alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-3860
Matching passage: CVE-2015-3860. CWE: CWE-284. CVSS: 7.199999809265137. packages/Keyguard/res/layout/keyguard_password_view.xml in Lockscreen in Android 5.x before 5.1.1 LMY48M does not restrict the number of characters in the passwordEntry input field, which allows physically proximate attackers to bypass intended access restrictions via a long password that triggers a SystemUI crash, aka internal bug 22214934.
Near-miss passage: CVE-2015-10057. CWE: CWE-284. CVSS: 9.800000190734863. A vulnerability was found in Little Apps Little Software Stats. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file inc/class.securelogin.php of the component Password Reset Handler. The manipulation leads to improper access controls. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.2 is able to address this issue. The identifier of the patch is 07ba8273a9311d1383f3686ac7cb32f20770ab1e. It is recommended to upgrade the affected component. The identifier VDB-218401 was assigned to this vulnerability.
Query: what is T1573
Matching passage: T1573 Encrypted Channel. Tactics: command and control. Description: Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Near-miss passage: T1573.001 Symmetric Cryptography. Tactics: command and control. Description: Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.
Query: alert when Detects instances where an HTTP service on an OpenCanary node has received a GET request.
Matching passage: Sigma rule: Detects instances where an HTTP service on an OpenCanary node has received a GET request.. Logsource: opencanary / application. Rule: title: OpenCanary - HTTP GET Request id: af6c3078-84cd-4c68-8842-08b76bd81b13 status: test description: Detects instances where an HTTP service on an OpenCanary node has received a GET request. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.initial-access - attack.t1190 logsource: category: application product: opencanary detection: selection: logtype: 3000 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects execution of a the file "execve_hijack" which is used by the Triple Cross rootkit as a way to elevate privileges. Logsource: linux / process_creation. Rule: title: Triple Cross eBPF Rootkit Execve Hijack id: 0326c3c8-7803-4a0f-8c5c-368f747f7c3e status: test description: Detects execution of a the file "execve_hijack" which is used by the Triple Cross rootkit as a way to elevate privileges references: - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/src/helpers/execve_hijack.c#L275 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-05 tags: - attack.privilege-escalation - attack.stealth logsource: category: process_creation product: linux detection: selection: Image|endswith: /sudo CommandLine|contains: execve_hijack condition: selection falsepositives: - Unlikely level: high
Query: patch priority for CVE-2015-3148
Matching passage: CVE-2015-3148. CWE: CWE-284. CVSS: 5.0. cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect as other users via a request.
Near-miss passage: CVE-2015-3063. CWE: CWE-284. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3062, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, CVE-2015-3073, and CVE-2015-3074.
Query: Sigma rule for Detects when end user consent is blocked due to risk-based consent.
Matching passage: Sigma rule: Detects when end user consent is blocked due to risk-based consent.. Logsource: azure / auditlogs. Rule: title: End User Consent Blocked id: 7091372f-623c-4293-bc37-20c32b3492be status: test description: Detects when end user consent is blocked due to risk-based consent. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#end-user-stopped-due-to-risk-based-consent author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow' date: 2022-07-10 tags: - attack.credential-access - attack.t1528 logsource: product: azure service: auditlogs detection: selection: failure_status_reason: Microsoft.online.Security.userConsentBlockedForRiskyAppsExceptions condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects uncommon child processes of the Add-In deployment cache updating utility (AddInutil.exe) which could be a sign o. Logsource: windows / process_creation. Rule: title: Uncommon Child Process Of AddinUtil.EXE id: b5746143-59d6-4603-8d06-acbd60e166ee status: test description: 'Detects uncommon child processes of the Add-In deployment cache updating utility (AddInutil.exe) which could be a sign of potential abuse of the binary to proxy execution via a custom Addins.Store payload. ' references: - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri) date: 2023-09-18 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \addinutil.exe filter_main_werfault: Image|endswith: - :\Windows\System32\conhost.exe - :\Windows\System32\werfault.exe - :\Windows\SysWOW64\werfault.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-2270
Matching passage: CVE-2015-2270. CWE: CWE-17. CVSS: 4.300000190734863. lib/moodlelib.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4, when the theme uses the blocks-regions feature, establishes the course state at an incorrect point in the login-validation process, which allows remote attackers to obtain sensitive course information via unspecified vectors.
Near-miss passage: CVE-2015-3183. CWE: CWE-17. CVSS: 5.0. The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.
