alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: EDR alert: possible Messaging Applications (T1213.005)
Matching passage: T1213.005 Messaging Applications. Tactics: collection. Description: Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information. The following is a brief list of example information that may hold potential value to an adversary and may also be found on messaging applications: * Testing / development credentials (i.e., [Chat Messages](https://attack.mitre.org/techniques/T1552/008)) * Source code snippets * Links to network shares and other internal resources * Proprietary data(Citation: Guardian Grand Theft Auto Leak 2022) * Discussions about ongoing incident response efforts(Citation: SC Magazine Ragnar Locker 2021)(Citation: Microsoft DEV-0537) In addition to exfiltrating data from messaging applications, adversaries may leverage data from chat messages in order to improve their targeting - for example, by learning more about an environment or evading ongoing incident response efforts.(Citation: Sentinel Labs NullBulge 2024)(Citation: Permiso Scattered Spider 2023)
Near-miss passage: T1213.001 Confluence. Tactics: collection. Description: Adversaries may leverage Confluence repositories to mine valuable information. Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as: * Policies, procedures, and standards * Physical / logical network diagrams * System architecture diagrams * Technical system documentation * Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)) * Work / project schedules * Source code snippets * Links to network shares and other internal resources
Query: Sigma rule for Detects suspicious spawning of a process under a different user context than the parent process. Processes such as notep
Matching passage: Sigma rule: Detects suspicious spawning of a process under a different user context than the parent process. Processes such as notep. Logsource: windows / process_creation. Rule: title: Suspicious Cross-User Process Spawn id: d2b7a134-9c3e-4f8a-b56d-e0c1f8a29b47 status: experimental description: 'Detects suspicious spawning of a process under a different user context than the parent process. Processes such as notepad.exe, calculator etc. are generally spawned under the same user context and also they are often targeted as sacrificial process or decoy process to check successful privilege escalation. ' references: - https://github.com/MSNightmare/LegacyHive - https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-23 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 - attack.t1134 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \notepad.exe - \calc.exe - \mspaint.exe - \wordpad.exe - \write.exe filter_main_same_user: User|fieldref: ParentUser filter_optional_user_null: User: null filter_optional_parent_null: ParentUser: null filter_optional_empty_user: - ParentUser: - '' - '-' - User: - '' - '-' condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - RunAs usage spawning one of the listed binaries under a different account level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_susp_cross_user_process_spawn/info.yml
Near-miss passage: Sigma rule: Detects the execution of the "cloudflared" binary from a non standard location.. Logsource: windows / process_creation. Rule: title: Cloudflared Portable Execution id: fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd status: test description: 'Detects the execution of the "cloudflared" binary from a non standard location. ' references: - https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/ - https://github.com/cloudflare/cloudflared - https://www.intrinsec.com/akira_ransomware/ - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/ - https://github.com/cloudflare/cloudflared/releases author: Nasreddine Bencherchali (Nextron Systems) tags: - attack.command-and-control - attack.t1090.001 date: 2023-12-20 logsource: category: process_creation product: windows detection: selection: Image|endswith: \cloudflared.exe filter_main_admin_location: Image|contains: - :\Program Files (x86)\cloudflared\ - :\Program Files\cloudflared\ condition: selection and not 1 of filter_main_* falsepositives: - Legitimate usage of Cloudflared portable versions level: medium
Query: weakness Debug Messages Revealing Unnecessary Information
Matching passage: CWE-1295 Debug Messages Revealing Unnecessary Information. The product fails to adequately prevent the revealing of unnecessary and potentially sensitive system information within debugging messages.
Near-miss passage: CWE-1316 Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges. The address map of the on-chip fabric has protected and unprotected regions overlapping, allowing an attacker to bypass access control to the overlapping portion of the protected region.
Query: patch priority for CVE-2015-1344
Matching passage: CVE-2015-1344. CWE: CWE-264. CVSS: 7.199999809265137. The do_write_pids function in lxcfs.c in LXCFS before 0.12 does not properly check permissions, which allows local users to gain privileges by writing a pid to the tasks file.
Near-miss passage: CVE-2015-5367. CWE: CWE-264. CVSS: 6.900000095367432. The HP lt4112 LTE/HSPA+ Gobi 4G module with firmware before 12.500.00.15.1803 on EliteBook, ElitePad, Elite, ProBook, Spectre, ZBook, and mt41 Thin Client devices allows local users to gain privileges via unspecified vectors.
