alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: hunt for External Defacement activity
Matching passage: T1491.002 External Defacement. Tactics: impact. Description: An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users. [External Defacement](https://attack.mitre.org/techniques/T1491/002) may ultimately cause users to distrust the systems and to question/discredit the system’s integrity. Externally-facing websites are a common victim of defacement; often targeted by adversary and hacktivist groups in order to push a political message or spread propaganda.(Citation: FireEye Cyber Threats to Media Industries)(Citation: Kevin Mandia Statement to US Senate Committee on Intelligence)(Citation: Anonymous Hackers Deface Russian Govt Site) [External Defacement](https://attack.mitre.org/techniques/T1491/002) may be used as a catalyst to trigger events, or as a response to actions taken by an organization or government. Similarly, website defacement may also be used as setup, or a precursor, for future attacks such as [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).(Citation: Trend Micro Deep Dive Into Defacement)
Near-miss passage: T1491 Defacement. Tactics: impact. Description: Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for [Defacement](https://attack.mitre.org/techniques/T1491) include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of [Defacement](https://attack.mitre.org/techniques/T1491) in order to cause user discomfort, or to pressure compliance with accompanying messages.
Query: Encoded PowerShell / command-line abuse matching Application Layer Protocol
Matching passage: T1071 Application Layer Protocol. Tactics: command and control. Description: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.(Citation: Mandiant APT29 Eye Spy Email Nov 22)
Near-miss passage: T1071.004 DNS. Tactics: command and control. Description: Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. The DNS protocol serves an administrative function in computer networking and thus may be very common in environments. DNS traffic may also be allowed even before network authentication is completed. DNS packets contain many fields and headers in which data can be concealed. Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: PAN DNS Tunneling)(Citation: Medium DnsTunneling) DNS beaconing may be used to send commands to remote systems via DNS queries. A DNS beacon is created by tunneling DNS traffic (i.e. [Protocol Tunneling](https://attack.mitre.org/techniques/T1572)). The commands may be embedded into different DNS records, for example, TXT or A records.(Citation: OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government) DNS beacons may be difficult to detect because the beacons infrequently communicate with infected devices.(Citation: DNS Beacons) Infrequent communication conceals the malicious DNS traffic with normal DNS traffic.
Query: describe CVE-2015-2035
Matching passage: CVE-2015-2035. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote administrators to execute arbitrary SQL commands via the user parameter in the history page to admin.php.
Near-miss passage: CVE-2015-1441. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Piwigo before 2.5.6, 2.6.x before 2.6.5, and 2.7.x before 2.7.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Query: detection engineering for File Deletion
Matching passage: T1070.004 File Deletion. Tactics: stealth. Description: Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint. There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well.(Citation: Microsoft SDelete July 2016) Examples of built-in [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) functions include <code>del</code> on Windows, <code>rm</code> or <code>unlink</code> on Linux and macOS, and `rm` on ESXi.
Near-miss passage: T1070.005 Network Share Connection Removal. Tactics: stealth. Description: Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the <code>net use \\system\share /delete</code> command. (Citation: Technet Net Use)
Query: describe CVE-2015-2694
Matching passage: CVE-2015-2694. CWE: CWE-264. CVSS: 5.800000190734863. The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1) zero bytes of data or (2) an arbitrary realm name, related to plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit_srv.c.
Near-miss passage: CVE-2015-5515. CWE: CWE-264. CVSS: 4.900000095367432. The Views Bulk Operations (VBO) module 6.x-1.x and 7.x-3.x before 7.x-3.3 for Drupal, when the bulk operation for changing Roles is enabled, allows remote authenticated users to edit user accounts and add arbitrary roles to the accounts by leveraging access to a user account listing view with VBO enabled.
Query: exploit Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.
Matching passage: CVE-2015-8654. CWE: CWE-787. CVSS: 8.800000190734863. Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via crafted MPEG-4 data, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, CVE-2015-8455, CVE-2015-8652, CVE-2015-8656, CVE-2015-8657, CVE-2015-8658, and CVE-2015-8820.
Near-miss passage: CVE-2015-2502. CWE: CWE-787. CVSS: 8.800000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," as exploited in the wild in August 2015.
Query: alert when Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.
