alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: indicators of Container API
Matching passage: T1552.007 Container API. Tactics: credential access. Description: Adversaries may gather credentials via APIs within a containers environment. APIs in these environments, such as the Docker API and Kubernetes APIs, allow a user to remotely manage their container resources and cluster components.(Citation: Docker API)(Citation: Kubernetes API) An adversary may access the Docker API to collect logs that contain credentials to cloud, container, and various other resources in the environment.(Citation: Unit 42 Unsecured Docker Daemons) An adversary with sufficient permissions, such as via a pod's service account, may also use the Kubernetes API to retrieve credentials from the Kubernetes API server. These credentials may include those needed for Docker API authentication or secrets from Kubernetes cluster components.
Near-miss passage: T1552.001 Credentials In Files. Tactics: credential access. Description: Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords. It is possible to extract passwords from backups or saved virtual machines through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003).(Citation: CG 2014) Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller.(Citation: SRD GPP) In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files.(Citation: Unit 42 Hildegard Malware) They may also be found as parameters to deployment commands in container logs.(Citation: Unit 42 Unsecured Docker Daemons) In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.(Citation: Specter Ops - Cloud Credential Storage)
Query: describe CVE-2015-2447
Matching passage: CVE-2015-2447. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2446.
Near-miss passage: CVE-2015-9035. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a memory buffer fails to be freed after it is no longer needed potentially resulting in memory exhaustion.
Query: vulnerability: The virtnet_probe function in drivers/net/virtio_net.c in the Linux kernel before 4.2 attempts to support a FRAGLIST feature without proper memory allocation, which allows guest OS
Matching passage: CVE-2015-5156. CWE: CWE-119. CVSS: 6.099999904632568. The virtnet_probe function in drivers/net/virtio_net.c in the Linux kernel before 4.2 attempts to support a FRAGLIST feature without proper memory allocation, which allows guest OS users to cause a denial of service (buffer overflow and memory corruption) via a crafted sequence of fragmented packets.
Near-miss passage: CVE-2015-9171. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, if OEMCrypto_Dash_InstallEncapKeybox() is called with keyBoxLength set to a value higher than TZ_WV_MAX_DATA_LEN (20k), a buffer over-read occurs.
Query: vulnerability: Sinapsi eSolar Light with firmware before 2.0.3970_schsl_2.2.85 allows attackers to discover cleartext passwords by reading the HTML source code of the mail-configuration page.
Matching passage: CVE-2015-3949. CWE: CWE-200. CVSS: 2.0999999046325684. Sinapsi eSolar Light with firmware before 2.0.3970_schsl_2.2.85 allows attackers to discover cleartext passwords by reading the HTML source code of the mail-configuration page.
Near-miss passage: CVE-2015-7940. CWE: CWE-200. CVSS: 5.0. The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."
Query: exploit The (1) setreuid and (2) setregid system-call implementations in the kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 do not properly perform priv
Matching passage: CVE-2015-1117. CWE: CWE-264. CVSS: 6.900000095367432. The (1) setreuid and (2) setregid system-call implementations in the kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 do not properly perform privilege drops, which makes it easier for attackers to execute code with unintended user or group privileges via a crafted app.
Near-miss passage: CVE-2015-8991. CWE: CWE-264. CVSS: 7.0. Malicious file execution vulnerability in Intel Security McAfee Security Scan+ (MSS+) before 3.11.266.3 allows attackers to make the product momentarily vulnerable via executing preexisting specifically crafted malware during installation or uninstallation, but not during normal operation.
Query: CWE for Critical Public Variable Without Final Modifier
Matching passage: CWE-493 Critical Public Variable Without Final Modifier. The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values.
Near-miss passage: CWE-307 Improper Restriction of Excessive Authentication Attempts. The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
Query: CVE similar to CVE-2015-9383
Matching passage: CVE-2015-9383. CWE: CWE-125. CVSS: 6.5. FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.
