alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection engineering for Botnet
Matching passage: T1583.005 Botnet. Tactics: resource development. Description: Adversaries may buy, lease, or rent a network of compromised systems that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.(Citation: Norton Botnet) Adversaries may purchase a subscription to use an existing botnet from a booter/stresser service. Internet-facing edge devices and related network appliances that are end-of-life (EOL) and unsupported by their manufacturers are commonly acquired for botnet activities. Adversaries may lease operational relay box (ORB) networks – consisting of virtual private servers (VPS), small office/home office (SOHO) routers, or Internet of Things (IoT) devices – to serve as a botnet.(Citation: ORB Mandiant) With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale [Phishing](https://attack.mitre.org/techniques/T1566) or Distributed Denial of Service (DDoS).(Citation: Imperva DDoS for Hire)(Citation: Krebs-Anna)(Citation: Krebs-Bazaar)(Citation: Krebs-Booter) Acquired botnets may also be used to support Command and Control activity, such as [Hide Infrastructure](https://attack.mitre.org/techniques/T1665) through an established [Proxy](https://attack.mitre.org/techniques/T1090) network.
Near-miss passage: T1583.004 Server. Tactics: resource development. Description: Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, such as watering hole operations in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), enabling [Phishing](https://attack.mitre.org/techniques/T1566) operations, or facilitating [Command and Control](https://attack.mitre.org/tactics/TA0011). Instead of compromising a third-party [Server](https://attack.mitre.org/techniques/T1584/004) or renting a [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may opt to configure and run their own servers in support of operations. Free trial periods of cloud servers may also be abused.(Citation: Free Trial PurpleUrchin)(Citation: Freejacked) Adversaries may only need a lightweight setup if most of their activities will take place using online infrastructure. Or, they may need to build extensive infrastructure if they want to test, communicate, and control other aspects of their activities on their own systems.(Citation: NYTStuxnet)
Query: vulnerability: The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 attempts to use memset for a memory region of negative length during interaction with the mozil
Matching passage: CVE-2015-0806. CWE: CWE-17. CVSS: 7.5. The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 attempts to use memset for a memory region of negative length during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors that trigger rendering of 2D graphics content.
Near-miss passage: CVE-2015-2270. CWE: CWE-17. CVSS: 4.300000190734863. lib/moodlelib.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4, when the theme uses the blocks-regions feature, establishes the course state at an incorrect point in the login-validation process, which allows remote attackers to obtain sensitive course information via unspecified vectors.
Query: alert when Detects call to "Win32_QuickFixEngineering" in order to enumerate installed hotfixes often used in "enum" scripts by att
Matching passage: Sigma rule: Detects call to "Win32_QuickFixEngineering" in order to enumerate installed hotfixes often used in "enum" scripts by att. Logsource: windows / ps_script. Rule: title: PowerShell Hotfix Enumeration id: f5d1def8-1de0-4a0e-9794-1f6f27dd605c status: test description: Detects call to "Win32_QuickFixEngineering" in order to enumerate installed hotfixes often used in "enum" scripts by attackers references: - https://github.com/411Hall/JAWS/blob/233f142fcb1488172aa74228a666f6b3c5c48f1d/jaws-enum.ps1 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-21 tags: - attack.discovery logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Win32_QuickFixEngineering - HotFixID condition: selection falsepositives: - Legitimate administration scripts level: medium
Near-miss passage: Sigma rule: Detects the usage of particular AttributeLDAPDisplayNames, which are known for data exchange via LDAP by the tool LDAPFr. Logsource: windows / security. Rule: title: Suspicious LDAP-Attributes Used id: d00a9a72-2c09-4459-ad03-5e0a23351e36 status: test description: Detects the usage of particular AttributeLDAPDisplayNames, which are known for data exchange via LDAP by the tool LDAPFragger and are additionally not commonly used in companies. references: - https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961 - https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/ - https://github.com/fox-it/LDAPFragger author: xknow @xknow_infosec date: 2019-03-24 modified: 2022-10-05 tags: - attack.t1001.003 - attack.command-and-control logsource: product: windows service: security definition: The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule) detection: selection: EventID: 5136 AttributeValue|contains: '*' AttributeLDAPDisplayName: - primaryInternationalISDNNumber - otherFacsimileTelephoneNumber - primaryTelexNumber condition: selection falsepositives: - Companies, who may use these default LDAP-Attributes for personal information level: high
Query: risk of Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary code via an svn:// prot
Matching passage: CVE-2015-5259. CWE: CWE-119. CVSS: 8.600000381469727. Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary code via an svn:// protocol string, which triggers a heap-based buffer overflow and an out-of-bounds read.
Near-miss passage: CVE-2015-7034. CWE: CWE-119. CVSS: 6.800000190734863. The Apple iWork application before 2.6 for iOS and Apple Pages before 5.6 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Pages document.
