alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Sc
Matching passage: Sigma rule: Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Sc. Logsource: windows / ps_script. Rule: title: Windows Screen Capture with CopyFromScreen id: d4a11f63-2390-411c-9adf-d791fd152830 status: test description: 'Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md#atomic-test-6---windows-screen-capture-copyfromscreen author: frack113 date: 2021-12-28 modified: 2022-07-07 tags: - attack.collection - attack.t1113 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: .CopyFromScreen condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects Commandlet names from ShellIntel exploitation scripts.. Logsource: windows / ps_script. Rule: title: Malicious ShellIntel PowerShell Commandlets id: 402e1e1d-ad59-47b6-bf80-1ee44985b3a7 status: test description: Detects Commandlet names from ShellIntel exploitation scripts. references: - https://github.com/Shellntel/scripts/ author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems) date: 2021-08-09 modified: 2023-01-02 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Invoke-SMBAutoBrute - Invoke-GPOLinks - Invoke-Potato condition: selection falsepositives: - Unknown level: high
Query: risk of Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Mem
Matching passage: CVE-2015-6143. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6140, CVE-2015-6142, CVE-2015-6153, CVE-2015-6158, CVE-2015-6159, and CVE-2015-6160.
Near-miss passage: CVE-2015-0324. CWE: CWE-119. CVSS: 10.0. Buffer overflow in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Query: Persistence mechanism resembling Exploitation for Stealth
Matching passage: T1211 Exploitation for Stealth. Tactics: stealth. Description: Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components. Adversaries may exploit a system or application vulnerability to avoid detection while maintaining access within an environment. Exploitation occurs when an adversary leverages a programming flaw to execute code in a manner that minimizes visibility or blends in with legitimate activity. Rather than directly disabling defenses, adversaries may use exploitation to circumvent monitoring and logging mechanisms. This can include abusing vulnerabilities in logging pipelines, security tools, or cloud infrastructure to evade audit trails, suppress alerts, or operate without generating telemetry. Adversaries may identify these opportunities through prior reconnaissance or by performing discovery of security controls after initial access. In some cases, vulnerabilities in SaaS or public cloud environments may be exploited to evade logging, obscure activity, or deploy infrastructure that remains hidden from standard monitoring tools.(Citation: Bypassing CloudTrail in AWS Service Catalog)(Citation: GhostToken GCP flaw)
Near-miss passage: T1218.015 Electron Applications. Tactics: stealth. Description: Adversaries may abuse components of the Electron framework to execute malicious code. The Electron framework hosts many common applications such as Signal, Slack, and Microsoft Teams.(Citation: Electron 2) Originally developed by GitHub, Electron is a cross-platform desktop application development framework that employs web technologies like JavaScript, HTML, and CSS.(Citation: Electron 3) The Chromium engine is used to display web content and Node.js runs the backend code.(Citation: Electron 1) Due to the functional mechanics of Electron (such as allowing apps to run arbitrary commands), adversaries may also be able to perform malicious functions in the background potentially disguised as legitimate tools within the framework.(Citation: Electron 1) For example, the abuse of `teams.exe` and `chrome.exe` may allow adversaries to execute malicious commands as child processes of the legitimate application (e.g., `chrome.exe --disable-gpu-sandbox --gpu-launcher="C:\Windows\system32\cmd.exe /c calc.exe`).(Citation: Electron 6-8) Adversaries may also execute malicious content by planting malicious [JavaScript](https://attack.mitre.org/techniques/T1059/007) within Electron applications.(Citation: Electron Security)
Query: vulnerability: Audio in Apple OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, a different vulnerab
Matching passage: CVE-2015-5933. CWE: CWE-119. CVSS: 6.800000190734863. Audio in Apple OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, a different vulnerability than CVE-2015-5934.
Near-miss passage: CVE-2015-5843. CWE: CWE-119. CVSS: 7.199999809265137. IOMobileFrameBuffer in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
Query: exploit libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error respo
Matching passage: CVE-2015-2206. CWE: CWE-200. CVSS: 5.0. libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
Near-miss passage: CVE-2015-3690. CWE: CWE-200. CVSS: 4.300000190734863. The DiskImages subsystem in Apple iOS before 8.4 and OS X before 10.10.4 allows attackers to obtain sensitive memory-layout information for the kernel via a crafted app.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in 4images 1.7.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the cat_description parameter in an update
Matching passage: CVE-2015-7708. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in 4images 1.7.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the cat_description parameter in an updatecat action to admin/categories.php.
Near-miss passage: CVE-2015-3390. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Facebook Album Fetcher module for Drupal allows remote authenticated users with the "access administration pages" permission to inject arbitrary web script or HTML via unspecified vectors.
