alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: intelligence brief on T1558
Matching passage: T1558 Steal or Forge Kerberos Tickets. Tactics: credential access. Description: Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder) Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access. On Windows, the built-in <code>klist</code> utility can be used to list and analyze cached Kerberos tickets.(Citation: Microsoft Klist)
Near-miss passage: T1558.002 Silver Ticket. Tactics: credential access. Description: Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets.(Citation: ADSecurity Silver Tickets) Silver tickets are more limited in scope in than golden tickets in that they only enable adversaries to access a particular resource (e.g. MSSQL) and the system that hosts the resource; however, unlike golden tickets, adversaries with the ability to forge silver tickets are able to create TGS tickets without interacting with the Key Distribution Center (KDC), potentially making detection more difficult.(Citation: ADSecurity Detecting Forged Tickets) Password hashes for target services may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).
Query: risk of The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not check whether a node is expected, which
Matching passage: CVE-2015-1291. CWE: CWE-264. CVSS: 6.400000095367432. The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not check whether a node is expected, which allows remote attackers to bypass the Same Origin Policy or cause a denial of service (DOM tree corruption) via a web site with crafted JavaScript code and IFRAME elements.
Near-miss passage: CVE-2015-9015. CWE: CWE-264. CVSS: 7.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36714120.
Query: describe CVE-2015-9193
Matching passage: CVE-2015-9193. CWE: CWE-20. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, improper input validation could cause a memory overread and cause the app to crash.
Near-miss passage: CVE-2015-8740. CWE: CWE-20. CVSS: 5.300000190734863. The dissect_tds7_colmetadata_token function in epan/dissectors/packet-tds.c in the TDS dissector in Wireshark 2.0.x before 2.0.1 does not validate the number of columns, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet.
Query: weakness Unchecked Error Condition
Matching passage: CWE-391 Unchecked Error Condition. [PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES AND CONSIDER CWE-252, CWE-248, OR CWE-1069.] Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.
Near-miss passage: CWE-707 Improper Neutralization. The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
Query: patch priority for CVE-2015-4688
Matching passage: CVE-2015-4688. CWE: CWE-200. CVSS: 5.300000190734863. Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allow remote attackers to enumerate user accounts via a series of requests.
Near-miss passage: CVE-2015-3373. CWE: CWE-200. CVSS: 5.0. The Amazon AWS module before 7.x-1.3 for Drupal uses the base URL and AWS access key to generate the access token, which makes it easier for remote attackers to guess the token value and create backups via a crafted URL.
Query: ATT&CK technique for Malvertising
Matching passage: T1583.008 Malvertising. Tactics: resource development. Description: Adversaries may purchase online advertisements that can be abused to distribute malware to victims. Ads can be purchased to plant as well as favorably position artifacts in specific locations online, such as prominently placed within search engine results. These ads may make it more difficult for users to distinguish between actual search results and advertisements.(Citation: spamhaus-malvertising) Purchased ads may also target specific audiences using the advertising network’s capabilities, potentially further taking advantage of the trust inherently given to search engines and popular websites. Adversaries may purchase ads and other resources to help distribute artifacts containing malicious code to victims. Purchased ads may attempt to impersonate or spoof well-known brands. For example, these spoofed ads may trick victims into clicking the ad which could then send them to a malicious domain that may be a clone of official websites containing trojanized versions of the advertised software.(Citation: Masquerads-Guardio)(Citation: FBI-search) Adversary’s efforts to create malicious domains and purchase advertisements may also be automated at scale to better resist cleanup efforts.(Citation: sentinelone-malvertising) Malvertising may be used to support [Drive-by Target](https://attack.mitre.org/techniques/T1608/004) and [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), potentially requiring limited interaction from the user if the ad contains code/exploits that infect the target system's web browser.(Citation: BBC-malvertising) Adversaries may also employ several techniques to evade detection by the advertising network. For example, adversaries may dynamically route ad clicks to send automated crawler/policy enforcer traffic to benign sites while validating potential targets then sending victims referred from real ad clicks to malicious pages. This infection vector may therefore remain hidden from the ad network as well as any visitor not reaching th
Near-miss passage: T1583.002 DNS Server. Tactics: resource development. Description: Adversaries may set up their own Domain Name System (DNS) servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: [Application Layer Protocol](https://attack.mitre.org/techniques/T1071)). Instead of hijacking existing DNS servers, adversaries may opt to configure and run their own DNS servers in support of operations. By running their own DNS servers, adversaries can have more control over how they administer server-side DNS C2 traffic ([DNS](https://attack.mitre.org/techniques/T1071/004)). With control over a DNS server, adversaries can configure DNS applications to provide conditional responses to malware and, generally, have more flexibility in the structure of the DNS-based C2 channel.(Citation: Unit42 DNS Mar 2019)
Query: patch priority for CVE-2015-3694
Matching passage: CVE-2015-3694. CWE: CWE-119. CVSS: 6.800000190734863. FontParser in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-3719.
