alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: ATT&CK technique for Threat Intel Vendors
Matching passage: T1597.001 Threat Intel Vendors. Tactics: reconnaissance. Description: Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures.(Citation: D3Secutrity CTI Feeds) Adversaries may search in private threat intelligence vendor data to gather actionable information. If a threat actor is searching for information on their own activities, that falls under [Search Threat Vendor Data](https://attack.mitre.org/techniques/T1681). Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Near-miss passage: T1597.002 Purchase Technical Data. Tactics: reconnaissance. Description: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure.(Citation: ZDNET Selling Data) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
Query: vulnerability: The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-based Referer tracking.
Matching passage: CVE-2015-9273. CWE: CWE-79. CVSS: 6.099999904632568. The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-based Referer tracking.
Near-miss passage: CVE-2015-10080. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in NREL api-umbrella-web 0.7.1. It has been classified as problematic. This affects an unknown part of the component Admin Data Table Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 0.8.0 is able to address this issue. The patch is named f53a9fb87e10c457f0f3dd4f2af24d3b2f21b3ca. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-221487.
Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a sys. Logsource: windows / registry_set. Rule: title: RDP Sensitive Settings Changed to Zero id: a2863fbc-d5cb-48d5-83fb-d976d4b1743b related: - id: 3f6b7b62-61aa-45db-96bd-9c31b36b653c type: similar - id: 4b8f6d3a-9c5e-4f2a-a7d8-6b9c3e5f2a8d type: similar status: test description: 'Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the ''fAllowUnsolicited'' or enabling RDP via ''fDenyTSConnections'', etc. ' references: - https://web.archive.org/web/20200929062532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html - http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/ - https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03 - https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html - https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/ - http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/ - https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services author: Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali date: 2022-09-29 modified: 2022-11-26 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: - \fDenyTSConnections - \fSingleSessionPerUser - \UserAuthentication Details: DWORD (0x00000000) condition: selection falsepositives: - Some of the keys mentioned here could be modified by an administrator while setting group policy (it should be investigated either way) level: medium
Near-miss passage: Sigma rule: Detects denied requests by Active Directory Certificate Services. Example of these requests denial include issues with p. Logsource: windows / system. Rule: title: Active Directory Certificate Services Denied Certificate Enrollment Request id: 994bfd6d-0a2e-481e-a861-934069fcf5f5 status: test description: 'Detects denied requests by Active Directory Certificate Services. Example of these requests denial include issues with permissions on the certificate template or invalid signatures. ' references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd299871(v=ws.10) - https://www.gradenegger.eu/en/details-of-the-event-with-id-53-of-the-source-microsoft-windows-certificationauthority/ author: '@SerkinValery' date: 2024-03-07 tags: - attack.credential-access - attack.defense-impairment - attack.t1553.004 logsource: product: windows service: system detection: selection: Provider_Name: Microsoft-Windows-CertificationAuthority EventID: 53 condition: selection falsepositives: - Unknown level: low
Query: campaign using Exclusive Control
Matching passage: T1668 Exclusive Control. Tactics: persistence. Description: Adversaries who successfully compromise a system may attempt to maintain persistence by “closing the door” behind them – in other words, by preventing other threat actors from initially accessing or maintaining a foothold on the same system. For example, adversaries may patch a vulnerable, compromised system(Citation: Mandiant-iab-control)(Citation: CERT AT Fortinent Ransomware 2025) to prevent other threat actors from leveraging that vulnerability in the future. They may “close the door” in other ways, such as disabling vulnerable services(Citation: sophos-multiple-attackers), stripping privileges from accounts(Citation: aquasec-postgres-processes), or removing other malware already on the compromised device.(Citation: fsecure-netsky) Hindering other threat actors may allow an adversary to maintain sole access to a compromised system or network. This prevents the threat actor from needing to compete with or even being removed themselves by other threat actors. It also reduces the “noise” in the environment, lowering the possibility of being caught and evicted by defenders. Finally, in the case of [Resource Hijacking](https://attack.mitre.org/techniques/T1496), leveraging a compromised device’s full power allows the threat actor to maximize profit.(Citation: sophos-multiple-attackers)
Near-miss passage: T1078.002 Domain Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.(Citation: TechNet Credential Theft) Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.(Citation: Microsoft AD Accounts) Adversaries may compromise domain accounts, some with a high level of privileges, through various means such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or password reuse, allowing access to privileged resources of the domain.
