alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: incident response steps for Lateral movement indicators for Data Encoding
Matching passage: Playbook for T1132 Data Encoding. 1) Validate alert telemetry against T1132. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: command and control. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.(Citation: Wikipedia Binary-to-
Near-miss passage: Playbook for T1132.002 Non-Standard Encoding. Different response path focused on command and control.
Query: detection rule: Detects unauthorized access attempts to a resource.
Matching passage: Sigma rule: Detects unauthorized access attempts to a resource.. Logsource: bitbucket / audit. Rule: title: Bitbucket Unauthorized Access To A Resource id: 7215374a-de4f-4b33-8ba5-70804c9251d3 status: test description: Detects unauthorized access attempts to a resource. references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.resource-development - attack.t1586 logsource: product: bitbucket service: audit definition: 'Requirements: "Advance" log level is required to receive these audit events.' detection: selection: auditType.category: Security auditType.action: Unauthorized access to a resource condition: selection falsepositives: - Access attempts to non-existent repositories or due to outdated plugins. Usually "Anonymous" user is reported in the "author.name" field in most cases. level: critical
Near-miss passage: Sigma rule: Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application.. Logsource: windows / process_creation. Rule: title: REGISTER_APP.VBS Proxy Execution id: 1c8774a0-44d4-4db0-91f8-e792359c70bd status: test description: Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application. references: - https://twitter.com/sblmsrsn/status/1456613494783160325?s=20 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - \register_app.vbs - -register condition: selection falsepositives: - Legitimate usage of the script. Always investigate what's being registered to confirm if it's benign level: medium
Query: detection rule: Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as
Matching passage: Sigma rule: Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as. Logsource: windows / image_load. Rule: title: Time Travel Debugging Utility Usage - Image id: e76c8240-d68f-4773-8880-5c6f63595aaf status: test description: Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe. references: - https://lolbas-project.github.io/lolbas/Binaries/Tttracer/ - https://twitter.com/mattifestation/status/1196390321783025666 - https://twitter.com/oulusoyum/status/1191329746069655553 author: Ensar Şamil, @sblmsrsn, @oscd_initiative date: 2020-10-06 modified: 2022-12-02 tags: - attack.credential-access - attack.stealth - attack.t1218 - attack.t1003.001 logsource: product: windows category: image_load detection: selection: ImageLoaded|endswith: - \ttdrecord.dll - \ttdwriter.dll - \ttdloader.dll condition: selection falsepositives: - Legitimate usage by software developers/testers level: high
Near-miss passage: Sigma rule: Detect when users are authenticating without MFA being required.. Logsource: azure / signinlogs. Rule: title: Azure AD Only Single Factor Authentication Required id: 28eea407-28d7-4e42-b0be-575d5ba60b2c status: test description: Detect when users are authenticating without MFA being required. references: - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts author: MikeDuddington, '@dudders1' date: 2022-07-27 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.credential-access - attack.stealth - attack.defense-impairment - attack.t1078.004 - attack.t1556.006 logsource: product: azure service: signinlogs detection: selection: Status: Success AuthenticationRequirement: singleFactorAuthentication condition: selection falsepositives: - If this was approved by System Administrator. level: low
Query: CVE similar to CVE-2015-10041
Matching passage: CVE-2015-10041. CWE: CWE-89. CVSS: 9.800000190734863. ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Dovgalyuk AIBattle. Affected is the function sendComments of the file site/procedures.php. The manipulation of the argument text leads to sql injection. The name of the patch is e3aa4d0900167641d41cbccf53909229f00381c9. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218304. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Near-miss passage: CVE-2015-6537. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in the login page in Epiphany Cardio Server 3.3 allows remote attackers to execute arbitrary SQL commands via a crafted URL.
Query: describe CVE-2015-6471
Matching passage: CVE-2015-6471. CWE: CWE-200. CVSS: 5.300000190734863. Eaton Cooper Power Systems ProView 4.x and 5.x before 5.1 on Form 6 controls and Idea and IdeaPLUS relays does not properly initialize padding fields in Ethernet packets, which allows remote attackers to obtain sensitive information by reading packet data.
Near-miss passage: CVE-2015-1314. CWE: CWE-200. CVSS: 2.0999999046325684. The USAA Mobile Banking application before 7.10.1 for Android displays the most recently-used screen before prompting the user for login, which might allow physically proximate users to obtain banking account numbers and balances.
Query: CVE similar to CVE-2015-4489
Matching passage: CVE-2015-4489. CWE: CWE-119. CVSS: 7.5. The nsTArray_Impl class in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging a self assignment.
Near-miss passage: CVE-2015-8683. CWE: CWE-119. CVSS: 5.5. The putcontig8bitCIELab function in tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a packed TIFF image.
Query: weakness Use of Unmaintained Third Party Components
Matching passage: CWE-1104 Use of Unmaintained Third Party Components. The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.
Near-miss passage: CWE-142 Improper Neutralization of Value Delimiters. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.
