alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to caus
Matching passage: CVE-2015-1790. CWE: UNKNOWN. CVSS: 5.0. The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a PKCS#7 blob that uses ASN.1 encoding and lacks inner EncryptedContent data.
Near-miss passage: CVE-2015-4796. CWE: UNKNOWN. CVSS: 9.0. Unspecified vulnerability in the Java VM component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2, when running on Windows, allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-4888.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the Quizzler module before 7-x.1.16 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a node title
Matching passage: CVE-2015-3376. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Quizzler module before 7-x.1.16 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a node title.
Near-miss passage: CVE-2015-2043. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Visualware MyConnection Server 8.2b allow remote attackers to inject arbitrary web script or HTML via the (1) bt, (2) variable, or (3) et parameter to myspeed/db/historyitem.
Query: write Sigma for Detects when a user enables DNS-over-HTTPS. This can be used to hide internet activity or be used to hide the process of
Matching passage: Sigma rule: Detects when a user enables DNS-over-HTTPS. This can be used to hide internet activity or be used to hide the process of. Logsource: windows / registry_set. Rule: title: DNS-over-HTTPS Enabled by Registry id: 04b45a8a-d11d-49e4-9acc-4a1b524407a5 status: test description: 'Detects when a user enables DNS-over-HTTPS. This can be used to hide internet activity or be used to hide the process of exfiltrating data. With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors. ' references: - https://www.tenforums.com/tutorials/151318-how-enable-disable-dns-over-https-doh-microsoft-edge.html - https://github.com/elastic/detection-rules/issues/1371 - https://chromeenterprise.google/policies/?policy=DnsOverHttpsMode - https://admx.help/HKLM/Software/Policies/Mozilla/Firefox/DNSOverHTTPS author: Austin Songer date: 2021-07-22 modified: 2023-08-17 tags: - attack.persistence - attack.stealth - attack.defense-impairment - attack.t1140 - attack.t1112 logsource: product: windows category: registry_set detection: selection_edge: TargetObject|endswith: \SOFTWARE\Policies\Microsoft\Edge\BuiltInDnsClientEnabled Details: DWORD (0x00000001) selection_chrome: TargetObject|endswith: \SOFTWARE\Google\Chrome\DnsOverHttpsMode Details: secure selection_firefox: TargetObject|endswith: \SOFTWARE\Policies\Mozilla\Firefox\DNSOverHTTPS\Enabled Details: DWORD (0x00000001) condition: 1 of selection_* falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Detects network connections from the Equation Editor process "eqnedt32.exe".. Logsource: windows / network_connection. Rule: title: Network Connection Initiated By Eqnedt32.EXE id: a66bc059-c370-472c-a0d7-f8fd1bf9d583 status: test description: Detects network connections from the Equation Editor process "eqnedt32.exe". references: - https://twitter.com/forensicitguy/status/1513538712986079238 - https://forensicitguy.github.io/xloader-formbook-velvetsweatshop-spreadsheet/ - https://news.sophos.com/en-us/2019/07/18/a-new-equation-editor-exploit-goes-commercial-as-maldoc-attacks-using-it-spike/ author: Max Altgelt (Nextron Systems) date: 2022-04-14 modified: 2024-05-31 tags: - attack.execution - attack.t1203 logsource: category: network_connection product: windows detection: selection: Image|endswith: \eqnedt32.exe condition: selection falsepositives: - Unlikely level: high
Query: risk of Buffer overflow in the XDRBuffer::grow function in js/src/vm/Xdr.cpp in Mozilla Firefox before 43.0 might allow remote attackers to cause a denial of service or possibly have unspe
Matching passage: CVE-2015-7220. CWE: CWE-119. CVSS: 10.0. Buffer overflow in the XDRBuffer::grow function in js/src/vm/Xdr.cpp in Mozilla Firefox before 43.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code.
Near-miss passage: CVE-2015-9118. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, MDM9635M, SD 400, SD 410/12, SD 615/16/SD 415, SD 800, SD 808, and SD 810, in ADSP's QDI Root-PD driver, untrusted arguments from User PD may cause integer overflow resulting in buffer overflow.
