alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: ATT&CK technique for Domain Trust Discovery
Matching passage: T1482 Domain Trust Discovery. Tactics: discovery. Description: Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain.(Citation: Microsoft Trusts) Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct [SID-History Injection](https://attack.mitre.org/techniques/T1134/005), [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003), and [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).(Citation: AdSecurity Forging Trust Tickets)(Citation: Harmj0y Domain Trusts) Domain trusts can be enumerated using the `DSEnumerateDomainTrusts()` Win32 API call, .NET methods, and LDAP.(Citation: Harmj0y Domain Trusts) The Windows utility [Nltest](https://attack.mitre.org/software/S0359) is known to be used by adversaries to enumerate domain trusts.(Citation: Microsoft Operation Wilysupply)
Near-miss passage: T1619 Cloud Storage Object Discovery. Tactics: discovery. Description: Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage. Similar to [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) on a local host, after identifying available storage services (i.e. [Cloud Infrastructure Discovery](https://attack.mitre.org/techniques/T1580)) adversaries may access the contents/objects stored in cloud infrastructure. Cloud service providers offer APIs allowing users to enumerate objects stored within cloud storage. Examples include ListObjectsV2 in AWS (Citation: ListObjectsV2) and List Blobs in Azure(Citation: List Blobs) .
Query: risk of The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character, which might allow remote at
Matching passage: CVE-2015-4026. CWE: CWE-19. CVSS: 7.5. The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character, which might allow remote attackers to bypass intended extension restrictions and execute files with unexpected names via a crafted first argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.
Near-miss passage: CVE-2015-0613. CWE: CWE-19. CVSS: 7.099999904632568. The Connection Conversation Manager (aka CuCsMgr) process in Cisco Unity Connection 8.5 before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, 9.x before 9.1(2)SU2, and 10.0 before 10.0(1)SU1, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (core dump and restart) via crafted SIP INVITE messages, aka Bug ID CSCul20444.
Query: CVE similar to CVE-2015-6623
Matching passage: CVE-2015-6623. CWE: CWE-264. CVSS: 9.300000190734863. Wi-Fi in Android 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24872703.
Near-miss passage: CVE-2015-4331. CWE: CWE-264. CVSS: 3.5. Cisco Prime Infrastructure (PI) 1.4(0.45) and earlier, when AAA authentication is used, allows remote authenticated users to bypass intended access restrictions via a username with a modified composition of lowercase and uppercase characters, aka Bug ID CSum59958.
Query: patch priority for CVE-2015-6277
Matching passage: CVE-2015-6277. CWE: CWE-399. CVSS: 6.099999904632568. The ARP implementation in Cisco NX-OS on Nexus 1000V devices for VMware vSphere 5.2(1)SV3(1.4), Nexus 3000 devices 7.3(0)ZD(0.47), Nexus 4000 devices 4.1(2)E1, Nexus 9000 devices 7.3(0)ZD(0.61), and MDS 9000 devices 7.0(0)HSK(0.353) and SAN-OS NX-OS on MDS 9000 devices 7.0(0)HSK(0.353) allows remote attackers to cause a denial of service (ARP process restart) via crafted packet-header fields, aka Bug ID CSCut25292.
Near-miss passage: CVE-2015-2668. CWE: CWE-399. CVSS: 5.0. ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted xz archive file.
Query: patch priority for CVE-2015-2017
Matching passage: CVE-2015-2017. CWE: UNKNOWN. CVSS: 4.300000190734863. CRLF injection vulnerability in IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.8 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.
Near-miss passage: CVE-2015-3979. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary code via unknown vectors, aka SAP Security Note 2097534.
Query: patch priority for CVE-2015-2983
Matching passage: CVE-2015-2983. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in admin.php in PHP Kobo Photo Gallery CMS for PC, smartphone and feature phone 1.0.1 Free and earlier allows remote attackers to hijack the authentication of arbitrary users.
Near-miss passage: CVE-2015-9332. CWE: CWE-352. CVSS: 6.5. The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.
Query: patch priority for CVE-2015-1565
Matching passage: CVE-2015-1565. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the online help in Hitachi Device Manager, Tiered Storage Manager, Replication Manager, and Global Link Manager before 8.1.2-00, and Compute Systems Manager before 7.6.1-08 and 8.x before 8.1.2-00, as used in Hitachi Command Suite, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-6663. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Client form in the Device Inspector page in SAP Afaria 7 allows remote attackers to inject arbitrary web script or HTML via crafted client name data, aka SAP Security Note 2152669.
Query: common weakness: Exposure of Information Through Shell Error Message
Matching passage: CWE-535 Exposure of Information Through Shell Error Message. A command shell error message indicates that there exists an unhandled exception in the web application code. In many cases, an attacker can leverage the conditions that cause these errors in order to gain unauthorized access to the system.
