alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects the execution of "lodctr.exe" to rebuild the performance counter registry values. This can be abused by attacker
Matching passage: Sigma rule: Detects the execution of "lodctr.exe" to rebuild the performance counter registry values. This can be abused by attacker. Logsource: windows / process_creation. Rule: title: Rebuild Performance Counter Values Via Lodctr.EXE id: cc9d3712-6310-4320-b2df-7cb408274d53 status: test description: Detects the execution of "lodctr.exe" to rebuild the performance counter registry values. This can be abused by attackers by providing a malicious config file to overwrite performance counter configuration to confuse and evade monitoring and security solutions. references: - https://learn.microsoft.com/en-us/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-15 modified: 2024-03-05 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \lodctr.exe OriginalFileName: LODCTR.EXE selection_cli: CommandLine|contains|windash: ' -r' condition: all of selection_* falsepositives: - Legitimate usage by an administrator level: medium
Near-miss passage: Sigma rule: Detects usage of bitsadmin downloading a file with a suspicious extension. Logsource: windows / process_creation. Rule: title: File With Suspicious Extension Downloaded Via Bitsadmin id: 5b80a791-ad9b-4b75-bcc1-ad4e1e89c200 status: test description: Detects usage of bitsadmin downloading a file with a suspicious extension references: - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin - https://isc.sans.edu/diary/22264 - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-06-28 modified: 2023-05-30 tags: - attack.persistence - attack.execution - attack.stealth - attack.t1197 - attack.s0190 - attack.t1036.003 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \bitsadmin.exe - OriginalFileName: bitsadmin.exe selection_flags: CommandLine|contains: - ' /transfer ' - ' /create ' - ' /addfile ' selection_extension: CommandLine|contains: - .7z - .asax - .ashx - .asmx - .asp - .aspx - .bat - .cfm - .cgi - .chm - .cmd - .dll - .gif - .jpeg - .jpg - .jsp - .jspx - .log - .png - .ps1 - .psm1 - .rar - .scf - .sct - .txt - .vbe - .vbs - .war - .wsf - .wsh - .xll - .zip condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_extensions/info.yml simulation: - type: atomic-red-team name: Windows - BITSAdmin BITS Download technique: T1105 atomic_guid: a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b
Query: describe CVE-2015-2735
Matching passage: CVE-2015-2735. CWE: CWE-17. CVSS: 9.300000190734863. nsZipArchive.cpp in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which allows remote attackers to have an unspecified impact via a crafted ZIP archive.
Near-miss passage: CVE-2015-0806. CWE: CWE-17. CVSS: 7.5. The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 attempts to use memset for a memory region of negative length during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors that trigger rendering of 2D graphics content.
Query: Sigma rule for Detects an unexpected file being deleted by dns.exe which my indicate activity related to remote code execution or other
Matching passage: Sigma rule: Detects an unexpected file being deleted by dns.exe which my indicate activity related to remote code execution or other. Logsource: windows / file_delete. Rule: title: Unusual File Deletion by Dns.exe id: 8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0 related: - id: 9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3 type: similar status: test description: Detects an unexpected file being deleted by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed) references: - https://www.elastic.co/guide/en/security/current/unusual-file-modification-by-dns-exe.html author: Tim Rauch (Nextron Systems), Elastic (idea) date: 2022-09-27 modified: 2023-02-15 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: file_delete product: windows detection: selection: Image|endswith: \dns.exe filter: TargetFilename|endswith: \dns.log condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat a. Logsource: windows / ps_script. Rule: title: AADInternals PowerShell Cmdlets Execution - PsScript id: 91e69562-2426-42ce-a647-711b8152ced6 related: - id: c86500e9-a645-4680-98d7-f882c70c1ea3 type: similar status: test description: Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365. references: - https://o365blog.com/aadinternals/ - https://github.com/Gerenios/AADInternals author: Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2022-12-23 modified: 2025-02-06 tags: - attack.execution - attack.reconnaissance - attack.discovery - attack.credential-access - attack.impact logsource: product: windows category: ps_script definition: Script Block Logging must be enable detection: selection: ScriptBlockText|contains: - Add-AADInt - ConvertTo-AADInt - Disable-AADInt - Enable-AADInt - Export-AADInt - Find-AADInt - Get-AADInt - Grant-AADInt - Initialize-AADInt - Install-AADInt - Invoke-AADInt - Join-AADInt - New-AADInt - Open-AADInt - Read-AADInt - Register-AADInt - Remove-AADInt - Reset-AADInt - Resolve-AADInt - Restore-AADInt - Save-AADInt - Search-AADInt - Send-AADInt - Set-AADInt - Start-AADInt - Unprotect-AADInt - Update-AADInt condition: selection falsepositives: - Legitimate use of the library for administrative activity level: high
Query: CVE similar to CVE-2015-4452
Matching passage: CVE-2015-4452. CWE: UNKNOWN. CVSS: 9.300000190734863. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-4435, CVE-2015-4438, CVE-2015-4441, CVE-2015-4445, CVE-2015-4447, CVE-2015-4451, CVE-2015-5085, and CVE-2015-5086.
