alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Lateral movement indicators for Network Logon Script
Matching passage: T1037.003 Network Logon Script. Tactics: persistence, privilege escalation. Description: Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence. Network logon scripts can be assigned using Active Directory or Group Policy Objects.(Citation: Petri Logon Script AD) These logon scripts run with the privileges of the user they are assigned to. Depending on the systems within the network, initializing one of these scripts could apply to more than one or potentially all systems. Adversaries may use these scripts to maintain persistence on a network. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
Near-miss passage: T1037.002 Login Hook. Tactics: persistence, privilege escalation. Description: Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that points to a specific script to execute with root privileges upon user logon. The plist file is located in the <code>/Library/Preferences/com.apple.loginwindow.plist</code> file and can be modified using the <code>defaults</code> command-line utility. This behavior is the same for logout hooks where a script can be executed upon user logout. All hooks require administrator permissions to modify or create hooks.(Citation: Login Scripts Apple Dev)(Citation: LoginWindowScripts Apple Dev) Adversaries can add or insert a path to a malicious script in the <code>com.apple.loginwindow.plist</code> file, using the <code>LoginHook</code> or <code>LogoutHook</code> key-value pair. The malicious script is executed upon the next user login. If a login hook already exists, adversaries can add additional commands to an existing login hook. There can be only one login and logout hook on a system at a time.(Citation: S1 macOs Persistence)(Citation: Wardle Persistence Chapter) **Note:** Login hooks were deprecated in 10.11 version of macOS in favor of [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001)
Query: ATT&CK technique for Invisible Unicode
Matching passage: T1027.018 Invisible Unicode. Tactics: stealth. Description: Adversaries may abuse invisible or non-printing Unicode characters to conceal malicious content within files, scripts, or text. By inserting characters that do not visibly render, adversaries may hide data, alter how content is interpreted, or make malicious code appear as benign text or whitespace. Adversaries may encode these malicious payloads, using binary, Base64, or custom schemes, to be reconstructed at runtime through scripting features such as [JavaScript](https://attack.mitre.org/techniques/T1059/007) Proxy traps, `eval()`, or other dynamic execution methods. This technique enables adversaries to evade visual inspection and basic static analysis by hiding malicious encoded content in innocuous text.(Citation: PUAs Unicode - Eriksen)(Citation: Tycoon2FA - Unicode)(Citation: Unicode - Veracode) Unicode is a standardized character encoding model that assigns a unique numerical value, known as a code point, to every character across writing systems, enabling consistent text representation across platforms, applications, and languages. Code points are represented as `U+` followed by a hexadecimal value and may be encoded using formats such as `UTF-8` or `UTF-16`. Adversaries may abuse the valid code points in Unicode that are not visibly rendered but still take up bytes, such as zero-width spaces, variation selectors, or bidirectional formatting controls, to conceal malicious payloads.(Citation: Tycoon2FA - Unicode)(Citation: GlassWorm - Unicode)(Citation: Unicode and Hidden Prompts - Perets) Adversaries may additionally exploit Private Use Area (PUA) characters, a range of code points reserved for custom assignment. PUA characters that are not defined by a font or application are typically rendered blank.(Citation: PUAs Unicode - Eriksen) Unicode characters may also be leveraged in support of other techniques such as [Phishing](https://attack.mitre.org/techniques/T1660), [Right-to-Left Override](https://attack.mitre.org/techniques/T1036/002), or [User Executio
