alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Outbound C2 pattern associated with Tool
Matching passage: T1588.002 Tool. Tactics: resource development. Description: Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). Adversaries may obtain tools to support their operations, including to support execution of post-compromise behaviors. Tools may also be leveraged for testing – for example, evaluating malware against commercial antivirus or endpoint detection and response (EDR) applications.(Citation: Forescout Conti Leaks 2022)(Citation: Sentinel Labs Top Tier Target 2025) Tool acquisition may involve the procurement of commercial software licenses, including for red teaming tools such as Cobalt Strike. In addition to freely downloading or purchasing software, adversaries may steal software and/or software licenses from third-party entities (including other adversaries). Threat actors may also crack trial versions of software.(Citation: Recorded Future Beacon 2019)
Near-miss passage: T1588 Obtain Capabilities. Tactics: resource development. Description: Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle. In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals.(Citation: NationsBuying)(Citation: PegasusCitizenLab) In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.(Citation: DiginotarCompromise)
Query: patch priority for CVE-2015-6535
Matching passage: CVE-2015-6535. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remote administrators to inject arbitrary web script or HTML via the Profile name field (youtube_embed_name parameter).
Near-miss passage: CVE-2015-4366. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Mover module 6.x-1.0 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Query: Lateral movement indicators for Weaken Encryption
Matching passage: T1600 Weaken Encryption. Tactics: defense impairment. Description: Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications.(Citation: Cisco Synful Knock Evolution) Encryption can be used to protect transmitted network traffic to maintain its confidentiality (protect against unauthorized disclosure) and integrity (protect against unauthorized changes). Encryption ciphers are used to convert a plaintext message to ciphertext and can be computationally intensive to decipher without the associated decryption key. Typically, longer keys increase the cost of cryptanalysis, or decryption without the key. Adversaries can compromise and manipulate devices that perform encryption of network traffic. For example, through behaviors such as [Modify System Image](https://attack.mitre.org/techniques/T1601), [Reduce Key Space](https://attack.mitre.org/techniques/T1600/001), and [Disable Crypto Hardware](https://attack.mitre.org/techniques/T1600/002), an adversary can negatively effect and/or eliminate a device’s ability to securely encrypt network traffic. This poses a greater risk of unauthorized disclosure and may help facilitate data manipulation, Credential Access, or Collection efforts.(Citation: Cisco Blog Legacy Device Attacks)
Near-miss passage: T1600.002 Disable Crypto Hardware. Tactics: defense impairment. Description: Adversaries disable a network device’s dedicated hardware encryption, which may enable them to leverage weaknesses in software encryption in order to reduce the effort involved in collecting, manipulating, and exfiltrating transmitted data. Many network devices such as routers, switches, and firewalls, perform encryption on network traffic to secure transmission across networks. Often, these devices are equipped with special, dedicated encryption hardware to greatly increase the speed of the encryption process as well as to prevent malicious tampering. When an adversary takes control of such a device, they may disable the dedicated hardware, for example, through use of [Modify System Image](https://attack.mitre.org/techniques/T1601), forcing the use of software to perform encryption on general processors. This is typically used in conjunction with attacks to weaken the strength of the cipher in software (e.g., [Reduce Key Space](https://attack.mitre.org/techniques/T1600/001)). (Citation: Cisco Blog Legacy Device Attacks)
Query: detection rule: Enumerates Active Directory to determine computers that are joined to the domain
Matching passage: Sigma rule: Enumerates Active Directory to determine computers that are joined to the domain. Logsource: windows / ps_script. Rule: title: DirectorySearcher Powershell Exploitation id: 1f6399cf-2c80-4924-ace1-6fcff3393480 status: test description: Enumerates Active Directory to determine computers that are joined to the domain references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md#atomic-test-15---enumerate-domain-computers-within-active-directory-using-directorysearcher author: frack113 date: 2022-02-12 tags: - attack.discovery - attack.t1018 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'New-Object ' - System.DirectoryServices.DirectorySearcher - .PropertiesToLoad.Add - .findall() - Properties.name condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation att. Logsource: nginx. Rule: title: Nginx Core Dump id: 59ec40bb-322e-40ab-808d-84fa690d7e56 status: test description: Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts. references: - https://docs.nginx.com/nginx/admin-guide/monitoring/debugging/#enabling-core-dumps - https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/ author: Florian Roth (Nextron Systems) date: 2021-05-31 modified: 2023-05-08 tags: - attack.impact - attack.t1499.004 logsource: service: nginx detection: keywords: - exited on signal 6 (core dumped) condition: keywords falsepositives: - Serious issues with a configuration or plugin level: high
Query: exploit Multiple buffer overflows in iCloud Keychain in Apple iOS before 8.2 and Apple OS X through 10.10.2 allow man-in-the-middle attackers to execute arbitrary code by modifying the cli
Matching passage: CVE-2015-1065. CWE: CWE-119. CVSS: 5.400000095367432. Multiple buffer overflows in iCloud Keychain in Apple iOS before 8.2 and Apple OS X through 10.10.2 allow man-in-the-middle attackers to execute arbitrary code by modifying the client-server data stream during keychain recovery.
