alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: hunt for JamPlus activity
Matching passage: T1127.003 JamPlus. Tactics: stealth, execution. Description: Adversaries may use `JamPlus` to proxy the execution of a malicious script. `JamPlus` is a build utility tool for code and data build systems. It works with several popular compilers and can be used for generating workspaces in code editors such as Visual Studio.(Citation: JamPlus manual) Adversaries may abuse the `JamPlus` build utility to execute malicious scripts via a `.jam` file, which describes the build process and required dependencies. Because the malicious script is executed from a reputable developer tool, it may subvert application control security systems such as Smart App Control.(Citation: Cyble)(Citation: Elastic Security Labs)
Near-miss passage: T1127.002 ClickOnce. Tactics: stealth, execution. Description: Adversaries may use ClickOnce applications (.appref-ms and .application files) to proxy execution of code through a trusted Windows utility.(Citation: Burke/CISA ClickOnce BlackHat) ClickOnce is a deployment that enables a user to create self-updating Windows-based .NET applications (i.e, .XBAP, .EXE, or .DLL) that install and run from a file share or web page with minimal user interaction. The application launches as a child process of DFSVC.EXE, which is responsible for installing, launching, and updating the application.(Citation: SpectorOps Medium ClickOnce) Because ClickOnce applications receive only limited permissions, they do not require administrative permissions to install.(Citation: Microsoft Learn ClickOnce) As such, adversaries may abuse ClickOnce to proxy execution of malicious code without needing to escalate privileges. ClickOnce may be abused in a number of ways. For example, an adversary may rely on [User Execution](https://attack.mitre.org/techniques/T1204). When a user visits a malicious website, the .NET malware is disguised as legitimate software and a ClickOnce popup is displayed for installation.(Citation: NetSPI ClickOnce) Adversaries may also abuse ClickOnce to execute malware via a [Rundll32](https://attack.mitre.org/techniques/T1218/011) script using the command `rundll32.exe dfshim.dll,ShOpenVerbApplication1`.(Citation: LOLBAS /Dfsvc.exe) Additionally, an adversary can move the ClickOnce application file to a remote user’s startup folder for continued malicious code deployment (i.e., [Registry Run Keys / Startup Folder](https://attack.mitre.org/techniques/T1547/001)).(Citation: Burke/CISA ClickOnce BlackHat)(Citation: Burke/CISA ClickOnce Paper)
Query: CVE similar to CVE-2015-7441
Matching passage: CVE-2015-7441. CWE: CWE-17. CVSS: 6.800000190734863. Remote Artifact Loader (RAL) in IBM WebSphere Process Server 7 and Business Process Manager Advanced 7.5 through 7.5.1.2, 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.2, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.2 does not properly use SSL for its HTTPS connection, which allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.
Near-miss passage: CVE-2015-4037. CWE: CWE-17. CVSS: 1.899999976158142. The slirp_smb function in net/slirp.c in QEMU 2.3.0 and earlier creates temporary files with predictable names, which allows local users to cause a denial of service (instantiation failure) by creating /tmp/qemu-smb.*-* files before the program.
Query: adversary uses Trap
Matching passage: T1546.005 Trap. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. The <code>trap</code> command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like <code>ctrl+c</code> and <code>ctrl+d</code>. Adversaries can use this to register code to be executed when the shell encounters specific interrupts as a persistence mechanism. Trap commands are of the following format <code>trap 'command list' signals</code> where "command list" will be executed when "signals" are received.(Citation: Trap Manual)(Citation: Cyberciti Trap Statements)
Near-miss passage: T1546.007 Netsh Helper DLL. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility.(Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at <code>HKLM\SOFTWARE\Microsoft\Netsh</code>. Adversaries can use netsh.exe helper DLLs to trigger execution of arbitrary code in a persistent manner. This execution would take place anytime netsh.exe is executed, which could happen automatically, with another persistence technique, or if other software (ex: VPN) is present on the system that executes netsh.exe as part of its normal functionality.(Citation: Github Netsh Helper CS Beacon)(Citation: Demaske Netsh Persistence)
Query: hunt for Communication Through Removable Media activity
Matching passage: T1092 Communication Through Removable Media. Tactics: command and control. Description: Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.(Citation: ESET Sednit USBStealer 2014) Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091). Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.
Near-miss passage: T1090.002 External Proxy. Tactics: command and control. Description: Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion. External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.
