alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: SIEM correlation: collection activity consistent with Clipboard Data
Matching passage: T1115 Clipboard Data. Tactics: collection. Description: Adversaries may collect data stored in the clipboard from users copying information within or between applications. For example, on Windows adversaries can access clipboard data by using <code>clip.exe</code> or <code>Get-Clipboard</code>.(Citation: MSDN Clipboard)(Citation: clip_win_server)(Citation: CISA_AA21_200B) Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002)).(Citation: mining_ruby_reversinglabs) macOS and Linux also have commands, such as <code>pbpaste</code>, to grab clipboard contents.(Citation: Operating with EmPyre)
Near-miss passage: T1074.002 Remote Data Staging. Tactics: collection. Description: Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location. In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and stage data in that instance.(Citation: Mandiant M-Trends 2020) By staging data on one system prior to Exfiltration, adversaries can minimize the number of connections made to their C2 server and better evade detection.
Query: CVE similar to CVE-2015-7306
Matching passage: CVE-2015-7306. CWE: CWE-284. CVSS: 4.900000095367432. The CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal does not properly check access permissions, which allows remote authenticated users to access and change settings by leveraging the "access administration pages" permission.
Near-miss passage: CVE-2015-6552. CWE: CWE-284. CVSS: 9.800000190734863. The management-services protocol implementation in Veritas NetBackup 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2 and NetBackup Appliance through 2.5.4, 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, and 2.7.x before 2.7.2 allows remote attackers to make arbitrary RPC calls via unspecified vectors.
Query: exploit QuickTime 7 in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file
Matching passage: CVE-2015-3792. CWE: CWE-119. CVSS: 6.800000190734863. QuickTime 7 in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-3765, CVE-2015-3779, CVE-2015-3788, CVE-2015-3789, CVE-2015-3790, CVE-2015-3791, CVE-2015-5751, CVE-2015-5753, and CVE-2015-5779.
Near-miss passage: CVE-2015-5791. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Query: patch priority for CVE-2015-3844
Matching passage: CVE-2015-3844. CWE: CWE-264. CVSS: 6.800000190734863. The getProcessRecordLocked method in services/core/java/com/android/server/am/ActivityManagerService.java in ActivityManager in Android before 5.1.1 LMY48I allows attackers to trigger incorrect process loading via a crafted application, as demonstrated by interfering with use of the Settings application, aka internal bug 21669445.
Near-miss passage: CVE-2015-5511. CWE: CWE-264. CVSS: 5.0. The HybridAuth Social Login module 7.x-2.x before 7.x-2.13 for Drupal allows remote attackers to bypass the user registration by administrator only configuration and create an account via a social login.
Query: incident response steps for Encoded PowerShell / command-line abuse matching Steganography
Matching passage: Playbook for T1027.003 Steganography. 1) Validate alert telemetry against T1027.003. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files. [Duqu](https://attack.mitre.org/software/S0038) was an early example of malware that used steganography. It encrypted the gathered information from a victim's system and hi
Near-miss passage: Playbook for T1027.010 Command Obfuscation. Different response path focused on stealth.
Query: describe CVE-2015-5873
Matching passage: CVE-2015-5873. CWE: CWE-119. CVSS: 7.199999809265137. IOGraphics in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5871, CVE-2015-5872, and CVE-2015-5890.
Near-miss passage: CVE-2015-2415. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects potential PowerShell commands or code within registry run keys. Logsource: windows / registry_set. Rule: title: Suspicious PowerShell In Registry Run Keys id: 8d85cf08-bf97-4260-ba49-986a2a65129c status: test description: Detects potential PowerShell commands or code within registry run keys references: - https://github.com/frack113/atomic-red-team/blob/a9051c38de8a5320b31c7039efcbd3b56cf2d65a/atomics/T1547.001/T1547.001.md#atomic-test-9---systembc-malware-as-a-service-registry - https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md author: frack113, Florian Roth (Nextron Systems) date: 2022-03-17 modified: 2025-07-18 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Software\Microsoft\Windows\CurrentVersion\Run - \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Details|contains: - powershell - 'pwsh ' - FromBase64String - .DownloadFile( - .DownloadString( - ' -w hidden ' - ' -w 1 ' - -windowstyle hidden - -window hidden - ' -nop ' - ' -encodedcommand ' - -ExecutionPolicy Bypass - Invoke-Expression - IEX ( - Invoke-Command - ICM - - Invoke-WebRequest - 'IWR ' - Invoke-RestMethod - 'IRM ' - ' -noni ' - ' -noninteractive ' condition: selection falsepositives: - Legitimate admin or third party scripts. Baseline according to your environment level: medium
Near-miss passage: Sigma rule: Detects a file ending in jse, vbe, js, vba, vbs, wsf, wsh written by cscript.exe or wscript.exe. Logsource: windows / file_event. Rule: title: WScript or CScript Dropper - File id: 002bdb95-0cf1-46a6-9e08-d38c128a6127 related: - id: cea72823-df4d-4567-950c-0b579eaf0846 type: derived status: test description: Detects a file ending in jse, vbe, js, vba, vbs, wsf, wsh written by cscript.exe or wscript.exe references: - WScript or CScript Dropper (cea72823-df4d-4567-950c-0b579eaf0846) author: Tim Shelton date: 2022-01-10 modified: 2026-02-17 tags: - attack.execution - attack.t1059.005 - attack.t1059.007 logsource: category: file_event product: windows detection: selection: Image|endswith: - \wscript.exe - \cscript.exe TargetFilename|contains: - :\Perflogs\ - :\ProgramData\ - :\Temp\ - :\Tmp\ - :\Users\ - :\Windows\Temp\ - \AppData\Local\Temp - \AppData\Roaming\Temp - \Start Menu\Programs\Startup\ - \Temporary Internet TargetFilename|endswith: - .js - .jse - .vba - .vbe - .vbs - .wsf - .wsh condition: selection falsepositives: - Unknown level: high
Query: explain CWE-824
Matching passage: CWE-824 Access of Uninitialized Pointer. The product accesses or uses a pointer that has not been initialized.