Near-miss passage: CVE-2015-2153. CWE: CWE-119. CVSS: 5.0. The rpki_rtr_pdu_print function in print-rpki-rtr.c in the TCP printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via a crafted header length in an RPKI-RTR Protocol Data Unit (PDU).
Query: patch priority for CVE-2015-0626
Matching passage: CVE-2015-0626. CWE: CWE-20. CVSS: 4.300000190734863. The SOAP interface in Cisco Hosted Collaboration Solution (HCS) allows remote attackers to obtain access to system-management tools via crafted Challenge SOAP calls, aka Bug ID CSCuc38114.
Near-miss passage: CVE-2015-7855. CWE: CWE-20. CVSS: 6.5. The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode 7 packet containing a long data value.
Query: Sigma rule for Detects backup catalog deletions
Matching passage: Sigma rule: Detects backup catalog deletions. Logsource: windows / application. Rule: title: Backup Catalog Deleted id: 9703792d-fd9a-456d-a672-ff92efe4806a status: test description: Detects backup catalog deletions references: - https://technet.microsoft.com/en-us/library/cc742154(v=ws.11).aspx - https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100 author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection) date: 2017-05-12 modified: 2022-12-25 tags: - attack.stealth - attack.t1070.004 logsource: product: windows service: application detection: selection: EventID: 524 Provider_Name: Microsoft-Windows-Backup condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious malformed user agent strings in proxy logs. Logsource: proxy. Rule: title: Suspicious User Agent id: 7195a772-4b3f-43a4-a210-6a003d65caa1 status: test description: Detects suspicious malformed user agent strings in proxy logs references: - https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb author: Florian Roth (Nextron Systems) date: 2017-07-08 modified: 2022-10-31 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection1: c-useragent|startswith: - user-agent - 'Mozilla/3.0 ' - 'Mozilla/2.0 ' - 'Mozilla/1.0 ' - 'Mozilla ' - ' Mozilla/' - Mozila/ - Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol selection2: c-useragent|contains: - ' (compatible;MSIE ' - '.0;Windows NT ' - loader selection3: c-useragent: - _ - CertUtil URL Agent - Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0) - Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 - HTTPS - Erbium-UA-4ce7c27cb4be9d32e333bf032c88235a - x - xxx falsepositives: - c-useragent: Mozilla/3.0 * Acrobat * - cs-host|endswith: - .acrobat.com - .adobe.com - .adobe.io condition: 1 of selection* and not falsepositives falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-0881
Matching passage: CVE-2015-0881. CWE: UNKNOWN. CVSS: 4.300000190734863. CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a response.
Near-miss passage: CVE-2015-4371. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the Perfecto module before 7.x-1.2 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in an unspecified parameter.
Query: CWE for Excessive Data Query Operations in a Large Data Table
Matching passage: CWE-1049 Excessive Data Query Operations in a Large Data Table. The product performs a data query with a large number of joins and sub-queries on a large data table.
