alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Outbound C2 pattern associated with DNS/Passive DNS
Matching passage: T1596.001 DNS/Passive DNS. Tactics: reconnaissance. Description: Adversaries may search DNS data for information about victims that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts. Adversaries may search DNS data to gather actionable information. Threat actors can query nameservers for a target organization directly, or search through centralized repositories of logged DNS query responses (known as passive DNS).(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Adversaries may also seek and target DNS misconfigurations/leaks that reveal information about internal networks. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Near-miss passage: T1596.005 Scan Databases. Tactics: reconnaissance. Description: Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners.(Citation: Shodan) Adversaries may search scan databases to gather actionable information. Threat actors can use online resources and lookup tools to harvest information from these services. Adversaries may seek information about their already identified targets, or use these datasets to discover opportunities for successful breaches. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).
Query: patch priority for CVE-2015-0439
Matching passage: CVE-2015-0439. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB, a different vulnerability than CVE-2015-4756.
Near-miss passage: CVE-2015-4895. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with M. Logsource: windows / process_creation. Rule: title: Potential Privilege Escalation via Service Permissions Weakness id: 0f9c21f1-6a73-4b0e-9809-cb562cb8d981 status: test description: Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment - https://pentestlab.blog/2017/03/31/insecure-registry-permissions/ author: Teymur Kheirkhabarov date: 2019-10-26 modified: 2024-12-01 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.011 logsource: product: windows category: process_creation detection: selection: IntegrityLevel: - Medium - S-1-16-8192 CommandLine|contains|all: - ControlSet - services CommandLine|contains: - \ImagePath - \FailureCommand - \ServiceDll condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons. Logsource: windows / create_remote_thread. Rule: title: HackTool - Potential CobaltStrike Process Injection id: 6309645e-122d-4c5b-bb2b-22e4f9c2fa42 status: test description: Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons references: - https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f - https://blog.cobaltstrike.com/2018/04/09/cobalt-strike-3-11-the-snake-that-eats-its-tail/ author: Olaf Hartong, Florian Roth (Nextron Systems), Aleksey Potapov, oscd.community date: 2018-11-30 modified: 2023-05-05 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.001 logsource: product: windows category: create_remote_thread detection: selection: StartAddress|endswith: - 0B80 - 0C7C - 0C88 condition: selection falsepositives: - Unknown level: high
Query: risk of Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explo
Matching passage: CVE-2015-0039. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0027, CVE-2015-0035, CVE-2015-0052, and CVE-2015-0068.
Near-miss passage: CVE-2015-6309. CWE: CWE-399. CVSS: 6.800000190734863. Cisco Email Security Appliance (ESA) 8.5.6-106 and 9.6.0-042 allows remote authenticated users to cause a denial of service (file-descriptor consumption and device reload) via crafted HTTP requests, aka Bug ID CSCuw32211.
Query: weakness Insecure Inherited Permissions
Matching passage: CWE-277 Insecure Inherited Permissions. A product defines a set of insecure permissions that are inherited by objects that are created by the program.
Near-miss passage: CWE-1392 Use of Default Credentials. The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.
