alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: explain T1567.003 Exfiltration to Text Storage Sites
Matching passage: T1567.003 Exfiltration to Text Storage Sites. Tactics: exfiltration. Description: Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as <code>pastebin[.]com</code>, are commonly used by developers to share code and other information. Text storage sites are often used to host malicious code for C2 communication (e.g., [Stage Capabilities](https://attack.mitre.org/techniques/T1608)), but adversaries may also use these sites to exfiltrate collected data. Furthermore, paid features and encryption options may allow adversaries to conceal and store data more securely.(Citation: Pastebin EchoSec) **Note:** This is distinct from [Exfiltration to Code Repository](https://attack.mitre.org/techniques/T1567/001), which highlight access to code repositories via APIs.
Near-miss passage: T1567.001 Exfiltration to Code Repository. Tactics: exfiltration. Description: Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection. Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network.
Query: risk of The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which al
Matching passage: CVE-2015-6524. CWE: CWE-255. CVSS: 5.0. The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.
Near-miss passage: CVE-2015-2915. CWE: CWE-255. CVSS: 7.300000190734863. Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M have a default password of admin for the admin account, which allows remote attackers to obtain web-management access by leveraging the ability to authenticate from the intranet.
Query: patch priority for CVE-2015-1925
Matching passage: CVE-2015-1925. CWE: CWE-119. CVSS: 7.800000190734863. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965.
Near-miss passage: CVE-2015-6075. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6068, CVE-2015-6072, CVE-2015-6073, CVE-2015-6077, CVE-2015-6079, CVE-2015-6080, and CVE-2015-6082.
Query: CVE similar to CVE-2015-7615
Matching passage: CVE-2015-7615. CWE: CWE-416. CVSS: 6.800000190734863. Use-after-free vulnerability in a SaveAs feature in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7617, and CVE-2015-7621.
Near-miss passage: CVE-2015-5706. CWE: CWE-416. CVSS: 4.599999904632568. Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a denial of service or possibly have unspecified other impact via O_TMPFILE filesystem operations that leverage a duplicate cleanup operation.
Query: detect Remove the Zone.Identifier alternate data stream which identifies the file as downloaded from the internet. in logs
Matching passage: Sigma rule: Remove the Zone.Identifier alternate data stream which identifies the file as downloaded from the internet.. Logsource: windows / ps_script. Rule: title: Suspicious Unblock-File id: 5947497f-1aa4-41dd-9693-c9848d58727d status: test description: Remove the Zone.Identifier alternate data stream which identifies the file as downloaded from the internet. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.005/T1553.005.md#atomic-test-3---remove-the-zoneidentifier-alternate-data-stream - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/unblock-file?view=powershell-7.2 author: frack113 date: 2022-02-01 tags: - attack.defense-impairment - attack.t1553.005 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'Unblock-File ' - '-Path ' condition: selection falsepositives: - Legitimate PowerShell scripts level: medium
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via COMPRESS OBFUSCATION. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module id: 7034cbbb-cc55-4dc2-8dad-36c0b942e8f1 related: - id: 20e5497e-331c-4cd5-8d36-935f6e2a9a07 type: derived status: test description: Detects Obfuscated Powershell via COMPRESS OBFUSCATION references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|contains|all: - new-object - text.encoding]::ascii Payload|contains: - system.io.compression.deflatestream - system.io.streamreader Payload|endswith: readtoend condition: selection_4103 falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-2484
Matching passage: CVE-2015-2484. CWE: CWE-264. CVSS: 6.400000095367432. Microsoft Internet Explorer 10 and 11 uses an incorrect flag during certain filesystem accesses, which allows remote attackers to delete arbitrary files via unspecified vectors, aka "Tampering Vulnerability."
Near-miss passage: CVE-2015-5961. CWE: CWE-264. CVSS: 3.299999952316284. The COPPA error page in the Accounts setup dialog in Mozilla Firefox OS before 2.2 embeds content from an external web server URL into the System process, which allows man-in-the-middle attackers to bypass intended access restrictions by spoofing that server.
Query: exploit WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and appli
Matching passage: CVE-2015-7097. CWE: CWE-119. CVSS: 6.800000190734863. WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.
Near-miss passage: CVE-2015-6979. CWE: CWE-119. CVSS: 9.300000190734863. GasGauge in Apple iOS before 9.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Query: patch priority for CVE-2015-4525
Matching passage: CVE-2015-4525. CWE: CWE-77. CVSS: 9.0. The log-gather implementation in the web administration interface in EMC Isilon OneFS 6.5.x.x through 7.1.1.x before 7.1.1.5 and 7.2.0.x before 7.2.0.2 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors.
Near-miss passage: CVE-2015-4974. CWE: CWE-77. CVSS: 7.199999809265137. IBM General Parallel File System (GPFS) 3.5.x before 3.5.0.27 and 4.1.x before 4.1.1.2 and Spectrum Scale 4.1.1.x before 4.1.1.2 allow local users to obtain root privileges for command execution via unspecified vectors.
Query: describe CVE-2015-1735
Matching passage: CVE-2015-1735. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1740, CVE-2015-1744, CVE-2015-1745, and CVE-2015-1766.