Query: actor TTPs: Screen Capture
Matching passage: T1113 Screen Capture. Tactics: collection. Description: Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.(Citation: CopyFromScreen .NET)(Citation: Antiquated Mac Malware)
Near-miss passage: T1557 Adversary-in-the-Middle. Tactics: credential access, collection. Description: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002), or replay attacks ([Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212)). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.(Citation: Rapid7 MiTM Basics) For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware.(Citation: ttint_rat)(Citation: dns_changer_trojans)(Citation: ad_blocker_with_miner) Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens ([Steal Application Access Token](https://attack.mitre.org/techniques/T1528)) and session cookies ([Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539)).(Citation: volexity_0day_sophos_FW)(Citation: Token tactics) [Downgrade Attack](https://attack.mitre.org/techniques/T1689)s can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm.(Citation: mitm_tls_downgrade_att)(Citation: taxonomy_downgrade_att_tls)(Citation: tlseminar_downgrade_att) Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate
Query: exploit OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hija
Matching passage: CVE-2015-0259. CWE: CWE-345. CVSS: 5.099999904632568. OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.
Near-miss passage: CVE-2015-8254. CWE: CWE-345. CVSS: 5.900000095367432. The Frontel protocol before 3 on RSI Video Technologies Videofied devices does not use integrity protection, which makes it easier for man-in-the-middle attackers to (1) initiate a false alarm or (2) deactivate an alarm by modifying the client-server data stream.
Query: detection rule: Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers comm
Matching passage: Sigma rule: Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers comm. Logsource: windows / ps_script. Rule: title: Access to Browser Login Data id: fc028194-969d-4122-8abe-0470d5b8f12f related: - id: 98f4c75c-3089-44f3-b733-b327b9cd9c9d type: obsolete - id: 47147b5b-9e17-4d76-b8d2-7bac24c5ce1b type: similar status: test description: 'Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.003/T1555.003.md author: frack113 date: 2022-01-30 tags: - attack.credential-access - attack.t1555.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmd: ScriptBlockText|contains|all: - Copy-Item - -Destination selection_path: ScriptBlockText|contains: - \Opera Software\Opera Stable\Login Data - \Mozilla\Firefox\Profiles - \Microsoft\Edge\User Data\Default - \Google\Chrome\User Data\Default\Login Data - \Google\Chrome\User Data\Default\Login Data For Account condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles. Logsource: windows / process_access. Rule: title: HackTool - HandleKatz Duplicating LSASS Handle id: b1bd3a59-c1fd-4860-9f40-4dd161a7d1f5 status: test description: Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles references: - https://github.com/codewhitesec/HandleKatz author: Bhabesh Raj (rule), @thefLinkk date: 2022-06-27 modified: 2023-11-28 tags: - attack.execution - attack.t1106 - attack.t1003.001 - attack.credential-access logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe GrantedAccess: '0x1440' CallTrace|startswith: C:\Windows\System32\ntdll.dll+ CallTrace|contains: '|UNKNOWN(' CallTrace|endswith: ) condition: selection falsepositives: - Unknown level: high
Query: risk of Unspecified vulnerability in the Hyperion Common Security component in Oracle Hyperion 11.1.2.2, 11.1.2.3, and 11.1.2.4 allows remote authenticated users to affect availability via
Matching passage: CVE-2015-4773. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Hyperion Common Security component in Oracle Hyperion 11.1.2.2, 11.1.2.3, and 11.1.2.4 allows remote authenticated users to affect availability via unknown vectors related to User Account Update.
Near-miss passage: CVE-2015-2572. CWE: UNKNOWN. CVSS: 4.599999904632568. Unspecified vulnerability in the Oracle Hyperion Smart View for Office component in Oracle Hyperion 11.1.2.5.216 and earlier, when running on Windows, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core.
Query: write Sigma for Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin"
Matching passage: Sigma rule: Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin". Logsource: windows / process_creation. Rule: title: Sensitive File Dump Via Wbadmin.EXE id: 8b93a509-1cb8-42e1-97aa-ee24224cdc15 status: test description: 'Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information. ' references: - https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml - https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/ - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2024-05-10 tags: - attack.credential-access - attack.t1003.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wbadmin.exe - OriginalFileName: WBADMIN.EXE selection_backup: CommandLine|contains: - start - backup selection_path: CommandLine|contains: - \config\SAM - \config\SECURITY - \config\SYSTEM - \Windows\NTDS\NTDS.dit condition: all of selection_* falsepositives: - Legitimate backup operation by authorized administrators. Matches must be investigated and allowed on a case by case basis. level: high
Near-miss passage: Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: System Scripts Autorun Keys Modification id: e7a2fd40-3ae1-4a85-bf80-15cf624fb1b1 related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: obsolete status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: scripts_base: TargetObject|contains: \Software\Policies\Microsoft\Windows\System\Scripts scripts: TargetObject|contains: - \Startup - \Shutdown - \Logon - \Logoff filter: Details: (Empty) condition: scripts_base and scripts and not filter falsepositives: - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason - Legitimate administrator sets up autorun keys for legitimate reason level: medium
Query: describe CVE-2015-2270
Matching passage: CVE-2015-2270. CWE: CWE-17. CVSS: 4.300000190734863. lib/moodlelib.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4, when the theme uses the blocks-regions feature, establishes the course state at an incorrect point in the login-validation process, which allows remote attackers to obtain sensitive course information via unspecified vectors.
