alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-7042
Matching passage: CVE-2015-7042. CWE: UNKNOWN. CVSS: 4.300000190734863. The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to cause a denial of service via a crafted app, a different vulnerability than CVE-2015-7040, CVE-2015-7041, and CVE-2015-7043.
Near-miss passage: CVE-2015-6713. CWE: UNKNOWN. CVSS: 7.5. The Function call implementation in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Query: risk of drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c in the Qualcomm components in Android before 2016-08-05 on Nexus 6 devices does not validate the stream state, which allows
Matching passage: CVE-2015-8942. CWE: CWE-264. CVSS: 7.800000190734863. drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c in the Qualcomm components in Android before 2016-08-05 on Nexus 6 devices does not validate the stream state, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28814652 and Qualcomm internal bug CR803246.
Near-miss passage: CVE-2015-5051. CWE: CWE-264. CVSS: 4.300000190734863. IBM Maximo Asset Management 7.5 before 7.5.0.8 IF6 and 7.6 before 7.6.0.2 IF1 and Maximo Asset Management 7.5 before 7.5.0.8 IF6, 7.5.1, and 7.6 before 7.6.0.2 IF1 for SmartCloud Control Desk allow remote authenticated users to bypass intended access restrictions on query results via unspecified vectors.
Query: exploit Off-by-one error in the pcapng_read function in wiretap/pcapng.c in the pcapng file parser in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to ca
Matching passage: CVE-2015-2189. CWE: CWE-189. CVSS: 5.0. Off-by-one error in the pcapng_read function in wiretap/pcapng.c in the pcapng file parser in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via an invalid Interface Statistics Block (ISB) interface ID in a crafted packet.
Near-miss passage: CVE-2015-4022. CWE: CWE-189. CVSS: 7.5. Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow.
Query: describe CVE-2015-7184
Matching passage: CVE-2015-7184. CWE: CWE-284. CVSS: 6.800000190734863. The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Near-miss passage: CVE-2015-8275. CWE: CWE-284. CVSS: 5.5. LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 allow attackers to write to arbitrary files via crafted EDOC files.
Query: rule covering Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools
Matching passage: Sigma rule: Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools. Logsource: windows / process_creation. Rule: title: Sticky Key Like Backdoor Execution id: 2fdefcb3-dbda-401e-ae23-f0db027628bc related: - id: baca5663-583c-45f9-b5dc-ea96a22ce542 type: derived status: test description: Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen references: - https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors author: Florian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community date: 2018-03-15 modified: 2023-03-07 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.008 - car.2014-11-003 - car.2014-11-008 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \winlogon.exe Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - \wt.exe CommandLine|contains: - sethc.exe - utilman.exe - osk.exe - Magnify.exe - Narrator.exe - DisplaySwitch.exe condition: selection falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both cre. Logsource: windows / process_creation. Rule: title: PUA - Mouse Lock Execution id: c9192ad9-75e5-43eb-8647-82a0a5b493e3 status: test description: In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents. references: - https://github.com/klsecservices/Publications/blob/657deb6a6eb6e00669afd40173f425fb49682eaa/Incident-Response-Analyst-Report-2020.pdf - https://sourceforge.net/projects/mouselock/ author: Cian Heasley date: 2020-08-13 modified: 2023-02-21 tags: - attack.credential-access - attack.collection - attack.t1056.002 logsource: product: windows category: process_creation detection: selection: - Product|contains: Mouse Lock - Company|contains: Misc314 - CommandLine|contains: Mouse Lock_ condition: selection falsepositives: - Legitimate uses of Mouse Lock software level: medium
Query: detect Number of VM creations or deployment activities occur in Azure via the azureactivity log. in logs
Matching passage: Sigma rule: Number of VM creations or deployment activities occur in Azure via the azureactivity log.. Logsource: azure / activitylogs. Rule: title: Number Of Resource Creation Or Deployment Activities id: d2d901db-7a75-45a1-bc39-0cbf00812192 status: test description: Number of VM creations or deployment activities occur in Azure via the azureactivity log. references: - https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/Creating_Anomalous_Number_Of_Resources_detection.yaml author: sawwinnnaung date: 2020-05-07 modified: 2023-10-11 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: azure service: activitylogs detection: keywords: - Microsoft.Compute/virtualMachines/write - Microsoft.Resources/deployments/write condition: keywords falsepositives: - Valid change level: medium