Query: risk of OpenAFS before 1.6.13 allows remote attackers to spoof bos commands via unspecified vectors.
Matching passage: CVE-2015-3283. CWE: CWE-264. CVSS: 6.800000190734863. OpenAFS before 1.6.13 allows remote attackers to spoof bos commands via unspecified vectors.
Near-miss passage: CVE-2015-4596. CWE: CWE-264. CVSS: 7.800000190734863. Lenovo Mouse Suite before 6.73 allows local users to run arbitrary code with administrator privileges.
Query: rule covering Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permi
Matching passage: Sigma rule: Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permi. Logsource: windows / process_creation. Rule: title: Suspicious Recursive Takeown id: 554601fb-9b71-4bcc-abf4-21a611be4fde status: test description: Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permissions on specific files and folders references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/takeown - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.001/T1222.001.md#atomic-test-1---take-ownership-using-takeown-utility author: frack113 date: 2022-01-30 modified: 2022-11-21 tags: - attack.defense-impairment - attack.t1222.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: \takeown.exe CommandLine|contains|all: - '/f ' - /r condition: selection falsepositives: - Scripts created by developers and admins - Administrative activity level: medium
Near-miss passage: Sigma rule: Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that Windows. Logsource: windows / file_event. Rule: title: Suspicious Double Extension Files id: b4926b47-a9d7-434c-b3a0-adc3fa0bd13e related: - id: 1cdd9a09-06c9-4769-99ff-626e2b3991b8 type: derived - id: 3215aa19-f060-4332-86d5-5602511f3ca8 type: similar status: test description: Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that Windows hide default extensions by default. references: - https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/ - https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations - https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles - https://twitter.com/malwrhunterteam/status/1235135745611960321 - https://twitter.com/luc4m/status/1073181154126254080 - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites - https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/ author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2022-06-19 modified: 2026-03-31 tags: - attack.stealth - attack.t1036.007 logsource: category: file_event product: windows detection: selection_gen: TargetFilename|endswith: - .exe - .iso - .rar - .svg - .zip TargetFilename|contains: - .doc. - .docx. - .gif. - .jpeg. - .jpg. - .mp3. - .mp4. - .pdf. - .png. - .ppt. - .pptx. - .rtf. - .svg. - .txt. - .xls. - .xlsx. selection_exe: TargetFilename|endswith: - .rar.exe - .zip.exe filter_icons_linux: TargetFilename|startswith: /usr/share/icons/ condition: 1 of selection_* and not 1 of filter_* falsepositives: - Unlikely level: high
Query: Multiple failed authentications followed by Exploitation for Stealth
Matching passage: T1211 Exploitation for Stealth. Tactics: stealth. Description: Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components. Adversaries may exploit a system or application vulnerability to avoid detection while maintaining access within an environment. Exploitation occurs when an adversary leverages a programming flaw to execute code in a manner that minimizes visibility or blends in with legitimate activity. Rather than directly disabling defenses, adversaries may use exploitation to circumvent monitoring and logging mechanisms. This can include abusing vulnerabilities in logging pipelines, security tools, or cloud infrastructure to evade audit trails, suppress alerts, or operate without generating telemetry. Adversaries may identify these opportunities through prior reconnaissance or by performing discovery of security controls after initial access. In some cases, vulnerabilities in SaaS or public cloud environments may be exploited to evade logging, obscure activity, or deploy infrastructure that remains hidden from standard monitoring tools.(Citation: Bypassing CloudTrail in AWS Service Catalog)(Citation: GhostToken GCP flaw)
Near-miss passage: T1027.009 Embedded Payloads. Tactics: stealth. Description: Adversaries may embed payloads within other files to conceal malicious content from defenses. Otherwise seemingly benign files (such as scripts and executables) may be abused to carry and obfuscate malicious payloads and content. In some cases, embedded payloads may also enable adversaries to [Subvert Trust Controls](https://attack.mitre.org/techniques/T1553) by not impacting execution controls such as digital signatures and notarization tickets.(Citation: Sentinel Labs) Adversaries may embed payloads in various file formats to hide payloads.(Citation: Microsoft Learn) This is similar to [Steganography](https://attack.mitre.org/techniques/T1027/003), though does not involve weaving malicious content into specific bytes and patterns related to legitimate digital media formats.(Citation: GitHub PSImage) For example, adversaries have been observed embedding payloads within or as an overlay of an otherwise benign binary.(Citation: Securelist Dtrack2) Adversaries have also been observed nesting payloads (such as executables and run-only scripts) inside a file of the same format.(Citation: SentinelLabs reversing run-only applescripts 2021) Embedded content may also be used as [Process Injection](https://attack.mitre.org/techniques/T1055) payloads used to infect benign system processes.(Citation: Trend Micro) These embedded then injected payloads may be used as part of the modules of malware designed to provide specific features such as encrypting C2 communications in support of an orchestrator module. For example, an embedded module may be injected into default browsers, allowing adversaries to then communicate via the network.(Citation: Malware Analysis Report ComRAT)
Query: exploit Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to bypass the Same Origin Policy via data: and view-source: URIs.