Query: exploit Integer underflow in the RTPReceiverVideo::ParseRtpPacket function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 might allow remote attackers to obtain sensitive 
Matching passage: CVE-2015-7205. CWE: CWE-189. CVSS: 10.0. Integer underflow in the RTPReceiverVideo::ParseRtpPacket function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 might allow remote attackers to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a crafted WebRTC RTP packet.
Near-miss passage: CVE-2015-3223. CWE: CWE-189. CVSS: 5.300000190734863. The ldb_wildcard_compare function in ldb_match.c in ldb before 1.1.24, as used in the AD LDAP server in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, mishandles certain zero values, which allows remote attackers to cause a denial of service (infinite loop) via crafted packets.
Query: CVE similar to CVE-2015-4288
Matching passage: CVE-2015-4288. CWE: CWE-310. CVSS: 4.300000190734863. The LDAP implementation on the Cisco Web Security Appliance (WSA) 8.5.0-000, Email Security Appliance (ESA) 8.5.7-042, and Content Security Management Appliance (SMA) 8.3.6-048 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, aka Bug IDs CSCuo29561, CSCuv40466, and CSCuv40470.
Near-miss passage: CVE-2015-1010. CWE: CWE-310. CVSS: 4.900000095367432. Rockwell Automation RSView32 7.60.00 (aka CPR9 SR4) and earlier does not properly encrypt credentials, which allows local users to obtain sensitive information by reading a file and conducting a decryption attack.
Query: Outbound C2 pattern associated with Shortcut Modification
Matching passage: T1547.009 Shortcut Modification. Tactics: persistence, privilege escalation. Description: Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process. Adversaries may abuse shortcuts in the startup folder to execute their tools and achieve persistence.(Citation: Shortcut for Persistence ) Although often used as payloads in an infection chain (e.g. [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001)), adversaries may also create a new shortcut as a means of indirection, while also abusing [Masquerading](https://attack.mitre.org/techniques/T1036) to make the malicious shortcut appear as a legitimate program. Adversaries can also edit the target path or entirely replace an existing shortcut so their malware will be executed instead of the intended legitimate program. Shortcuts can also be abused to establish persistence by implementing other methods. For example, LNK browser extensions may be modified (e.g. [Browser Extensions](https://attack.mitre.org/techniques/T1176/001)) to persistently launch malware.
Near-miss passage: T1547.005 Security Support Provider. Tactics: persistence, privilege escalation. Description: Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages</code> and <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages</code>. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects creation of ".vhd"/".vhdx" files by browser processes. Malware can use mountable Virtual Hard Disk ".vhd" files. Logsource: windows / file_event. Rule: title: VHD Image Download Via Browser id: 8468111a-ef07-4654-903b-b863a80bbc95 status: test description: 'Detects creation of ".vhd"/".vhdx" files by browser processes. Malware can use mountable Virtual Hard Disk ".vhd" files to encapsulate payloads and evade security controls. ' references: - https://redcanary.com/blog/intelligence-insights-october-2021/ - https://www.kaspersky.com/blog/lazarus-vhd-ransomware/36559/ - https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/ author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' date: 2021-10-25 modified: 2023-05-05 tags: - attack.resource-development - attack.t1587.001 logsource: category: file_event product: windows detection: selection: Image|endswith: - \brave.exe - \chrome.exe - \firefox.exe - \iexplore.exe - \maxthon.exe - \MicrosoftEdge.exe - \msedge.exe - \msedgewebview2.exe - \opera.exe - \safari.exe - \seamonkey.exe - \vivaldi.exe - \whale.exe TargetFilename|contains: .vhd condition: selection falsepositives: - Legitimate downloads of ".vhd" files would also trigger this level: medium
Near-miss passage: Sigma rule: Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) from a non-standard directory.. Logsource: windows / process_creation. Rule: title: AddinUtil.EXE Execution From Uncommon Directory id: 6120ac2a-a34b-42c0-a9bd-1fb9f459f348 status: test description: Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) from a non-standard directory. references: - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri) date: 2023-09-18 modified: 2025-02-24 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \addinutil.exe - OriginalFileName: AddInUtil.exe filter_main_legit_location: Image|contains: - :\Windows\Microsoft.NET\Framework\ - :\Windows\Microsoft.NET\Framework64\ - :\Windows\Microsoft.NET\FrameworkArm\ - :\Windows\Microsoft.NET\FrameworkArm64\ - :\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: risk of wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low 
Matching passage: CVE-2015-7744. CWE: UNKNOWN. CVSS: 5.900000095367432. wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, aka a Lenstra attack.
Near-miss passage: CVE-2015-2346. CWE: UNKNOWN. CVSS: 4.0. XML external entity (XXE) vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote authenticated users to read arbitrary files via the req parameter.
Query: CVE similar to CVE-2015-9108
Matching passage: CVE-2015-9108. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, no address argument validation performed on calls to a QSEE syscall may lead to arbitrary read/write or NULL Pointer exception when calling a downstream function.