Query: Sigma YAML for windows / file_rename
Matching passage: Sigma rule: Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware ac. Logsource: windows / file_rename. Rule: title: Suspicious Appended Extension id: e3f673b3-65d1-4d80-9146-466f8b63fa99 status: test description: Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware activity renaming files and adding a custom extension to the encrypted files, such as ".jpg.crypted", ".docx.locky", etc. references: - https://app.any.run/tasks/d66ead5a-faf4-4437-93aa-65785afaf9e5/ - https://blog.cyble.com/2022/08/10/onyx-ransomware-renames-its-leak-site-to-vsop/ author: frack113 date: 2022-07-16 modified: 2023-11-11 tags: - attack.impact - attack.t1486 logsource: product: windows category: file_rename definition: 'Requirements: Microsoft-Windows-Kernel-File Provider with at least the KERNEL_FILE_KEYWORD_RENAME_SETLINK_PATH keyword' detection: selection: SourceFilename|endswith: - .doc - .docx - .jpeg - .jpg - .lnk - .pdf - .png - .pst - .rtf - .xls - .xlsx TargetFilename|contains: - .doc. - .docx. - .jpeg. - .jpg. - .lnk. - .pdf. - .png. - .pst. - .rtf. - .xls. - .xlsx. filter_main_generic: TargetFilename|endswith: - .backup - .bak - .old - .orig - .temp - .tmp filter_optional_anaconda: TargetFilename|contains: :\ProgramData\Anaconda3\ TargetFilename|endswith: .c~ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Backup software level: medium
Near-miss passage: Sigma rule: Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads rem. Logsource: windows / process_creation. Rule: title: Install New Package Via Winget Local Manifest id: 313d6012-51a0-4d93-8dfc-de8553239e25 status: test description: 'Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them. The manifest option enables you to install an application by passing in a YAML file directly to the client. Winget can be used to download and install exe, msi or msix files later. ' references: - https://learn.microsoft.com/en-us/windows/package-manager/winget/install#local-install - https://lolbas-project.github.io/lolbas/Binaries/Winget/ - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget author: Sreeman, Florian Roth (Nextron Systems), frack113 date: 2020-04-21 modified: 2023-04-17 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \winget.exe - OriginalFileName: winget.exe selection_install_flag: CommandLine|contains: - install - ' add ' selection_manifest_flag: CommandLine|contains: - '-m ' - --manifest condition: all of selection_* falsepositives: - Some false positives are expected in some environment that may use this functionality to install and test their custom applications level: medium
Query: exploit Safari in Apple iOS before 9 allows remote attackers to spoof the relationship between URLs and web content via a crafted window opener on a web site.
Matching passage: CVE-2015-5905. CWE: CWE-254. CVSS: 5.0. Safari in Apple iOS before 9 allows remote attackers to spoof the relationship between URLs and web content via a crafted window opener on a web site.
Near-miss passage: CVE-2015-3729. CWE: CWE-254. CVSS: 4.300000190734863. Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not indicate what web site originated an input prompt, which allows remote attackers to conduct spoofing attacks via a crafted site.
Query: exploit Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for WordPress allows remote attackers to redirect users to arbit
Matching passage: CVE-2015-5461. CWE: UNKNOWN. CVSS: 6.400000095367432. Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
Near-miss passage: CVE-2015-0254. CWE: UNKNOWN. CVSS: 7.5. Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.
Query: risk of EMC RSA Archer GRC 5.x before 5.5.3 uses cleartext for stored passwords in unspecified circumstances, which allows remote authenticated users to obtain sensitive information by rea
Matching passage: CVE-2015-4543. CWE: CWE-200. CVSS: 4.0. EMC RSA Archer GRC 5.x before 5.5.3 uses cleartext for stored passwords in unspecified circumstances, which allows remote authenticated users to obtain sensitive information by reading database fields.
Near-miss passage: CVE-2015-6059. CWE: CWE-200. CVSS: 4.300000190734863. The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Scripting Engine Information Disclosure Vulnerability."
Query: CVE similar to CVE-2015-5801
Matching passage: CVE-2015-5801. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-8893. CWE: CWE-119. CVSS: 5.5. app/aboot/aboot.c in the Qualcomm bootloader in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices allows attackers to cause a denial of service (OS outage or buffer over-read) via a crafted application, aka Android internal bug 28822690 and Qualcomm internal bug CR822275.
Query: secure coding against Persistent Storable Data Element without Associated Comparison Control Element
Matching passage: CWE-1097 Persistent Storable Data Element without Associated Comparison Control Element. The product uses a storable data element that does not have all of the associated functions or methods that are necessary to support comparison.
Near-miss passage: CWE-797 Only Filtering Special Elements at an Absolute Position. The product receives data from an upstream component, but only accounts for special elements at an absolute position (e.g. byte number 10), thereby missing remaining special elements that may exist before sending it to a downstream component.
Query: describe CVE-2015-8738
Matching passage: CVE-2015-8738. CWE: CWE-20. CVSS: 5.5. The s7comm_decode_ud_cpu_szl_subfunc function in epan/dissectors/packet-s7comm_szl_ids.c in the S7COMM dissector in Wireshark 2.0.x before 2.0.1 does not validate the list count in an SZL response, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted packet.
