alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Multiple failed authentications followed by MSBuild
Matching passage: T1127.001 MSBuild. Tactics: stealth, execution. Description: Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.(Citation: MSDN MSBuild) Adversaries can abuse MSBuild to proxy execution of malicious code. The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# or Visual Basic code to be inserted into an XML project file.(Citation: MSDN MSBuild)(Citation: Microsoft MSBuild Inline Tasks 2017) MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.(Citation: LOLBAS Msbuild)
Near-miss passage: T1127.002 ClickOnce. Tactics: stealth, execution. Description: Adversaries may use ClickOnce applications (.appref-ms and .application files) to proxy execution of code through a trusted Windows utility.(Citation: Burke/CISA ClickOnce BlackHat) ClickOnce is a deployment that enables a user to create self-updating Windows-based .NET applications (i.e, .XBAP, .EXE, or .DLL) that install and run from a file share or web page with minimal user interaction. The application launches as a child process of DFSVC.EXE, which is responsible for installing, launching, and updating the application.(Citation: SpectorOps Medium ClickOnce) Because ClickOnce applications receive only limited permissions, they do not require administrative permissions to install.(Citation: Microsoft Learn ClickOnce) As such, adversaries may abuse ClickOnce to proxy execution of malicious code without needing to escalate privileges. ClickOnce may be abused in a number of ways. For example, an adversary may rely on [User Execution](https://attack.mitre.org/techniques/T1204). When a user visits a malicious website, the .NET malware is disguised as legitimate software and a ClickOnce popup is displayed for installation.(Citation: NetSPI ClickOnce) Adversaries may also abuse ClickOnce to execute malware via a [Rundll32](https://attack.mitre.org/techniques/T1218/011) script using the command `rundll32.exe dfshim.dll,ShOpenVerbApplication1`.(Citation: LOLBAS /Dfsvc.exe) Additionally, an adversary can move the ClickOnce application file to a remote user’s startup folder for continued malicious code deployment (i.e., [Registry Run Keys / Startup Folder](https://attack.mitre.org/techniques/T1547/001)).(Citation: Burke/CISA ClickOnce BlackHat)(Citation: Burke/CISA ClickOnce Paper)
Query: risk of In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 
Matching passage: CVE-2015-9163. CWE: CWE-200. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, in a PlayReady function, information exposure can occur.
Near-miss passage: CVE-2015-2209. CWE: CWE-200. CVSS: 5.0. DLGuard 4.5 allows remote attackers to obtain the installation path via the c parameter to index.php.
Query: describe CVE-2015-4909
Matching passage: CVE-2015-4909. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.4.0, 12.1.2.0.0, and 12.1.3.0.0 allows remote attackers to affect integrity via vectors related to ADF Faces.
Near-miss passage: CVE-2015-0478. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JRockit R28.3.5, allows remote attackers to affect confidentiality via vectors related to JCE.
Query: CWE for Reliance on Package-level Scope
Matching passage: CWE-487 Reliance on Package-level Scope. Java packages are not inherently closed; therefore, relying on them for code security is not a good practice.
Near-miss passage: CWE-662 Improper Synchronization. The product utilizes multiple threads, processes, components, or systems to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.
Query: weakness Use of Incorrectly-Resolved Name or Reference
Matching passage: CWE-706 Use of Incorrectly-Resolved Name or Reference. The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
Near-miss passage: CWE-654 Reliance on a Single Factor in a Security Decision. A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.
Query: playbook for alert: Multiple failed authentications followed by Cloud Service Hijacking
Matching passage: Playbook for T1496.004 Cloud Service Hijacking. 1) Validate alert telemetry against T1496.004. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: impact. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability. For example, adversaries may leverage email and messaging services, such as AWS Simple Email Service (SES), AWS Simple Notification Service (SNS), SendGrid, and Twilio, in order to send large quantities of spam / [Phishing](https://attac
Near-miss passage: Playbook for T1496.003 SMS Pumping. Different response path focused on impact.
Query: describe CVE-2015-5576
Matching passage: CVE-2015-5576. CWE: CWE-200. CVSS: 5.0. Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors.
Near-miss passage: CVE-2015-4375. CWE: CWE-200. CVSS: 4.300000190734863. The Chaos tool suite (ctools) module 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to obtain sensitive node titles via (1) an autocomplete search on custom entities without an access query tag or (2) leveraging knowledge of the ID of an entity.
Query: CVE similar to CVE-2015-1812
Matching passage: CVE-2015-1812. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1813.
Near-miss passage: CVE-2015-0128. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix4, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-0124.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in Ipswitch MOVEit Mobile before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the query string to mobile/.
Matching passage: CVE-2015-7679. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Ipswitch MOVEit Mobile before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the query string to mobile/.