Query: patch priority for CVE-2015-5052
Matching passage: CVE-2015-5052. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in Sefrengo before 1.6.5 beta2.
Near-miss passage: CVE-2015-10055. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in PictureThisWebServer and classified as critical. This issue affects the function router.post of the file routes/user.js. The manipulation of the argument username/password leads to sql injection. The patch is named 68b9dc346e88b494df00d88c7d058e96820e1479. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218399.
Query: write Sigma for Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity
Matching passage: Sigma rule: Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity. Logsource: windows / process_creation. Rule: title: Potential Credential Dumping Via LSASS Process Clone id: c8da0dfd-4ed0-4b68-962d-13c9c884384e status: test description: Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity references: - https://www.matteomalvica.com/blog/2019/12/02/win-defender-atp-cred-bypass/ - https://twitter.com/Hexacorn/status/1420053502554951689 - https://twitter.com/SBousseaden/status/1464566846594691073?s=20 author: Florian Roth (Nextron Systems), Samir Bousseaden date: 2021-11-27 modified: 2023-03-02 tags: - attack.credential-access - attack.t1003 - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \Windows\System32\lsass.exe Image|endswith: \Windows\System32\lsass.exe condition: selection falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only availab. Logsource: windows / process_creation. Rule: title: Suspicious Service DACL Modification Via Set-Service Cmdlet id: a95b9b42-1308-4735-a1af-abb1c5e6f5ac related: - id: 99cf1e02-00fb-4c0d-8375-563f978dfd37 type: derived status: test description: Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only available with PowerShell 7) that can be used to hide services or make them unstopable references: - https://www.sans.org/blog/red-team-tactics-hiding-windows-services/ - https://learn.microsoft.com/pt-br/windows/win32/secauthz/sid-strings author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-18 tags: - attack.privilege-escalation - attack.persistence - attack.t1543.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \pwsh.exe - OriginalFileName: pwsh.dll selection_sddl_flag: CommandLine|contains: - '-SecurityDescriptorSddl ' - '-sd ' selection_set_service: CommandLine|contains|all: - 'Set-Service ' - D;; CommandLine|contains: - ;;;IU - ;;;SU - ;;;BA - ;;;SY - ;;;WD condition: all of selection_* falsepositives: - Unknown level: high
Query: describe CVE-2015-7260
Matching passage: CVE-2015-7260. CWE: CWE-264. CVSS: 7.800000190734863. Liebert MultiLink Automated Shutdown v4.2.4 allows local users to gain privileges by replacing the LiebertM executable file.
Near-miss passage: CVE-2015-6638. CWE: CWE-264. CVSS: 7.800000190734863. The Imagination Technologies driver in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted application, aka internal bug 24673908.
Query: describe CVE-2015-5018
Matching passage: CVE-2015-5018. CWE: CWE-78. CVSS: 8.0. IBM Security Access Manager for Web 7.0.0 before FP19 and 8.0 before 8.0.1.3 IF3, and Security Access Manager 9.0 before 9.0.0.0 IF1, allows remote authenticated users to execute arbitrary OS commands by leveraging Local Management Interface (LMI) access.
Near-miss passage: CVE-2015-0977. CWE: CWE-78. CVSS: 10.0. Network Vision IntraVue before 2.3.0a14 on Windows allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Query: secure coding against Storage of Sensitive Data in a Mechanism without Access Control
Matching passage: CWE-921 Storage of Sensitive Data in a Mechanism without Access Control. The product stores sensitive information in a file system or device that does not have built-in access control.
