alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: explain T1204.005 Malicious Library
Matching passage: T1204.005 Malicious Library. Tactics: execution. Description: Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may [Upload Malware](https://attack.mitre.org/techniques/T1608/001) to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that establishes persistence, steals data, or mines cryptocurrency.(Citation: Datadog Security Labs Malicious PyPi Packages 2024)(Citation: Fortinet Malicious NPM Packages 2023) In some cases, threat actors may compromise and backdoor existing popular libraries (i.e., [Compromise Software Dependencies and Development Tools](https://attack.mitre.org/techniques/T1195/001)). Alternatively, they may create entirely new packages and leverage behaviors such as typosquatting to encourage users to install them.
Near-miss passage: T1204.004 Malicious Copy and Paste. Tactics: execution. Description: An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). One such strategy is "ClickFix," in which adversaries present users with seemingly helpful solutions—such as prompts to fix errors or complete CAPTCHAs—that instead instruct the user to copy and paste malicious code. Malicious websites, such as those used in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), may present fake error messages or CAPTCHA prompts that instruct users to open a terminal or the Windows Run Dialog box and execute an arbitrary command. These commands may be obfuscated using encoding or other techniques to conceal malicious intent. Once executed, the adversary will typically be able to establish a foothold on the victim's machine.(Citation: CloudSEK Lumma Stealer 2024)(Citation: Sekoia ClickFake 2025)(Citation: Reliaquest CAPTCHA 2024)(Citation: AhnLab LummaC2 2025) Adversaries may also leverage phishing emails for this purpose. When a user attempts to open an attachment, they may be presented with a fake error and offered a malicious command to paste as a solution, consistent with the "ClickFix" strategy.(Citation: Proofpoint ClickFix 2024)(Citation: AhnLab Malicioys Copy Paste 2024) Tricking a user into executing a command themselves may help to bypass email filtering, browser sandboxing, or other mitigations designed to protect users against malicious downloaded files.
Query: patch priority for CVE-2015-4330
Matching passage: CVE-2015-4330. CWE: CWE-78. CVSS: 6.900000095367432. A local file script in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to gain privileges for OS command execution via invalid parameters, aka Bug ID CSCuv10556.
Near-miss passage: CVE-2015-7698. CWE: CWE-78. CVSS: 9.0. icewind1991 SMB before 1.0.3 allows remote authenticated users to execute arbitrary SMB commands via shell metacharacters in the user argument in the (1) listShares function in Server.php or the (2) connect or (3) read function in Share.php.
Query: CVE similar to CVE-2015-5168
Matching passage: CVE-2015-5168. CWE: UNKNOWN. CVSS: 9.800000190734863. Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2015-5206.
Near-miss passage: CVE-2015-2113. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in HP Easy Deploy, as distributed standalone and in HP Easy Tools before 3.0.1.1650, on HP Thin Client t5540, t5740, and t5740e devices and HP Flexible Thin Client t510, t520, t610, t620, and t820 devices allows remote attackers to execute arbitrary code via unknown vectors.
Query: describe CVE-2015-4287
Matching passage: CVE-2015-4287. CWE: CWE-264. CVSS: 5.0. Cisco Firepower Extensible Operating System 1.1(1.86) on Firepower 9000 devices allows remote attackers to bypass intended access restrictions and obtain sensitive device information by visiting an unspecified web page, aka Bug ID CSCuu82230.
Near-miss passage: CVE-2015-1810. CWE: CWE-264. CVSS: 4.599999904632568. The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name.
Query: patch priority for CVE-2015-8284
Matching passage: CVE-2015-8284. CWE: CWE-284. CVSS: 8.800000190734863. SeaWell Networks Spectrum SDC 02.05.00 allows remote viewer users to perform administrative functions.
Near-miss passage: CVE-2015-4649. CWE: CWE-284. CVSS: 7.199999809265137. Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to gain root privileges via unspecified vectors, a different vulnerability than CVE-2015-3654.
