alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection engineering for Dynamic Linker Hijacking
Matching passage: T1574.006 Dynamic Linker Hijacking. Tactics: stealth, execution. Description: Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from various environment variables and files, such as <code>LD_PRELOAD</code> on Linux or <code>DYLD_INSERT_LIBRARIES</code> on macOS.(Citation: TheEvilBit DYLD_INSERT_LIBRARIES)(Citation: Timac DYLD_INSERT_LIBRARIES)(Citation: Gabilondo DYLD_INSERT_LIBRARIES Catalina Bypass) Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name.(Citation: Man LD.SO)(Citation: TLDP Shared Libraries)(Citation: Apple Doco Archive Dynamic Libraries) Each platform's linker uses an extensive list of environment variables at different points in execution. These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions in the original library.(Citation: Baeldung LD_PRELOAD) Hijacking dynamic linker variables may grant access to the victim process's memory, system/network resources, and possibly elevated privileges. On Linux, adversaries may set <code>LD_PRELOAD</code> to point to malicious libraries that match the name of legitimate libraries which are requested by a victim program, causing the operating system to load the adversary's malicious code upon execution of the victim program. For example, adversaries have used `LD_PRELOAD` to inject a malicious library into every descendant process of the `sshd` daemon, resulting in execution under a legitimate process. When the executing sub-process calls the `execve` function, for example, the malicious library’s `execve` function is executed rather than the system function `execve` contained in the system library on disk. This allows adversaries to [Hide Artifacts](https://attack.mitre.org/techniques/T1564) from detection, as
Near-miss passage: T1574 Hijack Execution Flow. Tactics: stealth, execution. Description: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.
Query: CVE similar to CVE-2015-0876
Matching passage: CVE-2015-0876. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the print_language_selectbox function in classes/adminpage.inc.php in Saurus CMS Community Edition before 4.7 2015-02-04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-6061. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Microsoft Skype for Business 2016, Lync 2010 and 2013 SP1, Lync 2010 Attendee, and Lync Room System allows remote attackers to inject arbitrary web script or HTML via an instant-message session, aka "Server Input Validation Information Disclosure Vulnerability."
Query: vulnerability: Buffer overflow in Saitoh Kikaku Maruo Editor 8.51 and earlier allows remote attackers to execute arbitrary code via a crafted .hmbook file.
Matching passage: CVE-2015-0903. CWE: CWE-119. CVSS: 7.5. Buffer overflow in Saitoh Kikaku Maruo Editor 8.51 and earlier allows remote attackers to execute arbitrary code via a crafted .hmbook file.
Near-miss passage: CVE-2015-9177. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, in a crypto API function, a buffer over-read can occur.
Query: Outbound C2 pattern associated with Double File Extension
Matching passage: T1036.007 Double File Extension. Tactics: stealth. Description: Adversaries may abuse a double extension in the filename as a means of masquerading the true file type. A file name may include a secondary file type extension that may cause only the first extension to be displayed (ex: <code>File.txt.exe</code> may render in some views as just <code>File.txt</code>). However, the second extension is the true file type that determines how the file is opened and executed. The real file extension may be hidden by the operating system in the file browser (ex: explorer.exe), as well as in any software configured using or similar to the system’s policies.(Citation: PCMag DoubleExtension)(Citation: SOCPrime DoubleExtension) Adversaries may abuse double extensions to attempt to conceal dangerous file types of payloads. A very common usage involves tricking a user into opening what they think is a benign file type but is actually executable code. Such files often pose as email attachments and allow an adversary to gain [Initial Access](https://attack.mitre.org/tactics/TA0001) into a user’s system via [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) then [User Execution](https://attack.mitre.org/techniques/T1204). For example, an executable file attachment named <code>Evil.txt.exe</code> may display as <code>Evil.txt</code> to a user. The user may then view it as a benign text file and open it, inadvertently executing the hidden malware.(Citation: SOCPrime DoubleExtension) Common file types, such as text files (.txt, .doc, etc.) and image files (.jpg, .gif, etc.) are typically used as the first extension to appear benign. Executable extensions commonly regarded as dangerous, such as .exe, .lnk, .hta, and .scr, often appear as the second extension and true file type.
