alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: hunt for Network Devices activity
Matching passage: T1584.008 Network Devices. Tactics: resource development. Description: Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not [Initial Access](https://attack.mitre.org/tactics/TA0001) to that environment, but rather to leverage these devices to support additional targeting. Once an adversary has control, compromised network devices can be used to launch additional operations, such as hosting payloads for [Phishing](https://attack.mitre.org/techniques/T1566) campaigns (i.e., [Link Target](https://attack.mitre.org/techniques/T1608/005)) or enabling the required access to execute [Content Injection](https://attack.mitre.org/techniques/T1659) operations. Adversaries may also be able to harvest reusable credentials (i.e., [Valid Accounts](https://attack.mitre.org/techniques/T1078)) from compromised network devices. Adversaries often target Internet-facing edge devices and related network appliances that specifically do not support robust host-based defenses.(Citation: Mandiant Fortinet Zero Day)(Citation: Wired Russia Cyberwar) Compromised network devices may be used to support subsequent [Command and Control](https://attack.mitre.org/tactics/TA0011) activity, such as [Hide Infrastructure](https://attack.mitre.org/techniques/T1665) through an established [Proxy](https://attack.mitre.org/techniques/T1090) and/or [Botnet](https://attack.mitre.org/techniques/T1584/005) network.(Citation: Justice GRU 2024)
Near-miss passage: T1584.007 Serverless. Tactics: resource development. Description: Adversaries may compromise serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them. Once compromised, the serverless runtime environment can be leveraged to either respond directly to infected machines or to [Proxy](https://attack.mitre.org/techniques/T1090) traffic to an adversary-owned command and control server.(Citation: BlackWater Malware Cloudflare Workers)(Citation: AWS Lambda Redirector)(Citation: GWS Apps Script Abuse 2021) As traffic generated by these functions will appear to come from subdomains of common cloud providers, it may be difficult to distinguish from ordinary traffic to these providers - making it easier to [Hide Infrastructure](https://attack.mitre.org/techniques/T1665).(Citation: Detecting Command & Control in the Cloud)(Citation: BlackWater Malware Cloudflare Workers)
Query: weakness Source Code Element without Standard Prologue
Matching passage: CWE-1115 Source Code Element without Standard Prologue. The source code contains elements such as source files that do not consistently provide a prologue or header that has been standardized for the project.
Near-miss passage: CWE-144 Improper Neutralization of Line Delimiters. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as line delimiters when they are sent to a downstream component.
Query: CVE similar to CVE-2015-5172
Matching passage: CVE-2015-5172. CWE: CWE-640. CVSS: 9.800000190734863. Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire password reset links.
Near-miss passage: CVE-2015-7257. CWE: CWE-640. CVSS: 7.5. ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated non-administrator users to change the admin password by intercepting an outgoing password change request, and changing the username parameter from "support" to "admin".
Query: risk of WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corrupt
Matching passage: CVE-2015-1078. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Near-miss passage: CVE-2015-0027. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0035, CVE-2015-0039, CVE-2015-0052, and CVE-2015-0068.
Query: indicators of Selective Exclusion
Matching passage: T1679 Selective Exclusion. Tactics: stealth. Description: Adversaries may intentionally exclude certain files, folders, directories, file types, or system components from encryption or tampering during a ransomware or malicious payload execution. Some file extensions that adversaries may avoid encrypting include `.dll`, `.exe`, and `.lnk`.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024) Adversaries may perform this behavior to avoid alerting users, to evade detection by security tools and analysts, or, in the case of ransomware, to ensure that the system remains operational enough to deliver the ransom notice. Exclusions may target files and components whose corruption would cause instability, break core services, or immediately expose the attack. By carefully avoiding these areas, adversaries maintain system responsiveness while minimizing indicators that could trigger alarms or otherwise inhibit achieving their goals.
