alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: explain T1098.005 Device Registration
Matching passage: T1098.005 Device Registration. Tactics: persistence, privilege escalation. Description: Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance. MFA systems, such as Duo or Okta, allow users to associate devices with their accounts in order to complete MFA requirements. An adversary that compromises a user’s credentials may enroll a new device in order to bypass initial MFA requirements and gain persistent access to a network.(Citation: CISA MFA PrintNightmare)(Citation: DarkReading FireEye SolarWinds) In some cases, the MFA self-enrollment process may require only a username and password to enroll the account's first device or to enroll a device to an inactive account. (Citation: Mandiant APT29 Microsoft 365 2022) Similarly, an adversary with existing access to a network may register a device or a virtual machine to Entra ID and/or its device management system, Microsoft Intune, in order to access sensitive data or resources while bypassing conditional access policies.(Citation: AADInternals - Device Registration)(Citation: AADInternals - Conditional Access Bypass)(Citation: Microsoft DEV-0537)(Citation: Expel Atlas Lion 2025) Devices registered in Entra ID may be able to conduct [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) campaigns via intra-organizational emails, which are less likely to be treated as suspicious by the email client.(Citation: Microsoft - Device Registration) Additionally, an adversary may be able to perform a [Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002) on an Entra ID tenant by registering a large number of devices.(Citation: AADInternals - BPRT)
Near-miss passage: T1098 Account Manipulation. Tactics: persistence, privilege escalation. Description: Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078).
Query: CVE similar to CVE-2015-5451
Matching passage: CVE-2015-5451. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in HP Operations Orchestration Central 10.x before 10.22.001 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Near-miss passage: CVE-2015-3382. CWE: CWE-352. CVSS: 5.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Node basket module for Drupal allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add or (2) remove nodes from a basket via unspecified vectors.
Query: vulnerability: Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect availability via vectors related to CPU performance counters drivers.
Matching passage: CVE-2015-2609. CWE: UNKNOWN. CVSS: 4.900000095367432. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect availability via vectors related to CPU performance counters drivers.
Near-miss passage: CVE-2015-4900. CWE: UNKNOWN. CVSS: 6.5. Unspecified vulnerability in the XDB - XML Database component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
Query: explain CWE-1272
Matching passage: CWE-1272 Sensitive Information Uncleared Before Debug/Power State Transition. The product performs a power or debug state transition, but it does not clear sensitive information that should no longer be accessible due to changes to information access restrictions.
Near-miss passage: CWE-170 Improper Null Termination. The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.
Query: CVE similar to CVE-2015-5229
Matching passage: CVE-2015-5229. CWE: CWE-17. CVSS: 7.5. The calloc function in the glibc package in Red Hat Enterprise Linux (RHEL) 6.7 and 7.2 does not properly initialize memory areas, which might allow context-dependent attackers to cause a denial of service (hang or crash) via unspecified vectors.
Near-miss passage: CVE-2015-6818. CWE: CWE-17. CVSS: 7.5. The decode_ihdr_chunk function in libavcodec/pngdec.c in FFmpeg before 2.7.2 does not enforce uniqueness of the IHDR (aka image header) chunk in a PNG image, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted image with two or more of these chunks.
Query: Sigma YAML for aws / cloudtrail
Matching passage: Sigma rule: Detects the modification of the findings on SecurityHub.. Logsource: aws / cloudtrail. Rule: title: AWS SecurityHub Findings Evasion id: a607e1fe-74bf-4440-a3ec-b059b9103157 status: stable description: Detects the modification of the findings on SecurityHub. references: - https://docs.aws.amazon.com/cli/latest/reference/securityhub/ author: Sittikorn S date: 2021-06-28 tags: - attack.defense-impairment - attack.t1685 logsource: product: aws service: cloudtrail detection: selection: eventSource: securityhub.amazonaws.com eventName: - BatchUpdateFindings - DeleteInsight - UpdateFindings - UpdateInsight condition: selection falsepositives: - System or Network administrator behaviors - DEV, UAT, SAT environment. You should apply this rule with PROD environment only. level: high
Near-miss passage: Sigma rule: Detects applications being added to the "allowed applications" list of exploit guard in order to bypass controlled folde. Logsource: windows / registry_set. Rule: title: Suspicious Application Allowed Through Exploit Guard id: 42205c73-75c8-4a63-9db1-e3782e06fda0 status: test description: Detects applications being added to the "allowed applications" list of exploit guard in order to bypass controlled folder settings references: - https://www.microsoft.com/security/blog/2017/10/23/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection_key: TargetObject|contains: SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications selection_paths: TargetObject|contains: - \Users\Public\ - \AppData\Local\Temp\ - \Desktop\ - \PerfLogs\ - \Windows\Temp\ condition: all of selection_* falsepositives: - Unlikely level: high
Query: CVE similar to CVE-2015-5177
Matching passage: CVE-2015-5177. CWE: CWE-415. CVSS: 7.5. Double free vulnerability in the SLPDKnownDAAdd function in slpd/slpd_knownda.c in OpenSLP 1.2.1 allows remote attackers to cause a denial of service (crash) via a crafted package.