Matching passage: Sigma rule: Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.. Logsource: azure / auditlogs. Rule: title: Guest User Invited By Non Approved Inviters id: 0b4b72e3-4c53-4d5b-b198-2c58cfef39a9 status: test description: Detects when a user that doesn't have permissions to invite a guest user attempts to invite one. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#things-to-monitor author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H' date: 2022-08-10 tags: - attack.privilege-escalation - attack.initial-access - attack.persistence - attack.stealth - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: properties.message: Invite external user Status: failure condition: selection falsepositives: - A non malicious user is unaware of the proper process level: medium
Near-miss passage: Sigma rule: Detects actions taken by Windows Defender malware detection engines. Logsource: windows / windefend. Rule: title: Windows Defender Threat Detected id: 57b649ef-ff42-4fb0-8bf6-62da243a1708 status: stable description: Detects actions taken by Windows Defender malware detection engines references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus author: Ján Trenčanský date: 2020-07-28 tags: - attack.execution - attack.t1059 logsource: product: windows service: windefend detection: selection: EventID: - 1006 - 1015 - 1116 - 1117 condition: selection falsepositives: - Unlikely level: high
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which. Logsource: windows / file_event. Rule: title: Suspicious MSExchangeMailboxReplication ASPX Write id: 7280c9f3-a5af-45d0-916a-bc01cb4151c9 status: test description: Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation references: - https://redcanary.com/blog/blackbyte-ransomware/ author: Florian Roth (Nextron Systems) date: 2022-02-25 tags: - attack.initial-access - attack.t1190 - attack.persistence - attack.t1505.003 logsource: product: windows category: file_event detection: selection: Image|endswith: \MSExchangeMailboxReplication.exe TargetFilename|endswith: - .aspx - .asp condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded. Logsource: windows / security. Rule: title: HackTool - NoFilter Execution id: 7b14c76a-c602-4ae6-9717-eff868153fc0 status: test description: 'Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators ' references: - https://github.com/deepinstinct/NoFilter/blob/121d215ab130c5e8e3ad45a7e7fcd56f4de97b4d/NoFilter/Consts.cpp - https://github.com/deepinstinct/NoFilter - https://www.deepinstinct.com/blog/nofilter-abusing-windows-filtering-platform-for-privilege-escalation - https://x.com/_st0pp3r_/status/1742203752361128162?s=20 author: Stamatis Chatzimangou (st0pp3r) date: 2024-01-05 tags: - attack.privilege-escalation - attack.stealth - attack.t1134 - attack.t1134.001 logsource: product: windows service: security definition: 'Requirements: Audit Filtering Platform Policy Change needs to be enabled' detection: selection_5447: EventID: 5447 FilterName|contains: RonPolicy selection_5449: EventID: 5449 ProviderContextName|contains: RonPolicy condition: 1 of selection_* falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-0120
Matching passage: CVE-2015-0120. CWE: CWE-119. CVSS: 7.5. Buffer overflow in the FastBackMount process in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.11.1 has unspecified impact and remote attack vectors.
Near-miss passage: CVE-2015-6600. CWE: CWE-119. CVSS: 10.0. libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22882938.
Query: weakness Incorrect Selection of Fuse Values
Matching passage: CWE-1253 Incorrect Selection of Fuse Values. The logic level used to set a system to a secure state relies on a fuse being unblown.
Near-miss passage: CWE-428 Unquoted Search Path or Element. The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
Query: risk of IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX001, and 7.6.0 before 7.6.0.1 IFIX001; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX001 and 7.6.0 bef
Matching passage: CVE-2015-1933. CWE: CWE-200. CVSS: 2.0999999046325684. IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX001, and 7.6.0 before 7.6.0.1 IFIX001; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX001 and 7.6.0 before 7.6.0.1 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products do not have an off autocomplete attribute for the password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
Near-miss passage: CVE-2015-6088. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Browser ASLR Bypass."
Query: patch priority for CVE-2015-5115
Matching passage: CVE-2015-5115. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3095, CVE-2015-5087, CVE-2015-5094, CVE-2015-5100, CVE-2015-5102, CVE-2015-5103, and CVE-2015-5104.
