alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Modify Cloud Compute Infrastructure
Matching passage: T1578 Modify Cloud Compute Infrastructure. Tactics: defense impairment. Description: An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots. Permissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure. Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence.(Citation: Mandiant M-Trends 2020)
Near-miss passage: T1578.003 Delete Cloud Instance. Tactics: defense impairment. Description: An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence. Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable. An adversary may also [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and later terminate the instance after achieving their objectives.(Citation: Mandiant M-Trends 2020)
Query: detection rule: Detects "svchost.exe" spawning "rundll32.exe" with command arguments like "C:\windows\system32\davclnt.dll,DavSetCookie"
Matching passage: Sigma rule: Detects "svchost.exe" spawning "rundll32.exe" with command arguments like "C:\windows\system32\davclnt.dll,DavSetCookie". Logsource: windows / process_creation. Rule: title: WebDav Client Execution Via Rundll32.EXE id: 2dbd9d3d-9e27-42a8-b8df-f13825c6c3d5 status: test description: 'Detects "svchost.exe" spawning "rundll32.exe" with command arguments like "C:\windows\system32\davclnt.dll,DavSetCookie". This could be an indicator of exfiltration or use of WebDav to launch code (hosted on a WebDav server). ' references: - https://github.com/OTRF/detection-hackathon-apt29/issues/17 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/7.B.4_C10730EA-6345-4934-AA0F-B0EFCA0C4BA6.md author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2023-09-18 tags: - attack.exfiltration - attack.t1048.003 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \svchost.exe selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|contains: C:\windows\system32\davclnt.dll,DavSetCookie condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Sysmon registry detection of a local hidden user account.. Logsource: windows / registry_event. Rule: title: Creation of a Local Hidden User Account by Registry id: 460479f3-80b7-42da-9c43-2cc1d54dbccd status: test description: Sysmon registry detection of a local hidden user account. references: - https://twitter.com/SBousseaden/status/1387530414185664538 author: Christian Burkard (Nextron Systems) date: 2021-05-03 modified: 2025-10-31 tags: - attack.persistence - attack.t1136.001 logsource: product: windows category: registry_event detection: selection: TargetObject|contains: \SAM\SAM\Domains\Account\Users\Names\ TargetObject|endswith: $\(Default) Image|endswith: \lsass.exe condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_event/registry_event_add_local_hidden_user/info.yml simulation: - type: atomic-red-team name: Create Hidden User in Registry technique: T1564.002 atomic_guid: 173126b7-afe4-45eb-8680-fa9f6400431c
Query: vulnerability: Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 allows remote attackers to inject arbitrary web scr
Matching passage: CVE-2015-2543. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."
Near-miss passage: CVE-2015-9373. CWE: CWE-79. CVSS: 6.099999904632568. PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Query: exploit Multiple buffer overflows in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I allow remote attackers to execute arbitrary code via invalid size values of NAL uni
Matching passage: CVE-2015-3832. CWE: CWE-119. CVSS: 10.0. Multiple buffer overflows in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I allow remote attackers to execute arbitrary code via invalid size values of NAL units in MP4 data, aka internal bug 19641538.
Near-miss passage: CVE-2015-0100. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Query: describe CVE-2015-1636
Matching passage: CVE-2015-1636. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2013 Gold and SP1 and SharePoint Server 2013 Gold and SP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."
Near-miss passage: CVE-2015-0129. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager (RQM) 4.x before 4.0.7 iFix3 and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: detection rule: Detects suspicious encoded payloads in WMI Event Consumers
Matching passage: Sigma rule: Detects suspicious encoded payloads in WMI Event Consumers. Logsource: windows / wmi_event. Rule: title: Suspicious Encoded Scripts in a WMI Consumer id: 83844185-1c5b-45bc-bcf3-b5bf3084ca5b status: test description: Detects suspicious encoded payloads in WMI Event Consumers references: - https://github.com/RiccardoAncarani/LiquidSnake author: Florian Roth (Nextron Systems) date: 2021-09-01 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.execution - attack.t1047 - attack.persistence - attack.t1546.003 logsource: product: windows category: wmi_event detection: selection_destination: Destination|base64offset|contains: - WriteProcessMemory - This program cannot be run in DOS mode - This program must be run under Win32 condition: selection_destination falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the deletion of a prefetch file which may indicate an attempt to destroy forensic evidence. Logsource: windows / file_delete. Rule: title: Prefetch File Deleted id: 0a1f9d29-6465-4776-b091-7f43b26e4c89 status: test description: Detects the deletion of a prefetch file which may indicate an attempt to destroy forensic evidence references: - Internal Research - https://www.group-ib.com/blog/hunting-for-ttps-with-prefetch-files/ author: Cedric MAURUGEON date: 2021-09-29 modified: 2024-01-25 tags: - attack.stealth - attack.t1070.004 logsource: product: windows category: file_delete detection: selection: TargetFilename|contains: :\Windows\Prefetch\ TargetFilename|endswith: .pf filter_main_svchost: Image|endswith: :\windows\system32\svchost.exe User|contains: - AUTHORI - AUTORI condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: hunt for /etc/passwd and /etc/shadow activity
Matching passage: T1003.008 /etc/passwd and /etc/shadow. Tactics: credential access. Description: Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable offline password cracking. Most modern Linux operating systems use a combination of <code>/etc/passwd</code> and <code>/etc/shadow</code> to store user account information, including password hashes in <code>/etc/shadow</code>. By default, <code>/etc/shadow</code> is only readable by the root user.(Citation: Linux Password and Shadow File Formats) Linux stores user information such as user ID, group ID, home directory path, and login shell in <code>/etc/passwd</code>. A "user" on the system may belong to a person or a service. All password hashes are stored in <code>/etc/shadow</code> - including entries for users with no passwords and users with locked or disabled accounts.(Citation: Linux Password and Shadow File Formats) Adversaries may attempt to read or dump the <code>/etc/passwd</code> and <code>/etc/shadow</code> files on Linux systems via command line utilities such as the <code>cat</code> command.(Citation: Arctic Wolf) Additionally, the Linux utility <code>unshadow</code> can be used to combine the two files in a format suited for password cracking utilities such as John the Ripper - for example, via the command <code>/usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.password.db</code>(Citation: nixCraft - John the Ripper). Since the user information stored in <code>/etc/passwd</code> are linked to the password hashes in <code>/etc/shadow</code>, an adversary would need to have access to both.