Near-miss passage: CVE-2015-1102. CWE: CWE-20. CVSS: 7.099999904632568. The kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 does not properly handle TCP headers, which allows man-in-the-middle attackers to cause a denial of service via unspecified vectors.
Query: describe CVE-2015-2939
Matching passage: CVE-2015-2939. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Scribunto extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via a function name, which is not properly handled in a Lua error backtrace.
Near-miss passage: CVE-2015-1944. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.0 before 8.0.0.1 CF17 and 8.5.0 before CF06 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: risk of Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, versi
Matching passage: CVE-2015-3953. CWE: CWE-259. CVSS: 9.800000190734863. Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices. Hospira has also released the Plum 360 Infusion System which is not vulnerable to this issue.
Near-miss passage: CVE-2015-1967. CWE: CWE-200. CVSS: 4.300000190734863. MQ Explorer in IBM WebSphere MQ before 8.0.0.3 does not recognize the absence of the compatibility-mode option, which allows remote attackers to obtain sensitive information by sniffing the network for a session in which TLS is not used.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Term Queue module before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web scri
Matching passage: CVE-2015-2088. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Term Queue module before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Near-miss passage: CVE-2015-6732. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the SemanticForms extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via the (1) wpSummary parameter to Special:FormEdit, the (2) "Template label (optional)" field in a form, or a (3) Field name in a template.
Query: exploit The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by 
Matching passage: CVE-2015-4053. CWE: CWE-200. CVSS: 2.0999999046325684. The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file.
Near-miss passage: CVE-2015-1000008. CWE: CWE-200. CVSS: 5.300000190734863. Path Disclosure Vulnerability in wordpress plugin MP3-jPlayer v2.3.2
Query: describe CVE-2015-7465
Matching passage: CVE-2015-7465. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service (JRS) 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Near-miss passage: CVE-2015-2770. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the command line page in Websense TRITON V-Series appliances before 8.0.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Query: describe CVE-2015-3737
Matching passage: CVE-2015-3737. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Near-miss passage: CVE-2015-7272. CWE: CWE-119. CVSS: 9.800000190734863. Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long SSH username or input.
Query: playbook for alert: Persistence mechanism resembling Domain Groups
Matching passage: Playbook for T1069.002 Domain Groups. 1) Validate alert telemetry against T1069.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: discovery. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators. Commands such as <code>net group /domain</code> of the [Net
Near-miss passage: Playbook for T1069 Permission Groups Discovery. Different response path focused on discovery.
Query: exploit The log viewer in McAfee Agent (MA) before 4.8.0 Patch 3 and 5.0.0, when the "Accept connections only from the ePO server" option is disabled, allows remote attackers to conduct cl
Matching passage: CVE-2015-2053. CWE: CWE-20. CVSS: 4.300000190734863. The log viewer in McAfee Agent (MA) before 4.8.0 Patch 3 and 5.0.0, when the "Accept connections only from the ePO server" option is disabled, allows remote attackers to conduct clickjacking attacks via a crafted web page, aka an "http-generic-click-jacking" vulnerability.
Near-miss passage: CVE-2015-9068. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, an argument to a mink syscall is not properly validated.
Query: Sigma rule for Detects when the enablement of developer features such as "Developer Mode" or "Application Sideloading". Which allows th
Matching passage: Sigma rule: Detects when the enablement of developer features such as "Developer Mode" or "Application Sideloading". Which allows th. Logsource: windows / registry_set. Rule: title: Potential Signing Bypass Via Windows Developer Features - Registry id: b110ebaf-697f-4da1-afd5-b536fa27a2c1 related: - id: a383dec4-deec-4e6e-913b-ed9249670848 type: similar status: test description: Detects when the enablement of developer features such as "Developer Mode" or "Application Sideloading". Which allows the user to install untrusted packages. references: - https://twitter.com/malmoeb/status/1560536653709598721 - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-12 modified: 2023-08-17 tags: - attack.stealth logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Microsoft\Windows\CurrentVersion\AppModelUnlock - \Policies\Microsoft\Windows\Appx\ TargetObject|endswith: - \AllowAllTrustedApps - \AllowDevelopmentWithoutDevLicense Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the load of a revoked kernel driver. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Revoked Kernel Driver Loaded id: 320fccbf-5e32-4101-82b8-2679c5f007c6 status: test description: Detects the load of a revoked kernel driver references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-06 tags: - attack.privilege-escalation logsource: product: windows service: codeintegrity-operational detection: selection: EventID: - 3021 - 3022 condition: selection falsepositives: - Unlikely level: high