Query: detection rule: Detects VBScript content stored into registry keys as seen being used by UNC2452 group
Matching passage: Sigma rule: Detects VBScript content stored into registry keys as seen being used by UNC2452 group. Logsource: windows / registry_set. Rule: title: VBScript Payload Stored in Registry id: 46490193-1b22-4c29-bdd6-5bf63907216f status: test description: Detects VBScript content stored into registry keys as seen being used by UNC2452 group references: - https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ author: Florian Roth (Nextron Systems) date: 2021-03-05 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: Software\Microsoft\Windows\CurrentVersion Details|contains: - 'vbscript:' - 'jscript:' - mshtml, - RunHTMLApplication - Execute( - CreateObject - window.close filter: TargetObject|contains: Software\Microsoft\Windows\CurrentVersion\Run filter_dotnet: Image|endswith: \msiexec.exe TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\ Details|contains: - \Microsoft.NET\Primary Interop Assemblies\Microsoft.mshtml.dll - <\Microsoft.mshtml,fileVersion= - _mshtml_dll_ - <\Microsoft.mshtml,culture= condition: selection and not 1 of filter* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the usage of "reg.exe" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusi. Logsource: windows / process_creation. Rule: title: Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE id: 48917adc-a28e-4f5d-b729-11e75da8941f status: test description: Detects the usage of "reg.exe" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusions for folders within AppData and ProgramData. references: - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ - https://redcanary.com/threat-detection-report/threats/qbot/ author: frack113 date: 2022-02-13 modified: 2023-02-04 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection: Image|endswith: \reg.exe CommandLine|contains: - SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths - SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths CommandLine|contains|all: - 'ADD ' - '/t ' - 'REG_DWORD ' - '/v ' - '/d ' - '0' condition: selection falsepositives: - Legitimate use level: medium
Query: Sigma rule for Detects DNS server discovery via LDAP query requests from uncommon applications
Matching passage: Sigma rule: Detects DNS server discovery via LDAP query requests from uncommon applications. Logsource: windows / dns_query. Rule: title: DNS Server Discovery Via LDAP Query id: a21bcd7e-38ec-49ad-b69a-9ea17e69509e status: test description: Detects DNS server discovery via LDAP query requests from uncommon applications references: - https://github.com/redcanaryco/atomic-red-team/blob/980f3f83fd81f37c1ca9c02dccfd1c3d9f9d0841/atomics/T1016/T1016.md#atomic-test-9---dns-server-discovery-using-nslookup - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/7fcdce70-5205-44d6-9c3a-260e616a2f04 author: frack113 date: 2022-08-20 modified: 2023-09-18 tags: - attack.discovery - attack.t1482 logsource: product: windows category: dns_query detection: selection: QueryName|startswith: _ldap. filter_main_generic: Image|contains: - :\Program Files\ - :\Program Files (x86)\ - :\Windows\ filter_main_defender: Image|contains: :\ProgramData\Microsoft\Windows Defender\Platform\ Image|endswith: \MsMpEng.exe filter_main_unknown: Image: <unknown process> filter_optional_azure: Image|startswith: C:\WindowsAzure\GuestAgent filter_main_null: Image: null filter_optional_browsers: Image|endswith: - \chrome.exe - \firefox.exe - \opera.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Likely level: low
Near-miss passage: Sigma rule: Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode. Logsource: windows / system. Rule: title: Local Privilege Escalation Indicator TabTip id: bc2e25ed-b92b-4daa-b074-b502bdd1982b status: test description: Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode references: - https://github.com/antonioCoco/JuicyPotatoNG author: Florian Roth (Nextron Systems) date: 2022-10-07 modified: 2023-04-14 tags: - attack.collection - attack.execution - attack.credential-access - attack.t1557.001 logsource: product: windows service: system detection: selection: Provider_Name: Microsoft-Windows-DistributedCOM EventID: 10001 param1: C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe param2: 2147943140 param3: '{054AAE20-4BEA-4347-8A35-64A533254A9D}' condition: selection falsepositives: - Unknown level: high
Query: weakness Insecure Setting of Generative AI/ML Model Inference Parameters
Matching passage: CWE-1434 Insecure Setting of Generative AI/ML Model Inference Parameters. The product has a component that relies on a generative AI/ML model configured with inference parameters that produce an unacceptably high rate of erroneous or unexpected outputs.
Near-miss passage: CWE-382 J2EE Bad Practices: Use of System.exit(). A J2EE application uses System.exit(), which also shuts down its container.
