alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Persistence mechanism resembling Modify Registry
Matching passage: T1112 Modify Registry. Tactics: defense impairment, persistence. Description: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution. Access to specific areas of the Registry depends on account permissions, with some keys requiring administrator-level access. The built-in Windows command-line utility [Reg](https://attack.mitre.org/software/S0075) may be used for local or remote Registry modification.(Citation: Microsoft Reg) Other tools, such as remote access tools, may also contain functionality to interact with the Registry through the Windows API. The Registry may be modified in order to hide configuration information or malicious payloads via [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027).(Citation: Unit42 BabyShark Feb 2019)(Citation: Avaddon Ransomware 2021)(Citation: Microsoft BlackCat Jun 2022)(Citation: CISA Russian Gov Critical Infra 2018) The Registry may also be modified to impair defenses, such as by enabling macros for all Microsoft Office products, allowing privilege escalation without alerting the user, increasing the maximum number of allowed outbound requests, and/or modifying systems to store plaintext credentials in memory.(Citation: CISA LockBit 2023)(Citation: Unit42 BabyShark Feb 2019) The Registry of a remote system may be modified to aid in execution of files as part of lateral movement. It requires the remote Registry service to be running on the target system.(Citation: Microsoft Remote) Often [Valid Accounts](https://attack.mitre.org/techniques/T1078) are required, along with access to the remote system's [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) for RPC communication. Finally, Registry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via [Reg](https://attack.mitre.org/software/S0075) or other utilities using the Win32 API.(Citation: Microsoft Reghide NOV 2
Near-miss passage: T1505.003 Web Shell. Tactics: persistence. Description: Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.(Citation: volexity_0day_sophos_FW) In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. [China Chopper](https://attack.mitre.org/software/S0020) Web shell client).(Citation: Lee 2013)
Query: weakness Remanent Data Readable after Memory Erase
Matching passage: CWE-1330 Remanent Data Readable after Memory Erase. Confidential information stored in memory circuits is readable or recoverable after being cleared or erased.
Near-miss passage: CWE-196 Unsigned to Signed Conversion Error. The product uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value if the value of the unsigned primitive can not be represented using a signed primitive.
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in Synology Note Station 1.1-0212 and earlier allow remote authenticated attackers to inject arbitrary web script or HTML via th
Matching passage: CVE-2015-9103. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in Synology Note Station 1.1-0212 and earlier allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) note title or (2) file name of attachments.
Near-miss passage: CVE-2015-4725. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in forgot.php in AudioShare 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the email parameter.
Query: alert when Detects actions that clear the local ShimCache and remove forensic evidence
Matching passage: Sigma rule: Detects actions that clear the local ShimCache and remove forensic evidence. Logsource: windows / process_creation. Rule: title: ShimCache Flush id: b0524451-19af-4efa-a46f-562a977f792e status: stable description: Detects actions that clear the local ShimCache and remove forensic evidence references: - https://medium.com/@blueteamops/shimcache-flush-89daff28d15e author: Florian Roth (Nextron Systems) date: 2021-02-01 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: process_creation product: windows detection: selection1a: CommandLine|contains|all: - rundll32 - apphelp.dll selection1b: CommandLine|contains: - ShimFlushCache - '#250' selection2a: CommandLine|contains|all: - rundll32 - kernel32.dll selection2b: CommandLine|contains: - BaseFlushAppcompatCache - '#46' condition: ( selection1a and selection1b ) or ( selection2a and selection2b ) falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation or modification of files within the "sudoers.d" directory on Linux systems. Such activity may indic. Logsource: linux / file_event. Rule: title: Persistence Via Sudoers.d Files id: ddb26b76-4447-4807-871f-1b035b2bfa5d status: test description: 'Detects the creation or modification of files within the "sudoers.d" directory on Linux systems. Such activity may indicate an attempt to establish or maintain privilege escalation by granting specific users elevated permissions. Unauthorized changes to sudoers files are a common technique used by attackers to persist administrative access. ' references: - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/apps/deployer.sh author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-05 modified: 2026-03-18 tags: - attack.privilege-escalation - attack.persistence - attack.t1548.003 logsource: product: linux category: file_event detection: selection: TargetFilename|startswith: /etc/sudoers.d/ filter_main_dpkg: Image|endswith: /usr/bin/dpkg TargetFilename: /etc/sudoers.d/README.dpkg-new condition: selection and not 1 of filter_main_* falsepositives: - Creation of legitimate files in sudoers.d folder as part of administrator work level: medium
Query: patch priority for CVE-2015-4201
Matching passage: CVE-2015-4201. CWE: CWE-20. CVSS: 5.0. The Gateway General Packet Radio Service Support Node (GGSN) component on Cisco ASR 5000 devices with software 17.2.0.59184 and 18.0.L0.59219 allows remote attackers to cause a denial of service (Session Manager restart) via an invalid TCP/IP header, aka Bug ID CSCut68058.
