alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: intelligence brief on T1673
Matching passage: T1673 Virtual Machine Discovery. Tactics: discovery. Description: An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host or hypervisor. For example, adversaries may enumerate a list of VMs on an ESXi hypervisor using a [Hypervisor CLI](https://attack.mitre.org/techniques/T1059/012) such as `esxcli` or `vim-cmd` (e.g. `esxcli vm process list or vim-cmd vmsvc/getallvms`).(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: TrendMicro Play) Adversaries may also directly leverage a graphical user interface, such as VMware vCenter, in order to view virtual machines on a host. Adversaries may use the information from [Virtual Machine Discovery](https://attack.mitre.org/techniques/T1673) during discovery to shape follow-on behaviors. Subsequently discovered VMs may be leveraged for follow-on activities such as [Service Stop](https://attack.mitre.org/techniques/T1489) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486).(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)
Near-miss passage: T1217 Browser Information Discovery. Tactics: discovery. Description: Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.(Citation: Kaspersky Autofill) Browser information may also highlight additional targets after an adversary has access to valid credentials, especially [Credentials In Files](https://attack.mitre.org/techniques/T1552/001) associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).(Citation: Chrome Roaming Profiles)
Query: patch priority for CVE-2015-7248
Matching passage: CVE-2015-7248. CWE: CWE-200. CVSS: 7.5. ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code, a different vulnerability than CVE-2015-8703.
Near-miss passage: CVE-2015-3193. CWE: CWE-200. CVSS: 7.5. The Montgomery squaring implementation in crypto/bn/asm/x86_64-mont5.pl in OpenSSL 1.0.2 before 1.0.2e on the x86_64 platform, as used by the BN_mod_exp function, mishandles carry propagation and produces incorrect output, which makes it easier for remote attackers to obtain sensitive private-key information via an attack against use of a (1) Diffie-Hellman (DH) or (2) Diffie-Hellman Ephemeral (DHE) ciphersuite.
Query: CVE similar to CVE-2015-4199
Matching passage: CVE-2015-4199. CWE: CWE-362. CVSS: 7.099999904632568. Race condition in the IPv6-to-IPv4 functionality in Cisco IOS 15.3S in the Performance Routing Engine (PRE) module on UBR devices allows remote attackers to cause a denial of service (NULL pointer free and module crash) by triggering intermittent connectivity with many IPv6 CPE devices, aka Bug ID CSCug47366.
Near-miss passage: CVE-2015-7990. CWE: CWE-362. CVSS: 5.800000190734863. Race condition in the rds_sendmsg function in net/rds/sendmsg.c in the Linux kernel before 4.3.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6937.
Query: detect Detects a suspicious Microsoft desktopimgdownldr file creation that stores a file to a suspicious location or contains a in logs
Matching passage: Sigma rule: Detects a suspicious Microsoft desktopimgdownldr file creation that stores a file to a suspicious location or contains a. Logsource: windows / file_event. Rule: title: Suspicious Desktopimgdownldr Target File id: fc4f4817-0c53-4683-a4ee-b17a64bc1039 status: test description: Detects a suspicious Microsoft desktopimgdownldr file creation that stores a file to a suspicious location or contains a file with a suspicious extension references: - https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/ - https://twitter.com/SBousseaden/status/1278977301745741825 author: Florian Roth (Nextron Systems) date: 2020-07-03 modified: 2022-06-02 tags: - attack.command-and-control - attack.t1105 logsource: product: windows category: file_event detection: selection: Image|endswith: \svchost.exe TargetFilename|contains: \Personalization\LockScreenImage\ filter1: TargetFilename|contains: C:\Windows\ filter2: TargetFilename|contains: - .jpg - .jpeg - .png condition: selection and not filter1 and not filter2 falsepositives: - False positives depend on scripts and administrative tools used in the monitored environment level: high
Near-miss passage: Sigma rule: Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary. Logsource: windows / registry_event. Rule: title: UAC Bypass Via Wsreset id: 6ea3bf32-9680-422d-9f50-e90716b12a66 status: test description: Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary file contained in a low-privilege registry. references: - https://www.bleepingcomputer.com/news/security/trickbot-uses-a-new-windows-10-uac-bypass-to-launch-quietly - https://lolbas-project.github.io/lolbas/Binaries/Wsreset author: oscd.community, Dmitry Uchakin date: 2020-10-07 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: \AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-1650
Matching passage: CVE-2015-1650. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Component Use After Free Vulnerability."
Near-miss passage: CVE-2015-7638. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.