Near-miss passage: T1003 OS Credential Dumping. Tactics: credential access. Description: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures.(Citation: Brining MimiKatz to Unix) Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.
Query: explain CWE-1024
Matching passage: CWE-1024 Comparison of Incompatible Types. The product performs a comparison between two entities, but the entities are of different, incompatible types that cannot be guaranteed to provide correct results when they are directly compared.
Near-miss passage: CWE-597 Use of Wrong Operator in String Comparison. The product uses the wrong operator when comparing a string, such as using == when the .equals() method should be used instead.
Query: vulnerability: cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar 
Matching passage: CVE-2015-3143. CWE: CWE-264. CVSS: 5.0. cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.
Near-miss passage: CVE-2015-6101. CWE: CWE-264. CVSS: 6.900000095367432. The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-6100.
Query: ATT&CK technique for Exfiltration over USB
Matching passage: T1052.001 Exfiltration over USB. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
Near-miss passage: T1052 Exfiltration Over Physical Medium. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
Query: alert when Detects the execution of the "cloudflared" binary from a non standard location.
Matching passage: Sigma rule: Detects the execution of the "cloudflared" binary from a non standard location.. Logsource: windows / process_creation. Rule: title: Cloudflared Portable Execution id: fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd status: test description: 'Detects the execution of the "cloudflared" binary from a non standard location. ' references: - https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/ - https://github.com/cloudflare/cloudflared - https://www.intrinsec.com/akira_ransomware/ - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/ - https://github.com/cloudflare/cloudflared/releases author: Nasreddine Bencherchali (Nextron Systems) tags: - attack.command-and-control - attack.t1090.001 date: 2023-12-20 logsource: category: process_creation product: windows detection: selection: Image|endswith: \cloudflared.exe filter_main_admin_location: Image|contains: - :\Program Files (x86)\cloudflared\ - :\Program Files\cloudflared\ condition: selection and not 1 of filter_main_* falsepositives: - Legitimate usage of Cloudflared portable versions level: medium
Near-miss passage: Sigma rule: Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.. Logsource: windows / process_creation. Rule: title: Potential DLL File Download Via PowerShell Invoke-WebRequest id: 0f0450f3-8b47-441e-a31b-15a91dc243e2 status: test description: Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets. references: - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution author: Florian Roth (Nextron Systems), Hieu Tran date: 2023-03-13 modified: 2025-07-18 tags: - attack.command-and-control - attack.execution - attack.t1059.001 - attack.t1105 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - 'Invoke-RestMethod ' - 'Invoke-WebRequest ' - 'IRM ' - 'IWR ' CommandLine|contains|all: - http - OutFile - .dll condition: selection falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-5067
Matching passage: CVE-2015-5067. CWE: CWE-255. CVSS: 7.5. The (1) Cross-System Tools and (2) Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, which allows remote attackers to obtain access via unspecified vectors, aka SAP Security Notes 2059659 and 2057982.
Near-miss passage: CVE-2015-4319. CWE: CWE-255. CVSS: 5.5. The password-change feature in the administrative web interface in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.1 improperly performs authorization, which allows remote authenticated users to reset arbitrary active-user passwords via unspecified vectors, aka Bug ID CSCuv12338.
Query: exploit Multiple cross-site scripting (XSS) vulnerabilities in Cisco Finesse 10.5(1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET o
Matching passage: CVE-2015-4310. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Cisco Finesse 10.5(1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug IDs CSCuq82322, CSCut95853, and CSCuq73975.