Near-miss passage: CVE-2015-5747. CWE: CWE-399. CVSS: 4.900000095367432. The fasttrap driver in the kernel in Apple OS X before 10.10.5 allows local users to cause a denial of service (resource consumption) via unspecified vectors.
Query: CWE for Improper Removal of Sensitive Information Before Storage or Transfer
Matching passage: CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer. The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
Near-miss passage: CWE-1342 Information Exposure through Microarchitectural State after Transient Execution. The processor does not properly clear microarchitectural state after incorrect microcode assists or speculative execution, resulting in transient execution.
Query: describe CVE-2015-5005
Matching passage: CVE-2015-5005. CWE: CWE-264. CVSS: 8.5. CSPOC in IBM PowerHA SystemMirror on AIX 6.1 and 7.1 allows remote authenticated users to perform an "su root" action by leveraging presence on the cluster-wide password-change list.
Near-miss passage: CVE-2015-2550. CWE: CWE-264. CVSS: 7.199999809265137. The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability."
Query: CVE similar to CVE-2015-1668
Matching passage: CVE-2015-1668. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-1956. CWE: CWE-399. CVSS: 7.800000190734863. IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (disk consumption) via a crafted byte sequence in authentication data, a different vulnerability than CVE-2015-1958 and CVE-2015-1987.
Query: exploit The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service 
Matching passage: CVE-2015-7019. CWE: CWE-119. CVSS: 5.599999904632568. The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via unspecified vectors, a different vulnerability than CVE-2015-7020.
Near-miss passage: CVE-2015-1845. CWE: CWE-119. CVSS: 10.0. Buffer overflow in the EntrReadArch function in unzoo might allow remote attackers to execute arbitrary code via unspecified vectors.
Query: detection rule: Detects the creation of the file "rootlog" which is used by the TripleCross rootkit as a way to check if the backdoor is
Matching passage: Sigma rule: Detects the creation of the file "rootlog" which is used by the TripleCross rootkit as a way to check if the backdoor is. Logsource: linux / file_event. Rule: title: Triple Cross eBPF Rootkit Default LockFile id: c0239255-822c-4630-b7f1-35362bcb8f44 status: test description: Detects the creation of the file "rootlog" which is used by the TripleCross rootkit as a way to check if the backdoor is already running. references: - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/src/helpers/execve_hijack.c#L33 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-05 modified: 2022-12-31 tags: - attack.stealth logsource: product: linux category: file_event detection: selection: TargetFilename: /tmp/rootlog condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects usage of system utilities to discover files and directories. Logsource: macos / process_creation. Rule: title: File and Directory Discovery - MacOS id: 089dbdf6-b960-4bcc-90e3-ffc3480c20f6 status: test description: Detects usage of system utilities to discover files and directories references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2022-11-25 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: macos detection: select_file_with_asterisk: Image: /usr/bin/file CommandLine|re: (.){200,} select_recursive_ls: Image: /bin/ls CommandLine|contains: -R select_find_execution: Image: /usr/bin/find select_mdfind_execution: Image: /usr/bin/mdfind select_tree_execution|endswith: Image: /tree condition: 1 of select* falsepositives: - Legitimate activities level: informational
Query: patch priority for CVE-2015-6568
Matching passage: CVE-2015-6568. CWE: CWE-20. CVSS: 8.800000190734863. Wolf CMS before 0.8.3.1 allows unrestricted file rename and PHP Code Execution because admin/plugin/file_manager/browse/ (aka the filemanager) does not prevent a change of a file extension to ".php" after originally using the parameter "filename" for uploading a JPEG image. Exploitation requires a registered user who has access to upload functionality.
Near-miss passage: CVE-2015-2435. CWE: CWE-20. CVSS: 9.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, and Silverlight before 5.1.40728 allow remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability."
Query: risk of Puppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist protection mechanism by leveraging the Puppet communications protocol.
Matching passage: CVE-2015-7330. CWE: CWE-254. CVSS: 8.800000190734863. Puppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist protection mechanism by leveraging the Puppet communications protocol.
Near-miss passage: CVE-2015-7863. CWE: CWE-254. CVSS: 5.0. The default configuration of Persistent Accelerite Radia Client Automation (formerly HP Client Automation) 7.9 through 9.1 before 2015-02-19 enables a remote Notify capability without the Extended Notify Security features, which might allow remote attackers to bypass intended access restrictions via unspecified vectors.