Query: risk of An issue was discovered on Samsung mobile devices with KK(4.4) and later software through 2015-05-13. There is a buffer overflow in datablock_write because the amount of received d
Matching passage: CVE-2015-5524. CWE: CWE-120. CVSS: 9.800000190734863. An issue was discovered on Samsung mobile devices with KK(4.4) and later software through 2015-05-13. There is a buffer overflow in datablock_write because the amount of received data is not validated. The Samsung ID is SVE-2015-4018 (December 2015).
Near-miss passage: CVE-2015-3717. CWE: CWE-120. CVSS: 7.5. Multiple buffer overflows in the printf functionality in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.
Query: patch priority for CVE-2015-8593
Matching passage: CVE-2015-8593. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in 1x call processing.
Near-miss passage: CVE-2015-3742. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Query: rule covering Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions.
Matching passage: Sigma rule: Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions.. Logsource: windows / file_event. Rule: title: Potential File Extension Spoofing Using Right-to-Left Override id: 979baf41-ca44-4540-9d0c-4fcef3b5a3a4 related: - id: ad691d92-15f2-4181-9aa4-723c74f9ddc3 type: derived status: test description: 'Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions. ' references: - https://redcanary.com/blog/right-to-left-override/ - https://www.malwarebytes.com/blog/news/2014/01/the-rtlo-method - https://tria.ge/241015-l98snsyeje/behavioral2 - https://www.unicode.org/versions/Unicode5.2.0/ch02.pdf author: Jonathan Peters (Nextron Systems), Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2024-11-17 modified: 2026-03-20 tags: - attack.execution - attack.stealth - attack.t1036.002 logsource: category: file_event product: windows detection: selection_rtlo_unicode: TargetFilename|contains: - \u202e - '[U+202E]' - ‮ selection_extensions: TargetFilename|contains: - 3pm. - 4pm. - cod. - fdp. - ftr. - gepj. - gnp. - gpj. - ism. - lmth. - nls. - piz. - slx. - tdo. - vsc. - vwm. - xcod. - xslx. - xtpp. condition: all of selection_* falsepositives: - Filenames that contains scriptures such as arabic or hebrew might make use of this character level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_right_to_left_override_extension_spoofing/info.yml
Near-miss passage: Sigma rule: Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files ha. Logsource: windows / process_creation. Rule: title: Hacktool Execution - PE Metadata id: 37c1333a-a0db-48be-b64b-7393b2386e3b status: test description: Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed references: - https://github.com/cube0x0 - https://www.virustotal.com/gui/search/metadata%253ACube0x0/files author: Florian Roth (Nextron Systems) date: 2022-04-27 modified: 2024-01-15 tags: - attack.credential-access - attack.resource-development - attack.t1588.002 - attack.t1003 logsource: category: process_creation product: windows detection: selection: Company: Cube0x0 condition: selection falsepositives: - Unlikely level: high
Query: describe CVE-2015-4452
Matching passage: CVE-2015-4452. CWE: UNKNOWN. CVSS: 9.300000190734863. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-4435, CVE-2015-4438, CVE-2015-4441, CVE-2015-4445, CVE-2015-4447, CVE-2015-4451, CVE-2015-5085, and CVE-2015-5086.
Near-miss passage: CVE-2015-0419. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Portal Framework, a different vulnerability than CVE-2013-1510.
Query: exploit The dgnc_mgmt_ioctl function in drivers/staging/dgnc/dgnc_mgmt.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to obtai
Matching passage: CVE-2015-7885. CWE: CWE-200. CVSS: 2.299999952316284. The dgnc_mgmt_ioctl function in drivers/staging/dgnc/dgnc_mgmt.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a crafted application.
Near-miss passage: CVE-2015-2214. CWE: CWE-200. CVSS: 5.0. NetCat 5.01 and earlier allows remote attackers to obtain the installation path via the redirect_url parameter to netshop/post.php.
Query: threat report mentioning Databases
Matching passage: T1213.006 Databases. Tactics: collection. Description: Adversaries may leverage databases to mine valuable information. These databases may be hosted on-premises or in the cloud (both in platform-as-a-service and software-as-a-service environments). Examples of databases from which information may be collected include MySQL, PostgreSQL, MongoDB, Amazon Relational Database Service, Azure SQL Database, Google Firebase, and Snowflake. Databases may include a variety of information of interest to adversaries, such as usernames, hashed passwords, personally identifiable information, and financial data. Data collected from databases may be used for [Lateral Movement](https://attack.mitre.org/tactics/TA0008), [Command and Control](https://attack.mitre.org/tactics/TA0011), or [Exfiltration](https://attack.mitre.org/tactics/TA0010). Data exfiltrated from databases may also be used to extort victims or may be sold for profit.(Citation: Google Cloud Threat Intelligence UNC5537 Snowflake 2024)
Near-miss passage: T1213.004 Customer Relationship Management Software. Tactics: collection. Description: Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable information. CRM software is used to assist organizations in tracking and managing customer interactions, as well as storing customer data. Once adversaries gain access to a victim organization, they may mine CRM software for customer data. This may include personally identifiable information (PII) such as full names, emails, phone numbers, and addresses, as well as additional details such as purchase histories and IT support interactions. By collecting this data, an adversary may be able to send personalized [Phishing](https://attack.mitre.org/techniques/T1566) emails, engage in SIM swapping, or otherwise target the organization’s customers in ways that enable financial gain or the compromise of additional organizations.(Citation: Bleeping Computer US Cellular Hack 2022)(Citation: Bleeping Computer Mint Mobile Hack 2021)(Citation: Bleeping Computer Bank Hack 2020) CRM software may be hosted on-premises or in the cloud. Information stored in these solutions may vary based on the specific instance or environment. Examples of CRM software include Microsoft Dynamics 365, Salesforce, Zoho, Zendesk, and HubSpot.
