alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: hunt for Archive via Library activity
Matching passage: T1560.002 Archive via Library. Tactics: collection. Description: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including [Python](https://attack.mitre.org/techniques/T1059/006) rarfile (Citation: PyPI RAR), libzip (Citation: libzip), and zlib (Citation: Zlib Github). Most libraries include functionality to encrypt and/or compress data. Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. Note that the libraries are different from the utilities. The libraries can be linked against when compiling, while the utilities require spawning a subshell, or a similar execution mechanism.
Near-miss passage: T1560.003 Archive via Custom Method. Tactics: collection. Description: An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.(Citation: ESET Sednit Part 2)
Query: patch priority for CVE-2015-1932
Matching passage: CVE-2015-1932. CWE: CWE-200. CVSS: 5.0. IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 and WebSphere Virtual Enterprise before 7.0.0.7 allow remote attackers to obtain potentially sensitive information about the proxy-server software by reading the HTTP Via header.
Near-miss passage: CVE-2015-8280. CWE: CWE-200. CVSS: 7.5. Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to discover credentials by reading detailed error messages.
Query: describe CVE-2015-8778
Matching passage: CVE-2015-8778. CWE: CWE-119. CVSS: 9.800000190734863. Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via the size argument to the __hcreate_r function, which triggers out-of-bounds heap-memory access.
Near-miss passage: CVE-2015-1682. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Office 2013 SP1, Excel 2013 SP1, PowerPoint 2013 SP1, Word 2013 SP1, Office 2013 RT SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Word 2013 RT SP1, Office for Mac 2011, Excel for Mac 2011, PowerPoint for Mac 2011, Word for Mac 2011, PowerPoint Viewer, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Excel Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps 2010 SP2, Excel Web App 2010 SP2, Office Web Apps Server 2013 SP1, SharePoint Foundation 2010 SP2, and SharePoint Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: Sigma YAML for windows / image_load
Matching passage: Sigma rule: Detects potential DLL sideloading of "roboform.dll", a DLL used by RoboForm Password Manager. Logsource: windows / image_load. Rule: title: Potential RoboForm.DLL Sideloading id: f64c9b2d-b0ad-481d-9d03-7fc75020892a status: test description: Detects potential DLL sideloading of "roboform.dll", a DLL used by RoboForm Password Manager references: - https://twitter.com/StopMalvertisin/status/1648604148848549888 - https://twitter.com/t3ft3lb/status/1656194831830401024 - https://www.roboform.com/ author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-05-14 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: - \roboform.dll - \roboform-x64.dll filter_main_path: Image|startswith: - ' C:\Program Files (x86)\Siber Systems\AI RoboForm\' - ' C:\Program Files\Siber Systems\AI RoboForm\' Image|endswith: - \robotaskbaricon.exe - \robotaskbaricon-x64.exe condition: selection and not 1 of filter_main_* falsepositives: - If installed on a per-user level, the path would be located in "AppData\Local". Add additional filters to reflect this mode of installation level: medium
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22). Logsource: windows / process_creation. Rule: title: UAC Bypass Using Consent and Comctl32 - Process id: 1ca6bd18-0ba0-44ca-851c-92ed89a61085 status: test description: Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-23 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \consent.exe Image|endswith: \werfault.exe IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 condition: selection falsepositives: - Unknown level: high
Query: detection engineering for Exfiltration Over Symmetric Encrypted Non-C2 Protocol
Matching passage: T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Symmetric encryption algorithms are those that use shared or the same keys/secrets on each end of the channel. This requires an exchange or pre-arranged agreement/possession of the value used to encrypt and decrypt data. Network protocols that use asymmetric encryption often utilize symmetric encryption once keys are exchanged, but adversaries may opt to manually share keys and implement symmetric cryptographic algorithms (ex: RC4, AES) vice using mechanisms that are baked into a protocol. This may result in multiple layers of encryption (in protocols that are natively encrypted such as HTTPS) or encryption in protocols that not typically encrypted (such as HTTP or FTP).
Near-miss passage: T1048 Exfiltration Over Alternative Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and/or obfuscate these alternate channels. [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048) can be done using various common operating system utilities such as [Net](https://attack.mitre.org/software/S0039)/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016) On macOS and Linux <code>curl</code> may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.(Citation: 20 macOS Common Tools and Techniques) Many IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or [Cloud API](https://attack.mitre.org/techniques/T1059/009).
Query: describe CVE-2015-2675
Matching passage: CVE-2015-2675. CWE: CWE-119. CVSS: 7.5. The OAuth implementation in librest before 0.7.93 incorrectly truncates the pointer returned by the rest_proxy_call_get_url function, which allows remote attackers to cause a denial of service (application crash) via running the EnsureCredentials method from the org.gnome.OnlineAccounts.Account interface on an object representing a Flickr account.