Query: Sigma YAML for windows / certificateservicesclient-lifecycle-system
Matching passage: Sigma rule: Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certi. Logsource: windows / certificateservicesclient-lifecycle-system. Rule: title: Certificate Exported From Local Certificate Store id: 58c0bff0-40a0-46e8-b5e8-b734b84d2017 status: test description: Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store. references: - https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html author: Zach Mathis date: 2023-05-13 tags: - attack.credential-access - attack.t1649 logsource: product: windows service: certificateservicesclient-lifecycle-system detection: selection: EventID: 1007 condition: selection falsepositives: - Legitimate application requesting certificate exports will trigger this. Apply additional filters as needed level: medium
Near-miss passage: Sigma rule: Detects execution of regsvr32 where the DLL is located in a highly suspicious locations. Logsource: windows / process_creation. Rule: title: Regsvr32 Execution From Highly Suspicious Location id: 327ff235-94eb-4f06-b9de-aaee571324be status: test description: Detects execution of regsvr32 where the DLL is located in a highly suspicious locations references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-26 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regsvr32.exe - OriginalFileName: REGSVR32.EXE selection_path_1: CommandLine|contains: - :\PerfLogs\ - :\Temp\ - \Windows\Registration\CRMLog - \Windows\System32\com\dmp\ - \Windows\System32\FxsTmp\ - \Windows\System32\Microsoft\Crypto\RSA\MachineKeys\ - \Windows\System32\spool\drivers\color\ - \Windows\System32\spool\PRINTERS\ - \Windows\System32\spool\SERVERS\ - \Windows\System32\Tasks_Migrated\ - \Windows\System32\Tasks\Microsoft\Windows\SyncCenter\ - \Windows\SysWOW64\com\dmp\ - \Windows\SysWOW64\FxsTmp\ - \Windows\SysWOW64\Tasks\Microsoft\Windows\PLA\System\ - \Windows\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\ - \Windows\Tasks\ - \Windows\Tracing\ selection_path_2: CommandLine|contains: - ' "C:\' - ' C:\' - ' ''C:\' - D:\ selection_exclude_known_dirs: CommandLine|contains: - C:\Program Files (x86)\ - C:\Program Files\ - C:\ProgramData\ - C:\Users\ - ' C:\Windows\' - ' "C:\Windows\' - ' ''C:\Windows\' filter_main_empty: CommandLine: '' filter_main_null: CommandLine: null condition: selection_img and (selection_path_1 or (selection_path_2 and not selection_exclude_known_dirs)) and not 1 of filter_main_* falsepositives: - Unlikely level: high
Query: risk of SQL injection vulnerability in the Interactive Voice Response (IVR) component in Cisco Unified Communications Manager (UCM) 10.5(1.98991.13) allows remote attackers to execute arbi
Matching passage: CVE-2015-0699. CWE: CWE-89. CVSS: 5.0. SQL injection vulnerability in the Interactive Voice Response (IVR) component in Cisco Unified Communications Manager (UCM) 10.5(1.98991.13) allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCut21563.
Near-miss passage: CVE-2015-1434. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in my little forum before 2.3.4 allow remote administrators to execute arbitrary SQL commands via the (1) letter parameter in a user action or (2) edit_category parameter to index.php.
Query: exploit Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to ur
Matching passage: CVE-2015-8077. CWE: CWE-189. CVSS: 7.5. Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the start_octet variable. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8076.
Near-miss passage: CVE-2015-1359. CWE: CWE-189. CVSS: 6.800000190734863. Multiple off-by-one errors in fpdfapi/fpdf_font/font_int.h in PDFium, as used in Google Chrome before 40.0.2214.91, allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted PDF document, related to an "intra-object-overflow" issue, a different vulnerability than CVE-2015-1205.
Query: describe CVE-2015-2342
Matching passage: CVE-2015-2342. CWE: UNKNOWN. CVSS: 10.0. The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol.
Near-miss passage: CVE-2015-4162. CWE: UNKNOWN. CVSS: 4.0. XML external entity (XXE) vulnerability in the management interface in PAN-OS before 5.0.16, 6.x before 6.0.8, and 6.1.x before 6.1.4 allows remote authenticated administrators to obtain sensitive information via crafted XML data.