Near-miss passage: T1205.001 Port Knocking. Tactics: stealth, persistence, command and control. Description: Adversaries may use port knocking to hide open ports used for persistence or command and control. To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports. After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software. This technique has been observed both for the dynamic opening of a listening port as well as the initiating of a connection to a listening server on a different system. The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.
Query: describe CVE-2015-8875
Matching passage: CVE-2015-8875. CWE: CWE-189. CVSS: 7.800000190734863. Multiple integer overflows in the (1) pixops_composite_nearest, (2) pixops_composite_color_nearest, and (3) pixops_process functions in pixops/pixops.c in gdk-pixbuf before 2.33.1 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted image, which triggers a heap-based buffer overflow.
Near-miss passage: CVE-2015-8364. CWE: CWE-189. CVSS: 6.800000190734863. Integer overflow in the ff_ivi_init_planes function in libavcodec/ivi.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via crafted image dimensions in Indeo Video Interactive data.
Query: write Sigma for Detects extraction of files with usage of steghide binary, the adversaries may use this technique to prevent the detecti
Matching passage: Sigma rule: Detects extraction of files with usage of steghide binary, the adversaries may use this technique to prevent the detecti. Logsource: linux / auditd. Rule: title: Steganography Extract Files with Steghide id: a5a827d9-1bbe-4952-9293-c59d897eb41b status: test description: Detects extraction of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information. references: - https://vitux.com/how-to-hide-confidential-files-in-images-on-debian-using-steganography/ author: Pawel Mazur date: 2021-09-11 modified: 2022-10-09 tags: - attack.stealth - attack.t1027.003 logsource: product: linux service: auditd detection: selection: type: EXECVE a0: steghide a1: extract a2: -sf a3|endswith: - .jpg - .png condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects source code enumeration that use GET requests by keyword searches in URL strings. Logsource: webserver. Rule: title: Source Code Enumeration Detection by Keyword id: 953d460b-f810-420a-97a2-cfca4c98e602 status: test description: Detects source code enumeration that use GET requests by keyword searches in URL strings references: - https://pentester.land/tutorials/2018/10/25/source-code-disclosure-via-exposed-git-folder.html - https://medium.com/@logicbomb_1/bugbounty-how-i-was-able-to-download-the-source-code-of-indias-largest-telecom-service-52cf5c5640a1 author: James Ahearn date: 2019-06-08 modified: 2022-10-05 tags: - attack.discovery - attack.t1083 logsource: category: webserver detection: keywords: - .git/ condition: keywords falsepositives: - Unknown level: medium
Query: alert when Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Sc
Matching passage: Sigma rule: Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Sc. Logsource: windows / ps_script. Rule: title: Windows Screen Capture with CopyFromScreen id: d4a11f63-2390-411c-9adf-d791fd152830 status: test description: 'Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md#atomic-test-6---windows-screen-capture-copyfromscreen author: frack113 date: 2021-12-28 modified: 2022-07-07 tags: - attack.collection - attack.t1113 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: .CopyFromScreen condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects attempts to create and add an account to the admin group via "dscl". Logsource: macos / process_creation. Rule: title: User Added To Admin Group Via Dscl id: b743623c-2776-40e0-87b1-682b975d0ca5 related: - id: 0c1ffcf9-efa9-436e-ab68-23a9496ebf5b type: obsolete status: test description: Detects attempts to create and add an account to the admin group via "dscl" references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-2---create-local-account-with-admin-privileges---macos - https://ss64.com/osx/dscl.html author: Sohan G (D4rkCiph3r) date: 2023-03-19 tags: - attack.persistence - attack.initial-access - attack.privilege-escalation - attack.stealth - attack.t1078.003 logsource: category: process_creation product: macos detection: selection: Image|endswith: /dscl CommandLine|contains|all: - ' -append ' - ' /Groups/admin ' - ' GroupMembership ' condition: selection falsepositives: - Legitimate administration activities level: medium
Query: exploit ImageIO in Apple iOS before 8.4.1 and OS X before 10.10.5 does not properly initialize an unspecified data structure, which allows remote attackers to obtain sensitive information 
Matching passage: CVE-2015-5782. CWE: CWE-200. CVSS: 4.300000190734863. ImageIO in Apple iOS before 8.4.1 and OS X before 10.10.5 does not properly initialize an unspecified data structure, which allows remote attackers to obtain sensitive information from process memory via a crafted TIFF image.
