alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Outbound C2 pattern associated with Silver Ticket
Matching passage: T1558.002 Silver Ticket. Tactics: credential access. Description: Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets.(Citation: ADSecurity Silver Tickets) Silver tickets are more limited in scope in than golden tickets in that they only enable adversaries to access a particular resource (e.g. MSSQL) and the system that hosts the resource; however, unlike golden tickets, adversaries with the ability to forge silver tickets are able to create TGS tickets without interacting with the Key Distribution Center (KDC), potentially making detection more difficult.(Citation: ADSecurity Detecting Forged Tickets) Password hashes for target services may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).
Near-miss passage: T1558.005 Ccache Files. Tactics: credential access. Description: Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having to re-enter credentials. The <code>/etc/krb5.conf</code> configuration file and the <code>KRB5CCNAME</code> environment variable are used to set the storage location for ccache entries. On Linux, credentials are typically stored in the `/tmp` directory with a naming format of `krb5cc_%UID%` or `krb5.ccache`. On macOS, ccache entries are stored by default in memory with an `API:{uuid}` naming scheme. Typically, users interact with ticket storage using <code>kinit</code>, which obtains a Ticket-Granting-Ticket (TGT) for the principal; <code>klist</code>, which lists obtained tickets currently held in the credentials cache; and other built-in binaries.(Citation: Kerberos GNU/Linux)(Citation: Binary Defense Kerberos Linux) Adversaries can collect tickets from ccache files stored on disk and authenticate as the current user without their password to perform [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003) attacks. Adversaries can also use these tickets to impersonate legitimate users with elevated privileges to perform [Privilege Escalation](https://attack.mitre.org/tactics/TA0004). Tools like Kekeo can also be used by adversaries to convert ccache files to Windows format for further [Lateral Movement](https://attack.mitre.org/tactics/TA0008). On macOS, adversaries may use open-source tools or the Kerberos framework to interact with ccache files and extract TGTs or Service Tickets via lower-level APIs.(Citation: SpectorOps Bifrost Kerberos macOS 2019)(Citation: Linux Kerberos Tickets)(Citation: Brining MimiKatz to Unix)(Citation: Kekeo)
Query: detection rule: This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe t
Matching passage: Sigma rule: This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe t. Logsource: windows / registry_set. Rule: title: Execution DLL of Choice Using WAB.EXE id: fc014922-5def-4da9-a0fc-28c973f41bfb status: test description: This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe tries to load the DLL from Registry. references: - https://github.com/LOLBAS-Project/LOLBAS/blob/8283d8d91552213ded165fd36deb6cb9534cb443/yml/OSBinaries/Wab.yml - https://twitter.com/Hexacorn/status/991447379864932352 - http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/ author: oscd.community, Natalia Shornikova date: 2020-10-13 modified: 2023-08-17 tags: - attack.stealth - attack.t1218 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Software\Microsoft\WAB\DLLPath filter: Details: '%CommonProgramFiles%\System\wab32.dll' condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Various protocols maybe used to put data on the device for exfil or infil. Logsource: cisco / aaa. Rule: title: Cisco Stage Data id: 5e51acb2-bcbe-435b-99c6-0e3cd5e2aa59 status: test description: Various protocols maybe used to put data on the device for exfil or infil author: Austin Clark date: 2019-08-12 modified: 2023-01-04 tags: - attack.collection - attack.lateral-movement - attack.command-and-control - attack.exfiltration - attack.t1074 - attack.t1105 - attack.t1560.001 logsource: product: cisco service: aaa detection: keywords: - tftp - rcp - puts - copy - configure replace - archive tar condition: keywords falsepositives: - Generally used to copy configs or IOS images level: low
Query: exploit Open proxy in Wordpress plugin google-adsense-and-hotel-booking v1.05
Matching passage: CVE-2015-1000009. CWE: CWE-284. CVSS: 9.100000381469727. Open proxy in Wordpress plugin google-adsense-and-hotel-booking v1.05
Near-miss passage: CVE-2015-6023. CWE: CWE-284. CVSS: 7.300000190734863. ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01_R05 allows remote attackers to bypass intended access restrictions via a direct request. NOTE: this issue can be combined with CVE-2015-6024 to execute arbitrary commands.
Query: risk of Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests t
Matching passage: CVE-2015-7537. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method.
Near-miss passage: CVE-2015-6373. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCux10611.
