alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Persistence mechanism resembling Lateral Tool Transfer
Matching passage: T1570 Lateral Tool Transfer. Tactics: lateral movement. Description: Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation. Adversaries may copy files between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) to connected network shares or with authenticated connections via [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001).(Citation: Unit42 LockerGoga 2019) Files can also be transferred using native or otherwise present tools on the victim system, such as scp, rsync, curl, sftp, and [ftp](https://attack.mitre.org/software/S0095). In some cases, adversaries may be able to leverage [Web Service](https://attack.mitre.org/techniques/T1102)s such as Dropbox or OneDrive to copy files from one machine to another via shared, automatically synced folders.(Citation: Dropbox Malware Sync)
Near-miss passage: T1563 Remote Service Session Hijacking. Tactics: lateral movement. Description: Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP. When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service. Adversaries may commandeer these sessions to carry out actions on remote systems. [Remote Service Session Hijacking](https://attack.mitre.org/techniques/T1563) differs from use of [Remote Services](https://attack.mitre.org/techniques/T1021) because it hijacks an existing session rather than creating a new session using [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: RDP Hijacking Medium)(Citation: Breach Post-mortem SSH Hijack)
Query: write Sigma for Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.
Matching passage: Sigma rule: Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.. Logsource: windows / ps_classic_start. Rule: title: Nslookup PowerShell Download Cradle id: 999bff6d-dc15-44c9-9f5c-e1051bfc86e1 related: - id: 1b3b01c7-84e9-4072-86e5-fc285a41ff23 type: similar status: test description: Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records. references: - https://twitter.com/Alh4zr3d/status/1566489367232651264 author: Sai Prashanth Pulisetti @pulisettis, Aishwarya Singam date: 2022-12-10 modified: 2025-02-25 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_classic_start detection: selection: Data|contains|all: - powershell - nslookup - '[1]' Data|contains: - -q=txt http - -querytype=txt http - -type=txt http condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious execution of 'Powercfg.exe' to change lock screen timeout. Logsource: windows / process_creation. Rule: title: Suspicious Powercfg Execution To Change Lock Screen Timeout id: f8d6a15e-4bc8-4c27-8e5d-2b10f0b73e5b status: test description: Detects suspicious execution of 'Powercfg.exe' to change lock screen timeout references: - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html - https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/powercfg-command-line-options author: frack113 date: 2022-11-18 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_power: - Image|endswith: \powercfg.exe - OriginalFileName: PowerCfg.exe selection_standby: - CommandLine|contains|all: - '/setacvalueindex ' - SCHEME_CURRENT - SUB_VIDEO - VIDEOCONLOCK - CommandLine|contains|all: - '-change ' - -standby-timeout- condition: all of selection_* falsepositives: - Unknown level: medium
Query: vulnerability: Cisco Application Visibility and Control (AVC) 15.3(3)JA, when FlexConnect is enabled, allows remote attackers to cause a denial of service (access-point outage) via a crafted UDP 
Matching passage: CVE-2015-6286. CWE: CWE-399. CVSS: 5.699999809265137. Cisco Application Visibility and Control (AVC) 15.3(3)JA, when FlexConnect is enabled, allows remote attackers to cause a denial of service (access-point outage) via a crafted UDP packet, aka Bug ID CSCuu47016.
Near-miss passage: CVE-2015-4226. CWE: CWE-399. CVSS: 7.099999904632568. The packet-storing feature on Cisco 9900 phones with firmware 9.3(2) does not properly support the RTP protocol, which allows remote attackers to cause a denial of service (device hang) by sending malformed RTP packets after a call is answered, aka Bug ID CSCur39976.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via t
Matching passage: CVE-2015-1385. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a powerpress-editcategoryfeed action in the powerpressadmin_categoryfeeds.php page to wp-admin/admin.php.
