alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Multiple failed authentications followed by Modify Authentication Process
Matching passage: T1556 Modify Authentication Process. Tactics: defense impairment, persistence, credential access. Description: Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using [Valid Accounts](https://attack.mitre.org/techniques/T1078). Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.
Near-miss passage: T1556.004 Network Device Authentication. Tactics: defense impairment, persistence, credential access. Description: Adversaries may use [Patch System Image](https://attack.mitre.org/techniques/T1601/001) to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices. [Modify System Image](https://attack.mitre.org/techniques/T1601) may include implanted code to the operating system for network devices to provide access for adversaries using a specific password. The modification includes a specific password which is implanted in the operating system image via the patch. Upon authentication attempts, the inserted code will first check to see if the user input is the password. If so, access is granted. Otherwise, the implanted code will pass the credentials on for verification of potentially valid credentials.(Citation: Mandiant - Synful Knock)
Query: exploit The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a minimum size for UTF-16 strings containing 
Matching passage: CVE-2015-3828. CWE: CWE-119. CVSS: 10.0. The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM), which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted 3GPP metadata, aka internal bug 20923261, a related issue to CVE-2015-3826.
Near-miss passage: CVE-2015-5552. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, and CVE-2015-5553.
Query: CWE for Observable Behavioral Discrepancy
Matching passage: CWE-205 Observable Behavioral Discrepancy. The product's behaviors indicate important differences that may be observed by unauthorized actors in a way that reveals (1) its internal state or decision process, or (2) differences from other products with equivalent functionality.
Near-miss passage: CWE-329 Generation of Predictable IV with CBC Mode. The product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key.
Query: detect Detects usage of bitsadmin downloading a file with a suspicious extension in logs
Matching passage: Sigma rule: Detects usage of bitsadmin downloading a file with a suspicious extension. Logsource: windows / process_creation. Rule: title: File With Suspicious Extension Downloaded Via Bitsadmin id: 5b80a791-ad9b-4b75-bcc1-ad4e1e89c200 status: test description: Detects usage of bitsadmin downloading a file with a suspicious extension references: - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin - https://isc.sans.edu/diary/22264 - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-06-28 modified: 2023-05-30 tags: - attack.persistence - attack.execution - attack.stealth - attack.t1197 - attack.s0190 - attack.t1036.003 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \bitsadmin.exe - OriginalFileName: bitsadmin.exe selection_flags: CommandLine|contains: - ' /transfer ' - ' /create ' - ' /addfile ' selection_extension: CommandLine|contains: - .7z - .asax - .ashx - .asmx - .asp - .aspx - .bat - .cfm - .cgi - .chm - .cmd - .dll - .gif - .jpeg - .jpg - .jsp - .jspx - .log - .png - .ps1 - .psm1 - .rar - .scf - .sct - .txt - .vbe - .vbs - .war - .wsf - .wsh - .xll - .zip condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_extensions/info.yml simulation: - type: atomic-red-team name: Windows - BITSAdmin BITS Download technique: T1105 atomic_guid: a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b
Near-miss passage: Sigma rule: Detects suspicious application installed by looking at the added shortcut to the app resolver cache. Logsource: windows / shell-core. Rule: title: Suspicious Application Installed id: 83c161b6-ca67-4f33-8ad0-644a0737cf07 status: test description: Detects suspicious application installed by looking at the added shortcut to the app resolver cache references: - https://nasbench.medium.com/finding-forensic-goodness-in-obscure-windows-event-logs-60e978ea45a3 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-14 tags: - attack.execution logsource: product: windows service: shell-core detection: selection_name: EventID: 28115 Name|contains: - Zenmap - AnyDesk - wireshark - openvpn selection_packageid: EventID: 28115 AppID|contains: - zenmap.exe - prokzult ad - wireshark - openvpn condition: 1 of selection_* falsepositives: - Packages or applications being legitimately used by users or administrators level: medium
Query: threat report mentioning Traffic Duplication
Matching passage: T1020.001 Traffic Duplication. Tactics: exfiltration. Description: Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis. For example, devices may be configured to forward network traffic to one or more destinations for analysis by a network analyzer or other monitoring device. (Citation: Cisco Traffic Mirroring)(Citation: Juniper Traffic Mirroring) Adversaries may abuse traffic mirroring to mirror or redirect network traffic through other infrastructure they control. Malicious modifications to network devices to enable traffic redirection may be possible through [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) or [Patch System Image](https://attack.mitre.org/techniques/T1601/001).(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks) Many cloud-based environments also support traffic mirroring. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to.(Citation: AWS Traffic Mirroring)(Citation: GCP Packet Mirroring)(Citation: Azure Virtual Network TAP) Adversaries may use traffic duplication in conjunction with [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Input Capture](https://attack.mitre.org/techniques/T1056), or [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) depending on the goals and objectives of the adversary.