Near-miss passage: CVE-2015-2326. CWE: CWE-125. CVSS: 5.5. The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/".
Query: detection rule: Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning
Matching passage: Sigma rule: Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning. Logsource: windows / process_creation. Rule: title: Potential AMSI Bypass Via .NET Reflection id: 30edb182-aa75-42c0-b0a9-e998bb29067c related: - id: 4f927692-68b5-4267-871b-073c45f4f6fe type: obsolete status: test description: Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning references: - https://s3cur3th1ssh1t.github.io/Bypass_AMSI_by_manual_modification/ - https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/ author: Markus Neis, @Kostastsale date: 2018-08-17 modified: 2023-02-03 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection: - CommandLine|contains|all: - System.Management.Automation.AmsiUtils - amsiInitFailed - CommandLine|contains|all: - '[Ref].Assembly.GetType' - SetValue($null,$true) - NonPublic,Static condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the use of the "capsh" utility to invoke a shell.. Logsource: linux / process_creation. Rule: title: Capsh Shell Invocation - Linux id: db1ac3be-f606-4e3a-89e0-9607cbe6b98a status: test description: 'Detects the use of the "capsh" utility to invoke a shell. ' references: - https://gtfobins.github.io/gtfobins/capsh/#shell - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-09-02 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection: Image|endswith: /capsh CommandLine|endswith: ' --' condition: selection falsepositives: - Unknown level: high
Query: Sigma rule for Detects a "winlogon.exe" process that initiate network communications with public IP addresses
Matching passage: Sigma rule: Detects a "winlogon.exe" process that initiate network communications with public IP addresses. Logsource: windows / network_connection. Rule: title: Outbound Network Connection To Public IP Via Winlogon id: 7610a4ea-c06d-495f-a2ac-0a696abcfd3b status: test description: Detects a "winlogon.exe" process that initiate network communications with public IP addresses references: - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ author: Christopher Peacock @securepeacock, SCYTHE @scythe_io date: 2023-04-28 modified: 2024-03-12 tags: - attack.execution - attack.command-and-control - attack.stealth - attack.t1218.011 logsource: category: network_connection product: windows detection: selection: Image|endswith: \winlogon.exe Initiated: 'true' filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 condition: selection and not 1 of filter_main_* falsepositives: - Communication to other corporate systems that use IP addresses from public address spaces level: medium
Near-miss passage: Sigma rule: F-Secure C3 produces DLLs with a default exported StartNodeRelay function.. Logsource: windows / process_creation. Rule: title: HackTool - F-Secure C3 Load by Rundll32 id: b18c9d4c-fac9-4708-bd06-dd5bfacf200f status: test description: F-Secure C3 produces DLLs with a default exported StartNodeRelay function. references: - https://github.com/FSecureLABS/C3/blob/11a081fd3be2aaf2a879f6b6e9a96ecdd24966ef/Src/NodeRelayDll/NodeRelayDll.cpp#L12 author: Alfie Champion (ajpc500) date: 2021-06-02 modified: 2023-03-05 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - rundll32.exe - .dll - StartNodeRelay condition: selection falsepositives: - Unknown level: critical
Query: telemetry for T1132
Matching passage: T1132 Data Encoding. Tactics: command and control. Description: Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.(Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.
Near-miss passage: T1132.001 Standard Encoding. Tactics: command and control. Description: Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system that adheres to existing protocol specifications. Common data encoding schemes include ASCII, Unicode, hexadecimal, Base64, and MIME.(Citation: Wikipedia Binary-to-text Encoding)(Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.
Query: vulnerability: dwarf_leb.c in libdwarf allows attackers to cause a denial of service (SIGSEGV).
Matching passage: CVE-2015-8538. CWE: CWE-20. CVSS: 6.5. dwarf_leb.c in libdwarf allows attackers to cause a denial of service (SIGSEGV).
Near-miss passage: CVE-2015-4276. CWE: CWE-20. CVSS: 6.5. Cisco WebEx Meetings Server 2.5MR1 allows remote authenticated users to execute arbitrary code via a crafted command parameter, aka Bug ID CSCus56138.