Near-miss passage: T1027.005 Indicator Removal from Tools. Tactics: stealth. Description: Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems. A good example of this is when malware is detected with a file signature and quarantined by anti-virus software. An adversary who can determine that the malware was quarantined because of its file signature may modify the file to explicitly avoid that signature, and then re-use the malware.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension. Logsource: windows / process_creation. Rule: title: Chromium Browser Instance Executed With Custom Extension id: 88d6e60c-759d-4ac1-a447-c0f1466c2d21 related: - id: 27ba3207-dd30-4812-abbf-5d20c57d474e type: similar status: test description: Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension references: - https://redcanary.com/blog/chromeloader/ - https://emkc.org/s/RJjuLa - https://www.mandiant.com/resources/blog/lnk-between-browsers author: Aedan Russell, frack113, X__Junior (Nextron Systems) date: 2022-06-19 modified: 2023-11-28 tags: - attack.persistence - attack.t1176.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \brave.exe - \chrome.exe - \msedge.exe - \opera.exe - \vivaldi.exe CommandLine|contains: --load-extension= condition: selection falsepositives: - Usage of Chrome Extensions in testing tools such as BurpSuite will trigger this alert level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_load_extension/info.yml
Near-miss passage: Sigma rule: Detects Exfiltration Over Alternative Protocol - ICMP. Adversaries may steal data by exfiltrating it over an un-encrypte. Logsource: windows / ps_script. Rule: title: PowerShell ICMP Exfiltration id: 4c4af3cd-2115-479c-8193-6b8bfce9001c status: test description: Detects Exfiltration Over Alternative Protocol - ICMP. Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048.003/T1048.003.md#atomic-test-2---exfiltration-over-alternative-protocol---icmp author: Bartlomiej Czyz @bczyz1, oscd.community date: 2020-10-10 modified: 2022-12-25 tags: - attack.exfiltration - attack.t1048.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - New-Object - System.Net.NetworkInformation.Ping - .Send( condition: selection falsepositives: - Legitimate usage of System.Net.NetworkInformation.Ping class level: medium
Query: describe CVE-2015-9156
Matching passage: CVE-2015-9156. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 615/16/SD 415, SD 617, SD 800, SD 808, and SD 810, when making a high speed Dual Carrier Downlink Data call in a multicell environment, a buffer overflow may occur.
Near-miss passage: CVE-2015-2549. CWE: CWE-119. CVSS: 7.199999809265137. The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Corruption Vulnerability."
Query: patch priority for CVE-2015-2252
Matching passage: CVE-2015-2252. CWE: CWE-94. CVSS: 8.800000190734863. Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to execute arbitrary code with root privileges via a crafted UDS patch with shell scripts.
Near-miss passage: CVE-2015-8351. CWE: CWE-94. CVSS: 9.0. PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_include is enabled, allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to frontend/captcha/ajaxresponse.php. NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences regardless of whether allow_url_include is enabled.
Query: patch priority for CVE-2015-8433
Matching passage: CVE-2015-8433. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-3910. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google V8 before 4.3.61.21, as used in Google Chrome before 43.0.2357.65, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Query: CVE similar to CVE-2015-6921
Matching passage: CVE-2015-6921. CWE: CWE-79. CVSS: 2.5999999046325684. Cross-site scripting (XSS) vulnerability in the Zendesk Feedback Tab module 7.x-1.x before 7.x-1.1 for Drupal allows remote administrators with the "Configure Zendesk Feedback Tab" permission to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-1911. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Sterling Order Management 8.5 before HF113, Sterling Selling and Fulfillment Foundation 9.0.0 before FP92, and Sterling Field Sales (SFS) 9.0 before HF7 in IBM Sterling Selling and Fulfillment Suite allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Query: incident response steps for Lateral movement indicators for Outlook Home Page
Matching passage: Playbook for T1137.004 Outlook Home Page. 1) Validate alert telemetry against T1137.004. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: persistence. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system. Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders. This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened. A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page
Near-miss passage: Playbook for T1137.003 Outlook Forms. Different response path focused on persistence.
Query: describe CVE-2015-3272
Matching passage: CVE-2015-3272. CWE: UNKNOWN. CVSS: 7.400000095367432. Open redirect vulnerability in the clean_param function in lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving an HTTP Referer header that has a substring match with a local URL.
Near-miss passage: CVE-2015-4812. CWE: UNKNOWN. CVSS: 2.5999999046325684. Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 11.1.1.9 allows remote attackers to affect confidentiality via vectors related to OSSL Module.