Near-miss passage: CWE-920 Improper Restriction of Power Consumption. The product operates in an environment in which power is a limited resource that cannot be automatically replenished, but the product does not properly restrict the amount of power that its operation consumes.
Query: risk of The xenmem_add_to_physmap_one function in arch/arm/mm.c in Xen 4.5.x, 4.4.x, and earlier does not limit the number of printk console messages when reporting a failure to retrieve a
Matching passage: CVE-2015-6654. CWE: CWE-264. CVSS: 2.0999999046325684. The xenmem_add_to_physmap_one function in arch/arm/mm.c in Xen 4.5.x, 4.4.x, and earlier does not limit the number of printk console messages when reporting a failure to retrieve a reference on a foreign page, which allows remote domains to cause a denial of service by leveraging permissions to map the memory of a foreign guest.
Near-miss passage: CVE-2015-5736. CWE: CWE-264. CVSS: 7.199999809265137. The Fortishield.sys driver in Fortinet FortiClient before 5.2.4 allows local users to execute arbitrary code with kernel privileges by setting the callback function in a (1) 0x220024 or (2) 0x220028 ioctl call.
Query: exploit Multiple cross-site scripting (XSS) vulnerabilities in the Google Analyticator plugin before 6.4.9.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via
Matching passage: CVE-2015-6238. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the Google Analyticator plugin before 6.4.9.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) ga_adsense, (2) ga_admin_disable_DimentionIndex, (3) ga_downloads_prefix, (4) ga_downloads, or (5) ga_outbound_prefix parameter in the google-analyticator page to wp-admin/admin.php.
Near-miss passage: CVE-2015-8233. CWE: CWE-79. CVSS: 2.5999999046325684. Cross-site scripting (XSS) vulnerability in the MAYO theme 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.6 for Drupal allows remote administrators with the "Administer themes" permission to inject arbitrary web script or HTML via unspecified vectors related to theme settings.
Query: vulnerability: Red Hat OpenShift Enterprise 3.0.0.0 does not properly check permissions, which allows remote authenticated users with build permissions to execute arbitrary shell commands with ro
Matching passage: CVE-2015-5222. CWE: CWE-264. CVSS: 8.5. Red Hat OpenShift Enterprise 3.0.0.0 does not properly check permissions, which allows remote authenticated users with build permissions to execute arbitrary shell commands with root permissions on arbitrary build pods via unspecified vectors.
Near-miss passage: CVE-2015-8965. CWE: CWE-264. CVSS: 9.800000190734863. Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the classpath, such as test code or administration code. The issue exists because the ilog.views.faces.IlvFacesController servlet in jviews-framework-all.jar does not require explicit configuration of servlets that can be called.
Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running. Logsource: windows / registry_set. Rule: title: Internet Explorer DisableFirstRunCustomize Enabled id: ab567429-1dfb-4674-b6d2-979fd2f9d125 status: test description: 'Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running the first run wizard the first time a user starts the browser after installing Internet Explorer or Windows. ' references: - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf - https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/ - https://admx.help/?Category=InternetExplorer&Policy=Microsoft.Policies.InternetExplorer::NoFirstRunCustomise author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-16 modified: 2025-10-07 tags: - attack.defense-impairment logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: \Microsoft\Internet Explorer\Main\DisableFirstRunCustomize Details: - DWORD (0x00000001) - DWORD (0x00000002) filter_main_generic: Image: - C:\Windows\explorer.exe - C:\Windows\System32\ie4uinit.exe filter_optional_avira: Image|contains|all: - \Temp\ - \.cr\avira_ Details|contains: DWORD (0x00000001) filter_optional_foxit: Image: - C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe - C:\Program Files\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe Details|contains: DWORD (0x00000001) condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - As this is controlled by group policy as well as user settings. Some false positives may occur. level: medium
Near-miss passage: Sigma rule: Detects the execution of the PurpleSharp adversary simulation tool. Logsource: windows / process_creation. Rule: title: HackTool - PurpleSharp Execution id: ff23ffbc-3378-435e-992f-0624dcf93ab4 status: test description: Detects the execution of the PurpleSharp adversary simulation tool references: - https://github.com/mvelazc0/PurpleSharp author: Florian Roth (Nextron Systems) date: 2021-06-18 modified: 2023-02-05 tags: - attack.t1587 - attack.resource-development logsource: category: process_creation product: windows detection: selection_img: - Image|contains: \purplesharp - OriginalFileName: PurpleSharp.exe selection_cli: CommandLine|contains: - xyz123456.exe - PurpleSharp condition: 1 of selection_* falsepositives: - Unlikely level: critical
Query: patch priority for CVE-2015-9196
Matching passage: CVE-2015-9196. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Small Cell SoC FSM9055, MDM9635M, SD 400, and SD 800, improper input validation in tzbsp_ocmem can cause privilege escalation.
