alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Monitor and alert on group membership additions of groups that have CA policy modification access
Matching passage: Sigma rule: Monitor and alert on group membership additions of groups that have CA policy modification access. Logsource: azure / auditlogs. Rule: title: User Added To Group With CA Policy Modification Access id: 91c95675-1f27-46d0-bead-d1ae96b97cd3 status: test description: Monitor and alert on group membership additions of groups that have CA policy modification access references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner' date: 2022-08-04 tags: - attack.privilege-escalation - attack.credential-access - attack.persistence - attack.defense-impairment - attack.t1548 - attack.t1556 logsource: product: azure service: auditlogs detection: selection: properties.message: Add member from group condition: selection falsepositives: - User removed from the group is approved level: medium
Near-miss passage: Sigma rule: Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux syste. Logsource: linux / process_creation. Rule: title: Disable Or Stop Services id: de25eeb8-3655-4643-ac3a-b662d3f26b6b status: test description: 'Detects the usage of utilities such as ''systemctl'', ''service''...etc to stop or disable tools and services on Linux systems. Attackers may stop or disable security tools and services to evade detection, maintain persistence, or disrupt system operations. ' references: - https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-15 modified: 2025-03-18 tags: - attack.defense-impairment - attack.t1685 - attack.impact - attack.t1489 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /service - /systemctl - /chkconfig CommandLine|contains: - ' stop ' - ' disable ' filter_main_legit_snapd: Image|endswith: /systemctl CommandLine|contains: - --no-reload disable snap-snapd- - ' stop snap-snapd-' filter_main_ssh_preinstall: Image|endswith: /systemctl ParentCommandLine|contains: tmp.ci/preinst upgrade CommandLine|contains|all: - ' stop ' - ssh. filter_main_ubuntu_upgrade: ParentCommandLine|contains: /dpkg/info/ubuntu-pro-client.prerm upgrade Image|endswith: /systemctl filter_optional_aws_agent: Image|endswith: /systemctl CommandLine|endswith: snap.amazon-ssm-agent.amazon-ssm-agent.service condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate administration activities - Some false positives are to be expected. Apply additional filters as needed before pushing to production. level: medium
Query: describe CVE-2015-2086
Matching passage: CVE-2015-2086. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the live preview in the Panopoly Magic module before 7.x-1.17 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a pane title.
Near-miss passage: CVE-2015-6253. CWE: CWE-79. CVSS: 5.400000095367432. edx-platform before 2015-08-17 allows XSS in the Studio listing of courses.
Query: vulnerability: Untrusted search path vulnerability in Ecava IntegraXor SCADA Server before 4.2.4488 allows local users to gain privileges via a renamed DLL in the default install directory.
Matching passage: CVE-2015-0990. CWE: UNKNOWN. CVSS: 4.400000095367432. Untrusted search path vulnerability in Ecava IntegraXor SCADA Server before 4.2.4488 allows local users to gain privileges via a renamed DLL in the default install directory.
Near-miss passage: CVE-2015-4907. CWE: UNKNOWN. CVSS: 4.599999904632568. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than CVE-2015-4820.
Query: CVE similar to CVE-2015-1076
Matching passage: CVE-2015-1076. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Near-miss passage: CVE-2015-6421. CWE: CWE-399. CVSS: 7.5. cifs-ao in the CIFS optimization functionality on Cisco Wide Area Application Service (WAAS) and Virtual WAAS (vWAAS) devices 5.x before 5.3.5d and 5.4 and 5.5 before 5.5.3 allows remote attackers to cause a denial of service (resource consumption and device reload) via crafted network traffic, aka Bug ID CSCus85330.
Query: risk of Microsoft Internet Explorer 6 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explore
Matching passage: CVE-2015-0029. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-1077. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Query: CWE for Unexpected Status Code or Return Value
Matching passage: CWE-394 Unexpected Status Code or Return Value. The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.
Near-miss passage: CWE-926 Improper Export of Android Application Components. The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.
Query: secure coding against Incorrect Privilege Assignment
Matching passage: CWE-266 Incorrect Privilege Assignment. A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
Near-miss passage: CWE-104 Struts: Form Bean Does Not Extend Validation Class. If a form bean does not extend an ActionForm subclass of the Validator framework, it can expose the application to other weaknesses related to insufficient input validation.
Query: risk of Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality via unknown vectors related to installation.
Matching passage: CVE-2015-2627. CWE: UNKNOWN. CVSS: 2.5999999046325684. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality via unknown vectors related to installation.
Near-miss passage: CVE-2015-8812. CWE: UNKNOWN. CVSS: 9.800000190734863. drivers/infiniband/hw/cxgb3/iwch_cm.c in the Linux kernel before 4.5 does not properly identify error conditions, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted packets.
Query: alert when Detects Commandlet names from ShellIntel exploitation scripts.
Matching passage: Sigma rule: Detects Commandlet names from ShellIntel exploitation scripts.. Logsource: windows / ps_script. Rule: title: Malicious ShellIntel PowerShell Commandlets id: 402e1e1d-ad59-47b6-bf80-1ee44985b3a7 status: test description: Detects Commandlet names from ShellIntel exploitation scripts. references: - https://github.com/Shellntel/scripts/ author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems) date: 2021-08-09 modified: 2023-01-02 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Invoke-SMBAutoBrute - Invoke-GPOLinks - Invoke-Potato condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of PowerShell via the creation of a named pipe starting with PSHost. Logsource: windows / pipe_created. Rule: title: New PowerShell Instance Created id: ac7102b4-9e1e-4802-9b4f-17c5524c015c related: - id: 58cb02d5-78ce-4692-b3e1-dce850aae41a type: derived status: test description: Detects the execution of PowerShell via the creation of a named pipe starting with PSHost references: - https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html - https://threathunterplaybook.com/hunts/windows/190410-LocalPwshExecution/notebook.html author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2019-09-12 modified: 2023-11-30 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName|startswith: \PSHost condition: selection falsepositives: - Likely level: informational
Query: actor TTPs: Digital Certificates
Matching passage: T1588.004 Digital Certificates. Tactics: resource development. Description: Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. Adversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) if the certificate is trusted or otherwise added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)). The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities.(Citation: DiginotarCompromise) Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for. Certificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free.(Citation: Let's Encrypt FAQ) After obtaining a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control.