Query: campaign using Ccache Files
Matching passage: T1558.005 Ccache Files. Tactics: credential access. Description: Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having to re-enter credentials. The <code>/etc/krb5.conf</code> configuration file and the <code>KRB5CCNAME</code> environment variable are used to set the storage location for ccache entries. On Linux, credentials are typically stored in the `/tmp` directory with a naming format of `krb5cc_%UID%` or `krb5.ccache`. On macOS, ccache entries are stored by default in memory with an `API:{uuid}` naming scheme. Typically, users interact with ticket storage using <code>kinit</code>, which obtains a Ticket-Granting-Ticket (TGT) for the principal; <code>klist</code>, which lists obtained tickets currently held in the credentials cache; and other built-in binaries.(Citation: Kerberos GNU/Linux)(Citation: Binary Defense Kerberos Linux) Adversaries can collect tickets from ccache files stored on disk and authenticate as the current user without their password to perform [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003) attacks. Adversaries can also use these tickets to impersonate legitimate users with elevated privileges to perform [Privilege Escalation](https://attack.mitre.org/tactics/TA0004). Tools like Kekeo can also be used by adversaries to convert ccache files to Windows format for further [Lateral Movement](https://attack.mitre.org/tactics/TA0008). On macOS, adversaries may use open-source tools or the Kerberos framework to interact with ccache files and extract TGTs or Service Tickets via lower-level APIs.(Citation: SpectorOps Bifrost Kerberos macOS 2019)(Citation: Linux Kerberos Tickets)(Citation: Brining MimiKatz to Unix)(Citation: Kekeo)
Near-miss passage: T1558.001 Golden Ticket. Tactics: credential access. Description: Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TGT), also known as a golden ticket.(Citation: AdSecurity Kerberos GT Aug 2015) Golden tickets enable adversaries to generate authentication material for any account in Active Directory.(Citation: CERT-EU Golden Ticket Protection) Using a golden ticket, adversaries are then able to request ticket granting service (TGS) tickets, which enable access to specific resources. Golden tickets require adversaries to interact with the Key Distribution Center (KDC) in order to obtain TGS.(Citation: ADSecurity Detecting Forged Tickets) The KDC service runs all on domain controllers that are part of an Active Directory domain. KRBTGT is the Kerberos Key Distribution Center (KDC) service account and is responsible for encrypting and signing all Kerberos tickets.(Citation: ADSecurity Kerberos and KRBTGT) The KRBTGT password hash may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) and privileged access to a domain controller.
Query: write Sigma for Detects the execution of the BitLocker Access Agent Update Utility (baaupdate.exe) which is not a common parent process
Matching passage: Sigma rule: Detects the execution of the BitLocker Access Agent Update Utility (baaupdate.exe) which is not a common parent process. Logsource: windows / process_creation. Rule: title: Suspicious BitLocker Access Agent Update Utility Execution id: 9f38c1db-e2ae-40bf-81d0-5b68f73fb512 related: - id: 6e8fe0a8-ba0b-4a93-8f9e-82657e7a5984 type: similar status: experimental description: 'Detects the execution of the BitLocker Access Agent Update Utility (baaupdate.exe) which is not a common parent process for other processes. Suspicious child processes spawned by baaupdate.exe could indicate an attempt at lateral movement via BitLocker DCOM & COM Hijacking. ' references: - https://github.com/rtecCyberSec/BitlockMove author: andrewdanis, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-10-18 tags: - attack.stealth - attack.t1218 - attack.lateral-movement - attack.t1021.003 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \baaupdate.exe Image|endswith: - \bitsadmin.exe - \cmd.exe - \cscript.exe - \mshta.exe - \powershell_ise.exe - \powershell.exe - \regsvr32.exe - \rundll32.exe - \schtasks.exe - \wmic.exe - \wscript.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious requests to Telegram API without the usual Telegram User-Agent. Logsource: proxy. Rule: title: Telegram API Access id: b494b165-6634-483d-8c47-2026a6c52372 status: test description: Detects suspicious requests to Telegram API without the usual Telegram User-Agent references: - https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/ - https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/ - https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/ author: Florian Roth (Nextron Systems) date: 2018-06-05 modified: 2023-05-18 tags: - attack.command-and-control - attack.t1071.001 - attack.t1102.002 logsource: category: proxy detection: selection: cs-host: api.telegram.org filter: c-useragent|contains: - Telegram - Bot condition: selection and not filter falsepositives: - Legitimate use of Telegram bots in the company level: medium
Query: vulnerability: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF09 allows remote attackers to inject arbitrary web script or H
Matching passage: CVE-2015-7457. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF09 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-0774. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Cisco Application and Content Networking System (ACNS) 5.5(9) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuu70650.