Near-miss passage: T1036.001 Invalid Code Signature. Tactics: stealth. Description: Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program. Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may improperly handle these files.(Citation: Threatexpress MetaTwin 2017) Unlike [Code Signing](https://attack.mitre.org/techniques/T1553/002), this activity will not result in a valid signature.
Query: Sigma rule for Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence purposes by malicious
Matching passage: Sigma rule: Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence purposes by malicious. Logsource: windows / process_creation. Rule: title: Suspicious GrpConv Execution id: f14e169e-9978-4c69-acb3-1cff8200bc36 status: test description: Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors references: - https://twitter.com/0gtweet/status/1526833181831200770 author: Florian Roth (Nextron Systems) date: 2022-05-19 tags: - attack.privilege-escalation - attack.persistence - attack.t1547 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - grpconv.exe -o - grpconv -o condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of Sysinternals tools via an AppX package. Attackers could install the Sysinternals Suite to get acces. Logsource: windows / appmodel-runtime. Rule: title: Sysinternals Tools AppX Versions Execution id: d29a20b2-be4b-4827-81f2-3d8a59eab5fc status: test description: 'Detects execution of Sysinternals tools via an AppX package. Attackers could install the Sysinternals Suite to get access to tools such as psexec and procdump to avoid detection based on System paths. ' references: - https://learn.microsoft.com/en-us/sysinternals/downloads/microsoft-store author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-16 modified: 2023-09-12 tags: - attack.execution - attack.stealth logsource: product: windows service: appmodel-runtime detection: selection: EventID: 201 ImageName: - procdump.exe - psloglist.exe - psexec.exe - livekd.exe - ADExplorer.exe condition: selection falsepositives: - Legitimate usage of sysinternals applications from the Windows Store will trigger this. Apply exclusions as needed. level: low
Query: exploit Cross-site scripting (XSS) vulnerability in usersettings.php in e107 2.0.0 allows remote attackers to inject arbitrary web script or HTML via the "Real Name" value.
Matching passage: CVE-2015-1057. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in usersettings.php in e107 2.0.0 allows remote attackers to inject arbitrary web script or HTML via the "Real Name" value.
Near-miss passage: CVE-2015-2941. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error message, related to unsafe calls to wddx_serialize_value.
Query: exploit The high-speed logging (HSL) feature in Cisco IOS XE 2.x and 3.x before 3.10.4S, 3.11 before 3.11.3S, 3.12 before 3.12.1S, 3.13 before 3.13.0S, 3.14 before 3.14.0S, and 3.15 before
Matching passage: CVE-2015-0640. CWE: CWE-20. CVSS: 7.800000190734863. The high-speed logging (HSL) feature in Cisco IOS XE 2.x and 3.x before 3.10.4S, 3.11 before 3.11.3S, 3.12 before 3.12.1S, 3.13 before 3.13.0S, 3.14 before 3.14.0S, and 3.15 before 3.15.0S allows remote attackers to cause a denial of service (device reload) via large IP packets that require NAT and HSL processing after fragmentation, aka Bug ID CSCuo25741.
Near-miss passage: CVE-2015-8711. CWE: CWE-20. CVSS: 5.5. epan/dissectors/packet-nbap.c in the NBAP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate conversation data, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet.
Query: explain CWE-1258
Matching passage: CWE-1258 Exposure of Sensitive System Information Due to Uncleared Debug Information. The hardware does not fully clear security-sensitive values, such as keys and intermediate values in cryptographic operations, when debug mode is entered.
Near-miss passage: CWE-627 Dynamic Variable Evaluation. In a language where the user can influence the name of a variable at runtime, if the variable names are not controlled, an attacker can read or write to arbitrary variables, or access arbitrary functions.
Query: describe CVE-2015-1178
Matching passage: CVE-2015-1178. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in cart.php in X-Cart 5.1.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) product_id or (2) category_id parameter.