Near-miss passage: CVE-2015-0344. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the web app in Adobe Connect before 9.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: CWE for Unprotected Windows Messaging Channel ('Shatter')
Matching passage: CWE-422 Unprotected Windows Messaging Channel ('Shatter'). The product does not properly verify the source of a message in the Windows Messaging System while running at elevated privileges, creating an alternate channel through which an attacker can directly send a message to the product.
Near-miss passage: CWE-1248 Semiconductor Defects in Hardware Logic with Security-Sensitive Implications. The security-sensitive hardware module contains semiconductor defects.
Query: risk of MobileStorageMounter in Apple iOS before 8.2 and Apple TV before 7.1 does not delete invalid disk-image folders, which allows attackers to create folders in arbitrary filesystem lo
Matching passage: CVE-2015-1062. CWE: CWE-19. CVSS: 5.0. MobileStorageMounter in Apple iOS before 8.2 and Apple TV before 7.1 does not delete invalid disk-image folders, which allows attackers to create folders in arbitrary filesystem locations via a crafted app.
Near-miss passage: CVE-2015-0621. CWE: CWE-19. CVSS: 7.800000190734863. Cisco TelePresence MCU devices with software 4.5(1.45) allow remote attackers to cause a denial of service (device reload) via an unspecified series of TCP packets, aka Bug ID CSCur50347.
Query: risk of The chmd_init_decomp function in chmd.c in libmspack before 0.5 does not properly validate the reset interval, which allows remote attackers to cause a denial of service (divide-by
Matching passage: CVE-2015-4467. CWE: CWE-189. CVSS: 4.300000190734863. The chmd_init_decomp function in chmd.c in libmspack before 0.5 does not properly validate the reset interval, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted CHM file.
Near-miss passage: CVE-2015-7674. CWE: CWE-189. CVSS: 6.800000190734863. Integer overflow in the pixops_scale_nearest function in pixops/pixops.c in gdk-pixbuf before 2.32.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted GIF image file, which triggers a heap-based buffer overflow.
Query: describe CVE-2015-0195
Matching passage: CVE-2015-0195. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in IBM Content Template Catalog 4.x before 4.1.4 for WebSphere Portal 8.0.x and 4.x before 4.3.1 for WebSphere Portal 8.5.x allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-6509. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) proxypass parameter to system_advanced_misc.php; (2) adaptiveend, (3) adaptivestart, (4) maximumstates, (5) maximumtableentries, or (6) aliasesresolveinterval parameter to system_advanced_firewall.php; (7) proxyurl, (8) proxyuser, or (9) proxyport parameter to system_advanced_misc.php; or (10) name, (11) notification_name, (12) ipaddress, (13) password, (14) smtpipaddress, (15) smtpport, (16) smtpfromaddress, (17) smtpnotifyemailaddress, (18) smtpusername, or (19) smtppassword parameter to system_advanced_notifications.php.