Query: how to detect Query Registry
Matching passage: T1012 Query Registry. Tactics: discovery. Description: Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. The Registry contains a significant amount of information about the operating system, configuration, software, and security.(Citation: Wikipedia Windows Registry) Information can easily be queried using the [Reg](https://attack.mitre.org/software/S0075) utility, though other means to access the Registry exist. Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from [Query Registry](https://attack.mitre.org/techniques/T1012) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Near-miss passage: T1652 Device Driver Discovery. Tactics: discovery. Description: Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) or other defenses (e.g., [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)), as well as potential exploitable vulnerabilities (e.g., [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)). Many OS utilities may provide information about local device drivers, such as `driverquery.exe` and the `EnumDeviceDrivers()` API function on Windows.(Citation: Microsoft Driverquery)(Citation: Microsoft EnumDeviceDrivers) Information about device drivers (as well as associated services, i.e., [System Service Discovery](https://attack.mitre.org/techniques/T1007)) may also be available in the Registry.(Citation: Microsoft Registry Drivers) On Linux/macOS, device drivers (in the form of kernel modules) may be visible within `/dev` or using utilities such as `lsmod` and `modinfo`.(Citation: Linux Kernel Programming)(Citation: lsmod man)(Citation: modinfo man)
Query: patch priority for CVE-2015-3617
Matching passage: CVE-2015-3617. CWE: CWE-264. CVSS: 7.800000190734863. Fortinet FortiManager 5.0 before 5.0.11 and 5.2 before 5.2.2 allow local users to gain privileges via crafted CLI commands.
Near-miss passage: CVE-2015-6642. CWE: CWE-264. CVSS: 9.800000190734863. The kernel in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24157888.
Query: detect Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This d in logs
Matching passage: Sigma rule: Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This d. Logsource: m365 / threat_management. Rule: title: PST Export Alert Using New-ComplianceSearchAction id: 6897cd82-6664-11ed-9022-0242ac120002 related: - id: 18b88d08-d73e-4f21-bc25-4b9892a4fdd0 type: similar status: test description: Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This detection will detect PST export even if the 'eDiscovery search or exported' alert is disabled in the O365.This rule will apply to ExchangePowerShell usage and from the cloud. references: - https://learn.microsoft.com/en-us/powershell/module/exchange/new-compliancesearchaction?view=exchange-ps author: Nikita Khalimonenkov date: 2022-11-17 tags: - attack.collection - attack.t1114 logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter Payload|contains|all: - New-ComplianceSearchAction - Export - pst condition: selection falsepositives: - Exporting a PST can be done for legitimate purposes by legitimate sources, but due to the sensitive nature of PST content, it must be monitored. level: medium
Near-miss passage: Sigma rule: Triggers on any Sysmon "FileBlockShredding" event, which indicates a violation of the configured shredding policy.. Logsource: windows / sysmon. Rule: title: Sysmon Blocked File Shredding id: c3e5c1b1-45e9-4632-b242-27939c170239 status: test description: Triggers on any Sysmon "FileBlockShredding" event, which indicates a violation of the configured shredding policy. references: - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon author: frack113 date: 2023-07-20 tags: - attack.defense-impairment logsource: product: windows service: sysmon detection: selection: EventID: 28 condition: selection falsepositives: - Unlikely level: high
Query: vulnerability: xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via
Matching passage: CVE-2015-8973. CWE: CWE-284. CVSS: 8.300000190734863. xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password.
Near-miss passage: CVE-2015-1376. CWE: CWE-284. CVSS: 4.0. pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrary files via an upload URL with a host other than pixabay.com.
Query: detection rule: Detects when a user bypasses the push protection on a secret detected by secret scanning.
Matching passage: Sigma rule: Detects when a user bypasses the push protection on a secret detected by secret scanning.. Logsource: github / audit. Rule: title: Github Push Protection Bypass Detected id: 02cf536a-cf21-4876-8842-4159c8aee3cc status: test description: Detects when a user bypasses the push protection on a secret detected by secret scanning. references: - https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/push-protection-for-repositories-and-organizations - https://thehackernews.com/2024/03/github-rolls-out-default-secret.html author: Muhammad Faisal (@faisalusuf) date: 2024-03-07 tags: - attack.defense-impairment - attack.t1685 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action|contains: secret_scanning_push_protection.bypass condition: selection falsepositives: - Allowed administrative activities. level: low
Near-miss passage: Sigma rule: Adversaries may manipulate accounts to maintain access to victim systems. Account manipulation may consist of any action. Logsource: windows / ps_script. Rule: title: Powershell LocalAccount Manipulation id: 4fdc44df-bfe9-4fcc-b041-68f5a2d3031c status: test description: 'Adversaries may manipulate accounts to maintain access to victim systems. Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1098/T1098.md#atomic-test-1---admin-account-manipulate - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.localaccounts/?view=powershell-5.1 author: frack113 date: 2021-12-28 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Disable-LocalUser - Enable-LocalUser - Get-LocalUser - Set-LocalUser - New-LocalUser - Rename-LocalUser - Remove-LocalUser condition: selection falsepositives: - Legitimate administrative script level: medium
Query: describe CVE-2015-4500
Matching passage: CVE-2015-4500. CWE: CWE-119. CVSS: 7.5. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Near-miss passage: CVE-2015-5805. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Query: CVE similar to CVE-2015-0340
Matching passage: CVE-2015-0340. CWE: UNKNOWN. CVSS: 5.0. Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows remote attackers to bypass intended file-upload restrictions via unspecified vectors.
Near-miss passage: CVE-2015-4871. CWE: UNKNOWN. CVSS: 5.800000190734863. Unspecified vulnerability in Oracle Java SE 7u85 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.