Near-miss passage: CWE-1043 Data Element Aggregating an Excessively Large Number of Non-Primitive Elements. The product uses a data element that has an excessively large number of sub-elements with non-primitive data types such as structures or aggregated objects.
Query: CVE similar to CVE-2015-2213
Matching passage: CVE-2015-2213. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash.
Near-miss passage: CVE-2015-5659. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in Network Applied Communication Laboratory Pref Shimane CMS 2.x before 2.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Query: CVE similar to CVE-2015-7802
Matching passage: CVE-2015-7802. CWE: CWE-119. CVSS: 5.5. gifread.c in gif2png, as used in OptiPNG before 0.7.6, allows remote attackers to cause a denial of service (uninitialized memory read) via a crafted GIF file.
Near-miss passage: CVE-2015-5279. CWE: CWE-119. CVSS: 7.199999809265137. Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.
Query: Persistence mechanism resembling IDE Tunneling
Matching passage: T1219.001 IDE Tunneling. Tactics: command and control. Description: Adversaries may abuse Integrated Development Environment (IDE) software with remote development features to establish an interactive command and control channel on target systems within a network. IDE tunneling combines SSH, port forwarding, file sharing, and debugging into a single secure connection, letting developers work on remote systems as if they were local. Unlike SSH and port forwarding, IDE tunneling encapsulates an entire session and may use proprietary tunneling protocols alongside SSH, allowing adversaries to blend in with legitimate development workflows. Some IDEs, like Visual Studio Code, also provide CLI tools (e.g., `code tunnel`) that adversaries may use to programmatically establish tunnels and generate web-accessible URLs for remote access. These tunnels can be authenticated through accounts such as GitHub, enabling the adversary to control the compromised system via a legitimate developer portal.(Citation: sentinelone operationDigitalEye Dec 2024)(Citation: Unit42 Chinese VSCode 06 September 2024)(Citation: Thornton tutorial VSCode shell September 2023) Additionally, adversaries may use IDE tunneling for persistence. Some IDEs, such as Visual Studio Code and JetBrains, support automatic reconnection. Adversaries may configure the IDE to auto-launch at startup, re-establishing the tunnel upon execution. Compromised developer machines may also be exploited as jump hosts to move further into the network. IDE tunneling tools may be built-in or installed as [IDE Extensions](https://attack.mitre.org/techniques/T1176/002).
Near-miss passage: T1219.002 Remote Desktop Software. Tactics: command and control. Description: An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) Remote access modules/features may also exist as part of otherwise existing software such as Zoom or Google Chrome’s Remote Desktop.(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)
Query: detect Detects when a firewall rule is modified or deleted in Google Cloud Platform (GCP). in logs
Matching passage: Sigma rule: Detects when a firewall rule is modified or deleted in Google Cloud Platform (GCP).. Logsource: gcp / gcp.audit. Rule: title: Google Cloud Firewall Modified or Deleted id: fe513c69-734c-4d4a-8548-ac5f609be82b status: test description: Detects when a firewall rule is modified or deleted in Google Cloud Platform (GCP). references: - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging - https://developers.google.com/resources/api-libraries/documentation/compute/v1/java/latest/com/google/api/services/compute/Compute.Firewalls.html author: Austin Songer @austinsonger date: 2021-08-13 modified: 2022-10-09 tags: - attack.defense-impairment - attack.t1685 logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name: - v*.Compute.Firewalls.Delete - v*.Compute.Firewalls.Patch - v*.Compute.Firewalls.Update - v*.Compute.Firewalls.Insert condition: selection falsepositives: - Firewall rules being modified or deleted may be performed by a system administrator. Verify that the firewall configuration change was expected. - Exceptions can be added to this rule to filter expected behavior. level: medium
Near-miss passage: Sigma rule: Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace. Logsource: windows / process_access. Rule: title: Credential Dumping Attempt Via WerFault id: e5b33f7d-eb93-48b6-9851-09e1e610b6d7 status: test description: Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up. references: - https://github.com/helpsystems/nanodump/commit/578116faea3d278d53d70ea932e2bbfe42569507 author: Florian Roth (Nextron Systems) date: 2012-06-27 modified: 2023-11-29 tags: - attack.credential-access - attack.t1003.001 - attack.s0002 logsource: category: process_access product: windows detection: selection: SourceImage|endswith: \WerFault.exe TargetImage|endswith: \lsass.exe GrantedAccess: '0x1FFFFF' condition: selection falsepositives: - Actual failures in lsass.exe that trigger a crash dump (unlikely) - Unknown cases in which WerFault accesses lsass.exe level: high
Query: Multiple failed authentications followed by Scanning IP Blocks
Matching passage: T1595.001 Scanning IP Blocks. Tactics: reconnaissance. Description: Adversaries may scan victim IP blocks to gather information that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses. Adversaries may scan IP blocks in order to [Gather Victim Network Information](https://attack.mitre.org/techniques/T1590), such as which IP addresses are actively in use as well as more detailed information about hosts assigned these addresses. Scans may range from simple pings (ICMP requests and responses) to more nuanced scans that may reveal host software/versions via server banners or other network artifacts.(Citation: Botnet Scan) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Near-miss passage: T1595 Active Scanning. Tactics: reconnaissance. Description: Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction. Adversaries may perform different forms of active scanning depending on what information they seek to gather. These scans can also be performed in various ways, including using native features of network protocols such as ICMP.(Citation: Botnet Scan)(Citation: OWASP Fingerprinting) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).
