alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: SIEM correlation: lateral movement activity consistent with VNC
Matching passage: T1021.005 VNC. Tactics: lateral movement. Description: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely control machines using Virtual Network Computing (VNC). VNC is a platform-independent desktop sharing system that uses the RFB (“remote framebuffer”) protocol to enable users to remotely control another computer’s display by relaying the screen, mouse, and keyboard inputs over the network.(Citation: The Remote Framebuffer Protocol) VNC differs from [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) as VNC is screen-sharing software rather than resource-sharing software. By default, VNC uses the system's authentication, but it can be configured to use credentials specific to VNC.(Citation: MacOS VNC software for Remote Desktop)(Citation: VNC Authentication) Adversaries may abuse VNC to perform malicious actions as the logged-on user such as opening documents, downloading files, and running arbitrary commands. An adversary could use VNC to remotely control and monitor a system to collect data and information to pivot to other systems within the network. Specific VNC libraries/implementations have also been susceptible to brute force attacks and memory usage exploitation.(Citation: Hijacking VNC)(Citation: macOS root VNC login without authentication)(Citation: VNC Vulnerabilities)(Citation: Offensive Security VNC Authentication Check)(Citation: Attacking VNC Servers PentestLab)(Citation: Havana authentication bug)
Near-miss passage: T1021.008 Direct Cloud VM Connections. Tactics: lateral movement. Description: Adversaries may leverage [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log directly into accessible cloud hosted compute infrastructure through cloud native methods. Many cloud providers offer interactive connections to virtual infrastructure that can be accessed through the [Cloud API](https://attack.mitre.org/techniques/T1059/009), such as Azure Serial Console(Citation: Azure Serial Console), AWS EC2 Instance Connect(Citation: EC2 Instance Connect)(Citation: lucr-3: Getting SaaS-y in the cloud), and AWS System Manager.(Citation: AWS System Manager). Methods of authentication for these connections can include passwords, application access tokens, or SSH keys. These cloud native methods may, by default, allow for privileged access on the host with SYSTEM or root level access. Adversaries may utilize these cloud native methods to directly access virtual infrastructure and pivot through an environment.(Citation: SIM Swapping and Abuse of the Microsoft Azure Serial Console) These connections typically provide direct console access to the VM rather than the execution of scripts (i.e., [Cloud Administration Command](https://attack.mitre.org/techniques/T1651)).
Query: describe CVE-2015-4386
Matching passage: CVE-2015-4386. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in unspecified administration pages in the EntityBulkDelete module 7.x-1.0 for Drupal allow remote attackers to inject arbitrary web script or HTML via unknown vectors involving creating or editing (1) comments, (2) taxonomy terms, or (3) nodes.
Near-miss passage: CVE-2015-1347. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in client.inc.php in osTicket before 1.9.5.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
Query: vulnerability: The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable assertion and application crash) 
Matching passage: CVE-2015-6908. CWE: CWE-20. CVSS: 5.0. The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd.
Near-miss passage: CVE-2015-9046. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached due to an improper bound on the size of a frequency list.
Query: risk of Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."
Matching passage: CVE-2015-0071. CWE: UNKNOWN. CVSS: 6.5. Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."
Near-miss passage: CVE-2015-0334. CWE: UNKNOWN. CVSS: 9.300000190734863. Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-0336.
Query: exploit Multiple cross-site scripting (XSS) vulnerabilities in Alkacon OpenCms 9.5.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) homelink paramete
Matching passage: CVE-2015-2351. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Alkacon OpenCms 9.5.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) homelink parameter to system/modules/org.opencms.workplace.help/jsptemplates/help_head.jsp, (2) workplaceresource parameter to system/workplace/locales/en/help/index.html, (3) path parameter to system/workplace/views/admin/admin-main.jsp, (4) mode parameter to system/workplace/views/explorer/explorer_files.jsp, or (5) query parameter in a search action to system/modules/org.opencms.workplace.help/elements/search.jsp.