Query: rule covering Detects potential exfiltration attempt via audio file using PowerShell
Matching passage: Sigma rule: Detects potential exfiltration attempt via audio file using PowerShell. Logsource: windows / ps_script. Rule: title: Potential Data Exfiltration Via Audio File id: e4f93c99-396f-47c8-bb0f-201b1fa69034 status: test description: Detects potential exfiltration attempt via audio file using PowerShell references: - https://github.com/gtworek/PSBits/blob/e97cbbb173b31cbc4d37244d3412de0a114dacfb/NoDLP/bin2wav.ps1 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-16 tags: - attack.exfiltration logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_main: ScriptBlockText|contains|all: - '[System.Math]::' - '[IO.FileMode]::' - BinaryWriter selection_header_wav: ScriptBlockText|contains|all: - '0x52' - '0x49' - '0x46' - '0x57' - '0x41' - '0x56' - '0x45' - '0xAC' condition: selection_main and 1 of selection_header_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the installation of a new shim database where the file is located in a non-default location. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Shim Database In Uncommon Location id: 6b6976a3-b0e6-4723-ac24-ae38a737af41 status: test description: Detects the installation of a new shim database where the file is located in a non-default location references: - https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html - https://andreafortuna.org/2018/11/12/process-injection-and-persistence-using-application-shimming/ - https://www.blackhat.com/docs/asia-14/materials/Erickson/Asia-14-Erickson-Persist-It-Using-And-Abusing-Microsofts-Fix-It-Patches.pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-01 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.011 logsource: category: registry_set product: windows detection: selection: TargetObject|contains|all: - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\ - \DatabasePath filter_main_known_locations: Details|contains: :\Windows\AppPatch\Custom condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: rule covering Identifies when an account hasn't signed in during the past n number of days.
Matching passage: Sigma rule: Identifies when an account hasn't signed in during the past n number of days.. Logsource: azure / pim. Rule: title: Stale Accounts In A Privileged Role id: e402c26a-267a-45bd-9615-bd9ceda6da85 status: test description: Identifies when an account hasn't signed in during the past n number of days. references: - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#potential-stale-accounts-in-a-privileged-role author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-14 tags: - attack.initial-access - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation logsource: product: azure service: pim detection: selection: riskEventType: staleSignInAlertIncident condition: selection falsepositives: - Investigate if potential generic account that cannot be removed. level: high
Near-miss passage: Sigma rule: Detects the ld.so preload persistence file. See `man ld.so` for more information.. Logsource: linux. Rule: title: Code Injection by ld.so Preload id: 7e3c4651-c347-40c4-b1d4-d48590fdf684 status: test description: Detects the ld.so preload persistence file. See `man ld.so` for more information. references: - https://man7.org/linux/man-pages/man8/ld.so.8.html author: Christian Burkard (Nextron Systems) date: 2021-05-05 modified: 2022-10-09 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.006 logsource: product: linux detection: keywords: - /etc/ld.so.preload condition: keywords falsepositives: - Rare temporary workaround for library misconfiguration level: high
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects the creation of suspcious binary files inside the "\windows\system32\spool\drivers\color\" as seen in the blog r. Logsource: windows / file_event. Rule: title: Drop Binaries Into Spool Drivers Color Folder id: ce7066a6-508a-42d3-995b-2952c65dc2ce status: test description: Detects the creation of suspcious binary files inside the "\windows\system32\spool\drivers\color\" as seen in the blog referenced below references: - https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-28 tags: - attack.stealth logsource: product: windows category: file_event detection: selection: TargetFilename|startswith: C:\Windows\System32\spool\drivers\color\ TargetFilename|endswith: - .dll - .exe - .sys condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actor. Logsource: gcp / google_workspace.login. Rule: title: Google Workspace Government Attack Warning id: eafe6f2b-cfec-4612-aec2-49563c33a087 status: experimental description: Detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actor references: - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging - https://cloud.google.com/logging/docs/audit/understanding-audit-logs - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#gov_attack_warning author: Tom Kluter date: 2026-04-28 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.impact - attack.stealth - attack.t1078 logsource: product: gcp service: google_workspace.login detection: selection: protoPayload.serviceName: login.googleapis.com protoPayload.metadata.event.eventName: gov_attack_warning condition: selection falsepositives: - Unknown level: medium
Query: describe CVE-2015-2549
Matching passage: CVE-2015-2549. CWE: CWE-119. CVSS: 7.199999809265137. The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-5295. CWE: CWE-119. CVSS: 5.400000095367432. The template-validate command in OpenStack Orchestration API (Heat) before 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote authenticated users to cause a denial of service (memory consumption) or determine the existence of local files via the resource type in a template, as demonstrated by file:///dev/zero.
Query: exploit The prepend_path function in fs/dcache.c in the Linux kernel before 4.2.4 does not properly handle rename actions inside a bind mount, which allows local users to bypass an intende
Matching passage: CVE-2015-2925. CWE: UNKNOWN. CVSS: 6.900000095367432. The prepend_path function in fs/dcache.c in the Linux kernel before 4.2.4 does not properly handle rename actions inside a bind mount, which allows local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack."
Near-miss passage: CVE-2015-4834. CWE: UNKNOWN. CVSS: 3.700000047683716. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Utility/Zones.
Query: vulnerability: Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to gain shell access and execute arbitrary code with root privileges via unspeci
Matching passage: CVE-2015-4650. CWE: CWE-264. CVSS: 9.800000190734863. Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to gain shell access and execute arbitrary code with root privileges via unspecified vectors.
Near-miss passage: CVE-2015-4351. CWE: CWE-264. CVSS: 4.900000095367432. The Spider Video Player module for Drupal allows remote authenticated users with the "access Spider Video Player administration" permission to delete arbitrary files via a crafted URL.