alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: telemetry for T1087
Matching passage: T1087 Account Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)). Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment. For examples, cloud environments typically provide easily accessible interfaces to obtain user lists.(Citation: AWS List Users)(Citation: Google Cloud - IAM Servie Accounts List API) On hosts, adversaries can use default [PowerShell](https://attack.mitre.org/techniques/T1059/001) and other command line functionality to identify accounts. Information about email addresses and accounts may also be extracted by searching an infected system’s files.
Near-miss passage: T1087.003 Email Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists) In on-premises Exchange and Exchange Online, the <code>Get-GlobalAddressList</code> PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016) In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List)
Query: playbook for alert: Outbound C2 pattern associated with Compute Hijacking
Matching passage: Playbook for T1496.001 Compute Hijacking. 1) Validate alert telemetry against T1496.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: impact. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may leverage the compute resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. One common purpose for [Compute Hijacking](https://attack.mitre.org/techniques/T1496/001) is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively i
Near-miss passage: Playbook for T1496.003 SMS Pumping. Different response path focused on impact.
Query: risk of SQL injection vulnerability in the login form in GSI WiNPAT Portal 3.2.0.1001 through 3.6.1.0 allows remote attackers to execute arbitrary SQL commands via the username field.
Matching passage: CVE-2015-5376. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in the login form in GSI WiNPAT Portal 3.2.0.1001 through 3.6.1.0 allows remote attackers to execute arbitrary SQL commands via the username field.
Near-miss passage: CVE-2015-9098. CWE: CWE-89. CVSS: 9.800000190734863. In Redgate SQL Monitor before 3.10 and 4.x before 4.2, a remote attacker can gain unauthenticated access to the Base Monitor, resulting in the ability to execute arbitrary SQL commands on any monitored Microsoft SQL Server machines. If the Base Monitor is connecting to these machines using an account with SQL admin privileges, then code execution on the operating system can result in full system compromise (if Microsoft SQL Server is running with local administrator privileges).
Query: common weakness: Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
Matching passage: CWE-652 Improper Neutralization of Data within XQuery Expressions ('XQuery Injection'). The product uses external input to dynamically construct an XQuery expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.
Near-miss passage: CWE-1099 Inconsistent Naming Conventions for Identifiers. The product's code, documentation, or other artifacts do not consistently use the same naming conventions for variables, callables, groups of related callables, I/O capabilities, data types, file names, or similar types of elements.
Query: exploit IOKit in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption and appli
Matching passage: CVE-2015-3776. CWE: CWE-119. CVSS: 9.300000190734863. IOKit in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption and application crash) via a malformed plist.
Near-miss passage: CVE-2015-1500. CWE: CWE-119. CVSS: 6.800000190734863. Multiple stack-based buffer overflows in the TSUnicodeGraphEditorControl in SolarWinds Server and Application Monitor (SAM) allow remote attackers to execute arbitrary code via unspecified vectors to (1) graphManager.load or (2) factory.load.
Query: exploit Saia Burgess PCD1.M0xx0, PCD1.M2xx0, PCD2.M5xx0, PCD3.Mxx60, PCD3.Mxxx0, PCD7.D4xxD, PCD7.D4xxV, PCD7.D4xxWTPF, and PCD7.D4xxxT5F devices before 1.24.50 and PCD3.T665 and PCD3.T666
Matching passage: CVE-2015-7911. CWE: CWE-255. CVSS: 9.100000381469727. Saia Burgess PCD1.M0xx0, PCD1.M2xx0, PCD2.M5xx0, PCD3.Mxx60, PCD3.Mxxx0, PCD7.D4xxD, PCD7.D4xxV, PCD7.D4xxWTPF, and PCD7.D4xxxT5F devices before 1.24.50 and PCD3.T665 and PCD3.T666 devices before 1.24.41 have hardcoded credentials, which allows remote attackers to obtain administrative access via an FTP session.
Near-miss passage: CVE-2015-7280. CWE: CWE-255. CVSS: 9.800000190734863. The web administration interface on ReadyNet WRT300N-DD devices with firmware 1.0.26 has a default password of admin for the admin account, which allows remote attackers to obtain administrative privileges by leveraging a LAN session.