Query: patch priority for CVE-2015-4240
Matching passage: CVE-2015-4240. CWE: CWE-399. CVSS: 5.0. Cisco IP Communicator 8.6(4) allows remote attackers to cause a denial of service (service outage) via an unspecified URL in a GET request, aka Bug ID CSCuu37656.
Near-miss passage: CVE-2015-0711. CWE: CWE-399. CVSS: 5.0. The hamgr service in the IPv6 Proxy Mobile (PM) implementation in Cisco StarOS 18.1.0.59776 on ASR 5000 devices allows remote attackers to cause a denial of service (service reload and call-processing outage) via malformed PM packets, aka Bug ID CSCut94711.
Query: vulnerability: Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service (service interruption) via a c
Matching passage: CVE-2015-4407. CWE: CWE-119. CVSS: 6.5. Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service (service interruption) via a crafted HTTP request, aka the PSIA issue.
Near-miss passage: CVE-2015-2441. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 through 11 and Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2452.
Query: exploit puppetlabs-mysql 3.1.0 through 3.6.0 allow remote attackers to bypass authentication by leveraging creation of a database account without a password when a 'mysql_user' user parame
Matching passage: CVE-2015-7224. CWE: CWE-287. CVSS: 9.800000190734863. puppetlabs-mysql 3.1.0 through 3.6.0 allow remote attackers to bypass authentication by leveraging creation of a database account without a password when a 'mysql_user' user parameter contains a host with a netmask.
Near-miss passage: CVE-2015-8332. CWE: CWE-287. CVSS: 8.800000190734863. Huawei Video Content Management (VCM) before V100R001C10SPC001 does not properly "authenticate online user identities and privileges," which allows remote authenticated users to gain privileges and perform a case operation as another user via a crafted message, aka "Horizontal Privilege Escalation Vulnerability."
Query: describe CVE-2015-3078
Matching passage: CVE-2015-3078. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3089, CVE-2015-3090, and CVE-2015-3093.
Near-miss passage: CVE-2015-6991. CWE: CWE-119. CVSS: 6.800000190734863. FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, CVE-2015-7010, and CVE-2015-7018.
Query: exploit The signal implementation in the Linux kernel before 4.3.5 on powerpc platforms does not check for an MSR with both the S and T bits set, which allows local users to cause a denial
Matching passage: CVE-2015-8844. CWE: CWE-20. CVSS: 5.5. The signal implementation in the Linux kernel before 4.3.5 on powerpc platforms does not check for an MSR with both the S and T bits set, which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application.
Near-miss passage: CVE-2015-7893. CWE: CWE-20. CVSS: 8.800000190734863. SecEmailUI in Samsung Galaxy S6 does not sanitize HTML email content, allows remote attackers to execute arbitrary JavaScript.
Query: CVE similar to CVE-2015-1602
Matching passage: CVE-2015-1602. CWE: CWE-200. CVSS: 2.0999999046325684. Siemens SIMATIC STEP 7 (TIA Portal) 12 and 13 before 13 SP1 Upd1 improperly stores password data within project files, which makes it easier for local users to determine cleartext (1) protection-level passwords or (2) web-server passwords by leveraging the ability to read these files.
Near-miss passage: CVE-2015-8509. CWE: CWE-200. CVSS: 3.5. Template.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.16, 4.3.x and 4.4.x before 4.4.11, and 4.5.x and 5.0.x before 5.0.2 does not properly construct CSV files, which allows remote attackers to obtain sensitive information by leveraging a web browser that interprets CSV data as JavaScript code.
Query: rule covering Detects potential DLL sideloading of "mscorsvc.dll".