Query: alert when Detects changes to the "MaxMpxCt" registry value. MaxMpxCt specifies the maximum outstanding network requests for the se
Matching passage: Sigma rule: Detects changes to the "MaxMpxCt" registry value. MaxMpxCt specifies the maximum outstanding network requests for the se. Logsource: windows / registry_set. Rule: title: MaxMpxCt Registry Value Changed id: 0e6a9e62-627e-496c-aef5-bfa39da29b5e status: test description: 'Detects changes to the "MaxMpxCt" registry value. MaxMpxCt specifies the maximum outstanding network requests for the server per client, which is used when negotiating a Server Message Block (SMB) connection with a client. Note if the value is set beyond 125 older Windows 9x clients will fail to negotiate. Ransomware threat actors and operators (specifically BlackCat) were seen increasing this value in order to handle a higher volume of traffic. ' references: - https://www.huntress.com/blog/blackcat-ransomware-affiliate-ttps - https://securityscorecard.com/research/deep-dive-into-alphv-blackcat-ransomware - https://www.intrinsec.com/alphv-ransomware-gang-analysis/?cn-reloaded=1 - https://www.sentinelone.com/labs/blackcat-ransomware-highly-configurable-rust-driven-raas-on-the-prowl-for-victims/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-03-19 tags: - attack.stealth - attack.t1070.005 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Services\LanmanServer\Parameters\MaxMpxCt condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows p. Logsource: windows / process_creation. Rule: title: New Capture Session Launched Via DXCap.EXE id: 60f16a96-db70-42eb-8f76-16763e333590 status: test description: 'Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows package through DXCap itself. This can be abused to potentially bypass application whitelisting. ' references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dxcap/ - https://twitter.com/harr0ey/status/992008180904419328 author: Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2019-10-26 modified: 2022-06-09 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \DXCap.exe - OriginalFileName: DXCap.exe selection_cli: CommandLine|contains: ' -c ' condition: all of selection* falsepositives: - Legitimate execution of dxcap.exe by legitimate user level: medium
Query: risk of Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to execute arbitrary PH
Matching passage: CVE-2015-4133. CWE: UNKNOWN. CVSS: 7.5. Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in uploads/ directory.
Near-miss passage: CVE-2015-8327. CWE: UNKNOWN. CVSS: 7.5. Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.2.0 and in foomatic-filters in Foomatic 4.0.x allows remote attackers to execute arbitrary commands via ` (backtick) characters in a print job.
Query: risk of Cross-site scripting (XSS) vulnerability in the login page in Cisco TC Software before 7.1.0 on Cisco TelePresence Collaboration Desk and Room Endpoints devices allows remote attac
Matching passage: CVE-2015-0696. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the login page in Cisco TC Software before 7.1.0 on Cisco TelePresence Collaboration Desk and Room Endpoints devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuq94977.
Near-miss passage: CVE-2015-8795. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in the Admin UI in Apache Solr before 5.1 allow remote attackers to inject arbitrary web script or HTML via crafted fields that are mishandled during the rendering of the (1) Analysis page, related to webapp/web/js/scripts/analysis.js or (2) Schema-Browser page, related to webapp/web/js/scripts/schema-browser.js.
Query: patch priority for CVE-2015-1051
Matching passage: CVE-2015-1051. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the Context UI module in the Context module 7.x-3.x before 7.x-3.6 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter.
Near-miss passage: CVE-2015-7228. CWE: UNKNOWN. CVSS: 5.0. The RESTful module 7.x-1.x before 7.x-1.3 for Drupal does not properly cache pages of authenticated users when using non-cookie authentication providers, which allows remote attackers to obtain sensitive information via unspecified vectors.
Query: CVE similar to CVE-2015-7875
Matching passage: CVE-2015-7875. CWE: CWE-264. CVSS: 7.5. ctools 6.x-1.x before 6.x-1.14 and 7.x-1.x before 7.x-1.8 in Drupal does not verify the "edit" permission for the "content type" plugins that are used on Panels and similar systems to place content and functionality on a page.
Near-miss passage: CVE-2015-5633. CWE: CWE-264. CVSS: 6.800000190734863. The Newphoria Auction Camera application for iOS and before 1.2 for Android allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
Query: exploit Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition.
Matching passage: CVE-2015-0438. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition.
Near-miss passage: CVE-2015-4822. CWE: UNKNOWN. CVSS: 1.2000000476837158. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than CVE-2015-4831.
Query: rule covering Detects calls to hidden files or files located in hidden directories in NIX systems.