Near-miss passage: CVE-2015-2241. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.
Query: detection rule: Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to do
Matching passage: Sigma rule: Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to do. Logsource: windows / process_creation. Rule: title: Remote File Download Via Desktopimgdownldr Utility id: 214641c2-c579-4ecb-8427-0cf19df6842e status: test description: Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil. references: - https://www.elastic.co/guide/en/security/current/remote-file-download-via-desktopimgdownldr-utility.html author: Tim Rauch, Elastic (idea) date: 2022-09-27 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection: Image|endswith: \desktopimgdownldr.exe ParentImage|endswith: \desktopimgdownldr.exe CommandLine|contains: /lockscreenurl:http condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when an attacker tries to disable User Account Control (UAC) notification by tampering with the "UACDisableNotif. Logsource: windows / registry_set. Rule: title: UAC Notification Disabled id: c5f6a85d-b647-40f7-bbad-c10b66bab038 related: - id: 0d7ceeef-3539-4392-8953-3dc664912714 type: similar - id: 48437c39-9e5f-47fb-af95-3d663c3f2919 type: similar status: test description: 'Detects when an attacker tries to disable User Account Control (UAC) notification by tampering with the "UACDisableNotify" value. UAC is a critical security feature in Windows that prevents unauthorized changes to the operating system. It prompts the user for permission or an administrator password before allowing actions that could affect the system''s operation or change settings that affect other users. When "UACDisableNotify" is set to 1, UAC prompts are suppressed. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/7e11e9b79583545f208a6dc3fa062f2ed443d999/atomics/T1548.002/T1548.002.md - https://securityintelligence.com/x-force/x-force-hive0129-targeting-financial-institutions-latam-banking-trojan/ author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2024-05-10 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Security Center\UACDisableNotify Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: medium
Query: risk of Cross-site scripting (XSS) vulnerability in Cisco Unified Presence Server 9.1(1) allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID
Matching passage: CVE-2015-4220. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Cisco Unified Presence Server 9.1(1) allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCuq03773.
Near-miss passage: CVE-2015-6416. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Cisco Unified Email Interaction Manager and Unified Web Interaction Manager 11.0(1) allows remote attackers to inject arbitrary web script or HTML a crafted URL, aka Bug ID CSCuw24479.
Query: ATT&CK technique for Archive Collected Data
Matching passage: T1560 Archive Collected Data. Tactics: collection. Description: An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.(Citation: DOJ GRU Indictment Jul 2018) Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender. Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.
Near-miss passage: T1560.003 Archive via Custom Method. Tactics: collection. Description: An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.(Citation: ESET Sednit Part 2)
Query: risk of Mozilla Firefox before 41.0 allows remote attackers to bypass certain ECMAScript 5 (aka ES5) API protection mechanisms and modify immutable properties, and consequently execute arb
Matching passage: CVE-2015-4516. CWE: CWE-254. CVSS: 9.300000190734863. Mozilla Firefox before 41.0 allows remote attackers to bypass certain ECMAScript 5 (aka ES5) API protection mechanisms and modify immutable properties, and consequently execute arbitrary JavaScript code with chrome privileges, via a crafted web page that does not use ES5 APIs.
Near-miss passage: CVE-2015-6618. CWE: CWE-254. CVSS: 4.300000190734863. Bluetooth in Android 4.4 and 5.x before 5.1.1 LMY48Z allows user-assisted remote attackers to execute arbitrary code by leveraging access to the local physical environment, aka internal bug 24595992.
Query: CVE similar to CVE-2015-0598
Matching passage: CVE-2015-0598. CWE: CWE-19. CVSS: 6.800000190734863. The RADIUS implementation in Cisco IOS and IOS XE allows remote attackers to cause a denial of service (device reload) via crafted IPv6 Attributes in Access-Accept packets, aka Bug IDs CSCur84322 and CSCur27693.
Near-miss passage: CVE-2015-8985. CWE: CWE-19. CVSS: 5.900000095367432. The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.