Query: patch priority for CVE-2015-2827
Matching passage: CVE-2015-2827. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in CA Spectrum 9.2.x and 9.3.x before 9.3 H02 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-7459. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108355.
Query: detect Detects a network connection initiated by a binary to "api.mega.co.nz". Attackers were seen abusing file sharing website in logs
Matching passage: Sigma rule: Detects a network connection initiated by a binary to "api.mega.co.nz". Attackers were seen abusing file sharing website. Logsource: windows / network_connection. Rule: title: Network Connection Initiated To Mega.nz id: fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4 status: test description: 'Detects a network connection initiated by a binary to "api.mega.co.nz". Attackers were seen abusing file sharing websites similar to "mega.nz" in order to upload/download additional payloads. ' references: - https://megatools.megous.com/ - https://www.mandiant.com/resources/russian-targeting-gov-business author: Florian Roth (Nextron Systems) date: 2021-12-06 modified: 2024-05-31 tags: - attack.exfiltration - attack.t1567.002 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationHostname|endswith: - mega.co.nz - mega.nz condition: selection falsepositives: - Legitimate MEGA installers and utilities are expected to communicate with this domain. Exclude hosts that are known to be allowed to use this tool. level: low
Near-miss passage: Sigma rule: Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage sta. Logsource: linux / process_creation. Rule: title: ESXi Storage Information Discovery Via ESXCLI id: f41dada5-3f56-4232-8503-3fb7f9cf2d60 status: test description: Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit. references: - https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html - https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_storage.html author: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon date: 2023-09-04 tags: - attack.discovery - attack.execution - attack.t1033 - attack.t1007 - attack.t1059.012 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /esxcli CommandLine|contains: storage selection_cli: CommandLine|contains: - ' get' - ' list' condition: all of selection_* falsepositives: - Legitimate administration activities level: medium
Query: vulnerability: Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity via unknown vectors related to Beans.
Matching passage: CVE-2015-0477. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity via unknown vectors related to Beans.
Near-miss passage: CVE-2015-0384. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Siebel Public Sector component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect integrity via unknown vectors related to Public Sector Portal.
Query: vulnerability: AppleThunderboltEDMService in Apple OS X before 10.10.4 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified Thunderbolt commands.
Matching passage: CVE-2015-3678. CWE: CWE-77. CVSS: 7.199999809265137. AppleThunderboltEDMService in Apple OS X before 10.10.4 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified Thunderbolt commands.
Near-miss passage: CVE-2015-6613. CWE: CWE-77. CVSS: 5.099999904632568. Bluetooth in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows attackers to send commands to a debugging port, and consequently gain privileges, via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24371736.
Query: vulnerability: lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*.
Matching passage: CVE-2015-1331. CWE: CWE-59. CVSS: 4.900000095367432. lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*.
Near-miss passage: CVE-2015-1196. CWE: CWE-59. CVSS: 4.300000190734863. GNU patch 2.7.1 allows remote attackers to write to arbitrary files via a symlink attack in a patch file.
Query: describe CVE-2015-2273
Matching passage: CVE-2015-2273. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in mod/quiz/report/statistics/statistics_question_table.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the student role for a crafted quiz response.
Near-miss passage: CVE-2015-2220. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the ninja_forms_field_1 parameter in a ninja_forms_ajax_submit action to wp-admin/admin-ajax.php or (2) remote administrators to inject arbitrary web script or HTML via the fields[1] parameter to wp-admin/post.php.
Query: patch priority for CVE-2015-8729
Matching passage: CVE-2015-8729. CWE: CWE-20. CVSS: 5.5. The ascend_seek function in wiretap/ascendtext.c in the Ascend file parser in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not ensure the presence of a '\0' character at the end of a date string, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file.
Near-miss passage: CVE-2015-2530. CWE: CWE-20. CVSS: 9.300000190734863. Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted .jnt file, aka "Windows Journal RCE Vulnerability," a different vulnerability than CVE-2015-2513 and CVE-2015-2514.