Near-miss passage: T1020 Automated Exfiltration. Tactics: exfiltration. Description: Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.(Citation: ESET Gamaredon June 2020) When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).
Query: patch priority for CVE-2015-7051
Matching passage: CVE-2015-7051. CWE: CWE-264. CVSS: 9.300000190734863. MobileStorageMounter in Apple iOS before 9.2 and tvOS before 9.1 mishandles the timing of trust-cache loading, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
Near-miss passage: CVE-2015-3335. CWE: CWE-264. CVSS: 7.5. The NaClSandbox::InitializeLayerTwoSandbox function in components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc in Google Chrome before 42.0.2311.90 does not have RLIMIT_AS and RLIMIT_DATA limits for Native Client (aka NaCl) processes, which might make it easier for remote attackers to conduct row-hammer attacks or have unspecified other impact by leveraging the ability to run a crafted program in the NaCl sandbox.
Query: common weakness: External Control of File Name or Path
Matching passage: CWE-73 External Control of File Name or Path. The product allows user input to control or influence paths or file names that are used in filesystem operations.
Near-miss passage: CWE-433 Unparsed Raw Web Content Delivery. The product stores raw content or supporting code under the web document root with an extension that is not specifically handled by the server.
Query: describe CVE-2015-2298
Matching passage: CVE-2015-2298. CWE: CWE-200. CVSS: 7.5. node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive information by leveraging an improper substring check when exporting a padID.
Near-miss passage: CVE-2015-0152. CWE: CWE-200. CVSS: 9.800000190734863. D-Link DIR-815 devices with firmware before 2.07.B01 allow remote attackers to obtain sensitive information by leveraging cleartext storage of the administrative password.
Query: patch priority for CVE-2015-1799
Matching passage: CVE-2015-1799. CWE: CWE-17. CVSS: 4.300000190734863. The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 3.x and 4.x before 4.2.8p2 performs state-variable updates upon receiving certain invalid packets, which makes it easier for man-in-the-middle attackers to cause a denial of service (synchronization loss) by spoofing the source IP address of a peer.
Near-miss passage: CVE-2015-7192. CWE: CWE-17. CVSS: 7.5. The accessibility-tools feature in Mozilla Firefox before 42.0 on OS X improperly interacts with the implementation of the TABLE element, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using an NSAccessibilityIndexAttribute value to reference a row index.
Query: describe CVE-2015-3052
Matching passage: CVE-2015-3052. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-9161, CVE-2015-3046, CVE-2015-3049, CVE-2015-3050, CVE-2015-3051, CVE-2015-3056, CVE-2015-3057, CVE-2015-3070, and CVE-2015-3076.
Near-miss passage: CVE-2015-8330. CWE: CWE-119. CVSS: 7.800000190734863. The PCo agent in SAP Plant Connectivity (PCo) allows remote attackers to cause a denial of service (memory corruption and agent crash) via crafted xMII requests, aka SAP Security Note 2238619.
Query: detect Cron
Matching passage: T1053.003 Cron. Tactics: execution, persistence, privilege escalation. Description: Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code.(Citation: 20 macOS Common Tools and Techniques) The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths. An adversary may use <code>cron</code> in Linux or Unix environments to execute programs at system startup or on a scheduled basis for [Persistence](https://attack.mitre.org/tactics/TA0003). In ESXi environments, cron jobs must be created directly via the crontab file (e.g., `/var/spool/cron/crontabs/root`).(Citation: CloudSEK ESXiArgs 2023)
Near-miss passage: T1053.005 Scheduled Task. Tactics: execution, persistence, privilege escalation. Description: Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The [schtasks](https://attack.mitre.org/software/S0111) utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel.(Citation: Stack Overflow) In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.(Citation: Red Canary - Atomic Red Team) An adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence. The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and/or to run a process under the context of a specified account (such as SYSTEM). Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused the Windows Task Scheduler to potentially mask one-time execution under signed/trusted system processes.(Citation: ProofPoint Serpent) Adversaries may also create "hidden" scheduled tasks (i.e. [Hide Artifacts](https://attack.mitre.org/techniques/T1564)) that may not be visible to defender tools and manual queries used to enumerate tasks. Specifically, an adversary may hide a task from `schtasks /query` and the Task Scheduler by deleting the associated Security Descriptor (SD) registry value (where deletion of this value must be completed using SYSTEM permissions).(Citation: SigmaHQ)(Citation: Tarrask scheduled task) Adversaries may also employ alternate me
Query: risk of The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (
Matching passage: CVE-2015-8855. CWE: CWE-399. CVSS: 7.5. The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."