Query: mitigate Patch System Image
Matching passage: T1601.001 Patch System Image. Tactics: defense impairment. Description: Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses.(Citation: Killing the myth of Cisco IOS rootkits) (Citation: Killing IOS diversity myth) (Citation: Cisco IOS Shellcode) (Citation: Cisco IOS Forensics Developments) (Citation: Juniper Netscreen of the Dead) Some network devices are built with a monolithic architecture, where the entire operating system and most of the functionality of the device is contained within a single file. Adversaries may change this file in storage, to be loaded in a future boot, or in memory during runtime. To change the operating system in storage, the adversary will typically use the standard procedures available to device operators. This may involve downloading a new file via typical protocols used on network devices, such as TFTP, FTP, SCP, or a console connection. The original file may be overwritten, or a new file may be written alongside of it and the device reconfigured to boot to the compromised image. To change the operating system in memory, the adversary typically can use one of two methods. In the first, the adversary would make use of native debug commands in the original, unaltered running operating system that allow them to directly modify the relevant memory addresses containing the running operating system. This method typically requires administrative level access to the device. In the second method for changing the operating system in memory, the adversary would make use of the boot loader. The boot loader is the first piece of software that loads when the device starts that, in turn, will launch the operating system. Adversaries may use malicious code previously implanted in the boot loader, such as through the [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) method, to directly manipulate running operating system code in memory. This malicious code in the bootloader provides the capability of direct memory manipulation to the adversary,
Near-miss passage: T1601 Modify System Image. Tactics: defense impairment. Description: Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves. On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file. To change the operating system, the adversary typically only needs to affect this one file, replacing or modifying it. This can either be done live in memory during system runtime for immediate effect, or in storage to implement the change on the next boot of the network device.
Query: telemetry for T1053.007
Matching passage: T1053.007 Container Orchestration Job. Tactics: execution, persistence, privilege escalation. Description: Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster. In Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks.(Citation: Kubernetes Jobs)(Citation: Kubernetes CronJob) An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in various nodes within a cluster.(Citation: Threat Matrix for Kubernetes)
Near-miss passage: T1053 Scheduled Task/Job. Tactics: execution, persistence, privilege escalation. Description: Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.(Citation: TechNet Task Scheduler Security) Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges). Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.(Citation: ProofPoint Serpent)
Query: common weakness: URL Redirection to Untrusted Site ('Open Redirect')
Matching passage: CWE-601 URL Redirection to Untrusted Site ('Open Redirect'). The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Near-miss passage: CWE-12 ASP.NET Misconfiguration: Missing Custom Error Page. An ASP .NET application must enable custom error pages in order to prevent attackers from mining information from the framework's built-in responses.
Query: patch priority for CVE-2015-3839
Matching passage: CVE-2015-3839. CWE: CWE-476. CVSS: 5.5. The updateMessageStatus function in Android 5.1.1 and earlier allows local users to cause a denial of service (NULL pointer exception and process crash).
Near-miss passage: CVE-2015-9111. CWE: CWE-476. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, in a QTEE syscall handler, an untrusted pointer dereference can occur.
Query: explain CWE-760
Matching passage: CWE-760 Use of a One-Way Hash with a Predictable Salt. The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input.
Near-miss passage: CWE-572 Call to Thread run() instead of start(). The product calls a thread's run() method instead of calling start(), which causes the code to run in the thread of the caller instead of the callee.
Query: patch priority for CVE-2015-1763
Matching passage: CVE-2015-1763. CWE: CWE-284. CVSS: 8.5. Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014 does not prevent use of uninitialized memory in certain attempts to execute virtual functions, which allows remote authenticated users to execute arbitrary code via a crafted query, aka "SQL Server Remote Code Execution Vulnerability."
Near-miss passage: CVE-2015-3224. CWE: CWE-284. CVSS: 4.300000190734863. request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.
Query: detection rule: Detects the use of PowerShell with Uninstall-WindowsFeature or Remove-WindowsFeature cmdlets to disable or remove the Wi