Near-miss passage: CVE-2015-1932. CWE: CWE-200. CVSS: 5.0. IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 and WebSphere Virtual Enterprise before 7.0.0.7 allow remote attackers to obtain potentially sensitive information about the proxy-server software by reading the HTTP Via header.
Query: exploit Multiple cross-site scripting (XSS) vulnerabilities in Visualware MyConnection Server 8.2b allow remote attackers to inject arbitrary web script or HTML via the (1) bt, (2) variabl
Matching passage: CVE-2015-2043. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Visualware MyConnection Server 8.2b allow remote attackers to inject arbitrary web script or HTML via the (1) bt, (2) variable, or (3) et parameter to myspeed/db/historyitem.
Near-miss passage: CVE-2015-2031. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: detection rule: Detects additions to the Emond Launch Daemon that adversaries may use to gain persistence and elevate privileges.
Matching passage: Sigma rule: Detects additions to the Emond Launch Daemon that adversaries may use to gain persistence and elevate privileges.. Logsource: macos / file_event. Rule: title: MacOS Emond Launch Daemon id: 23c43900-e732-45a4-8354-63e4a6c187ce status: test description: Detects additions to the Emond Launch Daemon that adversaries may use to gain persistence and elevate privileges. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.014/T1546.014.md - https://posts.specterops.io/leveraging-emond-on-macos-for-persistence-a040a2785124 author: Alejandro Ortuno, oscd.community date: 2020-10-23 modified: 2021-11-27 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.014 logsource: category: file_event product: macos detection: selection_1: TargetFilename|contains: /etc/emond.d/rules/ TargetFilename|endswith: .plist selection_2: TargetFilename|contains: /private/var/db/emondClients/ condition: 1 of selection_* falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects Bitbucket global secret scanning rule deletion activity.. Logsource: bitbucket / audit. Rule: title: Bitbucket Global Secret Scanning Rule Deleted id: e16cf0f0-ee88-4901-bd0b-4c8d13d9ee05 status: test description: Detects Bitbucket global secret scanning rule deletion activity. references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html - https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.defense-impairment - attack.t1685 logsource: product: bitbucket service: audit definition: 'Requirements: "Basic" log level is required to receive these audit events.' detection: selection: auditType.category: Global administration auditType.action: Global secret scanning rule deleted condition: selection falsepositives: - Legitimate user activity. level: medium
Query: rule covering Detects suspicious use of command-line tools such as curl or wget to download remote content - particularly scripts - in
Matching passage: Sigma rule: Detects suspicious use of command-line tools such as curl or wget to download remote content - particularly scripts - in. Logsource: linux / process_creation. Rule: title: Suspicious Download and Execute Pattern via Curl/Wget id: a2d9e2f3-0f43-4c7a-bcd9-9acfc0d723aa status: experimental description: 'Detects suspicious use of command-line tools such as curl or wget to download remote content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by immediate execution, indicating potential malicious activity. This pattern is commonly used by malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks. ' references: - https://gtfobins.github.io/gtfobins/wget/ - https://gtfobins.github.io/gtfobins/curl/ author: Aayush Gupta date: 2025-06-17 tags: - attack.execution - attack.t1059.004 - attack.t1203 logsource: category: process_creation product: linux detection: selection_downloader: CommandLine|contains: - /curl - /wget selection_tmp: CommandLine|contains: - /tmp/ - /dev/shm/ selection_executor: CommandLine|contains: sh -c condition: all of selection_* falsepositives: - System update scripts using temporary files - Installer scripts or automated provisioning tools level: high
Near-miss passage: Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: Session Manager Autorun Keys Modification id: 046218bd-e0d8-4113-a3c3-895a12b2b298 related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: obsolete status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 - attack.t1546.009 logsource: category: registry_set product: windows detection: session_manager_base: TargetObject|contains: \System\CurrentControlSet\Control\Session Manager session_manager: TargetObject|contains: - \SetupExecute - \S0InitialCommand - \KnownDlls - \Execute - \BootExecute - \AppCertDlls filter: Details: (Empty) condition: session_manager_base and session_manager and not filter falsepositives: - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason - Legitimate administrator sets up autorun keys for legitimate reason level: medium
Query: exploit mediaserver in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to cause a denial of service (process crash) via unspecified vectors, aka internal bug 222
Matching passage: CVE-2015-7718. CWE: UNKNOWN. CVSS: 5.0. mediaserver in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to cause a denial of service (process crash) via unspecified vectors, aka internal bug 22278703, a different vulnerability than CVE-2015-6605.