Near-miss passage: CWE-439 Behavioral Change in New Version or Environment. A's behavior or functionality changes with a new version of A, or a new environment, which is not known (or manageable) by B.
Query: detection rule: Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes
Matching passage: Sigma rule: Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes. Logsource: windows / dns_query. Rule: title: DNS Query for Anonfiles.com Domain - Sysmon id: 065cceea-77ec-4030-9052-fc0affea7110 related: - id: 29f171d7-aa47-42c7-9c7b-3c87938164d9 type: similar status: test description: Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes references: - https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte author: pH-T (Nextron Systems) date: 2022-07-15 modified: 2023-01-16 tags: - attack.exfiltration - attack.t1567.002 logsource: product: windows category: dns_query detection: selection: QueryName|contains: .anonfiles.com condition: selection falsepositives: - Rare legitimate access to anonfiles.com level: high
Near-miss passage: Sigma rule: Detects when Kubernetes Secrets are Modified or Deleted.. Logsource: kubernetes / audit. Rule: title: Kubernetes Secrets Modified or Deleted id: 58d31a75-a4f8-4c40-985b-373d58162ca2 related: - id: 2f0bae2d-bf20-4465-be86-1311addebaa3 type: similar status: test description: 'Detects when Kubernetes Secrets are Modified or Deleted. ' references: - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/ - https://commandk.dev/blog/guide-to-audit-k8s-secrets-for-compliance/ author: kelnage date: 2024-07-11 tags: - attack.credential-access logsource: product: kubernetes service: audit detection: selection: objectRef.resource: secrets verb: - create - delete - patch - replace - update condition: selection falsepositives: - Secrets being modified or deleted may be performed by a system administrator. - Automated processes may need to take these actions and may need to be filtered. level: medium
Query: patch priority for CVE-2015-5302
Matching passage: CVE-2015-5302. CWE: CWE-200. CVSS: 5.0. libreport 2.0.7 before 2.6.3 only saves changes to the first file when editing a crash report, which allows remote attackers to obtain sensitive information via unspecified vectors related to the (1) backtrace, (2) cmdline, (3) environ, (4) open_fds, (5) maps, (6) smaps, (7) hostname, (8) remote, (9) ks.cfg, or (10) anaconda-tb file attachment included in a Red Hat Bugzilla bug report.
Near-miss passage: CVE-2015-5610. CWE: CWE-200. CVSS: 4.0. The RSM (aka RSMWinService) service in SolarWinds N-Able N-Central before 9.5.1.4514 uses the same password decryption key across different customers' installations, which makes it easier for remote authenticated users to obtain the cleartext domain-administrator password by locating the encrypted password within HTML source code and then leveraging knowledge of this key from another installation.
Query: Sigma YAML for windows / image_load
Matching passage: Sigma rule: The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious. Logsource: windows / image_load. Rule: title: Fax Service DLL Search Order Hijack id: 828af599-4c53-4ed2-ba4a-a9f835c434ea status: test description: The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service. references: - https://windows-internals.com/faxing-your-way-to-system/ author: NVISO date: 2020-05-04 modified: 2022-06-02 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: Image|endswith: \fxssvc.exe ImageLoaded|endswith: ualapi.dll filter: ImageLoaded|startswith: C:\Windows\WinSxS\ condition: selection and not filter falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path. The. Logsource: windows / file_event. Rule: title: Registry Hive File Staged Outside Standard User Profile Path id: a7f3c891-2e4d-4b6a-9f8c-d5e2a1b04c73 status: experimental description: 'Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path. These files generally contain various user-specific registry settings and are typically located in the user''s profile directory. Staging these files outside of the standard path can be indicative of an attacker attempting to manipulate user registry settings for persistence, privilege escalation, or dump user registry hives for credential harvesting. ' references: - https://github.com/MSNightmare/LegacyHive - https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-23 tags: - attack.privilege-escalation - attack.t1548 - attack.credential-access - attack.t1003 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - \UsrClass.dat - \NTUSER.DAT filter_main_usrclass: TargetFilename|endswith: \AppData\Local\Microsoft\Windows\UsrClass.dat filter_main_ntuser: TargetFilename|re|i: ^C:\\Users\\[^\\]+\\NTUSER\.DAT$ filter_main_system: TargetFilename|startswith: - C:\Windows\System32\config\ - C:\Windows\SYSVOL\ - C:\Windows\ServiceProfiles\ condition: selection and not 1 of filter_main_* falsepositives: - Backup or profile migration software - Forensic acquisition tools level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_registry_hive_file_creation/info.yml
Query: vulnerability: Cross-site scripting (XSS) vulnerability in index.php in LEMON-S PHP Simple Oekaki BBS before 1.21 allows remote attackers to inject arbitrary web script or HTML via the oekakis pa
Matching passage: CVE-2015-2969. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in index.php in LEMON-S PHP Simple Oekaki BBS before 1.21 allows remote attackers to inject arbitrary web script or HTML via the oekakis parameter.