Near-miss passage: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'). The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Query: describe CVE-2015-9381
Matching passage: CVE-2015-9381. CWE: CWE-125. CVSS: 8.800000190734863. FreeType before 2.6.1 has a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c.
Near-miss passage: CVE-2015-8897. CWE: CWE-125. CVSS: 5.5. The SpliceImage function in MagickCore/transform.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (application crash) via a crafted png file.
Query: vulnerability: SysAid Help Desk before 15.2 does not properly restrict access to certain functionality, which allows remote attackers to (1) create administrator accounts via a crafted request to
Matching passage: CVE-2015-2993. CWE: CWE-264. CVSS: 7.5. SysAid Help Desk before 15.2 does not properly restrict access to certain functionality, which allows remote attackers to (1) create administrator accounts via a crafted request to /createnewaccount or (2) write to arbitrary files via the fileName parameter to /userentry.
Near-miss passage: CVE-2015-0767. CWE: CWE-264. CVSS: 7.199999809265137. Cisco Edge 300 software 1.0 and 1.1 on Edge 340 devices allows local users to obtain root privileges via unspecified commands, aka Bug ID CSCur18132.
Query: describe CVE-2015-1261
Matching passage: CVE-2015-1261. CWE: CWE-20. CVSS: 5.0. android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java in Google Chrome before 43.0.2357.65 on Android does not properly restrict use of a URL's fragment identifier during construction of a page-info popup, which allows remote attackers to spoof the URL bar or deliver misleading popup content via crafted text.
Near-miss passage: CVE-2015-0561. CWE: CWE-20. CVSS: 5.0. asn1/lpp/lpp.cnf in the LPP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 does not validate a certain index value, which allows remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted packet.
Query: vulnerability: SolarWinds Log and Event Manager (LEM) allows remote attackers to execute arbitrary commands on managed computers via a request to services/messagebroker/nonsecurestreamingamf invo
Matching passage: CVE-2015-7839. CWE: CWE-77. CVSS: 7.5. SolarWinds Log and Event Manager (LEM) allows remote attackers to execute arbitrary commands on managed computers via a request to services/messagebroker/nonsecurestreamingamf involving the traceroute functionality.
Near-miss passage: CVE-2015-20108. CWE: CWE-77. CVSS: 9.800000190734863. xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.
Query: detect Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from in logs
Matching passage: Sigma rule: Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from. Logsource: windows / file_event. Rule: title: ISO File Created Within Temp Folders id: 2f9356ae-bf43-41b8-b858-4496d83b2acb status: test description: Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022. references: - https://twitter.com/Sam0x90/status/1552011547974696960 - https://securityaffairs.co/wordpress/133680/malware/dll-sideloading-spread-qakbot.html - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image author: '@sam0x90' date: 2022-07-30 tags: - attack.initial-access - attack.t1566.001 logsource: category: file_event product: windows detection: selection_1: TargetFilename|contains|all: - \AppData\Local\Temp\ - .zip\ TargetFilename|endswith: .iso selection_2: TargetFilename|contains: \AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\ TargetFilename|endswith: .iso condition: 1 of selection* falsepositives: - Potential FP by sysadmin opening a zip file containing a legitimate ISO file level: high
Near-miss passage: Sigma rule: Detects the execution of "lodctr.exe" to rebuild the performance counter registry values. This can be abused by attacker. Logsource: windows / process_creation. Rule: title: Rebuild Performance Counter Values Via Lodctr.EXE id: cc9d3712-6310-4320-b2df-7cb408274d53 status: test description: Detects the execution of "lodctr.exe" to rebuild the performance counter registry values. This can be abused by attackers by providing a malicious config file to overwrite performance counter configuration to confuse and evade monitoring and security solutions. references: - https://learn.microsoft.com/en-us/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-15 modified: 2024-03-05 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \lodctr.exe OriginalFileName: LODCTR.EXE selection_cli: CommandLine|contains|windash: ' -r' condition: all of selection_* falsepositives: - Legitimate usage by an administrator level: medium
