alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: what is T1014
Matching passage: T1014 Rootkit. Tactics: stealth. Description: Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits) Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or [System Firmware](https://attack.mitre.org/techniques/T1542/001). (Citation: Wikipedia Rootkit) Rootkits have been seen for Windows, Linux, and Mac OS X systems. (Citation: CrowdStrike Linux Rootkit) (Citation: BlackHat Mac OSX Rootkit) Rootkits that reside or modify boot sectors are known as [Bootkit](https://attack.mitre.org/techniques/T1542/003)s and specifically target the boot process of the operating system.
Near-miss passage: T1218.001 Compiled HTML File. Tactics: stealth. Description: Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program) A custom CHM file containing embedded payloads could be delivered to a victim then triggered by [User Execution](https://attack.mitre.org/techniques/T1204). CHM execution may also bypass application application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe. (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017)
Query: CWE for Improper Neutralization of Multiple Leading Special Elements
Matching passage: CWE-161 Improper Neutralization of Multiple Leading Special Elements. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple leading special elements that could be interpreted in unexpected ways when they are sent to a downstream component.
Near-miss passage: CWE-1023 Incomplete Comparison with Missing Factors. The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.
Query: vulnerability: The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS.
Matching passage: CVE-2015-9303. CWE: CWE-79. CVSS: 6.099999904632568. The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS.
Near-miss passage: CVE-2015-8795. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in the Admin UI in Apache Solr before 5.1 allow remote attackers to inject arbitrary web script or HTML via crafted fields that are mishandled during the rendering of the (1) Analysis page, related to webapp/web/js/scripts/analysis.js or (2) Schema-Browser page, related to webapp/web/js/scripts/schema-browser.js.
Query: alert when Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where t
Matching passage: Sigma rule: Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where t. Logsource: windows / ps_script. Rule: title: Zip A Folder With PowerShell For Staging In Temp - PowerShell Script id: b7a3c9a3-09ea-4934-8864-6a32cacd98d9 related: - id: 71ff406e-b633-4989-96ec-bc49d825a412 type: similar - id: daf7eb81-35fd-410d-9d7a-657837e602bb type: similar - id: 85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98 type: similar status: test description: 'Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2021-07-20 modified: 2023-12-18 tags: - attack.collection - attack.t1074.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Compress-Archive -Path*-DestinationPath $env:TEMP - Compress-Archive -Path*-DestinationPath*\AppData\Local\Temp\ - Compress-Archive -Path*-DestinationPath*:\Windows\Temp\ condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like. Logsource: windows / security. Rule: title: RottenPotato Like Attack Pattern id: 16f5d8ca-44bd-47c8-acbe-6fc95a16c12f status: test description: Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like references: - https://twitter.com/SBousseaden/status/1195284233729777665 author: '@SBousseaden, Florian Roth' date: 2019-11-15 modified: 2022-12-22 tags: - attack.collection - attack.privilege-escalation - attack.credential-access - attack.t1557.001 logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 3 TargetUserName: ANONYMOUS LOGON WorkstationName: '-' IpAddress: - 127.0.0.1 - ::1 condition: selection falsepositives: - Unknown level: high
Query: campaign using Shared Webroot
Matching passage: T1051 Shared Webroot. Tactics: lateral movement. Description: **This technique has been deprecated and should no longer be used.** Adversaries may add malicious content to an internally accessible website through an open network file share that contains the website's webroot or Web content directory (Citation: Microsoft Web Root OCT 2016) (Citation: Apache Server 2018) and then browse to that content with a Web browser to cause the server to execute the malicious content. The malicious content will typically run under the context and permissions of the Web server process, often resulting in local system or administrative privileges, depending on how the Web server is configured. This mechanism of shared access and remote execution could be used for lateral movement to the system running the Web server. For example, a Web server running PHP with an open network share could allow an adversary to upload a remote access tool and PHP script to execute the RAT on the system running the Web server when a specific page is visited. (Citation: Webroot PHP 2011)
Near-miss passage: T1021.004 SSH. Tactics: lateral movement. Description: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user. SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. On ESXi, SSH can be enabled either directly on the host (e.g., via `vim-cmd hostsvc/enable_ssh`) or via vCenter.(Citation: Sygnia ESXi Ransomware 2025)(Citation: TrendMicro ESXI Ransomware)(Citation: Sygnia Abyss Locker 2025) The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password. In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to login as that user (i.e., [SSH Authorized Keys](https://attack.mitre.org/techniques/T1098/004)).
Query: rule covering Detects when a memory process image does not match the disk image, indicative of process hollowing.