Query: telemetry for T1578.001
Matching passage: T1578.001 Create Snapshot. Tactics: defense impairment. Description: An adversary may create a snapshot or data backup within a cloud account to evade defenses. A snapshot is a point-in-time copy of an existing cloud compute component such as a virtual machine (VM), virtual hard drive, or volume. An adversary may leverage permissions to create a snapshot in order to bypass restrictions that prevent access to existing compute service infrastructure, unlike in [Revert Cloud Instance](https://attack.mitre.org/techniques/T1578/004) where an adversary may revert to a snapshot to evade detection and remove evidence of their presence. An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002), mount one or more created snapshots to that instance, and then apply a policy that allows the adversary access to the created instance, such as a firewall policy that allows them inbound and outbound SSH access.(Citation: Mandiant M-Trends 2020)
Near-miss passage: T1578.002 Create Cloud Instance. Tactics: defense impairment. Description: An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses. Creating a new instance may allow an adversary to bypass firewall rules and permissions that exist on instances currently residing within an account. An adversary may [Create Snapshot](https://attack.mitre.org/techniques/T1578/001) of one or more volumes in an account, create a new instance, mount the snapshots, and then apply a less restrictive security policy to collect [Data from Local System](https://attack.mitre.org/techniques/T1005) or for [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002).(Citation: Mandiant M-Trends 2020) Creating a new instance may also allow an adversary to carry out malicious activity within an environment without affecting the execution of current running instances.
Query: patch priority for CVE-2015-6633
Matching passage: CVE-2015-6633. CWE: CWE-119. CVSS: 9.300000190734863. The display drivers in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23987307.
Near-miss passage: CVE-2015-0826. CWE: CWE-119. CVSS: 6.800000190734863. The nsTransformedTextRun::SetCapitalization function in Mozilla Firefox before 36.0 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read of heap memory) via a crafted Cascading Style Sheets (CSS) token sequence that triggers a restyle or reflow operation.
Query: rule covering Detects when changes are made to the SSH certificate configuration of the organization.
Matching passage: Sigma rule: Detects when changes are made to the SSH certificate configuration of the organization.. Logsource: github / audit. Rule: title: Github SSH Certificate Configuration Changed id: 2f575940-d85e-4ddc-af13-17dad6f1a0ef status: test description: Detects when changes are made to the SSH certificate configuration of the organization. references: - https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-git-access-to-your-organizations-repositories/about-ssh-certificate-authorities - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#ssh_certificate_authority author: Romain Gaillard (@romain-gaillard) date: 2024-07-29 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.stealth - attack.t1078.004 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action: - ssh_certificate_authority.create - ssh_certificate_requirement.disable condition: selection falsepositives: - Allowed administrative activities. level: medium
Near-miss passage: Sigma rule: Detects suspicious network connections made by a well-known Windows binary run with no command line parameters. Logsource: windows / network_connection. Rule: title: Suspicious Network Connection Binary No CommandLine id: 20384606-a124-4fec-acbb-8bd373728613 status: test description: Detects suspicious network connections made by a well-known Windows binary run with no command line parameters references: - https://redcanary.com/blog/raspberry-robin/ author: Florian Roth (Nextron Systems) date: 2022-07-03 tags: - attack.stealth logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: - \regsvr32.exe - \rundll32.exe - \dllhost.exe CommandLine|endswith: - \regsvr32.exe - \rundll32.exe - \dllhost.exe filter_no_cmdline: CommandLine: '' filter_null: CommandLine: null condition: selection and not 1 of filter* falsepositives: - Unknown level: high
Query: detect Detect malicious GPO modifications can be used to implement many other malicious behaviors. in logs