Near-miss passage: CVE-2015-6156. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6148.
Query: describe CVE-2015-5921
Matching passage: CVE-2015-5921. CWE: CWE-200. CVSS: 4.300000190734863. WebKit in Apple iOS before 9 mishandles "Content-Disposition: attachment" HTTP headers, which might allow man-in-the-middle attackers to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-7787. CWE: CWE-200. CVSS: 4.300000190734863. ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to discover the WPA2-PSK passphrase via unspecified vectors.
Query: vulnerability: WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corrupt
Matching passage: CVE-2015-1075. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Near-miss passage: CVE-2015-1899. CWE: CWE-399. CVSS: 7.800000190734863. IBM WebSphere Portal 8.5 through CF05 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
Query: exploit The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID parameter.
Matching passage: CVE-2015-9427. CWE: CWE-352. CVSS: 6.5. The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID parameter.
Near-miss passage: CVE-2015-8152. CWE: CWE-352. CVSS: 8.0. Cross-site request forgery (CSRF) vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6-MP4 allows remote authenticated users to hijack the authentication of administrators for requests that execute arbitrary code by adding lines to a logging script.
Query: exploit The System Integrity Protection feature in Apple OS X before 10.11.2 mishandles union mounts, which allows attackers to execute arbitrary code in a privileged context via a crafted
Matching passage: CVE-2015-7044. CWE: CWE-254. CVSS: 7.599999904632568. The System Integrity Protection feature in Apple OS X before 10.11.2 mishandles union mounts, which allows attackers to execute arbitrary code in a privileged context via a crafted app with root privileges.
Near-miss passage: CVE-2015-7435. CWE: CWE-254. CVSS: 2.5. IBM Tivoli Common Reporting (TCR) 2.1 before IF14, 2.1.1 before IF22, 2.1.1.2 before IF9, 3.1.0.0 through 3.1.2 as used in Cognos Business Intelligence before 10.2 IF16, and 3.1.2.1 as used in Cognos Business Intelligence before 10.2.1.1 IF12 allows local users to bypass the Cognos Application Firewall (CAF) protection mechanism via leading whitespace in the BackURL field.
Query: risk of WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corrupt
Matching passage: CVE-2015-1073. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Near-miss passage: CVE-2015-5058. CWE: CWE-399. CVSS: 7.800000190734863. Memory leak in the virtual server component in F5 Big-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and PEM 11.5.x before 11.5.1 HF10, 11.5.3 before HF1, and 11.6.0 before HF5, BIG-IQ Cloud, Device, and Security 4.4.0 through 4.5.0, and BIG-IQ ADC 4.5.0 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted ICMP packets.
Query: exploit The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted
Matching passage: CVE-2015-7309. CWE: CWE-74. CVSS: 6.5. The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it.
Near-miss passage: CVE-2015-5841. CWE: CWE-74. CVSS: 5.0. The CFNetwork Proxies component in Apple iOS before 9 does not properly handle a Set-Cookie header within a response to an HTTP CONNECT request, which allows remote proxy servers to conduct cookie-injection attacks via a crafted response.