Query: exploit Memory leak in the cuse_channel_release function in fs/fuse/cuse.c in the Linux kernel before 4.4 allows local users to cause a denial of service (memory consumption) or possibly h
Matching passage: CVE-2015-1339. CWE: CWE-399. CVSS: 6.199999809265137. Memory leak in the cuse_channel_release function in fs/fuse/cuse.c in the Linux kernel before 4.4 allows local users to cause a denial of service (memory consumption) or possibly have unspecified other impact by opening /dev/cuse many times.
Near-miss passage: CVE-2015-0708. CWE: CWE-399. CVSS: 6.099999904632568. Cisco IOS 15.4S, 15.4SN, and 15.5S and IOS XE 3.13S and 3.14S allow remote attackers to cause a denial of service (device crash) by including an IA_NA option in a DHCPv6 Solicit message on the local network, aka Bug ID CSCur29956.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web scri
Matching passage: CVE-2015-1629. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "ExchangeDLP Cross Site Scripting Vulnerability."
Near-miss passage: CVE-2015-7398. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: describe CVE-2015-8228
Matching passage: CVE-2015-8228. CWE: CWE-22. CVSS: 4.0. Directory traversal vulnerability in the SFTP server in Huawei AR 120, 150, 160, 200, 500, 1200, 2200, 3200, and 3600 routers with software before V200R006SPH003 allows remote authenticated users to access arbitrary directories via unspecified vectors.
Near-miss passage: CVE-2015-5471. CWE: CWE-22. CVSS: 5.300000190734863. Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter.
Query: describe CVE-2015-6601
Matching passage: CVE-2015-6601. CWE: CWE-119. CVSS: 10.0. libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22935234.
Near-miss passage: CVE-2015-5830. CWE: CWE-119. CVSS: 7.199999809265137. The Intel Graphics Driver component in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5877.
Query: weakness Improper Protection Against Voltage and Clock Glitches
Matching passage: CWE-1247 Improper Protection Against Voltage and Clock Glitches. The device does not contain or contains incorrectly implemented circuitry or sensors to detect and mitigate voltage and clock glitches and protect sensitive information or software contained on the device.
Near-miss passage: CWE-277 Insecure Inherited Permissions. A product defines a set of insecure permissions that are inherited by objects that are created by the program.
Query: rule covering Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for
Matching passage: Sigma rule: Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for. Logsource: windows / driver_load. Rule: title: Vulnerable HackSys Extreme Vulnerable Driver Load id: 295c9289-acee-4503-a571-8eacaef36b28 status: test description: Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors references: - https://github.com/hacksysteam/HackSysExtremeVulnerableDriver author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-18 modified: 2024-11-23 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: product: windows category: driver_load detection: selection: - ImageLoaded|endswith: \HEVD.sys - Hashes|contains: - IMPHASH=f26d0b110873a1c7d8c4f08fbeab89c5 - IMPHASH=c46ea2e651fd5f7f716c8867c6d13594 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to. Logsource: windows / registry_set. Rule: title: Outlook EnableUnsafeClientMailRules Setting Enabled - Registry id: 6763c6c8-bd01-4687-bc8d-4fa52cf8ba08 related: - id: c3cefdf4-6703-4e1c-bad8-bf422fc5015a type: similar - id: 55f0a3a1-846e-40eb-8273-677371b8d912 type: similar status: test description: Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros references: - https://support.microsoft.com/en-us/topic/how-to-control-the-rule-actions-to-start-an-application-or-run-a-macro-in-outlook-2016-and-outlook-2013-e4964b72-173c-959d-5d7b-ead562979048 - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=44 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-08 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Outlook\Security\EnableUnsafeClientMailRules Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-3086
Matching passage: CVE-2015-3086. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-3077 and CVE-2015-3084.
Near-miss passage: CVE-2015-0400. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Libraries.
