alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: ATT&CK technique for Cloud Account
Matching passage: T1087.004 Cloud Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. With authenticated access there are several tools that can be used to find accounts. The <code>Get-MsolRoleMember</code> PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365.(Citation: Microsoft msolrolemember)(Citation: GitHub Raindance) The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command <code>az ad user list</code> will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018) The AWS command <code>aws iam list-users</code> may be used to obtain a list of users in the current account while <code>aws iam list-roles</code> can obtain IAM roles that have a specified path prefix.(Citation: AWS List Roles)(Citation: AWS List Users) In GCP, <code>gcloud iam service-accounts list</code> and <code>gcloud projects get-iam-policy</code> may be used to obtain a listing of service accounts and users in a project.(Citation: Google Cloud - IAM Servie Accounts List API)
Near-miss passage: T1087.001 Local Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. Commands such as <code>net user</code> and <code>net localgroup</code> of the [Net](https://attack.mitre.org/software/S0039) utility and <code>id</code> and <code>groups</code> on macOS and Linux can list local users and groups.(Citation: Mandiant APT1)(Citation: id man page)(Citation: groups man page) On Linux, local users can also be enumerated through the use of the <code>/etc/passwd</code> file. On macOS, the <code>dscl . list /Users</code> command can be used to enumerate local accounts. On ESXi servers, the `esxcli system account list` command can list local user accounts.(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)
Query: risk of In all Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall.
Matching passage: CVE-2015-9072. CWE: CWE-476. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall.
Near-miss passage: CVE-2015-8922. CWE: CWE-476. CVSS: 5.5. The read_CodersInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted 7z file, related to the _7z_folder struct.
Query: detect Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles in logs
Matching passage: Sigma rule: Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles. Logsource: windows / process_access. Rule: title: HackTool - HandleKatz Duplicating LSASS Handle id: b1bd3a59-c1fd-4860-9f40-4dd161a7d1f5 status: test description: Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles references: - https://github.com/codewhitesec/HandleKatz author: Bhabesh Raj (rule), @thefLinkk date: 2022-06-27 modified: 2023-11-28 tags: - attack.execution - attack.t1106 - attack.t1003.001 - attack.credential-access logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe GrantedAccess: '0x1440' CallTrace|startswith: C:\Windows\System32\ntdll.dll+ CallTrace|contains: '|UNKNOWN(' CallTrace|endswith: ) condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of PowerShell to identify the current logged user.. Logsource: windows / ps_script. Rule: title: Suspicious PowerShell Get Current User id: 4096a49c-7de4-4da0-a230-c66ccd56ea5a status: test description: Detects the use of PowerShell to identify the current logged user. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md#atomic-test-4---user-discovery-with-env-vars-powershell-script - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md#atomic-test-5---getcurrent-user-with-powershell-script author: frack113 date: 2022-04-04 tags: - attack.discovery - attack.t1033 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - '[System.Environment]::UserName' - $env:UserName - '[System.Security.Principal.WindowsIdentity]::GetCurrent()' condition: selection falsepositives: - Legitimate PowerShell scripts level: low
Query: Sigma rule for Detects the creation of a schtask that executes a file from C:\Users\<USER>\AppData\Local
Matching passage: Sigma rule: Detects the creation of a schtask that executes a file from C:\Users\<USER>\AppData\Local. Logsource: windows / process_creation. Rule: title: Suspicious Schtasks Execution AppData Folder id: c5c00f49-b3f9-45a6-997e-cfdecc6e1967 status: test description: Detects the creation of a schtask that executes a file from C:\Users\<USER>\AppData\Local references: - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/ author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-03-15 modified: 2022-07-28 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.005 - attack.t1059.001 logsource: product: windows category: process_creation detection: selection: Image|endswith: \schtasks.exe CommandLine|contains|all: - /Create - /RU - /TR - C:\Users\ - \AppData\Local\ CommandLine|contains: - NT AUT - ' SYSTEM ' filter: ParentImage|contains|all: - \AppData\Local\Temp\ - TeamViewer_.exe Image|endswith: \schtasks.exe CommandLine|contains: /TN TVInstallRestore condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of files with scripting or executable extensions by Mysql daemon. Which could be an indicator of "U. Logsource: windows / file_event. Rule: title: Uncommon File Creation By Mysql Daemon Process id: c61daa90-3c1e-4f18-af62-8f288b5c9aaf status: test description: 'Detects the creation of files with scripting or executable extensions by Mysql daemon. Which could be an indicator of "User Defined Functions" abuse to download malware. ' references: - https://asec.ahnlab.com/en/58878/ - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-recon-mysql-malware-infection-via-user-defined-functions-udf/ author: Joseph Kamau date: 2024-05-27 tags: - attack.stealth logsource: product: windows category: file_event detection: selection: Image|endswith: - \mysqld.exe - \mysqld-nt.exe TargetFilename|endswith: - .bat - .dat - .dll - .exe - .ps1 - .psm1 - .vbe - .vbs condition: selection falsepositives: - Unknown level: high
Query: vulnerability: Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allows remote attackers to cause a denial of service (recursion and performance degradation) via crafted encr
Matching passage: CVE-2015-1672. CWE: CWE-310. CVSS: 5.0. Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allows remote attackers to cause a denial of service (recursion and performance degradation) via crafted encrypted data in an XML document, aka ".NET XML Decryption Denial of Service Vulnerability."