Near-miss passage: CVE-2015-2973. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the Welcart plugin before 1.4.18 for WordPress allow remote attackers to inject arbitrary web script or HTML via the usces_referer parameter to (1) classes/usceshop.class.php, (2) includes/edit-form-advanced.php, (3) includes/edit-form-advanced30.php, (4) includes/edit-form-advanced34.php, (5) includes/member_edit_form.php, (6) includes/order_edit_form.php, (7) includes/order_list.php, or (8) includes/usces_item_master_list.php, related to admin.php.
Query: Lateral movement indicators for Establish Accounts
Matching passage: T1585 Establish Accounts. Tactics: resource development. Description: Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) For operations incorporating social engineering, the utilization of an online persona may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, GitHub, Docker Hub, etc.). Establishing a persona may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) Establishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) In addition, establishing accounts may allow adversaries to abuse free services, such as registering for trial periods to [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) for malicious purposes.(Citation: Free Trial PurpleUrchin)
Near-miss passage: T1585.003 Cloud Accounts. Tactics: resource development. Description: Adversaries may create accounts with cloud providers that can be used during targeting. Adversaries can use cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, MEGA, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s. Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure. Establishing cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud) Creating [Cloud Accounts](https://attack.mitre.org/techniques/T1585/003) may also require adversaries to establish [Email Accounts](https://attack.mitre.org/techniques/T1585/002) to register with the cloud provider.
Query: describe CVE-2015-8724
Matching passage: CVE-2015-8724. CWE: CWE-20. CVSS: 5.5. The AirPDcapDecryptWPABroadcastKey function in epan/crypt/airpdcap.c in the 802.11 dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not verify the WPA broadcast key length, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.
Near-miss passage: CVE-2015-1086. CWE: CWE-20. CVSS: 6.900000095367432. The Audio Drivers subsystem in Apple iOS before 8.3 and Apple TV before 7.2 does not properly validate IOKit object metadata, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
Query: alert when Detects the download of suspicious file type from URLs with IP
Matching passage: Sigma rule: Detects the download of suspicious file type from URLs with IP. Logsource: windows / create_stream_hash. Rule: title: Unusual File Download from Direct IP Address id: 025bd229-fd1f-4fdb-97ab-20006e1a5368 status: test description: Detects the download of suspicious file type from URLs with IP references: - https://github.com/trustedsec/SysmonCommunityGuide/blob/adcdfee20999f422b974c8d4149bf4c361237db7/chapters/file-stream-creation-hash.md - https://labs.withsecure.com/publications/detecting-onenote-abuse author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) date: 2022-09-07 modified: 2023-02-10 tags: - attack.stealth - attack.t1564.004 logsource: product: windows category: create_stream_hash detection: selection: Contents|re: http[s]?://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3} TargetFilename|contains: - .ps1:Zone - .bat:Zone - .exe:Zone - .vbe:Zone - .vbs:Zone - .dll:Zone - .one:Zone - .cmd:Zone - .hta:Zone - .xll:Zone - .lnk:Zone condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of powershell scripts via Runscripthelper.exe. Logsource: windows / process_creation. Rule: title: Suspicious Runscripthelper.exe id: eca49c87-8a75-4f13-9c73-a5a29e845f03 status: test description: Detects execution of powershell scripts via Runscripthelper.exe references: - https://lolbas-project.github.io/lolbas/Binaries/Runscripthelper/ author: Victor Sergeev, oscd.community date: 2020-10-09 modified: 2022-07-11 tags: - attack.execution - attack.stealth - attack.t1059 - attack.t1202 logsource: category: process_creation product: windows detection: selection: Image|endswith: \Runscripthelper.exe CommandLine|contains: surfacecheck condition: selection falsepositives: - Unknown level: medium
Query: vulnerability: The ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows remote authenticated users to obtain sensitive password information via a crafted URL.
Matching passage: CVE-2015-1618. CWE: CWE-200. CVSS: 4.0. The ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows remote authenticated users to obtain sensitive password information via a crafted URL.
Near-miss passage: CVE-2015-3373. CWE: CWE-200. CVSS: 5.0. The Amazon AWS module before 7.x-1.3 for Drupal uses the base URL and AWS access key to generate the access token, which makes it easier for remote attackers to guess the token value and create backups via a crafted URL.
Query: describe CVE-2015-1421
Matching passage: CVE-2015-1421. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in the sctp_assoc_update function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service (slab corruption and panic) or possibly have unspecified other impact by triggering an INIT collision that leads to improper handling of shared-key data.
Near-miss passage: CVE-2015-1002. CWE: UNKNOWN. CVSS: 6.400000095367432. IniNet embeddedWebServer (aka eWebServer) before 2.02 mishandles URL encoding, which allows remote attackers to write to or delete files via a crafted string.
Query: exploit Samsung wssyncmlnps before 2015-10-31 allows directory traversal in a Kies restore, aka ZipFury.
Matching passage: CVE-2015-8780. CWE: CWE-22. CVSS: 6.400000095367432. Samsung wssyncmlnps before 2015-10-31 allows directory traversal in a Kies restore, aka ZipFury.
Near-miss passage: CVE-2015-6003. CWE: CWE-22. CVSS: 9.300000190734863. Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.