Near-miss passage: CVE-2015-0551. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop 6.7SP1 before P31, 6.7SP2 before P23, and 6.8 before P01; Documentum Administrator 6.7SP1 before P31, 6.7SP2 before P23, 7.0 before P18, 7.1 before P15, and 7.2 before P01; Documentum Digital Assets Manager 6.5SP6 before P25; Documentum Web Publishers 6.5 SP7 before P25; and Documentum Task Space 6.7SP1 before P31 and 6.7SP2 before P23 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Query: patch priority for CVE-2015-7181
Matching passage: CVE-2015-7181. CWE: CWE-119. CVSS: 7.5. The sec_asn1d_parse_leaf function in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, improperly restricts access to an unspecified data structure, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data, related to a "use-after-poison" issue.
Near-miss passage: CVE-2015-3702. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3700, and CVE-2015-3701.
Query: exploit Cross-site request forgery (CSRF) vulnerability in Cisco Prime Collaboration Assurance 10.5(1) and 10.6 allows remote attackers to hijack the authentication of arbitrary users, aka
Matching passage: CVE-2015-6330. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco Prime Collaboration Assurance 10.5(1) and 10.6 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus62712.
Near-miss passage: CVE-2015-2912. CWE: CWE-352. CVSS: 8.800000190734863. The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted HTTP request.
Query: risk of IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 allows remote a
Matching passage: CVE-2015-0126. CWE: UNKNOWN. CVSS: 6.5. IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 allows remote authenticated users to bypass intended file-upload restrictions via a modified extension.
Near-miss passage: CVE-2015-7236. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via crafted packets, involving a PMAP_CALLIT code.
Query: rule covering Detects attackers attempting to disable Windows Defender using Powershell
Matching passage: Sigma rule: Detects attackers attempting to disable Windows Defender using Powershell. Logsource: windows / process_creation. Rule: title: Disable Windows Defender AV Security Monitoring id: a7ee1722-c3c5-aeff-3212-c777e4733217 status: test description: Detects attackers attempting to disable Windows Defender using Powershell references: - https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/ - https://rvsec0n.wordpress.com/2020/01/24/malwares-that-bypass-windows-defender/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md author: ok @securonix invrep-de, oscd.community, frack113 date: 2020-10-12 modified: 2022-11-18 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_pwsh_binary: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_pwsh_cli: CommandLine|contains: - -DisableBehaviorMonitoring $true - -DisableRuntimeMonitoring $true selection_sc_binary: - Image|endswith: \sc.exe - OriginalFileName: sc.exe selection_sc_tamper_cmd_stop: CommandLine|contains|all: - stop - WinDefend selection_sc_tamper_cmd_delete: CommandLine|contains|all: - delete - WinDefend selection_sc_tamper_cmd_disabled: CommandLine|contains|all: - config - WinDefend - start=disabled condition: all of selection_pwsh_* or (selection_sc_binary and 1 of selection_sc_tamper_*) falsepositives: - Minimal, for some older versions of dev tools, such as pycharm, developers were known to sometimes disable Windows Defender to improve performance, but this generally is not considered a good security practice. level: high
Near-miss passage: Sigma rule: Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.. Logsource: windows / process_creation. Rule: title: SQLite Chromium Profile Data DB Access id: 24c77512-782b-448a-8950-eddb0785fc71 status: test description: Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing. references: - https://github.com/redcanaryco/atomic-red-team/blob/84d9edaaaa2c5511144521b0e4af726d1c7276ce/atomics/T1539/T1539.md#atomic-test-2---steal-chrome-cookies-windows - https://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/ author: TropChaud date: 2022-12-19 modified: 2023-01-19 tags: - attack.credential-access - attack.t1539 - attack.t1555.003 - attack.collection - attack.t1005 logsource: category: process_creation product: windows detection: selection_sql: - Product: SQLite - Image|endswith: - \sqlite.exe - \sqlite3.exe selection_chromium: CommandLine|contains: - \User Data\ - \Opera Software\ - \ChromiumViewer\ selection_data: CommandLine|contains: - Login Data - Cookies - Web Data - History - Bookmarks condition: all of selection_* falsepositives: - Unknown level: high
Query: detection rule: Monitor and alert for changes to the device registration policy.