Query: write Sigma for Detects usage of system utilities (only grep and egrep for now) to discover security software discovery
Matching passage: Sigma rule: Detects usage of system utilities (only grep and egrep for now) to discover security software discovery. Logsource: linux / process_creation. Rule: title: Security Software Discovery - Linux id: c9d8b7fd-78e4-44fe-88f6-599135d46d60 status: test description: Detects usage of system utilities (only grep and egrep for now) to discover security software discovery references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2022-11-27 tags: - attack.discovery - attack.t1518.001 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /grep - /egrep CommandLine|contains: - nessusd - td-agent - packetbeat - filebeat - auditbeat - osqueryd - cbagentd - falcond condition: selection falsepositives: - Legitimate activities level: low
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitra. Logsource: windows / image_load. Rule: title: Potential Mfdetours.DLL Sideloading id: d2605a99-2218-4894-8fd3-2afb7946514d status: test description: Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution. references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-03 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \mfdetours.dll filter_main_legit_path: ImageLoaded|contains: :\Program Files (x86)\Windows Kits\10\bin\ condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: medium
Query: patch priority for CVE-2015-1129
Matching passage: CVE-2015-1129. CWE: CWE-310. CVSS: 4.300000190734863. Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 does not properly select X.509 client certificates, which makes it easier for remote attackers to track users via a crafted web site.
Near-miss passage: CVE-2015-4550. CWE: CWE-310. CVSS: 4.300000190734863. The Cavium cryptographic-module firmware on Cisco Adaptive Security Appliance (ASA) devices with software 9.3(3) and 9.4(1.1) does not verify the AES-GCM Integrity Check Value (ICV) octets, which makes it easier for man-in-the-middle attackers to spoof IPSec and IKEv2 traffic by modifying packet data, aka Bug ID CSCuu66218.
Query: patch priority for CVE-2015-1854
Matching passage: CVE-2015-1854. CWE: CWE-284. CVSS: 7.5. 389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call.
Near-miss passage: CVE-2015-1763. CWE: CWE-284. CVSS: 8.5. Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014 does not prevent use of uninitialized memory in certain attempts to execute virtual functions, which allows remote authenticated users to execute arbitrary code via a crafted query, aka "SQL Server Remote Code Execution Vulnerability."
Query: exploit Memory leak in Huawei S5300EI, S5300SI, S5310HI, and S6300EI Campus series switches with software V200R003C00 before V200R003SPH011 and V200R005C00 before V200R005SPH008; S2350EI a
Matching passage: CVE-2015-8677. CWE: CWE-399. CVSS: 6.5. Memory leak in Huawei S5300EI, S5300SI, S5310HI, and S6300EI Campus series switches with software V200R003C00 before V200R003SPH011 and V200R005C00 before V200R005SPH008; S2350EI and S5300LI Campus series switches with software V200R003C00 before V200R003SPH011, V200R005C00 before V200R005SPH008, and V200R006C00 before V200R006SPH002; S9300, S7700, and S9700 Campus series switches with software V200R003C00 before V200R003SPH011, V200R005C00 before V200R005SPH009, and V200R006C00 before V200R006SPH003; S5720HI and S5720EI Campus series switches with software V200R006C00 before V200R006SPH002; and S2300 and S3300 Campus series switches with software V100R006C05 before V100R006SPH022 allows remote authenticated users to cause a denial of service (memory consumption and device restart) by logging in and out of the (1) HTTPS or (2) SFTP server, related to SSL session information.
Near-miss passage: CVE-2015-0202. CWE: CWE-399. CVSS: 7.800000190734863. The mod_dav_svn server in Subversion 1.8.0 through 1.8.11 allows remote attackers to cause a denial of service (memory consumption) via a large number of REPORT requests, which trigger the traversal of FSFS repository nodes.