Query: indicators of Local Storage Discovery
Matching passage: T1680 Local Storage Discovery. Tactics: discovery. Description: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number. This can be done to prepare for ransomware-related encryption, to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0109), or as a precursor to [Direct Volume Access](https://attack.mitre.org/techniques/T1006). On ESXi systems, adversaries may use [Hypervisor CLI](https://attack.mitre.org/techniques/T1059/012) commands such as `esxcli` to list storage connected to the host as well as `.vmdk` files.(Citation: TrendMicro)(Citation: TrendMicro ESXI Ransomware) On Windows systems, adversaries can use `wmic logicaldisk get` to find information about local network drives. They can also use `Get-PSDrive` in PowerShell to retrieve drives and may additionally use Windows API functions such as `GetDriveType`.(Citation: Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024)(Citation: Volexity) Linux has commands such as `parted`, `lsblk`, `fdisk`, `lshw`, and `df` that can list information about disk partitions such as size, type, file system types, and free space. The command `diskutil` on MacOS can be used to list disks while `system_profiler SPStorageDataType` can additionally show information such as a volume’s mount path, file system, and the type of drive in the system. Infrastructure as a Service (IaaS) cloud providers also have commands for storage discovery such as `describe volume` in AWS, `gcloud compute disks list` in GCP, and `az disk list` in Azure.(Citation: AWS docs describe volumes)(Citation: GCP gcloud compute disks list)(Citation: azure az disk)
Near-miss passage: T1619 Cloud Storage Object Discovery. Tactics: discovery. Description: Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage. Similar to [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) on a local host, after identifying available storage services (i.e. [Cloud Infrastructure Discovery](https://attack.mitre.org/techniques/T1580)) adversaries may access the contents/objects stored in cloud infrastructure. Cloud service providers offer APIs allowing users to enumerate objects stored within cloud storage. Examples include ListObjectsV2 in AWS (Citation: ListObjectsV2) and List Blobs in Azure(Citation: List Blobs) .
Query: alert when Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom VBScript
Matching passage: Sigma rule: Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom VBScript. Logsource: windows / registry_set. Rule: title: New BgInfo.EXE Custom VBScript Registry Configuration id: 992dd79f-dde8-4bb0-9085-6350ba97cfb3 related: - id: cd277474-5c52-4423-a52b-ac2d7969902f type: similar status: test description: Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom VBScript via "BgInfo.exe" references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-16 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Software\Winternals\BGInfo\UserFields\ Details|startswith: '4' condition: selection falsepositives: - Legitimate VBScript level: medium
Near-miss passage: Sigma rule: Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass. Logsource: windows / file_delete. Rule: title: ADS Zone.Identifier Deleted By Uncommon Application id: 3109530e-ab47-4cc6-a953-cac5ebcc93ae related: - id: 7eac0a16-5832-4e81-865f-0268a6d19e4b type: similar status: test description: Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps. references: - https://securityliterate.com/how-malware-abuses-the-zone-identifier-to-circumvent-detection-and-analysis/ - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-04 modified: 2025-07-04 tags: - attack.stealth - attack.t1070.004 logsource: product: windows category: file_delete detection: selection: TargetFilename|endswith: :Zone.Identifier filter_main_generic: Image: - C:\Program Files\PowerShell\7-preview\pwsh.exe - C:\Program Files\PowerShell\7\pwsh.exe - C:\Windows\explorer.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - C:\Windows\SysWOW64\explorer.exe - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe filter_optional_browsers_chrome: Image: - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - C:\Program Files\Google\Chrome\Application\chrome.exe filter_optional_browsers_firefox: Image: - C:\Program Files (x86)\Mozilla Firefox\firefox.exe - C:\Program Files\Mozilla Firefox\firefox.exe filter_optional_browsers_msedge: Image: - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - C:\Program Files\Microsoft\Edge\Application\msedge.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Other third party applications not listed. level: medium
Query: exploit Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.
Matching passage: CVE-2015-0505. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.
Near-miss passage: CVE-2015-2570. CWE: UNKNOWN. CVSS: 6.5. Unspecified vulnerability in the Oracle Demand Planning component in Oracle Supply Chain Products Suite 11.5.10, 12.0, 12.1, and 12.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Security.