Near-miss passage: CVE-2015-7109. CWE: CWE-119. CVSS: 9.300000190734863. IOAcceleratorFamily in Apple OS X before 10.11.2 and tvOS before 9.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Query: Sigma rule for RDP login with localhost source address may be a tunnelled login
Matching passage: Sigma rule: RDP login with localhost source address may be a tunnelled login. Logsource: windows / security. Rule: title: RDP Login from Localhost id: 51e33403-2a37-4d66-a574-1fda1782cc31 status: test description: RDP login with localhost source address may be a tunnelled login references: - https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html author: Thomas Patzke date: 2019-01-28 modified: 2022-10-09 tags: - attack.lateral-movement - car.2013-07-002 - attack.t1021.001 logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 10 IpAddress: - ::1 - 127.0.0.1 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects remote RPC calls to create or execute a scheduled task. Logsource: rpc_firewall / application. Rule: title: Remote Schedule Task Lateral Movement via ITaskSchedulerService id: ace3ff54-e7fd-46bd-8ea0-74b49a0aca1d status: test description: Detects remote RPC calls to create or execute a scheduled task references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.lateral-movement - attack.t1053 - attack.t1053.002 logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:86d35949-83c9-4044-b424-db363231fd0c"' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 86d35949-83c9-4044-b424-db363231fd0c OpNum: - 1 - 3 - 4 - 10 - 11 - 12 - 13 - 14 - 15 condition: selection falsepositives: - Unknown level: high
Query: alert when Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-d
Matching passage: Sigma rule: Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-d. Logsource: windows / image_load. Rule: title: Potential Mpclient.DLL Sideloading id: 418dc89a-9808-4b87-b1d7-e5ae0cb6effc related: - id: 7002aa10-b8d4-47ae-b5ba-51ab07e228b9 type: similar status: test description: Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory. references: - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool author: Bhabesh Raj date: 2022-08-02 modified: 2023-08-04 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: image_load detection: selection: ImageLoaded|endswith: \mpclient.dll Image|endswith: - \MpCmdRun.exe - \NisSrv.exe filter_main_known_locations: Image|startswith: - C:\Program Files (x86)\Windows Defender\ - C:\Program Files\Microsoft Security Client\ - C:\Program Files\Windows Defender\ - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects command line parameters or strings often used by crypto miners. Logsource: linux / process_creation. Rule: title: Linux Crypto Mining Indicators id: 9069ea3c-b213-4c52-be13-86506a227ab1 status: test description: Detects command line parameters or strings often used by crypto miners references: - https://www.poolwatch.io/coin/monero author: Florian Roth (Nextron Systems) date: 2021-10-26 modified: 2022-12-25 tags: - attack.impact - attack.t1496 logsource: product: linux category: process_creation detection: selection: CommandLine|contains: - ' --cpu-priority=' - --donate-level=0 - ' -o pool.' - ' --nicehash' - ' --algo=rx/0 ' - stratum+tcp:// - stratum+udp:// - sh -c /sbin/modprobe msr allow_writes=on - LS1kb25hdGUtbGV2ZWw9 - 0tZG9uYXRlLWxldmVsP - tLWRvbmF0ZS1sZXZlbD - c3RyYXR1bSt0Y3A6Ly - N0cmF0dW0rdGNwOi8v - zdHJhdHVtK3RjcDovL - c3RyYXR1bSt1ZHA6Ly - N0cmF0dW0rdWRwOi8v - zdHJhdHVtK3VkcDovL condition: selection falsepositives: - Legitimate use of crypto miners level: high
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the Mover module 6.x-1.0 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML vi
Matching passage: CVE-2015-4366. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Mover module 6.x-1.0 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-3429. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HTML via a fragment identifier.
Query: patch priority for CVE-2015-9182
Matching passage: CVE-2015-9182. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, lack of input validation in OEMCrypto_GenerateSignature() can cause buffer over read.
Near-miss passage: CVE-2015-0661. CWE: CWE-20. CVSS: 4.0. The SNMPv2 implementation in Cisco IOS XR allows remote authenticated users to cause a denial of service (snmpd daemon reload) via a malformed SNMP packet, aka Bug ID CSCur25858.
Query: risk of Off-by-one error in the readBuf function in listener.cpp in libcapsinetwork and monopd before 0.9.8, allows remote attackers to cause a denial of service (crash) via a long line.
Matching passage: CVE-2015-0841. CWE: CWE-193. CVSS: 7.5. Off-by-one error in the readBuf function in listener.cpp in libcapsinetwork and monopd before 0.9.8, allows remote attackers to cause a denial of service (crash) via a long line.
Near-miss passage: CVE-2015-8701. CWE: CWE-193. CVSS: 6.5. QEMU (aka Quick Emulator) built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmit (tx) descriptors in 'tx_consume' routine, if a descriptor was to have more than allowed (ROCKER_TX_FRAGS_MAX=16) fragments. A privileged user inside guest could use this flaw to cause memory leakage on the host or crash the QEMU process instance resulting in DoS issue.
Query: describe CVE-2015-1558
Matching passage: CVE-2015-1558. CWE: CWE-399. CVSS: 3.5. Asterisk Open Source 12.x before 12.8.1 and 13.x before 13.1.1, when using the PJSIP channel driver, does not properly reclaim RTP ports, which allows remote authenticated users to cause a denial of service (file descriptor consumption) via an SDP offer containing only incompatible codecs.
Near-miss passage: CVE-2015-0765. CWE: CWE-399. CVSS: 5.0. Cisco ONS 15454 System Software 10.30 and 10.301 allows remote attackers to cause a denial of service (tNetTask CPU consumption or card reset) via a flood of (1) IP or (2) Ethernet traffic, aka Bug ID CSCus57263.