alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects when an a role is modified or deleted in Google Workspace.
Matching passage: Sigma rule: Detects when an a role is modified or deleted in Google Workspace.. Logsource: gcp / google_workspace.admin. Rule: title: Google Workspace Role Modified or Deleted id: 6aef64e3-60c6-4782-8db3-8448759c714e status: test description: Detects when an a role is modified or deleted in Google Workspace. references: - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3 - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings author: Austin Songer date: 2021-08-24 modified: 2023-10-11 tags: - attack.impact logsource: product: gcp service: google_workspace.admin detection: selection: eventService: admin.googleapis.com eventName: - DELETE_ROLE - RENAME_ROLE - UPDATE_ROLE condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects setting proxy configuration. Logsource: linux / process_creation. Rule: title: Connection Proxy id: 72f4ab3f-787d-495d-a55d-68c2ff46cf4c status: test description: Detects setting proxy configuration author: Ömer Günal date: 2020-06-17 modified: 2022-10-05 tags: - attack.command-and-control - attack.t1090 logsource: product: linux category: process_creation detection: selection: CommandLine|contains: - http_proxy= - https_proxy= condition: selection falsepositives: - Legitimate administration activities level: low
Query: exploit Adobe Shockwave Player before 12.2.1.171 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Matching passage: CVE-2015-7649. CWE: CWE-119. CVSS: 10.0. Adobe Shockwave Player before 12.2.1.171 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Near-miss passage: CVE-2015-4002. CWE: CWE-119. CVSS: 9.0. drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 does not ensure that certain length values are sufficiently large, which allows remote attackers to cause a denial of service (system crash or large loop) or possibly execute arbitrary code via a crafted packet, related to the (1) oz_usb_rx and (2) oz_usb_handle_ep_data functions.
Query: patch priority for CVE-2015-7797
Matching passage: CVE-2015-7797. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7796, CVE-2015-7798, CVE-2016-1149, and CVE-2016-1150.
Near-miss passage: CVE-2015-7786. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the NTT DATA Smart Sourcing JavaScript module 2003-11-26 through 2013-07-09 for Web Analytics Service allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: describe CVE-2015-0287
Matching passage: CVE-2015-0287. CWE: CWE-17. CVSS: 5.0. The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse.
Near-miss passage: CVE-2015-7045. CWE: CWE-17. CVSS: 5.0. Keychain Access in Apple OS X before 10.11.2 and tvOS before 9.1 improperly interacts with Keychain Agent, which allows attackers to spoof the Keychain Server via unspecified vectors.
Query: patch priority for CVE-2015-0951
Matching passage: CVE-2015-0951. CWE: CWE-264. CVSS: 6.5. X-Cart before 5.1.11 allows remote authenticated users to read or delete address data of arbitrary accounts via a modified (1) update or (2) remove request.
Near-miss passage: CVE-2015-4685. CWE: CWE-264. CVSS: 7.0. Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users with access to the plcm account to gain privileges via a script in /var/polycom/cma/upgrade/scripts, related to a sudo misconfiguration.
Query: describe CVE-2015-7740
Matching passage: CVE-2015-7740. CWE: CWE-20. CVSS: 5.5. Huawei P7 before P7-L00C17B851, P7-L05C00B851, and P7-L09C92B851 and P8 ALE-UL00 before ALE-UL00B211 allows local users to cause a denial of service (OS crash) via vectors involving an application that passes crafted input to the GPU driver.
Near-miss passage: CVE-2015-6824. CWE: CWE-20. CVSS: 7.5. The sws_init_context function in libswscale/utils.c in FFmpeg before 2.7.2 does not initialize certain pixbuf data structures, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted video data.
Query: patch priority for CVE-2015-10087
Matching passage: CVE-2015-10087. CWE: CWE-434. CVSS: 8.800000190734863. ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in UpThemes Theme DesignFolio Plus 1.2 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 53f6ae62878076f99718e5feb589928e83c879a9. It is recommended to apply a patch to fix this issue. The identifier VDB-221809 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Near-miss passage: CVE-2015-7571. CWE: CWE-434. CVSS: 7.800000190734863. Unrestricted file upload vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
Query: exploit dwarf_leb.c in libdwarf allows attackers to cause a denial of service (SIGSEGV).