Matching passage: Sigma rule: Detects when a memory process image does not match the disk image, indicative of process hollowing.. Logsource: windows / process_tampering. Rule: title: Potential Process Hollowing Activity id: c4b890e5-8d8c-4496-8c66-c805753817cd status: test description: Detects when a memory process image does not match the disk image, indicative of process hollowing. references: - https://twitter.com/SecurePeacock/status/1486054048390332423?s=20 - https://www.bleepingcomputer.com/news/microsoft/microsoft-sysmon-now-detects-malware-process-tampering-attempts/ author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Sittikorn S date: 2022-01-25 modified: 2023-11-28 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.012 logsource: product: windows category: process_tampering detection: selection: Type: Image is replaced filter_main_generic: Image|contains: - :\Program Files (x86) - :\Program Files\ - :\Windows\System32\wbem\WMIADAP.exe - :\Windows\SysWOW64\wbem\WMIADAP.exe filter_optional_opera: Image|contains: \AppData\Local\Programs\Opera\ Image|endswith: \opera.exe filter_optional_edge: Image|endswith: \WindowsApps\MicrosoftEdge.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects appending of zip file to image. Logsource: linux / auditd. Rule: title: Steganography Hide Zip Information in Picture File id: 45810b50-7edc-42ca-813b-bdac02fb946b status: test description: Detects appending of zip file to image references: - https://zerotoroot.me/steganography-hiding-a-zip-in-a-jpeg-file/ author: Pawel Mazur date: 2021-09-09 modified: 2022-10-09 tags: - attack.stealth - attack.t1027.003 logsource: product: linux service: auditd detection: commands: type: EXECVE a0: cat a1: a1|endswith: - .jpg - .png a2: a2|endswith: .zip condition: commands and a1 and a2 falsepositives: - Unknown level: low
Query: CVE similar to CVE-2015-7484
Matching passage: CVE-2015-7484. CWE: CWE-200. CVSS: 4.300000190734863. IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1 and 4.0 before 4.0.7 iFix10 allow remote authenticated users with access to lifecycle projects to obtain sensitive information by sending a crafted URL to the Lifecycle Query Engine. IBM X-Force ID: 108619.
Near-miss passage: CVE-2015-7421. CWE: CWE-200. CVSS: 3.700000047683716. Unspecified vulnerability in GSKit on IBM MQ M2000 appliances before 8.0.0.4 allows remote attackers to obtain sensitive information via unknown vectors, a different vulnerability than CVE-2015-7420.
Query: detect Detects PowerShell scripts that contains reference to keystroke capturing functions in logs
Matching passage: Sigma rule: Detects PowerShell scripts that contains reference to keystroke capturing functions. Logsource: windows / ps_script. Rule: title: Potential Keylogger Activity id: 965e2db9-eddb-4cf6-a986-7a967df651e4 status: test description: Detects PowerShell scripts that contains reference to keystroke capturing functions references: - https://twitter.com/ScumBots/status/1610626724257046529 - https://www.virustotal.com/gui/file/d4486b63512755316625230e0c9c81655093be93876e0d80732e7eeaf7d83476/content - https://www.virustotal.com/gui/file/720a7ee9f2178c70501d7e3f4bcc28a4f456e200486dbd401b25af6da3b4da62/content - https://learn.microsoft.com/en-us/dotnet/api/system.windows.input.keyboard.iskeydown?view=windowsdesktop-7.0 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-04 tags: - attack.collection - attack.credential-access - attack.t1056.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: '[Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::' condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when an Okta policy is modified or deleted.. Logsource: okta / okta. Rule: title: Okta Policy Modified or Deleted id: 1667a172-ed4c-463c-9969-efd92195319a status: test description: Detects when an Okta policy is modified or deleted. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-12 modified: 2026-04-27 tags: - attack.impact logsource: product: okta service: okta detection: selection: eventType: - policy.lifecycle.update - policy.lifecycle.delete condition: selection falsepositives: - Okta Policies being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Okta Policies modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Query: Suspicious Cloud Accounts execution detected on endpoint
Matching passage: T1585.003 Cloud Accounts. Tactics: resource development. Description: Adversaries may create accounts with cloud providers that can be used during targeting. Adversaries can use cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, MEGA, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s. Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure. Establishing cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud) Creating [Cloud Accounts](https://attack.mitre.org/techniques/T1585/003) may also require adversaries to establish [Email Accounts](https://attack.mitre.org/techniques/T1585/002) to register with the cloud provider.