Matching passage: Sigma rule: Monitor and alert for changes to the device registration policy.. Logsource: azure / auditlogs. Rule: title: Changes to Device Registration Policy id: 9494bff8-959f-4440-bbce-fb87a208d517 status: test description: Monitor and alert for changes to the device registration policy. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#device-registrations-and-joins-outside-policy author: Michael Epping, '@mepples21' date: 2022-06-28 tags: - attack.privilege-escalation - attack.defense-impairment - attack.t1484 logsource: product: azure service: auditlogs detection: selection: Category: Policy ActivityDisplayName: Set device registration policies condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Adversaries may look for details about the network configuration and settings of systems they access or through informat. Logsource: windows / process_creation. Rule: title: Firewall Configuration Discovery Via Netsh.EXE id: 0e4164da-94bc-450d-a7be-a4b176179f1f status: test description: Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md#atomic-test-2---list-windows-firewall-rules - https://ss64.com/nt/netsh.html author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' date: 2021-12-07 modified: 2025-10-18 tags: - attack.discovery - attack.t1016 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: CommandLine|contains|all: - netsh - 'show ' - 'firewall ' CommandLine|contains: - 'config ' - 'state ' - 'rule ' - name=all condition: all of selection_* falsepositives: - Administrative activity level: low
Query: defense impairment using Clear Linux or Mac System Logs
Matching passage: T1685.006 Clear Linux or Mac System Logs. Tactics: defense impairment. Description: Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the `/var/log/` directory. Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs) * `/var/log/messages:`: General and system-related messages * `/var/log/secure or /var/log/auth.log`: Authentication logs * `/var/log/utmp or /var/log/wtmp`: Login records * `/var/log/kern.log`: Kernel logs * `/var/log/cron.log`: Crond logs * `/var/log/maillog`: Mail server logs * `/var/log/httpd/`: Web server access and error logs
Near-miss passage: T1685.002 Disable or Modify Cloud Log. Tactics: defense impairment. Description: An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities. For example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity. They may alternatively tamper with logging functionality, for example, by removing any associated SNS topics, disabling multi-region logging, or disabling settings that validate and/or encrypt log files.(Citation: AWS Cloud Trail)(Citation: Pacu Detection Disruption Module) In Office 365, an adversary may disable logging on mail collection activities for specific users by using the Set-MailboxAuditBypassAssociation cmdlet, by disabling M365 Advanced Auditing for the user, or by downgrading the user’s license from an Enterprise E5 to an Enterprise E3 license.(Citation: Dark Reading)
Query: CVE similar to CVE-2015-7185
Matching passage: CVE-2015-7185. CWE: CWE-254. CVSS: 4.300000190734863. Mozilla Firefox before 42.0 on Android does not ensure that the address bar is restored upon fullscreen-mode exit, which allows remote attackers to spoof the address bar via crafted JavaScript code.
Near-miss passage: CVE-2015-8990. CWE: CWE-254. CVSS: 7.5. Detection bypass vulnerability in Intel Security Advanced Threat Defense (ATD) 3.4.6 and earlier allows malware samples to bypass ATD detection via renaming the malware.