Query: detect Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code. in logs
Matching passage: Sigma rule: Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code.. Logsource: windows / process_creation. Rule: title: AspNetCompiler Execution id: a01b8329-5953-4f73-ae2d-aa01e1f35f00 related: - id: 9ccba514-7cb6-4c5c-b377-700758f2f120 type: similar - id: 4c7f49ee-2638-43bb-b85b-ce676c30b260 type: similar - id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622 type: similar status: test description: Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code. references: - https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/ - https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/ author: frack113 date: 2021-11-24 modified: 2025-02-24 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection: Image|contains: - :\Windows\Microsoft.NET\Framework\ - :\Windows\Microsoft.NET\Framework64\ - :\Windows\Microsoft.NET\FrameworkArm\ - :\Windows\Microsoft.NET\FrameworkArm64\ Image|endswith: \aspnet_compiler.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects modification addition to the 'TypedPaths' key in the user or admin registry via the commandline. Which might ind. Logsource: windows / process_creation. Rule: title: Persistence Via TypedPaths - CommandLine id: ec88289a-7e1a-4cc3-8d18-bd1f60e4b9ba status: test description: Detects modification addition to the 'TypedPaths' key in the user or admin registry via the commandline. Which might indicate persistence attempt references: - https://twitter.com/dez_/status/1560101453150257154 - https://forensafe.com/blogs/typedpaths.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-22 tags: - attack.persistence logsource: category: process_creation product: windows detection: selection: CommandLine|contains: \Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths condition: selection falsepositives: - Unknown level: medium
Query: describe CVE-2015-8870
Matching passage: CVE-2015-8870. CWE: CWE-20. CVSS: 7.400000095367432. Integer overflow in tools/bmp2tiff.c in LibTIFF before 4.0.4 allows remote attackers to cause a denial of service (heap-based buffer over-read), or possibly obtain sensitive information from process memory, via crafted width and length values in RLE4 or RLE8 data in a BMP file.
Near-miss passage: CVE-2015-7004. CWE: CWE-20. CVSS: 7.099999904632568. The kernel in Apple iOS before 9.1 allows attackers to cause a denial of service via a crafted app.
Query: exploit SQL injection vulnerability in WordPress Community Events plugin before 1.4.
Matching passage: CVE-2015-3313. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in WordPress Community Events plugin before 1.4.
Near-miss passage: CVE-2015-1479. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to execute arbitrary SQL commands via the site parameter.
Query: CVE similar to CVE-2015-7771
Matching passage: CVE-2015-7771. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the runtime engine in the Newphoria applican framework before 1.13.0 for Android and iOS allows remote attackers to inject arbitrary web script or HTML via a crafted SSID that is encountered by an applican application, a different vulnerability than CVE-2015-7772.
Near-miss passage: CVE-2015-8622. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1, when is configured with a relative URL, allows remote authenticated users to inject arbitrary web script or HTML via wikitext, as demonstrated by a wikilink to a page named "javascript:alert('XSS!')."
Query: actor TTPs: Audio Capture
Matching passage: T1123 Audio Capture. Tactics: collection. Description: An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.(Citation: ESET Attor Oct 2019) Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture audio. Audio files may be written to disk and exfiltrated later.
Near-miss passage: T1213.004 Customer Relationship Management Software. Tactics: collection. Description: Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable information. CRM software is used to assist organizations in tracking and managing customer interactions, as well as storing customer data. Once adversaries gain access to a victim organization, they may mine CRM software for customer data. This may include personally identifiable information (PII) such as full names, emails, phone numbers, and addresses, as well as additional details such as purchase histories and IT support interactions. By collecting this data, an adversary may be able to send personalized [Phishing](https://attack.mitre.org/techniques/T1566) emails, engage in SIM swapping, or otherwise target the organization’s customers in ways that enable financial gain or the compromise of additional organizations.(Citation: Bleeping Computer US Cellular Hack 2022)(Citation: Bleeping Computer Mint Mobile Hack 2021)(Citation: Bleeping Computer Bank Hack 2020) CRM software may be hosted on-premises or in the cloud. Information stored in these solutions may vary based on the specific instance or environment. Examples of CRM software include Microsoft Dynamics 365, Salesforce, Zoho, Zendesk, and HubSpot.
Query: vulnerability: The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel before 3.19.3 does not properly determine the memory locations used for encrypted da
Matching passage: CVE-2015-3331. CWE: CWE-119. CVSS: 9.300000190734863. The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel before 3.19.3 does not properly determine the memory locations used for encrypted data, which allows context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket.
Near-miss passage: CVE-2015-8645. CWE: CWE-119. CVSS: 8.800000190734863. Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8459, CVE-2015-8460, and CVE-2015-8636.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the Smart Trim module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary w
Matching passage: CVE-2015-5489. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Smart Trim module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors involving the field settings form.
Near-miss passage: CVE-2015-0167. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in textAngular-sanitize.js in textAngular before 1.3.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the editor.
Query: CVE similar to CVE-2015-0572
Matching passage: CVE-2015-0572. CWE: CWE-362. CVSS: 7.0. Multiple race conditions in drivers/char/adsprpc.c and drivers/char/adsprpc_compat.c in the ADSPRPC driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a denial of service (zero-value write) or possibly have unspecified other impact via a COMPAT_FASTRPC_IOCTL_INVOKE_FD ioctl call.
Near-miss passage: CVE-2015-5232. CWE: CWE-362. CVSS: 8.100000381469727. Race conditions in opa-fm before 10.4.0.0.196 and opa-ff before 10.4.0.0.197.