Matching passage: CVE-2015-8538. CWE: CWE-20. CVSS: 6.5. dwarf_leb.c in libdwarf allows attackers to cause a denial of service (SIGSEGV).
Near-miss passage: CVE-2015-4276. CWE: CWE-20. CVSS: 6.5. Cisco WebEx Meetings Server 2.5MR1 allows remote authenticated users to execute arbitrary code via a crafted command parameter, aka Bug ID CSCus56138.
Query: secure coding against Struts: Plug-in Framework not in Use
Matching passage: CWE-106 Struts: Plug-in Framework not in Use. When an application does not use an input validation framework such as the Struts Validator, there is a greater risk of introducing weaknesses related to insufficient input validation.
Near-miss passage: CWE-1298 Hardware Logic Contains Race Conditions. A race condition in the hardware logic results in undermining security guarantees of the system.
Query: patch priority for CVE-2015-7993
Matching passage: CVE-2015-7993. CWE: CWE-20. CVSS: 7.5. The Extended Application Services (aka XS or XS Engine) in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to execute arbitrary code via unspecified vectors related to "HTTP Login," aka SAP Security Note 2197397.
Near-miss passage: CVE-2015-8737. CWE: CWE-20. CVSS: 5.5. The mp2t_open function in wiretap/mp2t.c in the MP2T file parser in Wireshark 2.0.x before 2.0.1 does not validate the bit rate, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file.
Query: write Sigma for Detects suspicious command lines used in Covenant luanchers
Matching passage: Sigma rule: Detects suspicious command lines used in Covenant luanchers. Logsource: windows / process_creation. Rule: title: HackTool - Covenant PowerShell Launcher id: c260b6db-48ba-4b4a-a76f-2f67644e99d2 status: test description: Detects suspicious command lines used in Covenant luanchers references: - https://posts.specterops.io/covenant-v0-5-eee0507b85ba author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community date: 2020-06-04 modified: 2023-02-21 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1564.003 logsource: category: process_creation product: windows detection: selection_1: CommandLine|contains|all: - -Sta - -Nop - -Window - Hidden CommandLine|contains: - -Command - -EncodedCommand selection_2: CommandLine|contains: - 'sv o (New-Object IO.MemorySteam);sv d ' - mshta file.hta - GruntHTTP - -EncodedCommand cwB2ACAAbwAgA condition: 1 of selection_* level: high
Near-miss passage: Sigma rule: The OpenWith.exe executes other binary. Logsource: windows / process_creation. Rule: title: OpenWith.exe Executes Specified Binary id: cec8e918-30f7-4e2d-9bfa-a59cc97ae60f status: test description: The OpenWith.exe executes other binary references: - https://github.com/LOLBAS-Project/LOLBAS/blob/4db780e0f0b2e2bb8cb1fa13e09196da9b9f1834/yml/LOLUtilz/OSBinaries/Openwith.yml - https://twitter.com/harr0ey/status/991670870384021504 author: Beyu Denis, oscd.community (rule), @harr0ey (idea) date: 2019-10-12 modified: 2021-11-27 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: Image|endswith: \OpenWith.exe CommandLine|contains: /c condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-3408
Matching passage: CVE-2015-3408. CWE: CWE-77. CVSS: 10.0. Module::Signature before 0.74 allows remote attackers to execute arbitrary shell commands via a crafted SIGNATURE file which is not properly handled when generating checksums from a signed manifest.
Near-miss passage: CVE-2015-0778. CWE: CWE-77. CVSS: 7.5. osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file.
Query: exploit Cross-site scripting (XSS) vulnerability in MQ XR WebSockets Listener in WMQ Telemetry in IBM WebSphere MQ 8.0 before 8.0.0.2 allows remote attackers to inject arbitrary web script
Matching passage: CVE-2015-0176. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in MQ XR WebSockets Listener in WMQ Telemetry in IBM WebSphere MQ 8.0 before 8.0.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URI that is included in an error response.
Near-miss passage: CVE-2015-6584. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unit_testing/templates/6776.php.