Query: rule covering Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe proces
Matching passage: Sigma rule: Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe proces. Logsource: windows / create_remote_thread. Rule: title: Password Dumper Remote Thread in LSASS id: f239b326-2f41-4d6b-9dfa-c846a60ef505 status: stable description: 'Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage. The process in field Process is the malicious program. A single execution can lead to hundreds of events. ' references: - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/WCE.htm author: Thomas Patzke date: 2017-02-19 modified: 2021-06-21 tags: - attack.credential-access - attack.s0005 - attack.t1003.001 logsource: product: windows category: create_remote_thread detection: selection: TargetImage|endswith: \lsass.exe StartModule: '' condition: selection falsepositives: - Antivirus products level: high
Near-miss passage: Sigma rule: Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been. Logsource: macos / process_creation. Rule: title: Remote Access Tool - Team Viewer Session Started On MacOS Host id: f459ccb4-9805-41ea-b5b2-55e279e2424a related: - id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357 type: similar - id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d type: similar status: test description: 'Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder. ' references: - Internal Research author: Josh Nickels, Qi Nan date: 2024-03-11 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: process_creation product: macos detection: selection: ParentImage|endswith: /TeamViewer_Service Image|endswith: /TeamViewer_Desktop CommandLine|endswith: /TeamViewer_Desktop --IPCport 5939 --Module 1 condition: selection falsepositives: - Legitimate usage of TeamViewer level: low
Query: risk of Cross-site scripting (XSS) vulnerability in the "magic-macros" feature in Revive Adserver before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via a GET para
Matching passage: CVE-2015-7373. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the "magic-macros" feature in Revive Adserver before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via a GET parameter, which is not properly handled in a banner.
Near-miss passage: CVE-2015-2665. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: risk of Heap-based buffer overflow in the verify_vbr_checksum function in exfatfsck in exfat-utils before 1.2.1 allows remote attackers to cause a denial of service (infinite loop) or poss
Matching passage: CVE-2015-8026. CWE: CWE-119. CVSS: 7.800000190734863. Heap-based buffer overflow in the verify_vbr_checksum function in exfatfsck in exfat-utils before 1.2.1 allows remote attackers to cause a denial of service (infinite loop) or possibly execute arbitrary code via a crafted filesystem.
Near-miss passage: CVE-2015-2520. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: risk of IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to cause a denial of service (maintenance-
Matching passage: CVE-2015-0142. CWE: CWE-264. CVSS: 4.0. IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to cause a denial of service (maintenance-mode transition and data-storage outage) by calling the System Administration Mode function.
Near-miss passage: CVE-2015-2554. CWE: CWE-264. CVSS: 7.199999809265137. The kernel in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Windows Object Reference Elevation of Privilege Vulnerability."
Query: rule covering Detects potential DLL sideloading of "CCleanerDU.dll"
Matching passage: Sigma rule: Detects potential DLL sideloading of "CCleanerDU.dll". Logsource: windows / image_load. Rule: title: Potential CCleanerDU.DLL Sideloading id: 1fbc0671-5596-4e17-8682-f020a0b995dc status: test description: Detects potential DLL sideloading of "CCleanerDU.dll" references: - https://lab52.io/blog/2344-2/ author: X__Junior (Nextron Systems) date: 2023-07-13 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \CCleanerDU.dll filter_main_path: Image|startswith: - C:\Program Files\CCleaner\ - C:\Program Files (x86)\CCleaner\ Image|endswith: - \CCleaner.exe - \CCleaner64.exe condition: selection and not 1 of filter_main_* falsepositives: - False positives could occur from other custom installation paths. Apply additional filters accordingly. level: medium
Near-miss passage: Sigma rule: Detects a when net.exe is called with a password in the command line. Logsource: windows / process_creation. Rule: title: Password Provided In Command Line Of Net.EXE id: d4498716-1d52-438f-8084-4a603157d131 status: test description: Detects a when net.exe is called with a password in the command line references: - Internal Research author: Tim Shelton (HAWK.IO) date: 2021-12-09 modified: 2023-02-21 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.lateral-movement - attack.stealth - attack.t1021.002 - attack.t1078 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: CommandLine|contains|all: - ' use ' - :*\\ - /USER:* * filter_main_empty: CommandLine|endswith: ' ' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: secure coding against Callable with Insufficient Behavioral Summary
Matching passage: CWE-1117 Callable with Insufficient Behavioral Summary. The code contains a function or method whose signature and/or associated inline documentation does not sufficiently describe the callable's inputs, outputs, side effects, assumptions, or return codes.
Near-miss passage: CWE-1229 Creation of Emergent Resource. The product manages resources or behaves in a way that indirectly creates a new, distinct resource that can be used by attackers in violation of the intended policy.