Query: vulnerability: The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2010, Lync 2013 SP1, 
Matching passage: CVE-2015-6106. CWE: CWE-119. CVSS: 9.300000190734863. The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2010, Lync 2013 SP1, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Graphics Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-8507. CWE: CWE-119. CVSS: 9.300000190734863. mediaserver in Android 6.0 before 2015-12-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 24157524, a different vulnerability than CVE-2015-6616, CVE-2015-8505, and CVE-2015-8506.
Query: incident response steps for Outbound C2 pattern associated with Modify System Image
Matching passage: Playbook for T1601 Modify System Image. 1) Validate alert telemetry against T1601. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: defense impairment. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves. On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file. To change the operating system, the adversary typically only needs to affect this one file, replacing
Near-miss passage: Playbook for T1601.001 Patch System Image. Different response path focused on defense impairment.
Query: write Sigma for Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting
Matching passage: Sigma rule: Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting. Logsource: windows / process_creation. Rule: title: Potential Meterpreter/CobaltStrike Activity id: 15619216-e993-4721-b590-4c520615a67d status: test description: Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment - https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/ author: Teymur Kheirkhabarov, Ecco, Florian Roth date: 2019-10-26 modified: 2023-02-05 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.001 - attack.t1134.002 logsource: category: process_creation product: windows detection: selection_img: ParentImage|endswith: \services.exe selection_technique_1: CommandLine|contains|all: - /c - echo - \pipe\ CommandLine|contains: - cmd - '%COMSPEC%' selection_technique_2: CommandLine|contains|all: - rundll32 - .dll,a - '/p:' filter_defender: CommandLine|contains: MpCmdRun condition: selection_img and 1 of selection_technique_* and not 1 of filter_* falsepositives: - Commandlines containing components like cmd accidentally - Jobs and services started with cmd level: high
Near-miss passage: Sigma rule: Alert on when a user has performed an eDiscovery search or exported a PST file from the search. This PST file usually ha. Logsource: m365 / threat_management. Rule: title: PST Export Alert Using eDiscovery Alert id: 18b88d08-d73e-4f21-bc25-4b9892a4fdd0 related: - id: 6897cd82-6664-11ed-9022-0242ac120002 type: similar status: test description: Alert on when a user has performed an eDiscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content references: - https://learn.microsoft.com/en-us/microsoft-365/compliance/alert-policies?view=o365-worldwide author: Sorina Ionescu date: 2022-02-08 modified: 2022-11-17 tags: - attack.collection - attack.t1114 logsource: service: threat_management product: m365 definition: Requires the 'eDiscovery search or exported' alert to be enabled detection: selection: eventSource: SecurityComplianceCenter eventName: eDiscovery search started or exported status: success condition: selection falsepositives: - PST export can be done for legitimate purposes but due to the sensitive nature of its content it must be monitored. level: medium
Query: weakness Incomplete Model of Endpoint Features
Matching passage: CWE-437 Incomplete Model of Endpoint Features. A product acts as an intermediary or monitor between two or more endpoints, but it does not have a complete model of an endpoint's features, behaviors, or state, potentially causing the product to perform incorrect actions based on this incomplete model.
Near-miss passage: CWE-487 Reliance on Package-level Scope. Java packages are not inherently closed; therefore, relying on them for code security is not a good practice.
Query: detect Adversaries may carry out malicious operations using a virtual instance to avoid detection in logs
Matching passage: Sigma rule: Adversaries may carry out malicious operations using a virtual instance to avoid detection. Logsource: windows / ps_script. Rule: title: Suspicious Hyper-V Cmdlets id: 42d36aa1-3240-4db0-8257-e0118dcdd9cd status: test description: Adversaries may carry out malicious operations using a virtual instance to avoid detection references: - https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.006/T1564.006.md#atomic-test-3---create-and-start-hyper-v-virtual-machine author: frack113 date: 2022-04-09 tags: - attack.stealth - attack.t1564.006 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - New-VM - Set-VMFirmware - Start-VM condition: selection falsepositives: - Legitimate PowerShell scripts level: medium
Near-miss passage: Sigma rule: Detects the use of TruffleHog for AWS credential validation by identifying GetCallerIdentity API calls where the userAge. Logsource: aws / cloudtrail. Rule: title: AWS STS GetCallerIdentity Enumeration Via TruffleHog id: 9b1b8e9b-0a5d-4af1-9d2f-4c4b6e7c2c9d status: experimental description: 'Detects the use of TruffleHog for AWS credential validation by identifying GetCallerIdentity API calls where the userAgent indicates TruffleHog. Threat actors leverage TruffleHog to enumerate and validate exposed AWS keys. Successful exploitation allows threat actors to confirm the validity of compromised AWS credentials, facilitating further unauthorized access and actions within the AWS environment. ' references: - https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/ - https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html - https://github.com/trufflesecurity/trufflehog author: Adan Alvarez @adanalvarez date: 2025-10-12 tags: - attack.discovery - attack.t1087.004 logsource: product: aws service: cloudtrail detection: selection: eventSource: sts.amazonaws.com eventName: GetCallerIdentity userAgent|contains: TruffleHog condition: selection falsepositives: - Legitimate internal security scanning or key validation that intentionally uses TruffleHog. Authorize and filter known scanner roles, IP ranges, or assumed roles as needed. level: medium
Query: playbook for alert: Lateral movement indicators for Group Policy Preferences
Matching passage: Playbook for T1552.006 Group Policy Preferences. 1) Validate alert telemetry against T1552.006. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: credential access. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts.(Citation: Microsoft GPP 2016) These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and d
Near-miss passage: Playbook for T1552.002 Credentials in Registry. Different response path focused on credential access.