Near-miss passage: CVE-2015-0650. CWE: CWE-20. CVSS: 7.800000190734863. The Service Discovery Gateway (aka mDNS Gateway) in Cisco IOS 12.2, 12.4, 15.0, 15.1, 15.2, 15.3, and 15.4 and IOS XE 3.9.xS and 3.10.xS before 3.10.4S, 3.11.xS before 3.11.3S, 3.12.xS before 3.12.2S, and 3.13.xS before 3.13.1S allows remote attackers to cause a denial of service (device reload) by sending malformed mDNS UDP packets over (1) IPv4 or (2) IPv6, aka Bug ID CSCup70579.
Query: patch priority for CVE-2015-4455
Matching passage: CVE-2015-4455. CWE: CWE-434. CVSS: 9.800000190734863. Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/gform_aviary.
Near-miss passage: CVE-2015-2780. CWE: CWE-434. CVSS: 9.800000190734863. Unrestricted file upload vulnerability in Berta CMS allows remote attackers to execute arbitrary code by uploading a crafted image file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.
Query: patch priority for CVE-2015-3769
Matching passage: CVE-2015-3769. CWE: CWE-119. CVSS: 7.199999809265137. IOFireWireFamily in Apple OS X before 10.10.5 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3771 and CVE-2015-3772.
Near-miss passage: CVE-2015-7500. CWE: CWE-119. CVSS: 5.0. The xmlParseMisc function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via unspecified vectors related to incorrect entities boundaries and start tags.
Query: adversary uses Mail Protocols
Matching passage: T1071.003 Mail Protocols. Tactics: command and control. Description: Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as SMTP/S, POP3/S, and IMAP that carry electronic mail may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the email messages themselves. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: FireEye APT28)
Near-miss passage: T1071.004 DNS. Tactics: command and control. Description: Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. The DNS protocol serves an administrative function in computer networking and thus may be very common in environments. DNS traffic may also be allowed even before network authentication is completed. DNS packets contain many fields and headers in which data can be concealed. Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: PAN DNS Tunneling)(Citation: Medium DnsTunneling) DNS beaconing may be used to send commands to remote systems via DNS queries. A DNS beacon is created by tunneling DNS traffic (i.e. [Protocol Tunneling](https://attack.mitre.org/techniques/T1572)). The commands may be embedded into different DNS records, for example, TXT or A records.(Citation: OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government) DNS beacons may be difficult to detect because the beacons infrequently communicate with infected devices.(Citation: DNS Beacons) Infrequent communication conceals the malicious DNS traffic with normal DNS traffic.
Query: CVE similar to CVE-2015-2743
Matching passage: CVE-2015-2743. CWE: CWE-17. CVSS: 7.5. PDF.js in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 enables excessive privileges for internal Workers, which might allow remote attackers to execute arbitrary code by leveraging a Same Origin Policy bypass.
Near-miss passage: CVE-2015-5176. CWE: CWE-17. CVSS: 5.800000190734863. The PortletRequestDispatcher in PortletBridge, as used in Red Hat JBoss Portal 6.2.0, does not properly enforce the security constraints of servlets, which allows remote attackers to gain access to resources via a request that asks to render a non-JSF resource.