Near-miss passage: CVE-2015-1934. CWE: CWE-310. CVSS: 5.0. IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX002, and 7.6.0 before 7.6.0.1 IFIX001; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX002 and 7.6.0 before 7.6.0.1 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products do not properly encrypt passwords, which makes it easier for context-dependent attackers to determine cleartext passwords by leveraging access to a password file.
Query: risk of Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allows remote attackers to inject arbitrary web scr
Matching passage: CVE-2015-7377. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the invitaion_code parameter in a pie-register page to the default URI.
Near-miss passage: CVE-2015-3384. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Bank Account Listing Page in the Commerce Balanced Payments module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Query: detect Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address in logs
Matching passage: Sigma rule: Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address. Logsource: m365 / threat_management. Rule: title: Logon from a Risky IP Address id: c191e2fa-f9d6-4ccf-82af-4f2aba08359f status: test description: Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address. references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: Austin Songer @austinsonger date: 2021-08-23 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: Log on from a risky IP address status: success condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects blocked load attempts of revoked drivers. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Blocked Driver Load With Revoked Certificate id: 9b72b82d-f1c5-4632-b589-187159bc6ec1 status: test description: Detects blocked load attempts of revoked drivers references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-06 tags: - attack.persistence - attack.privilege-escalation - attack.t1543 logsource: product: windows service: codeintegrity-operational detection: selection: EventID: 3023 condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-3128
Matching passage: CVE-2015-3128. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
Near-miss passage: CVE-2015-6763. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google Chrome before 46.0.2490.71 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Query: CVE similar to CVE-2015-6367
Matching passage: CVE-2015-6367. CWE: CWE-399. CVSS: 7.800000190734863. Cisco Aironet 1800 devices with software 8.1(131.0) allow remote attackers to cause a denial of service (CPU consumption) by improperly establishing many SSHv2 connections, aka Bug ID CSCux13374.
Near-miss passage: CVE-2015-0031. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0022, CVE-2015-0026, CVE-2015-0030, CVE-2015-0036, and CVE-2015-0041.
Query: describe CVE-2015-3238
Matching passage: CVE-2015-3238. CWE: CWE-200. CVSS: 6.5. The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service (hang) via a large password.
Near-miss passage: CVE-2015-1009. CWE: CWE-200. CVSS: 1.7000000476837158. Schneider Electric InduSoft Web Studio before 7.1.3.5 Patch 5 and Wonderware InTouch Machine Edition through 7.1 SP3 Patch 4 use cleartext for project-window password storage, which allows local users to obtain sensitive information by reading a file.
Query: exploit Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memo
Matching passage: CVE-2015-6141. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6134.
Near-miss passage: CVE-2015-7941. CWE: CWE-119. CVSS: 4.300000190734863. libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities.
Query: detection rule: Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and ma
Matching passage: Sigma rule: Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and ma. Logsource: velocity / application. Rule: title: Potential Server Side Template Injection In Velocity id: 16c86189-b556-4ee8-b4c7-7e350a195a4f status: test description: Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE. references: - https://antgarsil.github.io/posts/velocity/ - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs author: Moti Harmats date: 2023-02-11 tags: - attack.initial-access - attack.t1190 logsource: category: application product: velocity definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)' detection: keywords: - ParseErrorException - VelocityException - TemplateInitException condition: keywords falsepositives: - Application bugs - Missing .vm files level: high
Near-miss passage: Sigma rule: Detects usage of cmdkey to look for cached credentials on the system. Logsource: windows / process_creation. Rule: title: Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE id: 07f8bdc2-c9b3-472a-9817-5a670b872f53 status: test description: Detects usage of cmdkey to look for cached credentials on the system references: - https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation - https://technet.microsoft.com/en-us/library/cc754243(v=ws.11).aspx - https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1003.005/T1003.005.md#atomic-test-1---cached-credential-dump-via-cmdkey author: jmallette, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2019-01-16 modified: 2024-03-05 tags: - attack.credential-access - attack.t1003.005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmdkey.exe - OriginalFileName: cmdkey.exe selection_cli: CommandLine|contains|windash: ' -l' condition: all of selection* falsepositives: - Legitimate administrative tasks level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmdkey_recon/info.yml simulation: - type: atomic-red-team name: Cached Credential Dump via Cmdkey technique: T1003.005 atomic_guid: 56506854-89d6-46a3-9804-b7fde90791f9
Query: ATT&CK technique for Malicious Link
Matching passage: T1204.001 Malicious Link. Tactics: execution. Description: An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002). Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203). Links may also lead users to download files that require execution via [Malicious File](https://attack.mitre.org/techniques/T1204/002).