Query: exploit Open redirect vulnerability in CMSPages/GetDocLink.ashx in Kentico CMS 8.2 through 8.2.41 allows remote attackers to redirect users to arbitrary web sites and conduct phishing atta
Matching passage: CVE-2015-7823. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in CMSPages/GetDocLink.ashx in Kentico CMS 8.2 through 8.2.41 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the link parameter.
Near-miss passage: CVE-2015-3636. CWE: UNKNOWN. CVSS: 4.900000095367432. The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect.
Query: Sigma YAML for azure / auditlogs
Matching passage: Sigma rule: Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Prope. Logsource: azure / auditlogs. Rule: title: CA Policy Updated by Non Approved Actor id: 50a3c7aa-ec29-44a4-92c1-fce229eef6fc status: test description: Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access author: Corissa Koopmans, '@corissalea' date: 2022-07-19 modified: 2024-05-28 tags: - attack.privilege-escalation - attack.credential-access - attack.persistence - attack.defense-impairment - attack.t1548 - attack.t1556 logsource: product: azure service: auditlogs detection: selection: properties.message: Update conditional access policy condition: selection falsepositives: - Misconfigured role permissions - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. level: medium
Near-miss passage: Sigma rule: Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode. Logsource: windows / system. Rule: title: Local Privilege Escalation Indicator TabTip id: bc2e25ed-b92b-4daa-b074-b502bdd1982b status: test description: Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode references: - https://github.com/antonioCoco/JuicyPotatoNG author: Florian Roth (Nextron Systems) date: 2022-10-07 modified: 2023-04-14 tags: - attack.collection - attack.execution - attack.credential-access - attack.t1557.001 logsource: product: windows service: system detection: selection: Provider_Name: Microsoft-Windows-DistributedCOM EventID: 10001 param1: C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe param2: 2147943140 param3: '{054AAE20-4BEA-4347-8A35-64A533254A9D}' condition: selection falsepositives: - Unknown level: high
Query: write Sigma for An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm
Matching passage: Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / process_creation. Rule: title: Remote Access Tool - LogMeIn Execution id: d85873ef-a0f8-4c48-a53a-6b621f11729d status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-3---logmein-files-detected-test-on-windows author: frack113 date: 2022-02-11 modified: 2023-03-05 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: - Description: LMIGuardianSvc - Product: LMIGuardianSvc - Company: LogMeIn, Inc. condition: selection falsepositives: - Legitimate use level: medium
Near-miss passage: Sigma rule: Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.. Logsource: windows / process_creation. Rule: title: Potential DLL File Download Via PowerShell Invoke-WebRequest id: 0f0450f3-8b47-441e-a31b-15a91dc243e2 status: test description: Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets. references: - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution author: Florian Roth (Nextron Systems), Hieu Tran date: 2023-03-13 modified: 2025-07-18 tags: - attack.command-and-control - attack.execution - attack.t1059.001 - attack.t1105 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - 'Invoke-RestMethod ' - 'Invoke-WebRequest ' - 'IRM ' - 'IWR ' CommandLine|contains|all: - http - OutFile - .dll condition: selection falsepositives: - Unknown level: medium
Query: describe CVE-2015-2776
Matching passage: CVE-2015-2776. CWE: CWE-20. CVSS: 4.300000190734863. The parse_SST function in FreeXL before 1.0.0i allows remote attackers to cause a denial of service (memory consumption) via a crafted shared strings table in a workbook.
Near-miss passage: CVE-2015-8562. CWE: CWE-20. CVSS: 7.5. Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015.
Query: secure coding against Use of Client-Side Authentication
Matching passage: CWE-603 Use of Client-Side Authentication. A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.
Near-miss passage: CWE-511 Logic/Time Bomb. The product contains code that is designed to disrupt the legitimate operation of the product (or its environment) when a certain time passes, or when a certain logical condition is met.
Query: patch priority for CVE-2015-1433
Matching passage: CVE-2015-1433. CWE: CWE-79. CVSS: 4.300000190734863. program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email.
Near-miss passage: CVE-2015-7360. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface (WebUI) in Fortinet FortiSandbox before 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) serial parameter to alerts/summary/profile/; the (2) urlForCreatingReport parameter to csearch/report/export/; the (3) id parameter to analysis/detail/download/screenshot; or vectors related to (4) "Fortiview threats by users search filtered by vdom" or (5) "PCAP file download generated by the VM scan feature."