Matching passage: Sigma rule: Detect malicious GPO modifications can be used to implement many other malicious behaviors.. Logsource: windows / ps_script. Rule: title: Modify Group Policy Settings - ScriptBlockLogging id: b7216a7d-687e-4c8d-82b1-3080b2ad961f related: - id: ada4b0c4-758b-46ac-9033-9004613a150d type: similar status: test description: Detect malicious GPO modifications can be used to implement many other malicious behaviors. references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1484.001/T1484.001.md author: frack113 date: 2022-08-19 tags: - attack.privilege-escalation - attack.defense-impairment - attack.t1484.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_path: ScriptBlockText|contains: \SOFTWARE\Policies\Microsoft\Windows\System selection_key: ScriptBlockText|contains: - GroupPolicyRefreshTimeDC - GroupPolicyRefreshTimeOffsetDC - GroupPolicyRefreshTime - GroupPolicyRefreshTimeOffset - EnableSmartScreen - ShellSmartScreenLevel condition: all of selection_* falsepositives: - Legitimate use level: medium
Near-miss passage: Sigma rule: Detects the use of the EnableRegion command in AWS CloudTrail logs. While AWS has 30+ regions, some of them are enabled. Logsource: aws / cloudtrail. Rule: title: AWS EnableRegion Command Monitoring id: a5ffb6ea-c784-4e01-b30a-deb6e58ca2ab status: experimental description: 'Detects the use of the EnableRegion command in AWS CloudTrail logs. While AWS has 30+ regions, some of them are enabled by default, others must be explicitly enabled in each account separately. There may be situations where security monitoring does not cover some new AWS regions. Monitoring the EnableRegion command is important for identifying potential persistence mechanisms employed by adversaries, as enabling additional regions can facilitate continued access and operations within an AWS environment. ' references: - https://docs.aws.amazon.com/accounts/latest/reference/API_EnableRegion.html - https://awscli.amazonaws.com/v2/documentation/api/2.14.0/reference/account/enable-region.html author: Ivan Saakov, Sergey Zelenskiy date: 2025-10-19 tags: - attack.persistence logsource: product: aws service: cloudtrail detection: selection: eventName: EnableRegion eventSource: account.amazonaws.com condition: selection falsepositives: - Legitimate use of the EnableRegion command by authorized administrators. level: medium
Query: SIEM correlation: credential access activity consistent with Cloud Instance Metadata API
Matching passage: T1552.005 Cloud Instance Metadata API. Tactics: credential access. Description: Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data. Most cloud service providers support a Cloud Instance Metadata API which is a service provided to running virtual instances that allows applications to access information about the running virtual instance. Available information generally includes name, security group, and additional metadata including sensitive data such as credentials and UserData scripts that may contain additional secrets. The Instance Metadata API is provided as a convenience to assist in managing applications and is accessible by anyone who can access the instance.(Citation: AWS Instance Metadata API) A cloud metadata API has been used in at least one high profile compromise.(Citation: Krebs Capital One August 2019) If adversaries have a presence on the running virtual instance, they may query the Instance Metadata API directly to identify credentials that grant access to additional resources. Additionally, adversaries may exploit a Server-Side Request Forgery (SSRF) vulnerability in a public facing web proxy that allows them to gain access to the sensitive information via a request to the Instance Metadata API.(Citation: RedLock Instance Metadata API 2018) The de facto standard across cloud service providers is to host the Instance Metadata API at <code>http[:]//169.254.169.254</code>.
Near-miss passage: T1552.002 Credentials in Registry. Tactics: credential access. Description: Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons. Example commands to find Registry keys related to password information: (Citation: Pentestlab Stored Credentials) * Local Machine Hive: <code>reg query HKLM /f password /t REG_SZ /s</code> * Current User Hive: <code>reg query HKCU /f password /t REG_SZ /s</code>
Query: CVE similar to CVE-2015-0161
Matching passage: CVE-2015-0161. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-1476. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in xlinkerz ecommerceMajor allow remote attackers to execute arbitrary SQL commands via the (1) productbycat parameter to product.php, or (2) username or (3) password parameter to __admin/index.php.