Query: describe CVE-2015-3001
Matching passage: CVE-2015-3001. CWE: CWE-255. CVSS: 5.0. SysAid Help Desk before 15.2 uses a hardcoded password of Password1 for the sa SQL Server Express user account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password.
Near-miss passage: CVE-2015-7287. CWE: CWE-255. CVSS: 7.5. CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 use the same 001984 default PIN across different customers' installations, which allows remote attackers to execute commands by leveraging knowledge of this PIN and including it in an SMS message.
Query: rule covering Detects the execution of a renamed version of the Plink binary
Matching passage: Sigma rule: Detects the execution of a renamed version of the Plink binary. Logsource: windows / process_creation. Rule: title: Renamed Plink Execution id: 1c12727d-02bf-45ff-a9f3-d49806a3cf43 status: test description: Detects the execution of a renamed version of the Plink binary references: - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - https://the.earth.li/~sgtatham/putty/0.58/htmldoc/Chapter7.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-06 modified: 2023-02-03 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: Plink - CommandLine|contains|all: - ' -l forward' - ' -P ' - ' -R ' filter: Image|endswith: \plink.exe condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled ta. Logsource: windows / taskscheduler. Rule: title: Important Scheduled Task Deleted or Disabled id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d related: - id: dbc1f800-0fe0-4bc0-9c66-292c2abe3f78 type: similar - id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad type: similar - id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980 type: similar status: test description: 'Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities ' references: - https://www.socinvestigation.com/most-common-windows-event-ids-to-hunt-mind-map/ author: frack113 date: 2023-01-13 modified: 2026-03-11 tags: - attack.impact - attack.t1489 logsource: product: windows service: taskscheduler definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger' detection: selection: EventID: - 141 - 142 TaskName|contains: - \Windows\SystemRestore\SR - \Windows\Windows Defender\ - \Windows\BitLocker - \Windows\WindowsBackup\ - \Windows\WindowsUpdate\ - \Windows\UpdateOrchestrator\ - \Windows\ExploitGuard filter_main_user: UserName|contains: - AUTHORI - AUTORI condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable/info.yml simulation: - type: atomic-red-team name: Windows - Disable the SR scheduled task technique: T1490 atomic_guid: 1c68c68d-83a4-4981-974e-8993055fa034
Query: patch priority for CVE-2015-7184
Matching passage: CVE-2015-7184. CWE: CWE-284. CVSS: 6.800000190734863. The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Near-miss passage: CVE-2015-8275. CWE: CWE-284. CVSS: 5.5. LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 allow attackers to write to arbitrary files via crafted EDOC files.
Query: write Sigma for Detects suspicious execution of 'Msbuild.exe' by a uncommon parent process
Matching passage: Sigma rule: Detects suspicious execution of 'Msbuild.exe' by a uncommon parent process. Logsource: windows / process_creation. Rule: title: Suspicious Msbuild Execution By Uncommon Parent Process id: 33be4333-2c6b-44f4-ae28-102cdbde0a31 status: test description: Detects suspicious execution of 'Msbuild.exe' by a uncommon parent process references: - https://app.any.run/tasks/abdf586e-df0c-4d39-89a7-06bf24913401/ - https://www.echotrail.io/insights/search/msbuild.exe author: frack113 date: 2022-11-17 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: - Image|endswith: \MSBuild.exe - OriginalFileName: MSBuild.exe filter_parent: ParentImage|endswith: - \devenv.exe - \cmd.exe - \msbuild.exe - \python.exe - \explorer.exe - \nuget.exe condition: selection and not filter_parent falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the attack technique pass the hash which is used to move laterally inside the network. Logsource: windows / security. Rule: title: Pass the Hash Activity 2 id: 8eef149c-bd26-49f2-9e5a-9b00e3af499b status: stable description: Detects the attack technique pass the hash which is used to move laterally inside the