Query: alert when Detects modification of LSA PPL protection settings via CommandLine. It may indicate an attempt to disable protection an
Matching passage: Sigma rule: Detects modification of LSA PPL protection settings via CommandLine. It may indicate an attempt to disable protection an. Logsource: windows / process_creation. Rule: title: LSA PPL Protection Setting Modification via CommandLine id: 8c0eca51-0f88-4db2-9183-fdfb10c703f9 status: test description: 'Detects modification of LSA PPL protection settings via CommandLine. It may indicate an attempt to disable protection and enable credential dumping tools to access LSASS process memory. ' references: - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/ - https://github.com/shoober420/windows11-scripts/blob/38d83331738cd713ccb42f2c4557d17a27aefd98/Windows11Tweaks.bat#L1825 author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2022-03-22 modified: 2026-03-13 tags: - attack.defense-impairment - attack.t1689 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \reg.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - reg.exe - powershell.exe - pwsh.dll selection_cli_action: CommandLine|contains|all: - ControlSet - \Control\Lsa CommandLine|contains: - Set-ItemProperty - New-ItemProperty - ' add ' selection_key: CommandLine|contains: - IsPplAutoEnabled - RunAsPPL - RunAsPPLBoot condition: all of selection_* falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal. Logsource: windows / process_creation. Rule: title: Suspicious Where Execution id: 725a9768-0f5e-4cb3-aec2-bc5719c6831a status: test description: 'Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1217/T1217.md author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-12-13 modified: 2022-06-29 tags: - attack.discovery - attack.t1217 logsource: category: process_creation product: windows detection: where_exe: - Image|endswith: \where.exe - OriginalFileName: where.exe where_opt: CommandLine|contains: - places.sqlite - cookies.sqlite - formhistory.sqlite - logins.json - key4.db - key3.db - sessionstore.jsonlz4 - History - Bookmarks - Cookies - Login Data condition: all of where_* falsepositives: - Unknown level: low
Query: patch priority for CVE-2015-0804
Matching passage: CVE-2015-0804. CWE: CWE-264. CVSS: 7.5. The HTMLSourceElement::BindToTree function in Mozilla Firefox before 37.0 does not properly constrain a data type after omitting namespace validation during certain tree-binding operations, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document containing a SOURCE element.
Near-miss passage: CVE-2015-3844. CWE: CWE-264. CVSS: 6.800000190734863. The getProcessRecordLocked method in services/core/java/com/android/server/am/ActivityManagerService.java in ActivityManager in Android before 5.1.1 LMY48I allows attackers to trigger incorrect process loading via a crafted application, as demonstrated by interfering with use of the Settings application, aka internal bug 21669445.
Query: CVE similar to CVE-2015-5553
Matching passage: CVE-2015-5553. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, and CVE-2015-5552.
Near-miss passage: CVE-2015-5546. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5545, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5552, and CVE-2015-5553.
Query: CVE similar to CVE-2015-9296
Matching passage: CVE-2015-9296. CWE: CWE-79. CVSS: 6.099999904632568. The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.
Near-miss passage: CVE-2015-8687. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in the Management Console in Alcatel-Lucent Motive Home Device Manager (HDM) before 4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) deviceTypeID parameter to DeviceType/getDeviceType.do; the (2) policyActionClass or (3) policyActionName parameter to PolicyAction/findPolicyActions.do; the deviceID parameter to (4) SingleDeviceMgmt/getDevice.do or (5) device/editDevice.do; the operation parameter to (6) ajax.do or (7) xmlHttp.do; or the (8) policyAction, (9) policyClass, or (10) policyName parameter to policy/findPolicies.do.
Query: incident response steps for SIEM correlation: impact activity consistent with Firmware Corruption
Matching passage: Playbook for T1495 Firmware Corruption. 1) Validate alert telemetry against T1495. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: impact. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying the availability to use the devices and/or the system.(Citation: Symantec Chernobyl W95.CIH) Firmware is software that is loaded and executed from non-volatile memory on hardware devices in order to initia
Near-miss passage: Playbook for T1490 Inhibit System Recovery. Different response path focused on impact.
Query: risk of QuickTime 7 in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file
Matching passage: CVE-2015-5779. CWE: CWE-119. CVSS: 7.5. QuickTime 7 in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-3765, CVE-2015-3779, CVE-2015-3788, CVE-2015-3789, CVE-2015-3790, CVE-2015-3791, CVE-2015-3792, CVE-2015-5751, and CVE-2015-5753.
Near-miss passage: CVE-2015-0826. CWE: CWE-119. CVSS: 6.800000190734863. The nsTransformedTextRun::SetCapitalization function in Mozilla Firefox before 36.0 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read of heap memory) via a crafted Cascading Style Sheets (CSS) token sequence that triggers a restyle or reflow operation.
Query: threat report mentioning Data from Local System
Matching passage: T1005 Data from Local System. Tactics: collection. Description: Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106) as well as a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008), which have functionality to interact with the file system to gather information.(Citation: show_run_config_cmd_cisco) Adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on the local system.