Query: CVE similar to CVE-2015-3768
Matching passage: CVE-2015-3768. CWE: CWE-189. CVSS: 9.300000190734863. Integer overflow in the kernel in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context via a crafted app that makes unspecified IOKit API calls.
Near-miss passage: CVE-2015-3864. CWE: CWE-189. CVSS: 10.0. Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824.
Query: risk of Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attack
Matching passage: CVE-2015-3113. CWE: CWE-787. CVSS: 9.800000190734863. Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.
Near-miss passage: CVE-2015-2100. CWE: CWE-787. CVSS: 8.800000190734863. Multiple stack-based buffer overflows in WebGate eDVR Manager and Control Center allow remote attackers to execute arbitrary code via unspecified vectors to the (1) TCPDiscover or (2) TCPDiscover2 function in the WESPDiscovery.WESPDiscoveryCtrl.1 control.
Query: describe CVE-2015-6756
Matching passage: CVE-2015-6756. CWE: UNKNOWN. CVSS: 6.800000190734863. Use-after-free vulnerability in the CPDFSDK_PageView implementation in fpdfsdk/src/fsdk_mgr.cpp in PDFium, as used in Google Chrome before 46.0.2490.71, allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by leveraging mishandling of a focused annotation in a PDF document.
Near-miss passage: CVE-2015-3124. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
Query: detection rule: Detects when an account is disabled or blocked for sign in but tried to log in
Matching passage: Sigma rule: Detects when an account is disabled or blocked for sign in but tried to log in. Logsource: azure / signinlogs. Rule: title: Account Disabled or Blocked for Sign in Attempts id: 4afac85c-224a-4dd7-b1af-8da40e1c60bd status: test description: Detects when an account is disabled or blocked for sign in but tried to log in references: - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-privileged-accounts author: Yochana Henderson, '@Yochana-H' date: 2022-06-17 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078.004 logsource: product: azure service: signinlogs detection: selection: ResultType: 50057 ResultDescription: Failure condition: selection falsepositives: - Account disabled or blocked in error - Automation account has been blocked or disabled level: medium
Near-miss passage: Sigma rule: Detects the creation of new files with the ".evtx" extension in non-common or non-standard location. This could indicate. Logsource: windows / file_event. Rule: title: EVTX Created In Uncommon Location id: 65236ec7-ace0-4f0c-82fd-737b04fd4dcb status: test description: 'Detects the creation of new files with the ".evtx" extension in non-common or non-standard location. This could indicate tampering with default EVTX locations in order to evade security controls or simply exfiltration of event log to search for sensitive information within. Note that backup software and legitimate administrator might perform similar actions during troubleshooting. ' references: - https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key author: D3F7A5105 date: 2023-01-02 modified: 2024-03-26 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: file_event product: windows definition: 'Requirements: The ".evtx" extension should be monitored via a Sysmon configuration. Example: <TargetFilename condition="end with">.evtx<TargetFilename>' detection: selection: TargetFilename|endswith: .evtx filter_main_path: TargetFilename|startswith: C:\Windows\System32\winevt\Logs\ filter_main_baseimage: TargetFilename|startswith: C:\ProgramData\Microsoft\Windows\Containers\BaseImages\ TargetFilename|endswith: \Windows\System32\winevt\Logs\ condition: selection and not 1 of filter_main_* falsepositives: - Administrator or backup activity - An unknown bug seems to trigger the Windows "svchost" process to drop EVTX files in the "C:\Windows\Temp" directory in the form "<log_name">_<uuid>.evtx". See https://superuser.com/questions/1371229/low-disk-space-after-filling-up-c-windows-temp-with-evtx-and-txt-files level: medium regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_create_evtx_non_common_locations/info.yml