Near-miss passage: Sigma rule: Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload abo. Logsource: linux / process_creation. Rule: title: Linux Base64 Encoded Shebang In CLI id: fe2f9663-41cb-47e2-b954-8a228f3b9dff status: test description: Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload about to be decoded references: - https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html - https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-15 tags: - attack.stealth - attack.t1140 logsource: product: linux category: process_creation detection: selection: CommandLine|contains: - IyEvYmluL2Jhc2 - IyEvYmluL2Rhc2 - IyEvYmluL3pza - IyEvYmluL2Zpc2 - IyEvYmluL3No condition: selection falsepositives: - Legitimate administration activities level: medium
Query: detect Detect built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool. Simila in logs
Matching passage: Sigma rule: Detect built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool. Simila. Logsource: windows / ps_script. Rule: title: Disable-WindowsOptionalFeature Command PowerShell id: 99c4658d-2c5e-4d87-828d-7c066ca537c3 status: test description: 'Detect built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images ' references: - https://github.com/redcanaryco/atomic-red-team/blob/5b67c9b141fa3918017f8fa44f2f88f0b1ecb9e1/atomics/T1562.001/T1562.001.md - https://learn.microsoft.com/en-us/powershell/module/dism/disable-windowsoptionalfeature?view=windowsserver2022-ps author: frack113 date: 2022-09-10 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmd: ScriptBlockText|contains|all: - Disable-WindowsOptionalFeature - -Online - -FeatureName selection_feature: ScriptBlockText|contains: - Windows-Defender-Gui - Windows-Defender-Features - Windows-Defender - Windows-Defender-ApplicationGuard condition: all of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Obfuscated use of Clip.exe to execute PowerShell. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation CLIP+ Launcher - PowerShell id: 73e67340-0d25-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of Clip.exe to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-13 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|re: cmd.{0,5}(?:/c|/r).+clip(?:\.exe)?.{0,4}&&.+clipboard]::\(\s\\"\{\d\}.+-f.+" condition: selection_4104 falsepositives: - Unknown level: high
Query: Sigma rule for Detects a segmentation fault error message caused by a crashing apache worker process
Matching passage: Sigma rule: Detects a segmentation fault error message caused by a crashing apache worker process. Logsource: apache. Rule: title: Apache Segmentation Fault id: 1da8ce0b-855d-4004-8860-7d64d42063b1 status: test description: Detects a segmentation fault error message caused by a crashing apache worker process references: - http://www.securityfocus.com/infocus/1633 author: Florian Roth (Nextron Systems) date: 2017-02-28 modified: 2021-11-27 tags: - attack.impact - attack.t1499.004 logsource: service: apache definition: 'Requirements: Must be able to collect the error.log file' detection: keywords: - exit signal Segmentation Fault condition: keywords falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should. Logsource: windows / process_creation. Rule: title: PrintBrm ZIP Creation of Extraction id: cafeeba3-01da-4ab4-b6c4-a31b1d9730c7 status: test description: Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation. references: - https://lolbas-project.github.io/lolbas/Binaries/PrintBrm/ author: frack113 date: 2022-05-02 tags: - attack.command-and-control - attack.stealth - attack.t1105 - attack.t1564.004 logsource: product: windows category: process_creation detection: selection: Image|endswith: \PrintBrm.exe CommandLine|contains|all: - ' -f' - .zip condition: selection falsepositives: - Unknown level: high
Query: exploit Beckhoff IPC Diagnostics before 1.8 does not properly restrict access to functions in /config, which allows remote attackers to cause a denial of service (reboot or shutdown), crea
Matching passage: CVE-2015-4051. CWE: CWE-284. CVSS: 9.0. Beckhoff IPC Diagnostics before 1.8 does not properly restrict access to functions in /config, which allows remote attackers to cause a denial of service (reboot or shutdown), create arbitrary users, or possibly have unspecified other impact via a crafted request, as demonstrated by a beckhoff.com:service:cxconfig:1#Write SOAP action to /upnpisapi.
Near-miss passage: CVE-2015-2267. CWE: CWE-284. CVSS: 4.0. mdeploy.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass intended access restrictions and extract archives to arbitrary directories via a crafted dataroot value.
Query: CVE similar to CVE-2015-2570
Matching passage: CVE-2015-2570. CWE: UNKNOWN. CVSS: 6.5. Unspecified vulnerability in the Oracle Demand Planning component in Oracle Supply Chain Products Suite 11.5.10, 12.0, 12.1, and 12.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Security.