Near-miss passage: CVE-2015-8388. CWE: CWE-119. CVSS: 7.5. PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Query: CVE similar to CVE-2015-7367
Matching passage: CVE-2015-7367. CWE: CWE-284. CVSS: 7.5. Revive Adserver before 3.2.2 allows remote attackers to perform unspecified actions by leveraging an unexpired session after the user has been (1) deleted or (2) unlinked.
Near-miss passage: CVE-2015-3062. CWE: CWE-284. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3063, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, CVE-2015-3073, and CVE-2015-3074.
Query: Sigma rule for Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential
Matching passage: Sigma rule: Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential. Logsource: linux / process_creation. Rule: title: Python Spawning Pretty TTY Via PTY Module id: c4042d54-110d-45dd-a0e1-05c47822c937 related: - id: 32e62bc7-3de0-4bb1-90af-532978fe42c0 type: similar status: test description: 'Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential reverse shell activity. ' references: - https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/ author: Nextron Systems date: 2022-06-03 modified: 2024-11-04 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection_img: - Image|endswith: - /python - /python2 - /python3 - Image|contains: - /python2. - /python3. selection_cli_import: CommandLine|contains: - import pty - 'from pty ' selection_cli_spawn: CommandLine|contains: spawn condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone o. Logsource: windows / process_creation. Rule: title: Sysmon Configuration Update id: 87911521-7098-470b-a459-9a57fc80bdfd status: test description: Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone one to avoid monitoring without shutting down the service completely references: - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-09 modified: 2026-06-29 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_pe: - Image|endswith: - \Sysmon64.exe - \Sysmon64a.exe - \Sysmon.exe - Description: System activity monitor selection_cli: CommandLine|contains|windash: -c condition: all of selection_* falsepositives: - Legitimate administrators might use this command to update Sysmon configuration. level: medium
Query: describe CVE-2015-6387
Matching passage: CVE-2015-6387. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Cisco Unified Computing System (UCS) Central Software 1.3(0.1) allows remote attackers to inject arbitrary web script or HTML via a crafted value in a URL, aka Bug ID CSCux33573.
Near-miss passage: CVE-2015-4386. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in unspecified administration pages in the EntityBulkDelete module 7.x-1.0 for Drupal allow remote attackers to inject arbitrary web script or HTML via unknown vectors involving creating or editing (1) comments, (2) taxonomy terms, or (3) nodes.
Query: ATT&CK technique for Startup Items
Matching passage: T1037.005 Startup Items. Tactics: persistence, privilege escalation. Description: Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.(Citation: Startup Items) This is technically a deprecated technology (superseded by [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)), and thus the appropriate folder, <code>/Library/StartupItems</code> isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. A startup item is a directory whose executable and configuration property list (plist), <code>StartupParameters.plist</code>, reside in the top-level directory. An adversary can create the appropriate folders/files in the StartupItems directory to register their own persistence mechanism.(Citation: Methods of Mac Malware Persistence) Additionally, since StartupItems run during the bootup phase of macOS, they will run as the elevated root user.
Near-miss passage: T1037.002 Login Hook. Tactics: persistence, privilege escalation. Description: Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that points to a specific script to execute with root privileges upon user logon. The plist file is located in the <code>/Library/Preferences/com.apple.loginwindow.plist</code> file and can be modified using the <code>defaults</code> command-line utility. This behavior is the same for logout hooks where a script can be executed upon user logout. All hooks require administrator permissions to modify or create hooks.(Citation: Login Scripts Apple Dev)(Citation: LoginWindowScripts Apple Dev) Adversaries can add or insert a path to a malicious script in the <code>com.apple.loginwindow.plist</code> file, using the <code>LoginHook</code> or <code>LogoutHook</code> key-value pair. The malicious script is executed upon the next user login. If a login hook already exists, adversaries can add additional commands to an existing login hook. There can be only one login and logout hook on a system at a time.(Citation: S1 macOs Persistence)(Citation: Wardle Persistence Chapter) **Note:** Login hooks were deprecated in 10.11 version of macOS in favor of [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001)
Query: CVE similar to CVE-2015-1403
Matching passage: CVE-2015-1403. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-10038. CWE: CWE-89. CVSS: 8.0. A vulnerability was found in nym3r0s pplv2. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The patch is named 28f8b0550104044da09f04659797487c59f85b00. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218023.
Query: detection rule: Detects execution of rundll32 where the DLL being called is stored in an Alternate Data Stream (ADS).