Near-miss passage: T1585 Establish Accounts. Tactics: resource development. Description: Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) For operations incorporating social engineering, the utilization of an online persona may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, GitHub, Docker Hub, etc.). Establishing a persona may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) Establishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) In addition, establishing accounts may allow adversaries to abuse free services, such as registering for trial periods to [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) for malicious purposes.(Citation: Free Trial PurpleUrchin)
Query: detection rule: Detects Windows services that got terminated for whatever reason
Matching passage: Sigma rule: Detects Windows services that got terminated for whatever reason. Logsource: windows / system. Rule: title: Windows Service Terminated With Error id: acfa2210-0d71-4eeb-b477-afab494d596c related: - id: d6b5520d-3934-48b4-928c-2aa3f92d6963 type: similar status: test description: Detects Windows services that got terminated for whatever reason references: - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-14 tags: - attack.stealth logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7023 condition: selection falsepositives: - False positives could occur since service termination could happen due to multiple reasons level: low
Near-miss passage: Sigma rule: Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe" Both can be used for AWL bypass and to execut. Logsource: windows / process_creation. Rule: title: Use of FSharp Interpreters id: b96b2031-7c17-4473-afe7-a30ce714db29 status: test description: 'Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe" Both can be used for AWL bypass and to execute F# code via scripts or inline. ' references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac - https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/ - https://lolbas-project.github.io/lolbas/OtherMSBinaries/FsiAnyCpu/ - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Fsi/ author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io date: 2022-06-02 modified: 2024-04-23 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \fsi.exe - \fsianycpu.exe - OriginalFileName: - fsi.exe - fsianycpu.exe condition: selection falsepositives: - Legitimate use by a software developer. level: medium
Query: detection rule: Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this actio
Matching passage: Sigma rule: Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this actio. Logsource: aws / cloudtrail. Rule: title: AWS Route 53 Domain Transfer Lock Disabled id: 3940b5f1-3f46-44aa-b746-ebe615b879e0 status: test description: Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar. references: - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/integrations/aws/persistence_route_53_domain_transfer_lock_disabled.toml - https://docs.aws.amazon.com/Route53/latest/APIReference/API_Operations_Amazon_Route_53.html - https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_DisableDomainTransferLock.html author: Elastic, Austin Songer @austinsonger date: 2021-07-22 modified: 2022-10-09 tags: - attack.persistence - attack.privilege-escalation - attack.credential-access - attack.t1098 logsource: product: aws service: cloudtrail detection: selection: eventSource: route53.amazonaws.com eventName: DisableDomainTransferLock condition: selection falsepositives: - A domain transfer lock may be disabled by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Activity from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Near-miss passage: Sigma rule: Detects weak passwords or often abused passwords (seen used by threat actors) via the CLI. An example would be a threat. Logsource: windows / process_creation. Rule: title: Weak or Abused Passwords In CLI id: 91edcfb1-2529-4ac2-9ecc-7617f895c7e4 status: test description: 'Detects weak passwords or often abused passwords (seen used by threat actors) via the CLI. An example would be a threat actor creating a new user via the net command and providing the password inline ' references: - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments - https://thedfirreport.com/2022/09/26/bumblebee-round-two/ - https://www.microsoft.com/en-us/security/blog/2022/10/25/dev-0832-vice-society-opportunistic-ransomware-campaigns-impacting-us-education-sector/ - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-14 modified: 2024-02-23 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - '123456789' - 123123qwE - Asd123.aaaa - Decryptme - P@ssw0rd! - Pass8080 - password123 - test@202 condition: selection falsepositives: - Legitimate usage of the passwords by users via commandline (should be discouraged) - Other currently unknown false positives level: medium
Query: describe CVE-2015-8772
Matching passage: CVE-2015-8772. CWE: CWE-19. CVSS: 9.100000381469727. McPvDrv.sys 4.6.111.0 in McAfee File Lock 5.x in McAfee Total Protection allows local users to obtain sensitive information from kernel memory or cause a denial of service (system crash) via a large VERIFY_INFORMATION.Length value in an IOCTL_DISK_VERIFY ioctl call.
Near-miss passage: CVE-2015-5348. CWE: CWE-19. CVSS: 8.100000381469727. Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
Query: CVE similar to CVE-2015-7547
Matching passage: CVE-2015-7547. CWE: CWE-119. CVSS: 8.100000381469727. Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module.
Near-miss passage: CVE-2015-3105. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Query: exploit The parse_SST function in FreeXL before 1.0.0i allows remote attackers to cause a denial of service (memory consumption) via a crafted shared strings table in a workbook.
Matching passage: CVE-2015-2776. CWE: CWE-20. CVSS: 4.300000190734863. The parse_SST function in FreeXL before 1.0.0i allows remote attackers to cause a denial of service (memory consumption) via a crafted shared strings table in a workbook.
Near-miss passage: CVE-2015-8562. CWE: CWE-20. CVSS: 7.5. Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015.