Near-miss passage: CVE-2015-5568. CWE: CWE-20. CVSS: 10.0. Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to cause a denial of service (vector-length corruption) or possibly have unspecified other impact via unknown vectors.
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in Ultimate PHP Board (aka myUPB) before 2.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) q param
Matching passage: CVE-2015-2217. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Ultimate PHP Board (aka myUPB) before 2.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) q parameter to search.php or (2) avatar parameter to profile.php.
Near-miss passage: CVE-2015-4552. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the quick edit function in xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the content of a post.
Query: risk of Use-after-free vulnerability in the EbmlMaster::Read function in libEBML before 1.3.3 allows context-dependent attackers to have unspecified impact via a "deeply nested element wit
Matching passage: CVE-2015-8789. CWE: UNKNOWN. CVSS: 9.600000381469727. Use-after-free vulnerability in the EbmlMaster::Read function in libEBML before 1.3.3 allows context-dependent attackers to have unspecified impact via a "deeply nested element with infinite size" followed by another element of an upper level in an EBML document.
Near-miss passage: CVE-2015-4916. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 8u60 and JavaFX 2.2.85 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2015-4906 and CVE-2015-4908.
Query: vulnerability: cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect as other users via a request.
Matching passage: CVE-2015-3148. CWE: CWE-284. CVSS: 5.0. cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect as other users via a request.
Near-miss passage: CVE-2015-3063. CWE: CWE-284. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3062, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, CVE-2015-3073, and CVE-2015-3074.
Query: describe CVE-2015-8798
Matching passage: CVE-2015-8798. CWE: CWE-22. CVSS: 8.0. Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0 before MP1, Critical System Protection (SCSP) before 5.2.9 MP6, Data Center Security: Server Advanced Server (DCS:SA) 6.x before 6.5 MP1 and 6.6 before MP1, and Data Center Security: Server Advanced Server and Agents (DCS:SA) through 6.6 MP1 allows remote authenticated users to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-7780. CWE: CWE-22. CVSS: 6.5. Directory traversal vulnerability in ManageEngine Firewall Analyzer before 8.0.
Query: write Sigma for Detects potential access attempts to the PowerShell console history directly via history file (ConsoleHost_history.txt).
Matching passage: Sigma rule: Detects potential access attempts to the PowerShell console history directly via history file (ConsoleHost_history.txt).. Logsource: windows / process_creation. Rule: title: Potential PowerShell Console History Access Attempt via History File id: f4ff7323-b5fc-4323-8b52-6b9408e15788 status: experimental description: 'Detects potential access attempts to the PowerShell console history directly via history file (ConsoleHost_history.txt). This can give access to plaintext passwords used in PowerShell commands or used for general reconnaissance. ' references: - https://0xdf.gitlab.io/2018/11/08/powershell-history-file.html author: Luc Génaux date: 2025-04-03 tags: - attack.credential-access - attack.t1552.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - ConsoleHost_history.txt - (Get-PSReadLineOption).HistorySavePath condition: selection falsepositives: - Legitimate access of the console history file is possible level: medium
Near-miss passage: Sigma rule: Detects usage of SoftPerfect's "netscan.exe". An application for scanning networks. It is actively used in-the-wild by t. Logsource: windows / process_creation. Rule: title: PUA - SoftPerfect Netscan Execution id: ca387a8e-1c84-4da3-9993-028b45342d30 status: test description: 'Detects usage of SoftPerfect''s "netscan.exe". An application for scanning networks. It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim. ' references: - https://www.protect.airbus.com/blog/uncovering-cyber-intruders-netscan/ - https://secjoes-reports.s3.eu-central-1.amazonaws.com/Sockbot%2Bin%2BGoLand.pdf - https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/yanluowang-ransomware-attacks-continue - https://research.nccgroup.com/2022/07/13/climbing-mount-everest-black-byte-bytes-back/ - https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-hive-ransomware/ - https://www.softperfect.com/products/networkscanner/ author: '@d4ns4n_ (Wuerth-Phoenix)' date: 2024-04-25 tags: - attack.discovery - attack.t1046 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \netscan.exe - Product: Network Scanner - Description: Application for scanning networks condition: selection falsepositives: - Legitimate administrator activity level: medium
Query: detect Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files ha in logs
Matching passage: Sigma rule: Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files ha. Logsource: windows / process_creation. Rule: title: Hacktool Execution - PE Metadata id: 37c1333a-a0db-48be-b64b-7393b2386e3b status: test description: Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed references: - https://github.com/cube0x0 - https://www.virustotal.com/gui/search/metadata%253ACube0x0/files author: Florian Roth (Nextron Systems) date: 2022-04-27 modified: 2024-01-15 tags: - attack.credential-access - attack.resource-development - attack.t1588.002 - attack.t1003 logsource: category: process_creation product: windows detection: selection: Company: Cube0x0 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to. Logsource: linux / process_creation. Rule: title: Curl Usage on Linux id: ea34fb97-e2c4-4afb-810f-785e4459b194 status: test description: Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to a remote server references: - https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-15 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: linux detection: selection: Image|endswith: /curl condition: selection falsepositives: - Scripts created by developers and admins - Administrative activity level: low
Query: risk of Cross-site scripting (XSS) vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user n
Matching passage: CVE-2015-6969. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user name in a comment, which is not properly handled in a Reply link.