Near-miss passage: CVE-2015-0967. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in SearchBlox before 8.2 allow remote attackers to inject arbitrary web script or HTML via (1) the search field in plugin/index.html or (2) the title field in the Create Featured Result form in admin/main.jsp.
Query: patch priority for CVE-2015-0207
Matching passage: CVE-2015-0207. CWE: UNKNOWN. CVSS: 5.0. The dtls1_listen function in d1_lib.c in OpenSSL 1.0.2 before 1.0.2a does not properly isolate the state information of independent data streams, which allows remote attackers to cause a denial of service (application crash) via crafted DTLS traffic, as demonstrated by DTLS 1.0 traffic to a DTLS 1.2 server.
Near-miss passage: CVE-2015-8050. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in the MovieClip object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a crafted beginGradientFill call, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: CWE for Use of Password Hash With Insufficient Computational Effort
Matching passage: CWE-916 Use of Password Hash With Insufficient Computational Effort. The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
Near-miss passage: CWE-821 Incorrect Synchronization. The product utilizes a shared resource in a concurrent manner, but it does not correctly synchronize access to the resource.
Query: vulnerability: kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2) hard link attack on /
Matching passage: CVE-2015-1338. CWE: CWE-59. CVSS: 7.199999809265137. kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2) hard link attack on /var/crash/vmcore.log.
Near-miss passage: CVE-2015-3436. CWE: CWE-59. CVSS: 6.599999904632568. provider/server/ECServer.cpp in Zarafa Collaboration Platform (ZCP) before 7.1.13 and 7.2.x before 7.2.1 allows local users to write to arbitrary files via a symlink attack on /tmp/zarafa-upgrade-lock.
Query: write Sigma for Detects command line parameters or strings often used by crypto miners
Matching passage: Sigma rule: Detects command line parameters or strings often used by crypto miners. Logsource: linux / process_creation. Rule: title: Linux Crypto Mining Indicators id: 9069ea3c-b213-4c52-be13-86506a227ab1 status: test description: Detects command line parameters or strings often used by crypto miners references: - https://www.poolwatch.io/coin/monero author: Florian Roth (Nextron Systems) date: 2021-10-26 modified: 2022-12-25 tags: - attack.impact - attack.t1496 logsource: product: linux category: process_creation detection: selection: CommandLine|contains: - ' --cpu-priority=' - --donate-level=0 - ' -o pool.' - ' --nicehash' - ' --algo=rx/0 ' - stratum+tcp:// - stratum+udp:// - sh -c /sbin/modprobe msr allow_writes=on - LS1kb25hdGUtbGV2ZWw9 - 0tZG9uYXRlLWxldmVsP - tLWRvbmF0ZS1sZXZlbD - c3RyYXR1bSt0Y3A6Ly - N0cmF0dW0rdGNwOi8v - zdHJhdHVtK3RjcDovL - c3RyYXR1bSt1ZHA6Ly - N0cmF0dW0rdWRwOi8v - zdHJhdHVtK3VkcDovL condition: selection falsepositives: - Legitimate use of crypto miners level: high
Near-miss passage: Sigma rule: Detects uses of the createdump.exe LOLOBIN utility to dump process memory. Logsource: windows / process_creation. Rule: title: CreateDump Process Dump id: 515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48 related: - id: 1a1ed54a-2ba4-4221-94d5-01dee560d71e type: similar status: test description: Detects uses of the createdump.exe LOLOBIN utility to dump process memory references: - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/ - https://twitter.com/bopin2020/status/1366400799199272960 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-01-04 modified: 2022-08-19 tags: - attack.stealth - attack.t1036 - attack.t1003.001 - attack.credential-access logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \createdump.exe - OriginalFileName: FX_VER_INTERNALNAME_STR selection_cli: CommandLine|contains: - ' -u ' - ' --full ' - ' -f ' - ' --name ' - '.dmp ' condition: all of selection_* falsepositives: - Command lines that use the same flags level: high
Query: SOC alert related to Valid Accounts
Matching passage: T1078 Valid Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.(Citation: volexity_0day_sophos_FW) Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence. In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account.(Citation: CISA MFA PrintNightmare) The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.(Citation: TechNet Credential Theft)
Near-miss passage: T1078.003 Local Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. Local Accounts may also be abused to elevate privileges and harvest credentials through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement.
Query: vulnerability: Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before
Matching passage: CVE-2015-3114. CWE: CWE-284. CVSS: 5.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-1937. CWE: CWE-284. CVSS: 7.5. IBM PowerVC 1.2.0.x through 1.2.0.4, 1.2.1.x through 1.2.1.2, and 1.2.2.x through 1.2.2.2 does not require authentication for the ceilometer NoSQL database, which allows remote attackers to read or write to arbitrary database records, and consequently obtain administrator privileges, via a session on port 27017.