Near-miss passage: CVE-2015-3183. CWE: CWE-17. CVSS: 5.0. The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.
Query: risk of In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM96
Matching passage: CVE-2015-9137. CWE: CWE-19. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, several EFS2 DIAG command handlers are not calling fs_diag_access_check().
Near-miss passage: CVE-2015-0854. CWE: CWE-19. CVSS: 7.800000190734863. App/HelperFunctions.pm in Shutter through 0.93.1 allows user-assisted remote attackers to execute arbitrary commands via a crafted image name that is mishandled during a "Show in Folder" action.
Query: patch priority for CVE-2015-8843
Matching passage: CVE-2015-8843. CWE: CWE-119. CVSS: 7.400000095367432. The Foxit Cloud Update Service (FoxitCloudUpdateService) in Foxit Reader 6.1 through 6.2.x and 7.x before 7.2.2, when an update to the Cloud plugin is available, allows local users to gain privileges by writing crafted data to a shared memory region, which triggers memory corruption.
Near-miss passage: CVE-2015-1547. CWE: CWE-119. CVSS: 6.5. The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff5.tif.
Query: patch priority for CVE-2015-4536
Matching passage: CVE-2015-4536. CWE: CWE-200. CVSS: 3.5. EMC Documentum Content Server before 7.0 P20, 7.1 before P18, and 7.2 before P02, when RPC tracing is configured, stores certain obfuscated password data in a log file, which allows remote authenticated users to obtain sensitive information by reading this file.
Near-miss passage: CVE-2015-8555. CWE: CWE-200. CVSS: 8.600000381469727. Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state, which allows local guest domains to obtain sensitive information from other domains via unspecified vectors.
Query: Sigma rule for Detects PAExec service installation
Matching passage: Sigma rule: Detects PAExec service installation. Logsource: windows / system. Rule: title: PAExec Service Installation id: de7ce410-b3fb-4e8a-b38c-3b999e2c3420 status: test description: Detects PAExec service installation references: - https://www.poweradmin.com/paexec/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-26 tags: - attack.execution - attack.t1569.002 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7045 selection_image: - ServiceName|startswith: PAExec- - ImagePath|startswith: C:\WINDOWS\PAExec- condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.. Logsource: windows / process_creation. Rule: title: Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe) id: a58353df-af43-4753-bad0-cd83ef35eef5 related: - id: 2afafd61-6aae-4df4-baed-139fa1f4c345 type: derived status: test description: Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731620(v=ws.11) - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-14 tags: - attack.credential-access - attack.t1003.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \ntdsutil.exe - OriginalFileName: ntdsutil.exe selection_cli: - CommandLine|contains|all: - snapshot - 'mount ' - CommandLine|contains|all: - ac - ' i' - ' ntds' condition: all of selection_* falsepositives: - Legitimate usage to restore snapshots - Legitimate admin activity level: medium
Query: vulnerability: The stock Android browser address bar in all Android operating systems suffers from Address Bar Spoofing, which allows remote attackers to trick a victim by displaying a malicious 
Matching passage: CVE-2015-3830. CWE: CWE-20. CVSS: 6.5. The stock Android browser address bar in all Android operating systems suffers from Address Bar Spoofing, which allows remote attackers to trick a victim by displaying a malicious page for legitimate domain names.
Near-miss passage: CVE-2015-1855. CWE: CWE-20. CVSS: 5.900000095367432. verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.
Query: patch priority for CVE-2015-5748
Matching passage: CVE-2015-5748. CWE: CWE-17. CVSS: 2.0999999046325684. The kernel in Apple OS X before 10.10.5 does not properly mount HFS volumes, which allows local users to cause a denial of service via a crafted volume.
Near-miss passage: CVE-2015-4620. CWE: CWE-17. CVSS: 7.800000190734863. name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DNSSEC validation, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) by constructing crafted zone data and then making a query for a name in that zone.