Query: exploit Heap-based buffer overflow in the parse_string function in libs/esl/src/esl_json.c in FreeSWITCH before 1.4.23 and 1.6.x before 1.6.2 allows remote attackers to execute arbitrary c
Matching passage: CVE-2015-7392. CWE: CWE-119. CVSS: 7.5. Heap-based buffer overflow in the parse_string function in libs/esl/src/esl_json.c in FreeSWITCH before 1.4.23 and 1.6.x before 1.6.2 allows remote attackers to execute arbitrary code via a trailing \u in a json string to cJSON_Parse.
Near-miss passage: CVE-2015-6153. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6140, CVE-2015-6142, CVE-2015-6143, CVE-2015-6158, CVE-2015-6159, and CVE-2015-6160.
Query: detection rule: Detects PowerShell core DLL being loaded by an Office Product
Matching passage: Sigma rule: Detects PowerShell core DLL being loaded by an Office Product. Logsource: windows / image_load. Rule: title: PowerShell Core DLL Loaded Via Office Application id: bb2ba6fb-95d4-4a25-89fc-30bb736c021a status: test description: Detects PowerShell core DLL being loaded by an Office Product references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-01 tags: - attack.stealth logsource: category: image_load product: windows detection: selection: Image|endswith: - \excel.exe - \mspub.exe - \outlook.exe - \onenote.exe - \onenoteim.exe - \powerpnt.exe - \winword.exe ImageLoaded|contains: - \System.Management.Automation.Dll - \System.Management.Automation.ni.Dll condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing. Logsource: windows / process_creation. Rule: title: Potential Windows Defender AV Bypass Via Dump64.EXE Rename id: 129966c9-de17-4334-a123-8b58172e664d status: test description: 'Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing it in the Visual Studio folder. Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage. ' references: - https://twitter.com/mrd0x/status/1460597833917251595 author: Austin Songer @austinsonger, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-11-26 modified: 2024-06-21 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: process_creation detection: selection_dump: Image|startswith: :\Program Files Image|contains: \Microsoft Visual Studio\ Image|endswith: \dump64.exe selection_tools_procdump: - OriginalFileName: procdump - CommandLine|contains: - ' -ma ' - ' -mp ' condition: selection_dump and 1 of selection_tools_* falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-3663
Matching passage: CVE-2015-3663. CWE: CWE-119. CVSS: 6.800000190734863. QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3661, CVE-2015-3662, CVE-2015-3666, CVE-2015-3667, and CVE-2015-3668.
Near-miss passage: CVE-2015-8662. CWE: CWE-119. CVSS: 7.300000190734863. The ff_dwt_decode function in libavcodec/jpeg2000dwt.c in FFmpeg before 2.8.4 does not validate the number of decomposition levels before proceeding with Discrete Wavelet Transform decoding, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data.
Query: exploit Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site
Matching passage: CVE-2015-6148. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6156.
Near-miss passage: CVE-2015-7555. CWE: CWE-119. CVSS: 5.5. Heap-based buffer overflow in giffix.c in giffix in giflib 5.1.1 allows attackers to cause a denial of service (program crash) via crafted image and logical screen width fields in a GIF file.