Matching passage: CVE-2015-7214. CWE: CWE-200. CVSS: 5.0. Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to bypass the Same Origin Policy via data: and view-source: URIs.
Near-miss passage: CVE-2015-2206. CWE: CWE-200. CVSS: 5.0. libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
Query: Encoded PowerShell / command-line abuse matching COR_PROFILER
Matching passage: T1574.012 COR_PROFILER. Tactics: stealth, execution. Description: Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profilers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR.(Citation: Microsoft Profiling Mar 2017)(Citation: Microsoft COR_PROFILER Feb 2013) The COR_PROFILER environment variable can be set at various scopes (system, user, or process) resulting in different levels of influence. System and user-wide environment variable scopes are specified in the Registry, where a [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) object can be registered as a profiler DLL. A process scope COR_PROFILER can also be created in-memory without modifying the Registry. Starting with .NET Framework 4, the profiling DLL does not need to be registered as long as the location of the DLL is specified in the COR_PROFILER_PATH environment variable.(Citation: Microsoft COR_PROFILER Feb 2013) Adversaries may abuse COR_PROFILER to establish persistence that executes a malicious DLL in the context of all .NET processes every time the CLR is invoked. The COR_PROFILER can also be used to elevate privileges (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)) if the victim .NET process executes at a higher permission level, as well as to hook and impair defenses provided by .NET processes.(Citation: RedCanary Mockingbird May 2020)(Citation: Red Canary COR_PROFILER May 2020)(Citation: Almond COR_PROFILER Apr 2019)(Citation: GitHub OmerYa Invisi-Shell)(Citation: subTee .NET Profilers May 2017)
Near-miss passage: T1574.010 Services File Permissions Weakness. Tactics: stealth, execution. Description: Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM. Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.
Query: vulnerability: The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header.
Matching passage: CVE-2015-9416. CWE: CWE-79. CVSS: 6.099999904632568. The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header.
Near-miss passage: CVE-2015-1394. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) sort_by, (2) sort_order, (3) items_view, (4) dir, (5) clipboard_task, (6) clipboard_files, (7) clipboard_src, or (8) clipboard_dest parameters in an addImages action to wp-admin/admin-ajax.php.
Query: patch priority for CVE-2015-3058
Matching passage: CVE-2015-3058. CWE: CWE-200. CVSS: 5.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to obtain sensitive information from process memory via unspecified vectors.
Near-miss passage: CVE-2015-4375. CWE: CWE-200. CVSS: 4.300000190734863. The Chaos tool suite (ctools) module 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to obtain sensitive node titles via (1) an autocomplete search on custom entities without an access query tag or (2) leveraging knowledge of the ID of an entity.
Query: CVE similar to CVE-2015-9229
Matching passage: CVE-2015-9229. CWE: CWE-79. CVSS: 4.800000190734863. In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated administrators via the images[1][alttext] parameter.
Near-miss passage: CVE-2015-4381. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote authenticated users with the "Administer own invoices" permission to inject arbitrary web script or HTML via unspecified vectors involving nodes of the "Invoice" content type.
Query: vulnerability: The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with s
Matching passage: CVE-2015-8226. CWE: CWE-20. CVSS: 5.5. The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with software before V100R001C233B111 allows remote attackers to cause a denial of service (crash) via a crafted application with the system or camera permission, a different vulnerability than CVE-2015-8225.
Near-miss passage: CVE-2015-0753. CWE: CWE-20. CVSS: 6.800000190734863. SQL injection vulnerability in Cisco Unified Email Interaction Manager (EIM) and Unified Web Interaction Manager (WIM) 9.0(2) allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuu30028.
Query: SOC alert related to Protocol or Service Impersonation
Matching passage: T1001.003 Protocol or Service Impersonation. Tactics: command and control. Description: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity. Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.(Citation: ESET Okrum July 2019)(Citation: Malleable-C2-U42)
Near-miss passage: T1001.001 Junk Data. Tactics: command and control. Description: Adversaries may add junk data to protocols used for command and control to make detection more difficult.(Citation: FireEye SUNBURST Backdoor December 2020) By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, deciphering, or otherwise analyzing the traffic. Examples may include appending/prepending data with junk characters or writing junk characters between significant characters.
Query: exploit The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection.
Matching passage: CVE-2015-9400. CWE: CWE-89. CVSS: 8.800000190734863. The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection.
Near-miss passage: CVE-2015-4066. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in admin/handlers.php in the GigPress plugin before 2.3.9 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) show_artist_id or (2) show_venue_id parameter in an add action in the gigpress.php page to wp-admin/admin.php.