump condition: 1 of selection_* falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-1711
Matching passage: CVE-2015-1711. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1658, CVE-2015-1706, CVE-2015-1717, and CVE-2015-1718.
Near-miss passage: CVE-2015-3696. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3700, CVE-2015-3701, and CVE-2015-3702.
Query: CVE similar to CVE-2015-5148
Matching passage: CVE-2015-5148. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in LivelyCart 1.2.0 allows remote attackers to execute arbitrary SQL commands via the search_query parameter to product/search.
Near-miss passage: CVE-2015-6486. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Query: rule covering Identifies when a Point-to-site VPN is Modified or Deleted.
Matching passage: Sigma rule: Identifies when a Point-to-site VPN is Modified or Deleted.. Logsource: azure / activitylogs. Rule: title: Azure Point-to-site VPN Modified or Deleted id: d9557b75-267b-4b43-922f-a775e2d1f792 status: test description: Identifies when a Point-to-site VPN is Modified or Deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-08-08 modified: 2022-08-23 tags: - attack.impact logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.NETWORK/P2SVPNGATEWAYS/WRITE - MICROSOFT.NETWORK/P2SVPNGATEWAYS/DELETE - MICROSOFT.NETWORK/P2SVPNGATEWAYS/RESET/ACTION - MICROSOFT.NETWORK/P2SVPNGATEWAYS/GENERATEVPNPROFILE/ACTION - MICROSOFT.NETWORK/P2SVPNGATEWAYS/DISCONNECTP2SVPNCONNECTIONS/ACTION - MICROSOFT.NETWORK/P2SVPNGATEWAYS/PROVIDERS/MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/WRITE condition: selection falsepositives: - Point-to-site VPN being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Point-to-site VPN modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which. Logsource: windows / file_event. Rule: title: Suspicious MSExchangeMailboxReplication ASPX Write id: 7280c9f3-a5af-45d0-916a-bc01cb4151c9 status: test description: Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation references: - https://redcanary.com/blog/blackbyte-ransomware/ author: Florian Roth (Nextron Systems) date: 2022-02-25 tags: - attack.initial-access - attack.t1190 - attack.persistence - attack.t1505.003 logsource: product: windows category: file_event detection: selection: Image|endswith: \MSExchangeMailboxReplication.exe TargetFilename|endswith: - .aspx - .asp condition: selection falsepositives: - Unknown level: high
Query: secure coding against Insufficient Isolation of Symbolic Constant Definitions
Matching passage: CWE-1107 Insufficient Isolation of Symbolic Constant Definitions. The source code uses symbolic constants, but it does not sufficiently place the definitions of these constants into a more centralized or isolated location.
Near-miss passage: CWE-563 Assignment to Variable without Use. The variable's value is assigned but never used, making it a dead store.
Query: Sigma YAML for windows / security
Matching passage: Sigma rule: Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to. Logsource: windows / security. Rule: title: Replay Attack Detected id: 5a44727c-3b85-4713-8c44-4401d5499629 status: test description: Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to the client references: - https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4649 author: frack113 date: 2022-10-14 tags: - attack.credential-access - attack.t1558 logsource: service: security product: windows detection: selection: EventID: 4649 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious pr. Logsource: windows / process_creation. Rule: title: Suspect Svchost Activity id: 16c37b52-b141-42a5-a3ea-bbe098444397 status: test description: It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space. references: - https://web.archive.org/web/20180718061628/https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2 author: David Burkett, @signalblur date: 2019-12-28 modified: 2022-06-27 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: category: process_creation product: windows detection: selection: CommandLine|endswith: svchost.exe Image|endswith: \svchost.exe filter: - ParentImage|endswith: - \rpcnet.exe - \rpcnetp.exe - CommandLine: null condition: selection and not filter falsepositives: - Rpcnet.exe / rpcnetp.exe which is a lojack style software. https://www.blackhat.com/docs/us-14/materials/us-14-Kamlyuk-Kamluk-Computrace-Backdoor-Revisited.pdf level: high