Matching passage: Sigma rule: Detects the use of PowerShell with Uninstall-WindowsFeature or Remove-WindowsFeature cmdlets to disable or remove the Wi. Logsource: windows / process_creation. Rule: title: Suspicious Uninstall of Windows Defender Feature via PowerShell id: c443012c-7928-43bf-ac20-7eda5efe61ad status: experimental description: 'Detects the use of PowerShell with Uninstall-WindowsFeature or Remove-WindowsFeature cmdlets to disable or remove the Windows Defender GUI feature, a common technique used by adversaries to evade defenses. ' references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.windows.servermanager.migration/uninstall-windowsfeature - https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware author: yxinmiracle date: 2025-08-22 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell_ISE.EXE - PowerShell.EXE - pwsh.dll selection_cli_uninstall: CommandLine|contains: - Uninstall-WindowsFeature - Remove-WindowsFeature selection_cli_defender_feature: CommandLine|contains: Windows-Defender condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects download of certain file types from hosts in suspicious TLDs. Logsource: proxy. Rule: title: Download From Suspicious TLD - Blacklist id: 00d0b5ab-1f55-4120-8e83-487c0a7baf19 related: - id: b5de2919-b74a-4805-91a7-5049accbaefe type: similar status: test description: Detects download of certain file types from hosts in suspicious TLDs references: - https://www.symantec.com/connect/blogs/shady-tld-research-gdn-and-our-2016-wrap - https://promos.mcafee.com/en-US/PDF/MTMW_Report.pdf - https://www.spamhaus.org/statistics/tlds/ - https://krebsonsecurity.com/2018/06/bad-men-at-work-please-dont-click/ author: Florian Roth (Nextron Systems) date: 2017-11-07 modified: 2023-05-18 tags: - attack.initial-access - attack.t1566 - attack.execution - attack.t1203 - attack.t1204.002 logsource: category: proxy detection: selection: c-uri-extension: - exe - vbs - bat - rar - ps1 - doc - docm - xls - xlsm - pptm - rtf - hta - dll - ws - wsf - sct - zip cs-host|endswith: - .country - .stream - .gdn - .mom - .xin - .kim - .men - .loan - .download - .racing - .online - .science - .ren - .gb - .win - .top - .review - .vip - .party - .tech - .xyz - .date - .faith - .zip - .cricket - .space - .info - .vn - .cm - .am - .cc - .asia - .ws - .tk - .biz - .su - .st - .ro - .ge - .ms - .pk - .nu - .me - .ph - .to - .tt - .name - .tv - .kz - .tc - .mobi - .study - .click - .link - .trade - .accountant - .cf - .gq - .ml - .ga - .pw condition: selection falsepositives: - All kinds of software downloads level: low
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the Zendesk Feedback Tab module 7.x-1.x before 7.x-1.1 for Drupal allows remote administrators with the "Configure Zendesk Feedback Tab"
Matching passage: CVE-2015-6921. CWE: CWE-79. CVSS: 2.5999999046325684. Cross-site scripting (XSS) vulnerability in the Zendesk Feedback Tab module 7.x-1.x before 7.x-1.1 for Drupal allows remote administrators with the "Configure Zendesk Feedback Tab" permission to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-1911. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Sterling Order Management 8.5 before HF113, Sterling Selling and Fulfillment Foundation 9.0.0 before FP92, and Sterling Field Sales (SFS) 9.0 before HF7 in IBM Sterling Selling and Fulfillment Suite allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Query: weakness Incorrect Short Circuit Evaluation
Matching passage: CWE-768 Incorrect Short Circuit Evaluation. The product contains a conditional statement with multiple logical expressions in which one of the non-leading expressions may produce side effects. This may lead to an unexpected state in the program after the execution of the conditional, because short-circuiting logic may prevent the side effects from occurring.
Near-miss passage: CWE-351 Insufficient Type Distinction. The product does not properly distinguish between different types of elements in a way that leads to insecure behavior.
Query: risk of Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
Matching passage: CVE-2015-5203. CWE: CWE-415. CVSS: 5.5. Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
Near-miss passage: CVE-2015-8962. CWE: CWE-415. CVSS: 7.300000190734863. Double free vulnerability in the sg_common_write function in drivers/scsi/sg.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (memory corruption and system crash) by detaching a device during an SG_IO ioctl call.
Query: describe CVE-2015-5790
Matching passage: CVE-2015-5790. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-2493. CWE: CWE-119. CVSS: 9.300000190734863. The (1) VBScript and (2) JScript engines in Microsoft Internet Explorer 8 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
Query: patch priority for CVE-2015-8540
Matching passage: CVE-2015-8540. CWE: CWE-189. CVSS: 8.800000190734863. Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x before 1.0.66, 1.1.x and 1.2.x before 1.2.56, 1.3.x and 1.4.x before 1.4.19, and 1.5.x before 1.5.26 allows remote attackers to have unspecified impact via a space character as a keyword in a PNG image, which triggers an out-of-bounds read.
Near-miss passage: CVE-2015-1474. CWE: CWE-189. CVSS: 10.0. Multiple integer overflows in the GraphicBuffer::unflatten function in platform/frameworks/native/libs/ui/GraphicBuffer.cpp in Android through 5.0 allow attackers to gain privileges or cause a denial of service (memory corruption) via vectors that trigger a large number of (1) file descriptors or (2) integer values.
Query: patch priority for CVE-2015-9232
Matching passage: CVE-2015-9232. CWE: CWE-345. CVSS: 5.300000190734863. The Good for Enterprise application 3.0.0.415 for Android does not use signature protection for its Authentication Delegation API intent. Also, the Good Dynamic application activation process does not attempt to detect malicious activation attempts involving modified names beginning with a com.good.gdgma substring. Consequently, an attacker could obtain access to intranet data. This issue is only relevant in cases where the user has already downloaded a malicious Android application.
Near-miss passage: CVE-2015-5236. CWE: CWE-345. CVSS: 7.5. It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value.
Query: risk of In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a QTEE application.
Matching passage: CVE-2015-9025. CWE: CWE-119. CVSS: 7.800000190734863. In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a QTEE application.
Near-miss passage: CVE-2015-1964. CWE: CWE-119. CVSS: 7.800000190734863. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, and CVE-2015-1965.