Query: patch priority for CVE-2015-2571
Matching passage: CVE-2015-2571. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer.
Near-miss passage: CVE-2015-0465. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, and 6.3.6 allows remote authenticated users to affect confidentiality via unknown vectors related to UI Infrastructure.
Query: ATT&CK technique for Source
Matching passage: T1153 Source. Tactics: execution. Description: **This technique has been deprecated and should no longer be used.** The <code>source</code> command loads functions into the current shell or executes files in the current context. This built-in command can be run in two different ways <code>source /path/to/filename [arguments]</code> or <code>.**This technique has been deprecated and should no longer be used.** /path/to/filename [arguments]</code>. Take note of the space after the ".". Without a space, a new shell is created that runs the program instead of running the program within the current context. This is often used to make certain features or functions available to a shell or to update a specific shell's environment.(Citation: Source Manual) Adversaries can abuse this functionality to execute programs. The file executed with this technique does not need to be marked executable beforehand.
Near-miss passage: T1053 Scheduled Task/Job. Tactics: execution, persistence, privilege escalation. Description: Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.(Citation: TechNet Task Scheduler Security) Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges). Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.(Citation: ProofPoint Serpent)
Query: exploit RLE Nova-Wind Turbine HMI devices store cleartext credentials, which allows remote attackers to obtain sensitive information via unspecified vectors.
Matching passage: CVE-2015-3951. CWE: CWE-200. CVSS: 5.0. RLE Nova-Wind Turbine HMI devices store cleartext credentials, which allows remote attackers to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-1618. CWE: CWE-200. CVSS: 4.0. The ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows remote authenticated users to obtain sensitive password information via a crafted URL.
Query: patch priority for CVE-2015-1697
Matching passage: CVE-2015-1697. CWE: CWE-94. CVSS: 9.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1675, CVE-2015-1695, CVE-2015-1696, CVE-2015-1698, and CVE-2015-1699.
Near-miss passage: CVE-2015-3446. CWE: CWE-94. CVSS: 9.300000190734863. The Framework Daemon in AlienVault Unified Security Management before 4.15 allows remote attackers to execute arbitrary Python code via a crafted plugin configuration file (.cfg).
Query: EDR alert: possible File Transfer Protocols (T1071.002)
Matching passage: T1071.002 File Transfer Protocols. Tactics: command and control. Description: Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as SMB(Citation: US-CERT TA18-074A), FTP(Citation: ESET Machete July 2019), FTPS, and TFTP that transfer files may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the transferred files. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.
Near-miss passage: T1071.003 Mail Protocols. Tactics: command and control. Description: Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as SMTP/S, POP3/S, and IMAP that carry electronic mail may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the email messages themselves. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: FireEye APT28)
Query: patch priority for CVE-2015-0653
Matching passage: CVE-2015-0653. CWE: CWE-287. CVSS: 10.0. The management interface in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway before X7.2.4, X8 before X8.1.2, and X8.2 before X8.2.2 and Cisco TelePresence Conductor before X2.3.1 and XC2.4 before XC2.4.1 allows remote attackers to bypass authentication via crafted login parameters, aka Bug IDs CSCur02680 and CSCur05556.
Near-miss passage: CVE-2015-2117. CWE: CWE-287. CVSS: 7.5. HP TippingPoint Security Management System (SMS) and TippingPoint Virtual Security Management System (vSMS) before 4.1 patch 3 and 4.2 before patch 1 do not require authentication for JBoss RMI requests, which allows remote attackers to execute arbitrary code by (1) uploading this code within an archive or (2) instantiating a class.
Query: vulnerability: Multiple cross-site request forgery (CSRF) vulnerabilities in Wing FTP Server before 4.4.7 allow remote attackers to hijack the authentication of administrators for requests that (
Matching passage: CVE-2015-4108. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Wing FTP Server before 4.4.7 allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary code via a crafted request to admin_lua_script.html or (2) add a domain administrator via a crafted request to admin_addadmin.html.
Near-miss passage: CVE-2015-7407. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in Lotus Mashups in IBM Mashup Center 3.0.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.