Matching passage: Sigma rule: Detects calls to hidden files or files located in hidden directories in NIX systems.. Logsource: linux / auditd. Rule: title: Use Of Hidden Paths Or Files id: 9e1bef8d-0fff-46f6-8465-9aa54e128c1e related: - id: d08722cd-3d09-449a-80b4-83ea2d9d4616 type: similar status: test description: Detects calls to hidden files or files located in hidden directories in NIX systems. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md author: David Burkett, @signalblur date: 2022-12-30 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: linux service: auditd detection: selection: type: PATH name|contains: /. filter: name|contains: - /.cache/ - /.config/ - /.pyenv/ - /.rustup/toolchains condition: selection and not filter falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with suspicious Addinroot or Pipeliner. Logsource: windows / process_creation. Rule: title: Suspicious AddinUtil.EXE CommandLine Execution id: 631b22a4-70f4-4e2f-9ea8-42f84d9df6d8 status: test description: 'Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with suspicious Addinroot or Pipelineroot paths. An adversary may execute AddinUtil.exe with uncommon Addinroot/Pipelineroot paths that point to the adversaries Addins.Store payload. ' references: - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html author: Nasreddine Bencherchali (Nextron Systems), Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri) date: 2023-09-18 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \addinutil.exe - OriginalFileName: AddInUtil.exe selection_susp_1_flags: CommandLine|contains: - '-AddInRoot:' - '-PipelineRoot:' selection_susp_1_paths: CommandLine|contains: - \AppData\Local\Temp\ - \Desktop\ - \Downloads\ - \Users\Public\ - \Windows\Temp\ selection_susp_2: CommandLine|contains: - -AddInRoot:. - -AddInRoot:"." - -PipelineRoot:. - -PipelineRoot:"." CurrentDirectory|contains: - \AppData\Local\Temp\ - \Desktop\ - \Downloads\ - \Users\Public\ - \Windows\Temp\ condition: selection_img and (all of selection_susp_1_* or selection_susp_2) falsepositives: - Unknown level: high
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects suspicious command line flags that let the user set a target user and command as e.g. seen in PsExec-like tools. Logsource: windows / process_creation. Rule: title: Suspicious RunAs-Like Flag Combination id: 50d66fb0-03f8-4da0-8add-84e77d12a020 status: test description: Detects suspicious command line flags that let the user set a target user and command as e.g. seen in PsExec-like tools references: - https://www.trendmicro.com/en_us/research/22/k/hack-the-real-box-apt41-new-subgroup-earth-longzhi.html author: Florian Roth (Nextron Systems) date: 2022-11-11 tags: - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection_user: CommandLine|contains: - ' -u system ' - ' --user system ' - ' -u NT' - ' -u "NT' - ' -u ''NT' - ' --system ' - ' -u administrator ' selection_command: CommandLine|contains: - ' -c cmd' - ' -c "cmd' - ' -c powershell' - ' -c "powershell' - ' --command cmd' - ' --command powershell' - ' -c whoami' - ' -c wscript' - ' -c cscript' condition: all of selection* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects usage of bitsadmin downloading a file using an URL that contains an IP. Logsource: windows / process_creation. Rule: title: Suspicious Download From Direct IP Via Bitsadmin id: 99c840f2-2012-46fd-9141-c761987550ef related: - id: 90f138c1-f578-4ac3-8c49-eecfd847c8b7 type: similar status: test description: Detects usage of bitsadmin downloading a file using an URL that contains an IP references: - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin - https://isc.sans.edu/diary/22264 - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ - https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/ author: Florian Roth (Nextron Systems) date: 2022-06-28 modified: 2023-02-15 tags: - attack.persistence - attack.execution - attack.stealth - attack.t1197 - attack.s0190 - attack.t1036.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \bitsadmin.exe - OriginalFileName: bitsadmin.exe selection_flags: CommandLine|contains: - ' /transfer ' - ' /create ' - ' /addfile ' selection_extension: CommandLine|contains: - ://1 - ://2 - ://3 - ://4 - ://5 - ://6 - ://7 - ://8 - ://9 filter_seven_zip: CommandLine|contains: ://7- condition: all of selection_* and not 1 of filter_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_direct_ip/info.yml
Query: CVE similar to CVE-2015-5903
Matching passage: CVE-2015-5903. CWE: CWE-119. CVSS: 10.0. The kernel in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5868 and CVE-2015-5896.