Query: adversary uses Resource Hijacking
Matching passage: T1496 Resource Hijacking. Tactics: impact. Description: Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Resource hijacking may take a number of different forms. For example, adversaries may: * Leverage compute resources in order to mine cryptocurrency * Sell network bandwidth to proxy networks * Generate SMS traffic for profit * Abuse cloud-based messaging services to send large quantities of spam messages In some cases, adversaries may leverage multiple types of Resource Hijacking at once.(Citation: Sysdig Cryptojacking Proxyjacking 2023)
Near-miss passage: T1496.003 SMS Pumping. Tactics: impact. Description: Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted service availability.(Citation: Twilio SMS Pumping) SMS pumping is a type of telecommunications fraud whereby a threat actor first obtains a set of phone numbers from a telecommunications provider, then leverages a victim’s messaging infrastructure to send large amounts of SMS messages to numbers in that set. By generating SMS traffic to their phone number set, a threat actor may earn payments from the telecommunications provider.(Citation: Twilio SMS Pumping Fraud) Threat actors often use publicly available web forms, such as one-time password (OTP) or account verification fields, in order to generate SMS traffic. These fields may leverage services such as Twilio, AWS SNS, and Amazon Cognito in the background.(Citation: Twilio SMS Pumping)(Citation: AWS RE:Inforce Threat Detection 2024) In response to the large quantity of requests, SMS costs may increase and communication channels may become overwhelmed.(Citation: Twilio SMS Pumping)
Query: rule covering Detects execution of PktMon, a tool that captures network packets.
Matching passage: Sigma rule: Detects execution of PktMon, a tool that captures network packets.. Logsource: windows / process_creation. Rule: title: PktMon.EXE Execution id: f956c7c1-0f60-4bc5-b7d7-b39ab3c08908 status: test description: Detects execution of PktMon, a tool that captures network packets. references: - https://lolbas-project.github.io/lolbas/Binaries/Pktmon/ author: frack113 date: 2022-03-17 modified: 2023-06-23 tags: - attack.discovery - attack.credential-access - attack.t1040 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \pktmon.exe - OriginalFileName: PktMon.exe condition: selection falsepositives: - Legitimate use level: medium
Near-miss passage: Sigma rule: Clear command history in network OS which is used for defense evasion. Logsource: cisco / aaa. Rule: title: Cisco Clear Logs id: ceb407f6-8277-439b-951f-e4210e3ed956 status: test description: Clear command history in network OS which is used for defense evasion references: - https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/command/reference/sysmgmt/n5k-sysmgmt-cr/n5k-sm_cmds_c.html - https://www.cisco.com/c/en/us/td/docs/ios/12_2sr/12_2sra/feature/guide/srmgtint.html#wp1127609 author: Austin Clark date: 2019-08-12 modified: 2023-05-26 tags: - attack.stealth - attack.t1070.003 logsource: product: cisco service: aaa detection: keywords: - clear logging - clear archive condition: keywords falsepositives: - Legitimate administrators may run these commands level: high
Query: CVE similar to CVE-2015-6552
Matching passage: CVE-2015-6552. CWE: CWE-284. CVSS: 9.800000190734863. The management-services protocol implementation in Veritas NetBackup 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2 and NetBackup Appliance through 2.5.4, 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, and 2.7.x before 2.7.2 allows remote attackers to make arbitrary RPC calls via unspecified vectors.
Near-miss passage: CVE-2015-1000010. CWE: CWE-284. CVSS: 7.5. Remote file download in simple-image-manipulator v1.0 wordpress plugin
Query: describe CVE-2015-7611
Matching passage: CVE-2015-7611. CWE: CWE-78. CVSS: 8.100000381469727. Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.
Near-miss passage: CVE-2015-2980. CWE: CWE-78. CVSS: 6.800000190734863. The Yodobashi application 1.2.1.0 and earlier for Android allows remote attackers to execute arbitrary Java methods, and consequently obtain sensitive information or execute OS commands, via a crafted HTML document.