Query: indicators of Application Window Discovery
Matching passage: T1010 Application Window Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.(Citation: Prevailion DarkWatchman 2021) For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ([Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) to evade.(Citation: ESET Grandoreiro April 2020) Adversaries typically abuse system features for this type of enumeration. For example, they may gather information through native system features such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) commands and [Native API](https://attack.mitre.org/techniques/T1106) functions.
Near-miss passage: T1087 Account Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)). Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment. For examples, cloud environments typically provide easily accessible interfaces to obtain user lists.(Citation: AWS List Users)(Citation: Google Cloud - IAM Servie Accounts List API) On hosts, adversaries can use default [PowerShell](https://attack.mitre.org/techniques/T1059/001) and other command line functionality to identify accounts. Information about email addresses and accounts may also be extracted by searching an infected system’s files.
Query: describe CVE-2015-5157
Matching passage: CVE-2015-5157. CWE: CWE-264. CVSS: 7.199999809265137. arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform mishandles IRET faults in processing NMIs that occurred during userspace execution, which might allow local users to gain privileges by triggering an NMI.
Near-miss passage: CVE-2015-5253. CWE: CWE-264. CVSS: 4.0. The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote authenticated users to bypass authentication via a crafted SAML response with a valid signed assertion, related to a "wrapping attack."
Query: how to detect Input Capture
Matching passage: T1056 Input Capture. Tactics: collection, credential access. Description: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004)) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. [Web Portal Capture](https://attack.mitre.org/techniques/T1056/003)).
Near-miss passage: T1056.004 Credential API Hooking. Tactics: collection, credential access. Description: Adversaries may hook into Windows application programming interface (API) functions and Linux system functions to collect user credentials. Malicious hooking mechanisms may capture API or function calls that include parameters that reveal user authentication credentials.(Citation: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017) Unlike [Keylogging](https://attack.mitre.org/techniques/T1056/001), this technique focuses specifically on API functions that include parameters that reveal user credentials. In Windows, hooking involves redirecting calls to these functions and can be implemented via: * **Hooks procedures**, which intercept and execute designated code in response to events such as messages, keystrokes, and mouse inputs.(Citation: Microsoft Hook Overview)(Citation: Elastic Process Injection July 2017) * **Import address table (IAT) hooking**, which use modifications to a process’s IAT, where pointers to imported API functions are stored.(Citation: Elastic Process Injection July 2017)(Citation: Adlice Software IAT Hooks Oct 2014)(Citation: MWRInfoSecurity Dynamic Hooking 2015) * **Inline hooking**, which overwrites the first bytes in an API function to redirect code flow.(Citation: Elastic Process Injection July 2017)(Citation: HighTech Bridge Inline Hooking Sept 2011)(Citation: MWRInfoSecurity Dynamic Hooking 2015) In Linux and macOS, adversaries may hook into system functions via the `LD_PRELOAD` (Linux) or `DYLD_INSERT_LIBRARIES` (macOS) environment variables, which enables loading shared libraries into a program’s address space. For example, an adversary may capture credentials by hooking into the `libc read` function leveraged by SSH or SCP.(Citation: Intezer Symbiote 2022)
Query: vulnerability: The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows R
Matching passage: CVE-2015-2507. CWE: CWE-264. CVSS: 7.199999809265137. The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Font Driver Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2512.
Near-miss passage: CVE-2015-7962. CWE: CWE-264. CVSS: 7.800000190734863. SafeNet Authentication Service for Outlook Web App Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.