Matching passage: Sigma rule: Detects execution of rundll32 where the DLL being called is stored in an Alternate Data Stream (ADS).. Logsource: windows / process_creation. Rule: title: Potential Rundll32 Execution With DLL Stored In ADS id: 9248c7e1-2bf3-4661-a22c-600a8040b446 status: test description: Detects execution of rundll32 where the DLL being called is stored in an Alternate Data Stream (ADS). references: - https://lolbas-project.github.io/lolbas/Binaries/Rundll32 author: Harjot Singh, '@cyb3rjy0t' date: 2023-01-21 modified: 2026-03-16 tags: - attack.stealth - attack.t1564.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|re: '[Rr][Uu][Nn][Dd][Ll][Ll]32(?:\.[Ee][Xx][Ee])? \S+?\w:\S+?:' condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects access to clipboard content via osascript, which may be used for data collection but also occurs in legitimate c. Logsource: macos / process_creation. Rule: title: Clipboard Access Via OSAScript id: 7794fa3c-edea-4cff-bec7-267dd4770fd7 related: - id: 1bc2e6c5-0885-472b-bed6-be5ea8eace55 type: derived status: test description: Detects access to clipboard content via osascript, which may be used for data collection but also occurs in legitimate clipboard utilities and automation scripts references: - https://www.sentinelone.com/blog/how-offensive-actors-use-applescript-for-attacking-macos/ author: Sohan G (D4rkCiph3r) date: 2023-01-31 modified: 2026-05-22 tags: - attack.collection - attack.execution - attack.t1115 - attack.t1059.002 logsource: product: macos category: process_creation detection: selection: Image|endswith: /osascript CommandLine|contains|all: - ' -e ' - clipboard filter_optional_opencode: ParentImage|endswith: opencode CommandLine|contains|all: - osascript - ' -e ' - set imageData to the clipboard - set fileRef condition: selection and not 1 of filter_optional_* falsepositives: - Legitimate clipboard utilities and automation scripts that read or write clipboard content - Developer tools and IDEs that use osascript for clipboard integration level: medium
Query: alert when Detects processes loading modules related to PCRE.NET package
Matching passage: Sigma rule: Detects processes loading modules related to PCRE.NET package. Logsource: windows / image_load. Rule: title: PCRE.NET Package Image Load id: 84b0a8f3-680b-4096-a45b-e9a89221727c status: test description: Detects processes loading modules related to PCRE.NET package references: - https://twitter.com/rbmaslen/status/1321859647091970051 - https://twitter.com/tifkin_/status/1321916444557365248 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-29 modified: 2022-10-09 tags: - attack.execution - attack.t1059 logsource: category: image_load product: windows detection: selection: ImageLoaded|contains: \AppData\Local\Temp\ba9ea7344a4a5f591d6e5dc32a13494b\ condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of "getcap" binary. This is often used during recon activity to determine potential binaries that can be a. Logsource: linux / process_creation. Rule: title: Capabilities Discovery - Linux id: d8d97d51-122d-4cdd-9e2f-01b4b4933530 status: test description: Detects usage of "getcap" binary. This is often used during recon activity to determine potential binaries that can be abused as GTFOBins or other. references: - https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes - https://github.com/carlospolop/PEASS-ng - https://github.com/diego-treitos/linux-smart-enumeration author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-28 modified: 2026-01-24 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: linux detection: selection: Image|endswith: /getcap CommandLine|contains: ' -r ' condition: selection falsepositives: - Unknown level: low
Query: CWE for Improper Handling of Incomplete Structural Elements
Matching passage: CWE-238 Improper Handling of Incomplete Structural Elements. The product does not handle or incorrectly handles when a particular structural element is not completely specified.
Near-miss passage: CWE-297 Improper Validation of Certificate with Host Mismatch. The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.
Query: patch priority for CVE-2015-2432
Matching passage: CVE-2015-2432. CWE: CWE-19. CVSS: 9.300000190734863. ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability."
Near-miss passage: CVE-2015-7979. CWE: CWE-19. CVSS: 7.5. NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server association tear down) by sending broadcast packets with invalid authentication to a broadcast client.
Query: risk of In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MSM8909W, SD 2
Matching passage: CVE-2015-9190. CWE: CWE-190. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 600, SD 615/16/SD 415, SD 808, and SD 810, if start_addr + size is too large in boot_clobber_check_local_address_range(), an integer overflow occurs, resulting in clobber protection check being bypassed and SBL memory corruption.
Near-miss passage: CVE-2015-5108. CWE: CWE-190. CVSS: 10.0. Integer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5097 and CVE-2015-5109.