Query: exploit The ISDN implementation in Cisco IOS 15.3S allows remote attackers to cause a denial of service (device reload) via malformed Q931 SETUP messages, aka Bug ID CSCut37890.
Matching passage: CVE-2015-0731. CWE: CWE-399. CVSS: 6.099999904632568. The ISDN implementation in Cisco IOS 15.3S allows remote attackers to cause a denial of service (device reload) via malformed Q931 SETUP messages, aka Bug ID CSCut37890.
Near-miss passage: CVE-2015-1886. CWE: CWE-399. CVSS: 7.800000190734863. The Remote Document Conversion Service (DCS) in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF16, and 8.5.0 through CF05 allows remote attackers to cause a denial of service (memory consumption) via crafted requests.
Query: exploit The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by lib
Matching passage: CVE-2015-1547. CWE: CWE-119. CVSS: 6.5. The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff5.tif.
Near-miss passage: CVE-2015-3746. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Query: detection rule: Detects potential DLL sideloading of "edputil.dll"
Matching passage: Sigma rule: Detects potential DLL sideloading of "edputil.dll". Logsource: windows / image_load. Rule: title: Potential Edputil.DLL Sideloading id: e4903324-1a10-4ed3-981b-f6fe3be3a2c2 status: test description: Detects potential DLL sideloading of "edputil.dll" references: - https://alternativeto.net/news/2023/5/cybercriminals-use-wordpad-vulnerability-to-spread-qbot-malware/ author: X__Junior (Nextron Systems) date: 2023-06-09 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \edputil.dll filter_main_generic: ImageLoaded|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects when an Policy Rule is Modified or Deleted.. Logsource: okta / okta. Rule: title: Okta Policy Rule Modified or Deleted id: 0c97c1d3-4057-45c9-b148-1de94b631931 status: test description: Detects when an Policy Rule is Modified or Deleted. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-12 modified: 2026-04-27 tags: - attack.impact logsource: product: okta service: okta detection: selection: eventType: - policy.rule.update - policy.rule.delete condition: selection falsepositives: - Unknown level: medium
Query: risk of telnetd in Cisco IOS XR 5.0.1 on Network Convergence System 6000 devices allows remote attackers to cause a denial of service (device reload) via a malformed TELNET packet, aka Bug
Matching passage: CVE-2015-0776. CWE: CWE-399. CVSS: 5.0. telnetd in Cisco IOS XR 5.0.1 on Network Convergence System 6000 devices allows remote attackers to cause a denial of service (device reload) via a malformed TELNET packet, aka Bug ID CSCuq31566.
Near-miss passage: CVE-2015-8877. CWE: CWE-399. CVSS: 7.5. The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function.
Query: patch priority for CVE-2015-4068
Matching passage: CVE-2015-4068. CWE: CWE-22. CVSS: 9.100000381469727. Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denial of service via a crafted file path to the (1) reportFileServlet or (2) exportServlet servlet.
Near-miss passage: CVE-2015-1386. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in unshield 1.0-1.
Query: describe CVE-2015-1854
Matching passage: CVE-2015-1854. CWE: CWE-284. CVSS: 7.5. 389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call.
Near-miss passage: CVE-2015-1763. CWE: CWE-284. CVSS: 8.5. Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014 does not prevent use of uninitialized memory in certain attempts to execute virtual functions, which allows remote authenticated users to execute arbitrary code via a crafted query, aka "SQL Server Remote Code Execution Vulnerability."
Query: incident response steps for SIEM correlation: persistence activity consistent with Implant Internal Image
Matching passage: Playbook for T1525 Implant Internal Image. 1) Validate alert telemetry against T1525. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: persistence. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may implant cloud or container images with malicious code to establish persistence after gaining access to an environment. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be implanted or backdoored. Unlike [Upload Malware](https://attack.mitre.org/techniques/T1608/001),
Near-miss passage: Playbook for T1078.002 Domain Accounts. Different response path focused on stealth, persistence, privilege escalation, initial access.