Near-miss passage: CVE-2015-0419. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Portal Framework, a different vulnerability than CVE-2013-1510.
Query: CVE similar to CVE-2015-0600
Matching passage: CVE-2015-0600. CWE: CWE-20. CVSS: 5.0. The mobility extension on Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allows remote attackers to cause a denial of service (logoff) via crafted packets, aka Bug ID CSCuq12139.
Near-miss passage: CVE-2015-5234. CWE: CWE-20. CVSS: 6.800000190734863. IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.
Query: risk of Directory traversal vulnerability in the bitrix.xscan module before 1.0.4 for Bitrix allows remote authenticated users to rename arbitrary files, and consequently obtain sensitive 
Matching passage: CVE-2015-8357. CWE: CWE-22. CVSS: 6.5. Directory traversal vulnerability in the bitrix.xscan module before 1.0.4 for Bitrix allows remote authenticated users to rename arbitrary files, and consequently obtain sensitive information or cause a denial of service, via a .. (dot dot) in the file parameter to admin/bitrix.xscan_worker.php.
Near-miss passage: CVE-2015-2007. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.5 Patch 6 allows remote authenticated users to read arbitrary files via a crafted URL.
Query: hunt for Server Software Component activity
Matching passage: T1505 Server Software Component. Tactics: persistence. Description: Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.(Citation: volexity_0day_sophos_FW)
Near-miss passage: T1505.002 Transport Agent. Tactics: persistence. Description: Adversaries may abuse Microsoft transport agents to establish persistent access to systems. Microsoft Exchange transport agents can operate on email messages passing through the transport pipeline to perform various tasks such as filtering spam, filtering malicious attachments, journaling, or adding a corporate signature to the end of all outgoing emails.(Citation: Microsoft TransportAgent Jun 2016)(Citation: ESET LightNeuron May 2019) Transport agents can be written by application developers and then compiled to .NET assemblies that are subsequently registered with the Exchange server. Transport agents will be invoked during a specified stage of email processing and carry out developer defined tasks. Adversaries may register a malicious transport agent to provide a persistence mechanism in Exchange Server that can be triggered by adversary-specified email events.(Citation: ESET LightNeuron May 2019) Though a malicious transport agent may be invoked for all emails passing through the Exchange transport pipeline, the agent can be configured to only carry out specific tasks in response to adversary defined criteria. For example, the transport agent may only carry out an action like copying in-transit attachments and saving them for later exfiltration if the recipient email address matches an entry on a list provided by the adversary.
Query: patch priority for CVE-2015-0134
Matching passage: CVE-2015-0134. CWE: CWE-119. CVSS: 10.0. Buffer overflow in the SSLv2 implementation in IBM Domino 8.5.x before 8.5.1 FP5 IF3, 8.5.2 before FP4 IF3, 8.5.3 before FP6 IF6, 9.0 before IF7, and 9.0.1 before FP2 IF3 allows remote attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-1924. CWE: CWE-119. CVSS: 7.800000190734863. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965.
Query: risk of Multiple memory leaks in Xen 4.0 through 4.6.x allow local guest administrators or domains with certain permission to cause a denial of service (memory consumption) via a large num
Matching passage: CVE-2015-7969. CWE: CWE-399. CVSS: 4.900000095367432. Multiple memory leaks in Xen 4.0 through 4.6.x allow local guest administrators or domains with certain permission to cause a denial of service (memory consumption) via a large number of "teardowns" of domains with the vcpu pointer array allocated using the (1) XEN_DOMCTL_max_vcpus hypercall or the xenoprofile state vcpu pointer array allocated using the (2) XENOPROF_get_buffer or (3) XENOPROF_set_passive hypercall.
Near-miss passage: CVE-2015-5747. CWE: CWE-399. CVSS: 4.900000095367432. The fasttrap driver in the kernel in Apple OS X before 10.10.5 allows local users to cause a denial of service (resource consumption) via unspecified vectors.
Query: CVE similar to CVE-2015-9258
Matching passage: CVE-2015-9258. CWE: CWE-310. CVSS: 7.5. In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability. Because an attacker controls the field specifying the signature algorithm, they might (for example) be able to forge a signature by forcing a misinterpretation of an RSA-PSS key as Ed25519 elliptic-curve data.
Near-miss passage: CVE-2015-3960. CWE: CWE-310. CVSS: 4.300000190734863. The firmware in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches uses hardcoded RSA private keys and certificates across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms for HTTPS sessions by leveraging knowledge of a private key from another installation.
Query: vulnerability: Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of
Matching passage: CVE-2015-5221. CWE: CWE-416. CVSS: 5.5. Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
Near-miss passage: CVE-2015-3890. CWE: CWE-416. CVSS: 7.5. Use-after-free vulnerability in Open Litespeed before 1.3.10.
Query: SOC runbook when seeing Multiple failed authentications followed by Remote System Discovery
Matching passage: Playbook for T1018 Remote System Discovery. 1) Validate alert telemetry against T1018. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: discovery. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as [Ping](https://attack.mitre.org/software/S0097), <code>net view</code
Near-miss passage: Playbook for T1615 Group Policy Discovery. Different response path focused on discovery.