Near-miss passage: CVE-2015-3758. CWE: CWE-20. CVSS: 4.300000190734863. UIKit WebView in Apple iOS before 8.4.1 allows attackers to bypass an intended user-confirmation requirement and initiate arbitrary FaceTime calls via an app that provides a crafted URL.
Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects the addition of the "Debugger" value to the "DbgManagedDebugger" key in order to achieve persistence. Which will. Logsource: windows / registry_set. Rule: title: Potential Registry Persistence Attempt Via DbgManagedDebugger id: 9827ae57-3802-418f-994b-d5ecf5cd974b status: test description: Detects the addition of the "Debugger" value to the "DbgManagedDebugger" key in order to achieve persistence. Which will get invoked when an application crashes references: - https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/ - https://github.com/last-byte/PersistenceSniper author: frack113 date: 2022-08-07 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Microsoft\.NETFramework\DbgManagedDebugger filter: Details: '"C:\Windows\system32\vsjitdebugger.exe" PID %d APPDOM %d EXTEXT "%s" EVTHDL %d' condition: selection and not filter falsepositives: - Legitimate use of the key to setup a debugger. Which is often the case on developers machines level: medium
Near-miss passage: Sigma rule: Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellS. Logsource: windows / registry_event. Rule: title: Run Once Task Configuration in Registry id: c74d7efc-8826-45d9-b8bb-f04fac9e4eff status: test description: Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellStartup references: - https://twitter.com/pabraeken/status/990717080805789697 - https://lolbas-project.github.io/lolbas/Binaries/Runonce/ author: Avneet Singh @v3t0_, oscd.community date: 2020-11-15 modified: 2024-03-25 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_event detection: selection: TargetObject|contains: \Microsoft\Active Setup\Installed Components TargetObject|endswith: \StubPath filter_optional_chrome: Details|contains|all: - C:\Program Files\Google\Chrome\Application\ - \Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level filter_optional_edge: Details|contains: - C:\Program Files (x86)\Microsoft\Edge\Application\ - C:\Program Files\Microsoft\Edge\Application\ Details|endswith: \Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable condition: selection and not 1 of filter_optional_* falsepositives: - Legitimate modification of the registry key by legitimate program level: medium
Query: vulnerability: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, was found in calesanz gibb-modul-151. This affects the function bearbeiten/login. The manipula
Matching passage: CVE-2015-10052. CWE: CWE-601. CVSS: 6.099999904632568. ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, was found in calesanz gibb-modul-151. This affects the function bearbeiten/login. The manipulation leads to open redirect. It is possible to initiate the attack remotely. The patch is named 88a517dc19443081210c804b655e72770727540d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218379. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Near-miss passage: CVE-2015-3190. CWE: CWE-601. CVSS: 6.099999904632568. With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the UAA logout link is susceptible to an open redirect which allows an attacker to insert malicious web page as a redirect parameter.
Query: detection rule: Detects Obfuscated use of Clip.exe to execute PowerShell
Matching passage: Sigma rule: Detects Obfuscated use of Clip.exe to execute PowerShell. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation CLIP+ Launcher - PowerShell id: 73e67340-0d25-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of Clip.exe to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-13 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|re: cmd.{0,5}(?:/c|/r).+clip(?:\.exe)?.{0,4}&&.+clipboard]::\(\s\\"\{\d\}.+-f.+" condition: selection_4104 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unau. Logsource: linux / process_creation. Rule: title: Shell Invocation Via Ssh - Linux id: 8737b7f6-8df3-4bb7-b1da-06019b99b687 status: test description: 'Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. ' references: - https://gtfobins.github.io/gtfobins/ssh/ - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-08-29 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /ssh CommandLine|contains: - ProxyCommand=; - permitlocalcommand=yes - localhost selection_cli: CommandLine|contains: - /bin/bash - /bin/dash - /bin/fish - /bin/sh - /bin/zsh - sh 0<&2 1>&2 - sh 1>&2 0<&2 condition: all of selection_* falsepositives: - Unknown level: high
Query: common weakness: Improper Control of a Resource Through its Lifetime
Matching passage: CWE-664 Improper Control of a Resource Through its Lifetime. The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.
Near-miss passage: CWE-820 Missing Synchronization. The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.
Query: describe CVE-2015-0933
Matching passage: CVE-2015-0933. CWE: CWE-22. CVSS: 3.5. Absolute path traversal vulnerability in ShareLaTeX 0.1.3 and earlier, when the paranoid openin_any setting is omitted, allows remote authenticated users to read arbitrary files via a \include command.
Near-miss passage: CVE-2015-0552. CWE: CWE-22. CVSS: 6.400000095367432. Directory traversal vulnerability in the gcab_folder_extract function in libgcab/gcab-folder.c in gcab 0.4 allows remote attackers to write to arbitrary files via crafted path in a CAB file, as demonstrated by "\tmp\moo."