Near-miss passage: CVE-2015-8404. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: CVE similar to CVE-2015-8422
Matching passage: CVE-2015-8422. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-0253. CWE: UNKNOWN. CVSS: 5.0. The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) by sending a request that lacks a method to an installation that enables the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI.
Query: Sigma rule for Detects execution of "TroubleshootingPack" cmdlets to leverage CVE-2022-30190 or action similar to "msdt" lolbin (as des
Matching passage: Sigma rule: Detects execution of "TroubleshootingPack" cmdlets to leverage CVE-2022-30190 or action similar to "msdt" lolbin (as des. Logsource: windows / ps_script. Rule: title: Troubleshooting Pack Cmdlet Execution id: 03409c93-a7c7-49ba-9a4c-a00badf2a153 status: test description: Detects execution of "TroubleshootingPack" cmdlets to leverage CVE-2022-30190 or action similar to "msdt" lolbin (as described in LOLBAS) references: - https://twitter.com/nas_bench/status/1537919885031772161 - https://lolbas-project.github.io/lolbas/Binaries/Msdt/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-21 tags: - attack.stealth - attack.t1202 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Invoke-TroubleshootingPack - C:\Windows\Diagnostics\System\PCW - -AnswerFile - -Unattended condition: selection falsepositives: - Legitimate usage of "TroubleshootingPack" cmdlet for troubleshooting purposes level: medium
Near-miss passage: Sigma rule: Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege. Logsource: windows / process_creation. Rule: title: Always Install Elevated Windows Installer id: cd951fdc-4b2f-47f5-ba99-a33bf61e3770 status: test description: Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege references: - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-48-638.jpg author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community date: 2020-10-13 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: product: windows category: process_creation detection: selection_user: User|contains: - AUTHORI - AUTORI selection_image_1: Image|contains|all: - \Windows\Installer\ - msi Image|endswith: tmp selection_image_2: Image|endswith: \msiexec.exe IntegrityLevel: - System - S-1-16-16384 filter_installer: ParentImage: C:\Windows\System32\services.exe filter_repair: - CommandLine|endswith: \system32\msiexec.exe /V - ParentCommandLine|endswith: \system32\msiexec.exe /V filter_sophos: ParentImage|startswith: C:\ProgramData\Sophos\ filter_avira: ParentImage|startswith: C:\ProgramData\Avira\ filter_avast: ParentImage|startswith: - C:\Program Files\Avast Software\ - C:\Program Files (x86)\Avast Software\ filter_google_update: ParentImage|startswith: - C:\Program Files\Google\Update\ - C:\Program Files (x86)\Google\Update\ condition: 1 of selection_image_* and selection_user and not 1 of filter_* falsepositives: - System administrator usage - Anti virus products - WindowsApps located in "C:\Program Files\WindowsApps\" level: medium
Query: playbook for alert: Persistence mechanism resembling Launch Agent
Matching passage: Playbook for T1543.001 Launch Agent. 1) Validate alert telemetry against T1543.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: persistence, privilege escalation. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in <code>/System/Library/LaunchAgents</code>, <code>/Library/LaunchAgents</code>, and <code>~/Library/LaunchAgents</code>.
Near-miss passage: Playbook for T1543.003 Windows Service. Different response path focused on persistence, privilege escalation.
Query: exploit Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availabil
Matching passage: CVE-2015-0444. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality based on Trillium, a different vulnerability than CVE-2015-0443, CVE-2015-0445, CVE-2015-0446, CVE-2015-2634, CVE-2015-2635, CVE-2015-2636, CVE-2015-4758, and CVE-2015-4759.
Near-miss passage: CVE-2015-1250. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.135 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Query: what is T1135
Matching passage: T1135 Network Share Discovery. Tactics: discovery. Description: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. File sharing over a Windows network occurs over the SMB protocol. (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder) [Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the <code>net view \\\\remotesystem</code> command. It can also be used to query shared drives on the local system using <code>net share</code>. For macOS, the <code>sharing -l</code> command lists all shared points used for smb services.
Near-miss passage: T1518.002 Backup Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of backup software or configurations that are installed on a system. Adversaries may use this information to shape follow-on behaviors, such as [Data Destruction](https://attack.mitre.org/techniques/T1485), [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486). Commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), `reg query` with [Reg](https://attack.mitre.org/software/S0075), `dir` with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for, such as Veeam, Acronis, Dropbox, or Paragon.(Citation: Symantec Play Ransomware 2023)