Near-miss passage: CVE-2015-5362. CWE: CWE-399. CVSS: 9.300000190734863. The BFD daemon in Juniper Junos OS 12.1X44 before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D15, 13.2 before 13.2R8, 13.3 before 13.3R6, 14.1 before 14.1R5, 14.1X50 before 14.1X50-D85, 14.1X55 before 14.1X55-D20, 14.2 before 14.2R3, 15.1 before 15.1R1, and 15.1X49 before 15.1X49-D10 allows remote attackers to cause a denial of service (bfdd crash and restart) or execute arbitrary code via a crafted BFD packet.
Query: CVE similar to CVE-2015-7268
Matching passage: CVE-2015-7268. CWE: CWE-254. CVSS: 4.199999809265137. Samsung 850 Pro and PM851 solid-state drives and Seagate ST500LT015 and ST500LT025 hard disk drives, when used on Windows and operating in Opal mode on Lenovo ThinkPad T440s laptops with BIOS 2.32 or ThinkPad W541 laptops with BIOS 2.21, or in Opal or eDrive mode on Dell Latitude E6410 laptops with BIOS A16 or Latitude E6430 laptops with BIOS A16, allow physically proximate attackers to bypass self-encrypting drive (SED) protection by triggering a soft reset and booting from an alternative OS, aka a "Forced Restart Attack."
Near-miss passage: CVE-2015-8615. CWE: CWE-254. CVSS: 5.0. The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ).
Query: exploit The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion ma
Matching passage: CVE-2015-6254. CWE: CWE-17. CVSS: 6.0. The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the message was received, which allows remote attackers to have unspecified impact via unknown vectors. NOTE: this identifier was SPLIT from CVE-2015-0277 per ADT2 due to different vulnerability types.
Near-miss passage: CVE-2015-0817. CWE: CWE-17. CVSS: 6.800000190734863. The asm.js implementation in Mozilla Firefox before 36.0.3, Firefox ESR 31.x before 31.5.2, and SeaMonkey before 2.33.1 does not properly determine the cases in which bounds checking may be safely skipped during JIT compilation and heap access, which allows remote attackers to read or write to unintended memory locations, and consequently execute arbitrary code, via crafted JavaScript.
Query: patch priority for CVE-2015-1701
Matching passage: CVE-2015-1701. CWE: UNKNOWN. CVSS: 7.800000190734863. Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in April 2015, aka "Win32k Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-8437. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in the Selection object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a crafted setFocus call, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: vulnerability: A vulnerability was found in nterchange up to 4.1.0. It has been rated as critical. This issue affects the function getContent of the file app/controllers/code_caller_controller.ph
Matching passage: CVE-2015-10009. CWE: CWE-94. CVSS: 9.800000190734863. A vulnerability was found in nterchange up to 4.1.0. It has been rated as critical. This issue affects the function getContent of the file app/controllers/code_caller_controller.php. The manipulation of the argument q with the input %5C%27%29;phpinfo%28%29;/* leads to code injection. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.1 is able to address this issue. The patch is named fba7d89176fba8fe289edd58835fe45080797d99. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217187.
Near-miss passage: CVE-2015-9272. CWE: CWE-94. CVSS: 9.800000190734863. The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code.
Query: weakness Runtime Resource Management Control Element in a Component Built to Run on Application Servers
Matching passage: CWE-1065 Runtime Resource Management Control Element in a Component Built to Run on Application Servers. The product uses deployed components from application servers, but it also uses low-level functions/methods for management of resources, instead of the API provided by the application server.
Near-miss passage: CWE-290 Authentication Bypass by Spoofing. This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Query: alert when Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order t
Matching passage: Sigma rule: Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order t. Logsource: linux / process_creation. Rule: title: Access of Sudoers File Content id: 0f79c4d2-4e1f-4683-9c36-b5469a665e06 status: test description: Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order to potentially list all users that have sudo rights. references: - https://github.com/sleventyeleven/linuxprivchecker/ author: Florian Roth (Nextron Systems) date: 2022-06-20 modified: 2025-06-04 tags: - attack.reconnaissance - attack.t1592.004 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /cat - /ed - /egrep - /emacs - /fgrep - /grep - /head - /less - /more - /nano - /tail CommandLine|contains: ' /etc/sudoers' condition: selection falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: TeamViewer_Desktop.exe is create during install. Logsource: windows / file_event. Rule: title: Installation of TeamViewer Desktop id: 9711de76-5d4f-4c50-a94f-21e4e8f8384d status: test description: TeamViewer_Desktop.exe is create during install references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-1---teamviewer-files-detected-test-on-windows author: frack113 date: 2022-01-28 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: \TeamViewer_Desktop.exe condition: selection falsepositives: - Unknown level: medium