Query: detection rule: Detects disabling of Time Machine (Apple's automated backup utility software) via the native macOS backup utility "tmuti
Matching passage: Sigma rule: Detects disabling of Time Machine (Apple's automated backup utility software) via the native macOS backup utility "tmuti. Logsource: macos / process_creation. Rule: title: Time Machine Backup Disabled Via Tmutil - MacOS id: 2c95fa8a-8b8d-4787-afce-7117ceb8e3da status: test description: 'Detects disabling of Time Machine (Apple''s automated backup utility software) via the native macOS backup utility "tmutil". An attacker can use this to prevent backups from occurring. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine - https://www.loobins.io/binaries/tmutil/ author: Pratinav Chandra date: 2024-05-29 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: macos detection: selection_img: - Image|endswith: /tmutil - CommandLine|contains: tmutil selection_cmd: CommandLine|contains: disable condition: all of selection_* falsepositives: - Legitimate administrator activity level: medium
Near-miss passage: Sigma rule: Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to. Logsource: windows / security. Rule: title: Replay Attack Detected id: 5a44727c-3b85-4713-8c44-4401d5499629 status: test description: Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to the client references: - https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4649 author: frack113 date: 2022-10-14 tags: - attack.credential-access - attack.t1558 logsource: service: security product: windows detection: selection: EventID: 4649 condition: selection falsepositives: - Unknown level: high
Query: risk of Xen 4.6.x and earlier does not properly enforce limits on page order inputs for the (1) XENMEM_increase_reservation, (2) XENMEM_populate_physmap, (3) XENMEM_exchange, and possibly 
Matching passage: CVE-2015-8338. CWE: CWE-254. CVSS: 7.199999809265137. Xen 4.6.x and earlier does not properly enforce limits on page order inputs for the (1) XENMEM_increase_reservation, (2) XENMEM_populate_physmap, (3) XENMEM_exchange, and possibly other HYPERVISOR_memory_op suboperations, which allows ARM guest OS administrators to cause a denial of service (CPU consumption, guest reboot, or watchdog timeout and host reboot) and possibly have unspecified other impact via unknown vectors.
Near-miss passage: CVE-2015-3750. CWE: CWE-254. CVSS: 6.400000095367432. WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not enforce the HTTP Strict Transport Security (HSTS) protection mechanism for Content Security Policy (CSP) report requests, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof a report by modifying the client-server data stream.
Query: CVE similar to CVE-2015-6287
Matching passage: CVE-2015-6287. CWE: CWE-399. CVSS: 5.0. Cisco Web Security Appliance (WSA) 8.0.6-078 and 8.0.6-115 allows remote attackers to cause a denial of service (service outage) via a flood of TCP traffic that leads to DNS resolution delays, aka Bug IDs CSCur32005 and CSCur07907.
Near-miss passage: CVE-2015-1563. CWE: CWE-399. CVSS: 2.0999999046325684. The ARM GIC distributor virtualization in Xen 4.4.x and 4.5.x allows local guests to cause a denial of service by causing a large number messages to be logged.
Query: detection rule: Detects changes in Sysmon driver altitude value. If the Sysmon driver is configured to load at an altitude of another re
Matching passage: Sigma rule: Detects changes in Sysmon driver altitude value. If the Sysmon driver is configured to load at an altitude of another re. Logsource: windows / registry_set. Rule: title: Sysmon Driver Altitude Change id: 4916a35e-bfc4-47d0-8e25-a003d7067061 status: test description: 'Detects changes in Sysmon driver altitude value. If the Sysmon driver is configured to load at an altitude of another registered service, it will fail to load at boot. ' references: - https://posts.specterops.io/shhmon-silencing-sysmon-via-driver-unload-682b5be57650 - https://youtu.be/zSihR3lTf7g author: B.Talebi date: 2022-07-28 modified: 2024-03-25 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Services\ TargetObject|endswith: \Instances\Sysmon Instance\Altitude condition: selection falsepositives: - Legitimate driver altitude change to hide sysmon level: high
Near-miss passage: Sigma rule: Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing. Logsource: windows / process_creation. Rule: title: Potential Windows Defender AV Bypass Via Dump64.EXE Rename id: 129966c9-de17-4334-a123-8b58172e664d status: test description: 'Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing it in the Visual Studio folder. Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage. ' references: - https://twitter.com/mrd0x/status/1460597833917251595 author: Austin Songer @austinsonger, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-11-26 modified: 2024-06-21 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: process_creation detection: selection_dump: Image|startswith: :\Program Files Image|contains: \Microsoft Visual Studio\ Image|endswith: \dump64.exe selection_tools_procdump: - OriginalFileName: procdump - CommandLine|contains: - ' -ma ' - ' -mp ' condition: selection_dump and 1 of selection_tools_* falsepositives: - Unknown level: high