Near-miss passage: CVE-2015-8962. CWE: CWE-415. CVSS: 7.300000190734863. Double free vulnerability in the sg_common_write function in drivers/scsi/sg.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (memory corruption and system crash) by detaching a device during an SG_IO ioctl call.
Query: Suspicious Cloud Instance Metadata API execution detected on endpoint
Matching passage: T1552.005 Cloud Instance Metadata API. Tactics: credential access. Description: Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data. Most cloud service providers support a Cloud Instance Metadata API which is a service provided to running virtual instances that allows applications to access information about the running virtual instance. Available information generally includes name, security group, and additional metadata including sensitive data such as credentials and UserData scripts that may contain additional secrets. The Instance Metadata API is provided as a convenience to assist in managing applications and is accessible by anyone who can access the instance.(Citation: AWS Instance Metadata API) A cloud metadata API has been used in at least one high profile compromise.(Citation: Krebs Capital One August 2019) If adversaries have a presence on the running virtual instance, they may query the Instance Metadata API directly to identify credentials that grant access to additional resources. Additionally, adversaries may exploit a Server-Side Request Forgery (SSRF) vulnerability in a public facing web proxy that allows them to gain access to the sensitive information via a request to the Instance Metadata API.(Citation: RedLock Instance Metadata API 2018) The de facto standard across cloud service providers is to host the Instance Metadata API at <code>http[:]//169.254.169.254</code>.
Near-miss passage: T1552.006 Group Policy Preferences. Tactics: credential access. Description: Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts.(Citation: Microsoft GPP 2016) These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public).(Citation: Microsoft GPP Key) The following tools and scripts can be used to gather and decrypt the password file from Group Policy Preference XML files: * Metasploit’s post exploitation module: <code>post/windows/gather/credentials/gpp</code> * Get-GPPPassword(Citation: Obscuresecurity Get-GPPPassword) * gpprefdecrypt.py On the SYSVOL share, adversaries may use the following command to enumerate potential GPP XML files: <code>dir /s * .xml</code>
Query: risk of In all Qualcomm products with Android releases from CAF using the Linux kernel, an integer overflow to buffer overflow vulnerability exists when loading an ELF file.
Matching passage: CVE-2015-9062. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, an integer overflow to buffer overflow vulnerability exists when loading an ELF file.
Near-miss passage: CVE-2015-2820. CWE: CWE-119. CVSS: 5.0. Buffer overflow in XcListener in SAP Afaria 7.0.6001.5 allows remote attackers to cause a denial of service (process termination) via a crafted request, aka SAP Security Note 2132584.
Query: CVE similar to CVE-2015-6792
Matching passage: CVE-2015-6792. CWE: UNKNOWN. CVSS: 9.800000190734863. The MIDI subsystem in Google Chrome before 47.0.2526.106 does not properly handle the sending of data, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors, related to midi_manager.cc, midi_manager_alsa.cc, and midi_manager_mac.cc, a different vulnerability than CVE-2015-8664.
Near-miss passage: CVE-2015-2641. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Privileges.
Query: describe CVE-2015-4118
Matching passage: CVE-2015-4118. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated users with monitor permissions to execute arbitrary SQL commands via the server parameter. NOTE: this can be leveraged by remote attackers using CVE-2015-4119.2.
Near-miss passage: CVE-2015-5642. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in ICZ MATCHA INVOICE before 2.5.7 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Query: Sigma rule for Detects a registry key used by IceID in a campaign that distributes malicious OneNote files
Matching passage: Sigma rule: Detects a registry key used by IceID in a campaign that distributes malicious OneNote files. Logsource: windows / registry_event. Rule: title: Potential Qakbot Registry Activity id: 1c8e96cd-2bed-487d-9de0-b46c90cade56 status: test description: Detects a registry key used by IceID in a campaign that distributes malicious OneNote files references: - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution author: Hieu Tran date: 2023-03-13 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: \Software\firm\soft\Name condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that ma. Logsource: windows / ps_script. Rule: title: Suspicious Mount-DiskImage id: 29e1c216-6408-489d-8a06-ee9d151ef819 status: test description: Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image - https://learn.microsoft.com/en-us/powershell/module/storage/mount-diskimage?view=windowsserver2022-ps author: frack113 date: 2022-02-01 tags: - attack.defense-impairment - attack.t1553.005 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'Mount-DiskImage ' - '-ImagePath ' condition: selection falsepositives: - Legitimate PowerShell scripts level: low
Query: vulnerability: Sierra Wireless ALEOS before 4.4.2 on AirLink ES, GX, and LS devices has hardcoded root accounts, which makes it easier for remote attackers to obtain administrative access via a (
Matching passage: CVE-2015-2897. CWE: CWE-200. CVSS: 10.0. Sierra Wireless ALEOS before 4.4.2 on AirLink ES, GX, and LS devices has hardcoded root accounts, which makes it easier for remote attackers to obtain administrative access via a (1) SSH or (2) TELNET session.