Near-miss passage: CVE-2015-5667. CWE: CWE-79. CVSS: 2.5999999046325684. Cross-site scripting (XSS) vulnerability in the HTML-Scrubber module before 0.15 for Perl, when the comment feature is enabled, allows remote attackers to inject arbitrary web script or HTML via a crafted comment.
Query: CVE similar to CVE-2015-9270
Matching passage: CVE-2015-9270. CWE: CWE-79. CVSS: 6.099999904632568. XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter.
Near-miss passage: CVE-2015-9386. CWE: CWE-79. CVSS: 6.099999904632568. The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation.
Query: risk of Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors.
Matching passage: CVE-2015-0500. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors.
Near-miss passage: CVE-2015-5184. CWE: UNKNOWN. CVSS: 7.5. Console: CORS headers set to allow all in Red Hat AMQ.
Query: CWE for Incorrect Block Delimitation
Matching passage: CWE-483 Incorrect Block Delimitation. The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error.
Near-miss passage: CWE-1288 Improper Validation of Consistency within Input. The product receives a complex input with multiple elements or fields that must be consistent with each other, but it does not validate or incorrectly validates that the input is actually consistent.
Query: risk of The COPPA error page in the Accounts setup dialog in Mozilla Firefox OS before 2.2 embeds content from an external web server URL into the System process, which allows man-in-the-m
Matching passage: CVE-2015-5961. CWE: CWE-264. CVSS: 3.299999952316284. The COPPA error page in the Accounts setup dialog in Mozilla Firefox OS before 2.2 embeds content from an external web server URL into the System process, which allows man-in-the-middle attackers to bypass intended access restrictions by spoofing that server.
Near-miss passage: CVE-2015-5635. CWE: CWE-264. CVSS: 6.800000190734863. The Newphoria Koritore application before 1.1 for Android and before 1.1 for iOS allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
Query: Encoded PowerShell / command-line abuse matching Application Window Discovery
Matching passage: T1010 Application Window Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.(Citation: Prevailion DarkWatchman 2021) For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ([Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) to evade.(Citation: ESET Grandoreiro April 2020) Adversaries typically abuse system features for this type of enumeration. For example, they may gather information through native system features such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) commands and [Native API](https://attack.mitre.org/techniques/T1106) functions.
Near-miss passage: T1482 Domain Trust Discovery. Tactics: discovery. Description: Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain.(Citation: Microsoft Trusts) Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct [SID-History Injection](https://attack.mitre.org/techniques/T1134/005), [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003), and [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).(Citation: AdSecurity Forging Trust Tickets)(Citation: Harmj0y Domain Trusts) Domain trusts can be enumerated using the `DSEnumerateDomainTrusts()` Win32 API call, .NET methods, and LDAP.(Citation: Harmj0y Domain Trusts) The Windows utility [Nltest](https://attack.mitre.org/software/S0359) is known to be used by adversaries to enumerate domain trusts.(Citation: Microsoft Operation Wilysupply)
Query: Multiple failed authentications followed by Remote Email Collection
Matching passage: T1114.002 Remote Email Collection. Tactics: collection. Description: Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords.
Near-miss passage: T1114.003 Email Forwarding Rule. Tactics: collection. Description: Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.(Citation: Pfammatter - Hidden Inbox Rules) Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient. These rules may be created through a local email application, a web interface, or by command-line interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2)(Citation: Mac Forwarding Rules) Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more. Adversaries may also hide the rule by making use of the Microsoft Messaging API (MAPI) to modify the rule properties, making it hidden and not visible from Outlook, OWA or most Exchange Administration tools.(Citation: Pfammatter - Hidden Inbox Rules) In some environments, administrators may be able to enable email forwarding rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.(Citation: Microsof
Query: describe CVE-2015-7243
Matching passage: CVE-2015-7243. CWE: CWE-119. CVSS: 7.5. Buffer overflow in Boxoft WAV to MP3 Converter allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted WAV file.
Near-miss passage: CVE-2015-2408. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1767 and CVE-2015-2401.