Query: describe CVE-2015-1767
Matching passage: CVE-2015-1767. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2401 and CVE-2015-2408.
Near-miss passage: CVE-2015-3111. CWE: CWE-119. CVSS: 10.0. Heap-based buffer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attackers to execute arbitrary code via unspecified vectors.
Query: CVE similar to CVE-2015-8478
Matching passage: CVE-2015-8478. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google V8 before 4.7.80.23, as used in Google Chrome before 47.0.2526.73, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Near-miss passage: CVE-2015-2581. CWE: UNKNOWN. CVSS: 6.400000095367432. Unspecified vulnerability in the Oracle Secure Global Desktop component in Oracle Virtualization 5.1 and 5.2 allows remote attackers to affect confidentiality and availability via unknown vectors related to JServer.
Query: patch priority for CVE-2015-2579
Matching passage: CVE-2015-2579. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in the Oracle Health Sciences Argus Safety component in Oracle Health Sciences Applications 8.0 allows local users to affect confidentiality via vectors related to BIP Installer.
Near-miss passage: CVE-2015-7866. CWE: UNKNOWN. CVSS: 7.199999809265137. Unquoted Windows search path vulnerability in the Smart Maximize Helper (nvSmartMaxApp.exe) in the Control Panel in the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 before 358.87 on Windows allows local users to gain privileges via a Trojan horse application, as demonstrated by C:\Program.exe.
Query: patch priority for CVE-2015-4826
Matching passage: CVE-2015-4826. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Types.
Near-miss passage: CVE-2015-4756. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB, a different vulnerability than CVE-2015-0439.
Query: common weakness: Improper Prevention of Lock Bit Modification
Matching passage: CWE-1231 Improper Prevention of Lock Bit Modification. The product uses a trusted lock bit for restricting access to registers, address regions, or other resources, but the product does not prevent the value of the lock bit from being modified after it has been set.
Near-miss passage: CWE-1221 Incorrect Register Defaults or Module Parameters. Hardware description language code incorrectly defines register defaults or hardware Intellectual Property (IP) parameters to insecure values.
Query: persistence using Office Application Startup
Matching passage: T1137 Office Application Startup. Tactics: persistence. Description: Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins. A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: SensePost Ruler GitHub) These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: TechNet O365 Outlook Rules)
Near-miss passage: T1137.004 Outlook Home Page. Tactics: persistence. Description: Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system. Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders. This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened. A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page.(Citation: SensePost Outlook Home Page) Once malicious home pages have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious Home Pages will execute when the right Outlook folder is loaded/reloaded.(Citation: SensePost Outlook Home Page)
Query: describe CVE-2015-3619
Matching passage: CVE-2015-3619. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in assets/js/vm2admin.js in the VirtueMart component before 3.0.8 for Joomla! allows remote attackers to inject arbitrary web script or HTML via vectors involving a "double encode combination of first_name, last_name and company."
Near-miss passage: CVE-2015-2275. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in WoltLab Community Gallery 2.0 before 2014-12-26 allows remote attackers to inject arbitrary web script or HTML via the parameters[data][7][title] parameter in a saveImageData action to index.php/AJAXProxy.
Query: adversary uses Remote Data Staging
Matching passage: T1074.002 Remote Data Staging. Tactics: collection. Description: Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location. In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and stage data in that instance.(Citation: Mandiant M-Trends 2020) By staging data on one system prior to Exfiltration, adversaries can minimize the number of connections made to their C2 server and better evade detection.
Near-miss passage: T1074 Data Staged. Tactics: collection. Description: Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.(Citation: PWC Cloud Hopper April 2017) In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and stage data in that instance.(Citation: Mandiant M-Trends 2020) Adversaries may choose to stage data from a victim network in a centralized location prior to Exfiltration to minimize the number of connections made to their C2 server and better evade detection.
Query: vulnerability: The Swift implementation in Apple Xcode before 7.1 mishandles type conversion, which has unspecified impact and attack vectors.
Matching passage: CVE-2015-7030. CWE: CWE-17. CVSS: 7.5. The Swift implementation in Apple Xcode before 7.1 mishandles type conversion, which has unspecified impact and attack vectors.
Near-miss passage: CVE-2015-1157. CWE: CWE-17. CVSS: 7.800000190734863. CoreText in Apple iOS 8.x through 8.3 allows remote attackers to cause a denial of service (reboot and messaging disruption) via crafted Unicode text that is not properly handled during display truncation in the Notifications feature, as demonstrated by Arabic characters in (1) an SMS message or (2) a WhatsApp message.
Query: exploit The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactformpp_id parameter to cp_contactformpp.php.
Matching passage: CVE-2015-9234. CWE: CWE-89. CVSS: 7.199999809265137. The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactformpp_id parameter to cp_contactformpp.php.
Near-miss passage: CVE-2015-7569. CWE: CWE-89. CVSS: 8.800000190734863. SQL injection vulnerability in "yeager/y.php/tab_USERLIST" in Yeager CMS 1.2.1 allows local users to execute arbitrary SQL commands via the "pagedir_orderby" parameter.