Matching passage: Sigma rule: Detects potential DLL sideloading of "mscorsvc.dll".. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of MsCorSvc.DLL id: cdb15e19-c2d0-432a-928e-e49c8c60dcf2 status: test description: Detects potential DLL sideloading of "mscorsvc.dll". references: - https://hijacklibs.net/entries/microsoft/built-in/mscorsvc.html author: Wietze Beukema date: 2024-07-11 modified: 2025-02-26 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: image_load detection: selection: ImageLoaded|endswith: \mscorsvc.dll filter_main_generic: ImageLoaded|startswith: - C:\Windows\Microsoft.NET\Framework\ - C:\Windows\Microsoft.NET\Framework64\ - C:\Windows\Microsoft.NET\FrameworkArm\ - C:\Windows\Microsoft.NET\FrameworkArm64\ - C:\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Legitimate applications loading their own versions of the DLL mentioned in this rule. level: medium
Near-miss passage: Sigma rule: Detects creation of WMI event subscription persistence method. Logsource: windows / wmi_event. Rule: title: WMI Event Subscription id: 0f06a3a5-6a09-413f-8743-e6cf35561297 status: test description: Detects creation of WMI event subscription persistence method references: - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-19-wmievent-wmieventfilter-activity-detected - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-20-wmievent-wmieventconsumer-activity-detected - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-21-wmievent-wmieventconsumertofilter-activity-detected author: Tom Ueltschi (@c_APT_ure) date: 2019-01-12 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.003 logsource: product: windows category: wmi_event detection: selection: EventID: - 19 - 20 - 21 condition: selection falsepositives: - Exclude legitimate (vetted) use of WMI event subscription in your network level: medium
Query: describe CVE-2015-1936
Matching passage: CVE-2015-1936. CWE: CWE-284. CVSS: 6.0. The administrative console in IBM WebSphere Application Server (WAS) 8.0.0 before 8.0.0.11 and 8.5 before 8.5.5.6, when the Security feature is disabled, allows remote authenticated users to hijack sessions via the JSESSIONID parameter.
Near-miss passage: CVE-2015-6848. CWE: CWE-284. CVSS: 8.5. EMC Isilon OneFS 7.1.x before 7.1.1.5, 7.2.0.x before 7.2.0.3, and 7.2.1.x before 7.2.1.1, when the RFC 2307 feature is configured but SFU is not universally present, allows remote authenticated AD users to obtain root privileges via unspecified vectors.
Query: describe CVE-2015-1776
Matching passage: CVE-2015-1776. CWE: CWE-200. CVSS: 6.199999809265137. Apache Hadoop 2.6.x encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials file on disk when the Intermediate data encryption feature is enabled, which allows local users to obtain sensitive information by reading the file.
Near-miss passage: CVE-2015-5827. CWE: CWE-200. CVSS: 5.0. WebKit in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain an object reference via vectors involving a (1) custom event, (2) message event, or (3) pop state event.
Query: vulnerability: Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Matching passage: CVE-2015-2955. CWE: CWE-78. CVSS: 7.5. Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Near-miss passage: CVE-2015-8557. CWE: CWE-78. CVSS: 9.0. The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.
Query: patch priority for CVE-2015-8374
Matching passage: CVE-2015-8374. CWE: CWE-200. CVSS: 4.0. fs/btrfs/inode.c in the Linux kernel before 4.3.3 mishandles compressed inline extents, which allows local users to obtain sensitive pre-truncation information from a file via a clone action.
Near-miss passage: CVE-2015-6115. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft .NET Framework 2.0 SP2, 3.5, and 3.5.1 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka ".NET ASLR Bypass."
Query: detect Detecting attempts to extract passwords with grep in logs
Matching passage: Sigma rule: Detecting attempts to extract passwords with grep. Logsource: linux / auditd. Rule: title: Credentials In Files - Linux id: df3fcaea-2715-4214-99c5-0056ea59eb35 status: test description: Detecting attempts to extract passwords with grep references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md author: Igor Fits, oscd.community date: 2020-10-15 modified: 2023-04-30 tags: - attack.credential-access - attack.t1552.001 logsource: product: linux service: auditd detection: selection: type: EXECVE keywords: '|all': - grep - password condition: selection and keywords falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects loaded unsigned image on the system. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Unsigned Image Loaded id: c92c24e7-f595-493f-9c98-53d5142f5c18 status: test description: Detects loaded unsigned image on the system references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-06 tags: - attack.privilege-escalation logsource: product: windows service: codeintegrity-operational detection: selection: EventID: 3037 condition: selection falsepositives: - Unlikely level: high