Query: write Sigma for Detects the creation of a new office macro files on the system via an application (browser, mail client). This can help
Matching passage: Sigma rule: Detects the creation of a new office macro files on the system via an application (browser, mail client). This can help. Logsource: windows / file_event. Rule: title: Office Macro File Download id: 0e29e3a7-1ad8-40aa-b691-9f82ecd33d66 related: - id: 91174a41-dc8f-401b-be89-7bfc140612a0 type: similar status: test description: 'Detects the creation of a new office macro files on the system via an application (browser, mail client). This can help identify potential malicious activity, such as the download of macro-enabled documents that could be used for exploitation. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference author: Nasreddine Bencherchali (Nextron Systems) date: 2022-01-23 modified: 2025-10-29 tags: - attack.initial-access - attack.t1566.001 logsource: category: file_event product: windows detection: selection_processes: Image|endswith: - \RuntimeBroker.exe - \outlook.exe - \thunderbird.exe - \brave.exe - \chrome.exe - \firefox.exe - \iexplore.exe - \maxthon.exe - \MicrosoftEdge.exe - \msedge.exe - \msedgewebview2.exe - \opera.exe - \safari.exe - \seamonkey.exe - \vivaldi.exe - \whale.exe selection_ext: - TargetFilename|endswith: - .docm - .dotm - .xlsm - .xltm - .potm - .pptm - TargetFilename|contains: - .docm:Zone - .dotm:Zone - .xlsm:Zone - .xltm:Zone - .potm:Zone - .pptm:Zone condition: all of selection_* falsepositives: - Legitimate macro files downloaded from the internet - Legitimate macro files sent as attachments via emails level: low
Near-miss passage: Sigma rule: Aversaries may use to interact with a remote network share using Server Message Block (SMB). This technique is used by p. Logsource: windows / file_event. Rule: title: Writing Local Admin Share id: 4aafb0fa-bff5-4b9d-b99e-8093e659c65f status: test description: 'Aversaries may use to interact with a remote network share using Server Message Block (SMB). This technique is used by post-exploitation frameworks. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.002/T1021.002.md#atomic-test-4---execute-command-writing-output-to-local-admin-share author: frack113 date: 2022-01-01 modified: 2022-08-13 tags: - attack.privilege-escalation - attack.persistence - attack.lateral-movement - attack.t1546.002 logsource: product: windows category: file_event detection: selection: TargetFilename|contains|all: - \\\\127.0.0 - \ADMIN$\ condition: selection falsepositives: - Unknown level: medium
Query: risk of OSIsoft PI AF 2.6 and 2.7 and PI SQL for AF 2.1.2.19 do not ensure that the PI SQL (AF) Trusted Users group lacks the Everyone account, which allows remote authenticated users to b
Matching passage: CVE-2015-1013. CWE: CWE-89. CVSS: 6.5. OSIsoft PI AF 2.6 and 2.7 and PI SQL for AF 2.1.2.19 do not ensure that the PI SQL (AF) Trusted Users group lacks the Everyone account, which allows remote authenticated users to bypass intended command restrictions via SQL statements.
Near-miss passage: CVE-2015-9458. CWE: CWE-89. CVSS: 7.199999809265137. The searchterms-tagging-2 plugin through 1.535 for WordPress has SQL injection via the pk_stt2_db_get_popular_terms count parameter exploitable via CSRF.
Query: exploit The Views Bulk Operations (VBO) module 6.x-1.x and 7.x-3.x before 7.x-3.3 for Drupal, when the bulk operation for changing Roles is enabled, allows remote authenticated users to ed
Matching passage: CVE-2015-5515. CWE: CWE-264. CVSS: 4.900000095367432. The Views Bulk Operations (VBO) module 6.x-1.x and 7.x-3.x before 7.x-3.3 for Drupal, when the bulk operation for changing Roles is enabled, allows remote authenticated users to edit user accounts and add arbitrary roles to the accounts by leveraging access to a user account listing view with VBO enabled.
Near-miss passage: CVE-2015-7961. CWE: CWE-264. CVSS: 7.800000190734863. SafeNet Authentication Service Remote Web Workplace Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.