Near-miss passage: CVE-2015-6678. CWE: CWE-119. CVSS: 10.0. Buffer overflow in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-6676.
Query: describe CVE-2015-9141
Matching passage: CVE-2015-9141. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 615/16/SD 415, SD 617, SD 800, SD 808, and SD 810, in HHO scenarios, during the ACQ procedure, there are possible instances where the search database is incorrectly updated resulting in memory corruption due to buffer overflow.
Near-miss passage: CVE-2015-3770. CWE: CWE-119. CVSS: 9.300000190734863. IOGraphics in Apple OS X before 10.10.5 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-5783.
Query: detection rule: Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type
Matching passage: Sigma rule: Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type. Logsource: windows / process_creation. Rule: title: Suspicious Schtasks Schedule Type With High Privileges id: 7a02e22e-b885-4404-b38b-1ddc7e65258a related: - id: 24c8392b-aa3c-46b7-a545-43f71657fe98 type: similar status: test description: Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-change - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-31 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_time: CommandLine|contains: - ' ONLOGON ' - ' ONSTART ' - ' ONCE ' - ' ONIDLE ' selection_privs: CommandLine|contains: - NT AUT - ' SYSTEM' - HIGHEST condition: all of selection_* falsepositives: - Some installers were seen using this method of creation unfortunately. Filter them in your environment level: medium
Near-miss passage: Sigma rule: Files with well-known filenames (sensitive files with credential data) copying. Logsource: windows / process_creation. Rule: title: Copying Sensitive Files with Credential Data id: e7be6119-fc37-43f0-ad4f-1f3f99be2f9f status: test description: Files with well-known filenames (sensitive files with credential data) copying references: - https://room362.com/post/2013/2013-06-10-volume-shadow-copy-ntdsdit-domain-hashes-remotely-part-1/ - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment - https://dfironthemountain.wordpress.com/2018/12/06/locked-file-access-using-esentutl-exe/ - https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Esentutl.yml author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community date: 2019-10-22 modified: 2024-06-04 tags: - attack.credential-access - attack.t1003.002 - attack.t1003.003 - car.2013-07-001 - attack.s0404 logsource: category: process_creation product: windows detection: selection_esent_img: - Image|endswith: \esentutl.exe - OriginalFileName: \esentutl.exe selection_esent_cli: CommandLine|contains|windash: - vss - ' /m ' - ' /y ' selection_susp_paths: CommandLine|contains: - \config\RegBack\sam - \config\RegBack\security - \config\RegBack\system - \config\sam - \config\security - '\config\system ' - \repair\sam - \repair\security - \repair\system - \windows\ntds\ntds.dit condition: all of selection_esent_* or selection_susp_paths falsepositives: - Copying sensitive files for legitimate use (eg. backup) or forensic investigation by legitimate incident responder or forensic investigator. level: high
Query: Multiple failed authentications followed by Compromise Software Dependencies and Development Tools
Matching passage: T1195.001 Compromise Software Dependencies and Development Tools. Tactics: initial access. Description: Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise)(Citation: Bitdefender NPM Repositories Compromised 2021)(Citation: MANDVI Malicious npm and PyPI Packages Disguised) This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by adversaries.(Citation: The Hacker News PyPi Revival Hijack 2024) Adversaries may also employ "typosquatting" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user.(Citation: Ahmed Backdoors in Python and NPM Packages)(Citation: Meyer PyPI Supply Chain Attack Uncovered)(Citation: Checkmarx-oss-seo) Additionally, CI/CD pipeline components, such as GitHub Actions, may be targeted in order to gain access to the building, testing, and deployment cycles of an application.(Citation: Unit 42 Palo Alto GitHub Actions Supply Chain Attack 2025) By adding malicious code into a GitHub action, a threat actor may be able to collect runtime credentials (e.g., via [Proc Filesystem](https://attack.mitre.org/techniques/T1003/007)) or insert further malicious components into the build pipelines for a second-order supply chain compromise.(Citation: OWASP CICD-SEC-4) As GitHub Actions are often dependent on other GitHub Actions, threat actors may be able to infect a large number of repositories via the compromise of a single Action.(Citation: Palo Alto Networks GitHub Actions Worm 2023) Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.
Near-miss passage: T1195.002 Compromise Software Supply Chain. Tactics: initial access. Description: Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version. Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.(Citation: Avast CCleaner3 2018)(Citation: Command Five SK 2011)