Near-miss passage: T1588.003 Code Signing Certificates. Tactics: resource development. Description: Adversaries may buy and/or steal code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is. Prior to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may purchase or steal code signing certificates for use in operations. The purchase of code signing certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal code signing materials directly from a compromised third-party.
Query: risk of Multiple stack-based buffer overflows in Moxa VPort ActiveX SDK Plus before 2.8 allow remote attackers to insert assembly-code lines via vectors involving a regkey (1) set or (2) g
Matching passage: CVE-2015-0986. CWE: CWE-119. CVSS: 7.5. Multiple stack-based buffer overflows in Moxa VPort ActiveX SDK Plus before 2.8 allow remote attackers to insert assembly-code lines via vectors involving a regkey (1) set or (2) get command.
Near-miss passage: CVE-2015-8319. CWE: CWE-119. CVSS: 7.800000190734863. Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application, a different vulnerability than CVE-2015-8318.
Query: campaign using Lateral Tool Transfer
Matching passage: T1570 Lateral Tool Transfer. Tactics: lateral movement. Description: Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation. Adversaries may copy files between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) to connected network shares or with authenticated connections via [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001).(Citation: Unit42 LockerGoga 2019) Files can also be transferred using native or otherwise present tools on the victim system, such as scp, rsync, curl, sftp, and [ftp](https://attack.mitre.org/software/S0095). In some cases, adversaries may be able to leverage [Web Service](https://attack.mitre.org/techniques/T1102)s such as Dropbox or OneDrive to copy files from one machine to another via shared, automatically synced folders.(Citation: Dropbox Malware Sync)
Near-miss passage: T1534 Internal Spearphishing. Tactics: lateral movement. Description: After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization. Internal spearphishing is multi-staged campaign where a legitimate account is initially compromised either by controlling the user's device or by compromising the account credentials of the user. Adversaries may then attempt to take advantage of the trusted internal account to increase the likelihood of tricking more victims into falling for phish attempts, often incorporating [Impersonation](https://attack.mitre.org/techniques/T1684/001).(Citation: Trend Micro - Int SP) For example, adversaries may leverage [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) or [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002) as part of internal spearphishing to deliver a payload or redirect to an external site to capture credentials through [Input Capture](https://attack.mitre.org/techniques/T1056) on sites that mimic login interfaces. Adversaries may also leverage internal chat apps, such as Microsoft Teams, to spread malicious content or engage users in attempts to capture sensitive information and/or credentials.(Citation: Int SP - chat apps)
Query: what is T1596.005
Matching passage: T1596.005 Scan Databases. Tactics: reconnaissance. Description: Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners.(Citation: Shodan) Adversaries may search scan databases to gather actionable information. Threat actors can use online resources and lookup tools to harvest information from these services. Adversaries may seek information about their already identified targets, or use these datasets to discover opportunities for successful breaches. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).
Near-miss passage: T1596.003 Digital Certificates. Tactics: reconnaissance. Description: Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content. These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location. Adversaries may search digital certificate data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about certificates.(Citation: SSLShopper Lookup) Digital certificate data may also be available from artifacts signed by the organization (ex: certificates used from encrypted web traffic are served with content).(Citation: Medium SSL Cert) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Query: describe CVE-2015-0478
Matching passage: CVE-2015-0478. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JRockit R28.3.5, allows remote attackers to affect confidentiality via vectors related to JCE.
Near-miss passage: CVE-2015-3136. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
Query: patch priority for CVE-2015-8791
Matching passage: CVE-2015-8791. CWE: CWE-200. CVSS: 4.300000190734863. The EbmlElement::ReadCodedSizeValue function in libEBML before 1.3.3 allows context-dependent attackers to obtain sensitive information from process heap memory via a crafted length value in an EBML id, which triggers an invalid memory access.
Near-miss passage: CVE-2015-1602. CWE: CWE-200. CVSS: 2.0999999046325684. Siemens SIMATIC STEP 7 (TIA Portal) 12 and 13 before 13 SP1 Upd1 improperly stores password data within project files, which makes it easier for local users to determine cleartext (1) protection-level passwords or (2) web-server passwords by leveraging the ability to read these files.
Query: exploit Integer overflow in Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute ar
Matching passage: CVE-2015-0338. CWE: UNKNOWN. CVSS: 10.0. Integer overflow in Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-6791. CWE: UNKNOWN. CVSS: 10.0. Multiple unspecified vulnerabilities in Google Chrome before 47.0.2526.80 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Query: CVE similar to CVE-2015-8280
Matching passage: CVE-2015-8280. CWE: CWE-200. CVSS: 7.5. Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to discover credentials by reading detailed error messages.
Near-miss passage: CVE-2015-8224. CWE: CWE-200. CVSS: 3.700000047683716. Huawei P8 before GRA-CL00C92B210, before GRA-L09C432B200, before GRA-TL00C01B210, and before GRA-UL00C00B210 allows remote attackers to obtain user equipment (aka UE) measurements of signal strengths.