network references: - https://github.com/iadgov/Event-Forwarding-Guidance/tree/master/Events - https://web.archive.org/web/20170909091934/https://blog.binarydefense.com/reliably-detecting-pass-the-hash-through-event-log-analysis - https://blog.stealthbits.com/how-to-detect-pass-the-hash-attacks/ author: Dave Kennedy, Jeff Warren (method) / David Vassallo (rule) date: 2019-06-14 modified: 2022-10-05 tags: - attack.lateral-movement - attack.t1550.002 logsource: product: windows service: security definition: The successful use of PtH for lateral movement between workstations would trigger event ID 4624 detection: selection_logon3: EventID: 4624 SubjectUserSid: S-1-0-0 LogonType: 3 LogonProcessName: NtLmSsp KeyLength: 0 selection_logon9: EventID: 4624 LogonType: 9 LogonProcessName: seclogo filter: TargetUserName: ANONYMOUS LOGON condition: 1 of selection_* and not filter falsepositives: - Administrator activity level: medium
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects creation of local users via the net.exe command with the option "never expire". Logsource: windows / process_creation. Rule: title: New User Created Via Net.EXE With Never Expire Option id: b9f0e6f5-09b4-4358-bae4-08408705bd5c related: - id: cd219ff3-fa99-45d4-8380-a7d15116c6dc type: derived status: test description: Detects creation of local users via the net.exe command with the option "never expire" references: - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-12 modified: 2023-02-21 tags: - attack.persistence - attack.t1136.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: CommandLine|contains|all: - user - add - expires:never condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects a suspicious program execution in Outlook temp folder. Logsource: windows / process_creation. Rule: title: Suspicious Execution From Outlook Temporary Folder id: a018fdc3-46a3-44e5-9afb-2cd4af1d4b39 status: test description: Detects a suspicious program execution in Outlook temp folder author: Florian Roth (Nextron Systems) references: - Internal Research date: 2019-10-01 modified: 2022-10-09 tags: - attack.initial-access - attack.t1566.001 logsource: category: process_creation product: windows detection: selection: Image|contains: \Temporary Internet Files\Content.Outlook\ condition: selection falsepositives: - Unknown level: high
Query: alert when Detects the use of tools that copy files from or to remote systems
Matching passage: Sigma rule: Detects the use of tools that copy files from or to remote systems. Logsource: linux. Rule: title: Remote File Copy id: 7a14080d-a048-4de8-ae58-604ce58a795b status: stable description: Detects the use of tools that copy files from or to remote systems references: - https://www.cisa.gov/stopransomware/ransomware-guide author: Ömer Günal date: 2020-06-18 tags: - attack.command-and-control - attack.lateral-movement - attack.t1105 logsource: product: linux detection: tools: - 'scp ' - 'rsync ' - 'sftp ' filter: - '@' - ':' condition: tools and filter falsepositives: - Legitimate administration activities level: low
Near-miss passage: Sigma rule: Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escala. Logsource: windows / registry_set. Rule: title: Add Port Monitor Persistence in Registry id: 944e8941-f6f6-4ee8-ac05-1c224e923c0e status: test description: 'Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.010/T1547.010.md author: frack113 date: 2021-12-30 modified: 2024-03-25 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.010 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Control\Print\Monitors\ Details|endswith: .dll filter_optional_cutepdf: Image: C:\Windows\System32\spoolsv.exe TargetObject|contains: \Control\Print\Monitors\CutePDF Writer Monitor v4.0\Driver Details: cpwmon64_v40.dll User|contains: - AUTHORI - AUTORI filter_optional_monvnc: TargetObject|contains: \Control\Print\Monitors\MONVNC\Driver filter_optional_vnc: TargetObject|contains|all: - Control\Print\Environments\ - \Drivers\ - \VNC Printer condition: selection and not 1 of filter_optional_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_add_port_monitor/info.yml simulation: - type: atomic-red-team name: Add Port Monitor persistence in Registry technique: T1547.010 atomic_guid: d34ef297-f178-4462-871e-9ce618d44e50