Near-miss passage: CVE-2015-7514. CWE: CWE-200. CVSS: 6.5. OpenStack Ironic 4.2.0 through 4.2.1 does not "clean" the disk after use, which allows remote authenticated users to obtain sensitive information.
Query: CVE similar to CVE-2015-2461
Matching passage: CVE-2015-2461. CWE: CWE-20. CVSS: 9.300000190734863. ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability," a different vulnerability than CVE-2015-2458 and CVE-2015-2459.
Near-miss passage: CVE-2015-1326. CWE: CWE-20. CVSS: 8.800000190734863. python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious code if an attacker supplies a .pyc file.
Query: SOC runbook when seeing Outbound C2 pattern associated with Exploits
Matching passage: Playbook for T1588.005 Exploits. 1) Validate alert telemetry against T1588.005. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: resource development. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may buy, steal, or download exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. Rather than developing their own exploits, an adversary may find/modify exploits from online or purchase them from exploit vendors.(Citation: Exploit Database)(Citat
Near-miss passage: Playbook for T1588.002 Tool. Different response path focused on resource development.
Query: describe CVE-2015-2017
Matching passage: CVE-2015-2017. CWE: UNKNOWN. CVSS: 4.300000190734863. CRLF injection vulnerability in IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.8 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.
Near-miss passage: CVE-2015-3979. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary code via unknown vectors, aka SAP Security Note 2097534.
Query: write Sigma for Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem
Matching passage: Sigma rule: Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem. Logsource: linux / process_creation. Rule: title: Container Residence Discovery Via Proc Virtual FS id: 746c86fb-ccda-4816-8997-01386263acc4 status: test description: Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem references: - https://blog.skyplabs.net/posts/container-detection/ - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker tags: - attack.discovery - attack.t1082 author: Seth Hanford date: 2023-08-23 logsource: category: process_creation product: linux detection: selection_tools: Image|endswith: - awk - /cat - grep - /head - /less - /more - /nl - /tail selection_procfs_kthreadd: CommandLine|contains: /proc/2/ selection_procfs_target: CommandLine|contains: /proc/ CommandLine|endswith: - /cgroup - /sched condition: selection_tools and 1 of selection_procfs_* falsepositives: - Legitimate system administrator usage of these commands - Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered level: low
Near-miss passage: Sigma rule: Detects the execution of a renamed "Msdt.exe" binary. Logsource: windows / process_creation. Rule: title: Renamed Msdt.EXE Execution id: bd1c6866-65fc-44b2-be51-5588fcff82b9 status: test description: Detects the execution of a renamed "Msdt.exe" binary references: - https://lolbas-project.github.io/lolbas/Binaries/Msdt/ author: pH-T (Nextron Systems) date: 2022-06-03 modified: 2023-02-03 tags: - attack.stealth - attack.t1036.003 logsource: category: process_creation product: windows detection: selection: OriginalFileName: msdt.exe filter: Image|endswith: \msdt.exe condition: selection and not filter falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_msdt/info.yml
Query: adversary uses Office Application Startup
Matching passage: T1137 Office Application Startup. Tactics: persistence. Description: Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins. A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: SensePost Ruler GitHub) These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: TechNet O365 Outlook Rules)
Near-miss passage: T1137.006 Add-ins. Tactics: persistence. Description: Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs. (Citation: Microsoft Office Add-ins) There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins. (Citation: MRWLabs Office Persistence Add-ins)(Citation: FireEye Mail CDS 2018) Add-ins can be used to obtain persistence because they can be set to execute code when an Office application starts.
Query: mitigate System Network Configuration Discovery
Matching passage: T1016 System Network Configuration Discovery. Tactics: discovery. Description: Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include [Arp](https://attack.mitre.org/software/S0099), [ipconfig](https://attack.mitre.org/software/S0100)/[ifconfig](https://attack.mitre.org/software/S0101), [nbtstat](https://attack.mitre.org/software/S0102), and [route](https://attack.mitre.org/software/S0103). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather information about configurations and settings, such as IP addresses of configured interfaces and static/dynamic routes (e.g. <code>show ip route</code>, <code>show ip interface</code>).(Citation: US-CERT-TA18-106A)(Citation: Mandiant APT41 Global Intrusion ) On ESXi, adversaries may leverage esxcli to gather network configuration information. For example, the command `esxcli network nic list` will retrieve the MAC address, while `esxcli network ip interface ipv4 get` will retrieve the local IPv4 address.(Citation: Trellix Rnasomhouse 2024) Adversaries may use the information from [System Network Configuration Discovery](https://attack.mitre.org/techniques/T1016) during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.
Near-miss passage: T1016.001 Internet Connection Discovery. Tactics: discovery. Description: Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using [Ping](https://attack.mitre.org/software/S0097), <code>tracert</code>, and GET requests to websites, or performing initial speed testing to confirm bandwidth. Adversaries may use the results and responses from these requests to determine if the system is capable of communicating with their C2 servers before attempting to connect to them. The results may also be used to identify routes, redirectors, and proxy servers.