Near-miss passage: T1204.004 Malicious Copy and Paste. Tactics: execution. Description: An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). One such strategy is "ClickFix," in which adversaries present users with seemingly helpful solutions—such as prompts to fix errors or complete CAPTCHAs—that instead instruct the user to copy and paste malicious code. Malicious websites, such as those used in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), may present fake error messages or CAPTCHA prompts that instruct users to open a terminal or the Windows Run Dialog box and execute an arbitrary command. These commands may be obfuscated using encoding or other techniques to conceal malicious intent. Once executed, the adversary will typically be able to establish a foothold on the victim's machine.(Citation: CloudSEK Lumma Stealer 2024)(Citation: Sekoia ClickFake 2025)(Citation: Reliaquest CAPTCHA 2024)(Citation: AhnLab LummaC2 2025) Adversaries may also leverage phishing emails for this purpose. When a user attempts to open an attachment, they may be presented with a fake error and offered a malicious command to paste as a solution, consistent with the "ClickFix" strategy.(Citation: Proofpoint ClickFix 2024)(Citation: AhnLab Malicioys Copy Paste 2024) Tricking a user into executing a command themselves may help to bypass email filtering, browser sandboxing, or other mitigations designed to protect users against malicious downloaded files.
Query: CVE similar to CVE-2015-1711
Matching passage: CVE-2015-1711. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1658, CVE-2015-1706, CVE-2015-1717, and CVE-2015-1718.
Near-miss passage: CVE-2015-3696. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3700, CVE-2015-3701, and CVE-2015-3702.
Query: common weakness: Unverified Password Change
Matching passage: CWE-620 Unverified Password Change. When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
Near-miss passage: CWE-203 Observable Discrepancy. The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Query: actor TTPs: Cloud Services
Matching passage: T1021.007 Cloud Services. Tactics: lateral movement. Description: Adversaries may log into accessible cloud services within a compromised environment using [Valid Accounts](https://attack.mitre.org/techniques/T1078) that are synchronized with or federated to on-premises user identities. The adversary may then perform management actions or access cloud-hosted resources as the logged-on user. Many enterprises federate centrally managed user identities to cloud services, allowing users to login with their domain credentials in order to access the cloud control plane. Similarly, adversaries may connect to available cloud services through the web console or through the cloud command line interface (CLI) (e.g., [Cloud API](https://attack.mitre.org/techniques/T1059/009)), using commands such as <code>Connect-AZAccount</code> for Azure PowerShell, <code>Connect-MgGraph</code> for Microsoft Graph PowerShell, and <code>gcloud auth login</code> for the Google Cloud CLI. In some cases, adversaries may be able to authenticate to these services via [Application Access Token](https://attack.mitre.org/techniques/T1550/001) instead of a username and password.
Near-miss passage: T1021.005 VNC. Tactics: lateral movement. Description: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely control machines using Virtual Network Computing (VNC). VNC is a platform-independent desktop sharing system that uses the RFB (“remote framebuffer”) protocol to enable users to remotely control another computer’s display by relaying the screen, mouse, and keyboard inputs over the network.(Citation: The Remote Framebuffer Protocol) VNC differs from [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) as VNC is screen-sharing software rather than resource-sharing software. By default, VNC uses the system's authentication, but it can be configured to use credentials specific to VNC.(Citation: MacOS VNC software for Remote Desktop)(Citation: VNC Authentication) Adversaries may abuse VNC to perform malicious actions as the logged-on user such as opening documents, downloading files, and running arbitrary commands. An adversary could use VNC to remotely control and monitor a system to collect data and information to pivot to other systems within the network. Specific VNC libraries/implementations have also been susceptible to brute force attacks and memory usage exploitation.(Citation: Hijacking VNC)(Citation: macOS root VNC login without authentication)(Citation: VNC Vulnerabilities)(Citation: Offensive Security VNC Authentication Check)(Citation: Attacking VNC Servers PentestLab)(Citation: Havana authentication bug)
Query: vulnerability: The Hostscan module in Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to write to arbitrary files via crafted IPC messages, aka Bug ID CSCus7917
Matching passage: CVE-2015-0665. CWE: CWE-22. CVSS: 6.599999904632568. The Hostscan module in Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to write to arbitrary files via crafted IPC messages, aka Bug ID CSCus79173.
Near-miss passage: CVE-2015-1192. CWE: CWE-22. CVSS: 5.0. Absolute path traversal vulnerability in kgb 1.0b4 allows remote attackers to write to arbitrary files via a full pathname in a crafted archive.