Near-miss passage: T1602.001 SNMP (MIB Dump). Tactics: collection. Description: Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP). The MIB is a configuration repository that stores variable information accessible via SNMP in the form of object identifiers (OID). Each OID identifies a variable that can be read or set and permits active management tasks, such as configuration changes, through remote modification of these variables. SNMP can give administrators great insight in their systems, such as, system information, description of hardware, physical location, and software packages(Citation: SANS Information Security Reading Room Securing SNMP Securing SNMP). The MIB may also contain device operational information, including running configuration, routing table, and interface details. Adversaries may use SNMP queries to collect MIB content directly from SNMP-managed devices in order to collect network information that allows the adversary to build network maps and facilitate future targeted exploitation.(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks)
Query: write Sigma for Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that Windows
Matching passage: Sigma rule: Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that Windows. Logsource: windows / file_event. Rule: title: Suspicious Double Extension Files id: b4926b47-a9d7-434c-b3a0-adc3fa0bd13e related: - id: 1cdd9a09-06c9-4769-99ff-626e2b3991b8 type: derived - id: 3215aa19-f060-4332-86d5-5602511f3ca8 type: similar status: test description: Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that Windows hide default extensions by default. references: - https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/ - https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations - https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles - https://twitter.com/malwrhunterteam/status/1235135745611960321 - https://twitter.com/luc4m/status/1073181154126254080 - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites - https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/ author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2022-06-19 modified: 2026-03-31 tags: - attack.stealth - attack.t1036.007 logsource: category: file_event product: windows detection: selection_gen: TargetFilename|endswith: - .exe - .iso - .rar - .svg - .zip TargetFilename|contains: - .doc. - .docx. - .gif. - .jpeg. - .jpg. - .mp3. - .mp4. - .pdf. - .png. - .ppt. - .pptx. - .rtf. - .svg. - .txt. - .xls. - .xlsx. selection_exe: TargetFilename|endswith: - .rar.exe - .zip.exe filter_icons_linux: TargetFilename|startswith: /usr/share/icons/ condition: 1 of selection_* and not 1 of filter_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the addition of a new user to a privileged group such as "root" or "sudo". Logsource: linux. Rule: title: Privileged User Has Been Created id: 0ac15ec3-d24f-4246-aa2a-3077bb1cf90e status: test description: Detects the addition of a new user to a privileged group such as "root" or "sudo" references: - https://digital.nhs.uk/cyber-alerts/2018/cc-2825 - https://linux.die.net/man/8/useradd - https://github.com/redcanaryco/atomic-red-team/blob/25acadc0b43a07125a8a5b599b28bbc1a91ffb06/atomics/T1136.001/T1136.001.md#atomic-test-5---create-a-new-user-in-linux-with-root-uid-and-gid author: Pawel Mazur date: 2022-12-21 modified: 2025-01-21 tags: - attack.privilege-escalation - attack.persistence - attack.t1136.001 - attack.t1098 logsource: product: linux definition: /var/log/secure on REHL systems or /var/log/auth.log on debian like Systems needs to be collected in order for this detection to work detection: selection_new_user: - new user selection_uids_gids: - GID=0, - UID=0, - GID=10, - GID=27, condition: all of selection_* falsepositives: - Administrative activity level: high
Query: vulnerability: Unspecified vulnerability in the Integrated Lights Out Manager (ILOM) component in Oracle Sun Systems Products Suite 3.0, 3.1, and 3.2 allows remote attackers to affect confidentia
Matching passage: CVE-2015-4821. CWE: UNKNOWN. CVSS: 9.300000190734863. Unspecified vulnerability in the Integrated Lights Out Manager (ILOM) component in Oracle Sun Systems Products Suite 3.0, 3.1, and 3.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Web.
Near-miss passage: CVE-2015-8405. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.