Near-miss passage: CVE-2015-2545. CWE: UNKNOWN. CVSS: 7.800000190734863. Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted EPS image, aka "Microsoft Office Malformed EPS File Vulnerability."
Query: vulnerability: In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in the processing of certain responses from the USIM.
Matching passage: CVE-2015-9049. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in the processing of certain responses from the USIM.
Near-miss passage: CVE-2015-9061. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, playReady DRM failed to check a length potentially leading to unauthorized access to secure memory.
Query: alert when Detects the addition of a new network route to a route table in AWS.
Matching passage: Sigma rule: Detects the addition of a new network route to a route table in AWS.. Logsource: aws / cloudtrail. Rule: title: New Network Route Added id: c803b2ce-c4a2-4836-beae-b112010390b1 status: test description: 'Detects the addition of a new network route to a route table in AWS. ' references: - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/ author: jamesc-grafana date: 2024-07-11 tags: - attack.defense-impairment - attack.t1686.001 logsource: product: aws service: cloudtrail detection: selection: eventSource: ec2.amazonaws.com eventName: CreateRoute condition: selection falsepositives: - New VPC Creation requiring setup of a new route table - New subnets added requiring routing setup level: medium
Near-miss passage: Sigma rule: Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several. Logsource: windows / ps_script. Rule: title: Enumerate Credentials from Windows Credential Manager With PowerShell id: 603c6630-5225-49c1-8047-26c964553e0e status: test description: 'Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555/T1555.md author: frack113 date: 2021-12-20 modified: 2022-12-25 tags: - attack.credential-access - attack.t1555 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmd: ScriptBlockText|contains|all: - vaultcmd - '/listcreds:' selection_option: ScriptBlockText|contains: - Windows Credentials - Web Credentials condition: all of selection_* falsepositives: - Unknown level: medium
Query: describe CVE-2015-3875
Matching passage: CVE-2015-3875. CWE: CWE-119. CVSS: 10.0. libutils in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22952485.
Near-miss passage: CVE-2015-2740. CWE: CWE-119. CVSS: 10.0. Buffer overflow in the nsXMLHttpRequest::AppendToResponseText function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 might allow remote attackers to cause a denial of service or have unspecified other impact via unknown vectors.
Query: patch priority for CVE-2015-4117
Matching passage: CVE-2015-4117. CWE: CWE-78. CVSS: 8.800000190734863. Vesta Control Panel before 0.9.8-14 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the backup parameter to list/backup/index.php.
Near-miss passage: CVE-2015-4183. CWE: CWE-78. CVSS: 7.199999809265137. Cisco UCS Central Software 1.2(1a) allows local users to gain privileges for OS command execution via a crafted CLI parameter, aka Bug ID CSCut32795.
Query: risk of Apple QuickTime before 7.7.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a differen
Matching passage: CVE-2015-5786. CWE: CWE-119. CVSS: 6.800000190734863. Apple QuickTime before 7.7.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-5785.
Near-miss passage: CVE-2015-0323. CWE: CWE-119. CVSS: 10.0. Heap-based buffer overflow in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0327.