Near-miss passage: CVE-2015-0108. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.8, and Maximo Asset Management 7.1 through 7.1.1.8 and 7.2 for Tivoli IT Asset Management for IT and certain other products, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-0104, CVE-2015-0107, and CVE-2015-0109.
Query: actor TTPs: Exploitation for Privilege Escalation
Matching passage: T1068 Exploitation for Privilege Escalation. Tactics: privilege escalation. Description: Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions. When initially gaining access to a system, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and software commonly running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user level permissions to SYSTEM or root permissions depending on the component that is vulnerable. This could also enable an adversary to move from a virtualized environment, such as within a virtual machine or container, onto the underlying host. This may be a necessary step for an adversary compromising an endpoint system that has been properly configured and limits other privilege escalation methods. Adversaries may bring a signed vulnerable driver onto a compromised machine so that they can exploit the vulnerability to execute code in kernel mode. This process is sometimes referred to as Bring Your Own Vulnerable Driver (BYOVD).(Citation: ESET InvisiMole June 2020)(Citation: Unit42 AcidBox June 2020) Adversaries may include the vulnerable driver with files delivered during Initial Access or download it to a compromised system via [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) or [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570).
Near-miss passage: T1037 Boot or Logon Initialization Scripts. Tactics: persistence, privilege escalation. Description: Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke March 2019) Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely. Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.
Query: patch priority for CVE-2015-0869
Matching passage: CVE-2015-0869. CWE: CWE-264. CVSS: 7.800000190734863. I-O DATA DEVICE NP-BBRM routers allow remote attackers to cause a denial of service (SSDP reflection) via UPnP requests.
Near-miss passage: CVE-2015-3185. CWE: CWE-264. CVSS: 4.300000190734863. The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior.
Query: patch priority for CVE-2015-7409
Matching passage: CVE-2015-7409. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.6 allows remote authenticated users to inject arbitrary web script or HTML via an unspecified field.
Near-miss passage: CVE-2015-0714. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Cisco Finesse Server 10.0(1), 10.5(1), 10.6(1), and 11.0(1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCut53595.
Query: patch priority for CVE-2015-4425
Matching passage: CVE-2015-4425. CWE: CWE-22. CVSS: 4.900000095367432. Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. (dot dot) in the dir parameter to admin/asset/add-asset-compatibility.
Near-miss passage: CVE-2015-6914. CWE: CWE-22. CVSS: 7.800000190734863. Absolute path traversal vulnerability in SiteFactory CMS 5.5.9 allows remote attackers to read arbitrary files via a full pathname in the file parameter to assets/download.aspx.
Query: Sigma rule for Identifies when a Point-to-site VPN is Modified or Deleted.
Matching passage: Sigma rule: Identifies when a Point-to-site VPN is Modified or Deleted.. Logsource: azure / activitylogs. Rule: title: Azure Point-to-site VPN Modified or Deleted id: d9557b75-267b-4b43-922f-a775e2d1f792 status: test description: Identifies when a Point-to-site VPN is Modified or Deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-08-08 modified: 2022-08-23 tags: - attack.impact logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.NETWORK/P2SVPNGATEWAYS/WRITE - MICROSOFT.NETWORK/P2SVPNGATEWAYS/DELETE - MICROSOFT.NETWORK/P2SVPNGATEWAYS/RESET/ACTION - MICROSOFT.NETWORK/P2SVPNGATEWAYS/GENERATEVPNPROFILE/ACTION - MICROSOFT.NETWORK/P2SVPNGATEWAYS/DISCONNECTP2SVPNCONNECTIONS/ACTION - MICROSOFT.NETWORK/P2SVPNGATEWAYS/PROVIDERS/MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/WRITE condition: selection falsepositives: - Point-to-site VPN being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Point-to-site VPN modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing comm. Logsource: windows / network_connection. Rule: title: Suspicious Outbound SMTP Connections id: 9976fa64-2804-423c-8a5b-646ade840773 status: test description: 'Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048.003/T1048.003.md#atomic-test-5---exfiltration-over-alternative-protocol---smtp - https://www.ietf.org/rfc/rfc2821.txt author: frack113 date: 2022-01-07 modified: 2022-09-21 tags: - attack.exfiltration - attack.t1048.003 logsource: category: network_connection product: windows detection: selection: DestinationPort: - 25 - 587 - 465 - 2525 Initiated: 'true' filter_clients: Image|endswith: - \thunderbird.exe - \outlook.exe filter_mailserver: Image|startswith: C:\Program Files\Microsoft\Exchange Server\ filter_outlook: Image|startswith: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_ Image|endswith: \HxTsr.exe condition: selection and not 1 of filter_* falsepositives: - Other SMTP tools level: medium