Query: detect Monitor and alert for Bitlocker key retrieval. in logs
Matching passage: Sigma rule: Monitor and alert for Bitlocker key retrieval.. Logsource: azure / auditlogs. Rule: title: Bitlocker Key Retrieval id: a0413867-daf3-43dd-9245-734b3a787942 status: test description: Monitor and alert for Bitlocker key retrieval. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#bitlocker-key-retrieval author: Michael Epping, '@mepples21' date: 2022-06-28 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: Category: KeyManagement OperationName: Read BitLocker key condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects programs that connect to known malware callback ports based on threat intelligence reports.. Logsource: linux / network_connection. Rule: title: Potentially Suspicious Malware Callback Communication - Linux id: dbfc7c98-04ab-4ab7-aa94-c74d22aa7376 related: - id: 4b89abaa-99fe-4232-afdd-8f9aa4d20382 type: derived status: test description: 'Detects programs that connect to known malware callback ports based on threat intelligence reports. ' references: - https://www.mandiant.com/resources/blog/triton-actor-ttp-profile-custom-attack-tools-detections - https://www.mandiant.com/resources/blog/ukraine-and-sandworm-team - https://www.elastic.co/guide/en/security/current/potential-non-standard-port-ssh-connection.html - https://thehackernews.com/2024/01/systembc-malwares-c2-server-analysis.html - https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors author: hasselj date: 2024-05-10 tags: - attack.persistence - attack.command-and-control - attack.t1571 logsource: category: network_connection product: linux detection: selection: Initiated: 'true' DestinationPort: - 888 - 999 - 2200 - 2222 - 4000 - 4444 - 6789 - 8531 - 50501 - 51820 filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: vulnerability: The KEYS subsystem in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (BUG) via crafted keyctl commands that negatively instantiate a
Matching passage: CVE-2015-8539. CWE: CWE-269. CVSS: 7.800000190734863. The KEYS subsystem in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (BUG) via crafted keyctl commands that negatively instantiate a key, related to security/keys/encrypted-keys/encrypted.c, security/keys/trusted.c, and security/keys/user_defined.c.
Near-miss passage: CVE-2015-0192. CWE: CWE-269. CVSS: 9.800000190734863. Unspecified vulnerability in IBM Java 8 before SR1, 7 R1 before SR2 FP11, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allows remote attackers to gain privileges via unknown vectors related to the Java Virtual Machine.
Query: CWE for J2EE Bad Practices: Direct Use of Threads
Matching passage: CWE-383 J2EE Bad Practices: Direct Use of Threads. Thread management in a Web application is forbidden in some circumstances and is always highly error prone.
Near-miss passage: CWE-168 Improper Handling of Inconsistent Special Elements. The product does not properly handle input in which an inconsistency exists between two or more special characters or reserved words.
Query: vulnerability: The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to obtain sensitive
Matching passage: CVE-2015-6059. CWE: CWE-200. CVSS: 4.300000190734863. The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Scripting Engine Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-5089. CWE: CWE-200. CVSS: 5.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2014-8450, CVE-2015-4449, CVE-2015-4450, CVE-2015-5088, and CVE-2015-5092.
Query: Sigma YAML for windows / ps_module
Matching passage: Sigma rule: Detects Obfuscated use of Environment Variables to execute PowerShell. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation VAR+ Launcher - PowerShell Module id: 6bfb8fa7-b2e7-4f6c-8d9d-824e5d06ea9e related: - id: 0adfbc14-0ed1-11eb-adc1-0242ac120002 type: derived status: test description: Detects Obfuscated use of Environment Variables to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|re: cmd.{0,5}(?:/c|/r)(?:\s|)"set\s[a-zA-Z]{3,6}.*(?:\{\d\}){1,}\\"\s+?-f(?:.*\)){1,}.*" condition: selection_4103 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any too. Logsource: windows / registry_set. Rule: title: Hide Schedule Task Via Index Value Tamper id: 5b16df71-8615-4f7f-ac9b-6c43c0509e61 related: - id: acd74772-5f88-45c7-956b-6a7b36c294d2 type: similar - id: 526cc8bc-1cdc-48ad-8b26-f19bff969cec type: similar status: test description: 'Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique) ' references: - https://blog.qualys.com/vulnerabilities-threat-research/2022/06/20/defending-against-scheduled-task-attacks-in-windows-environments author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-26 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|contains|all: - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ - Index Details: DWORD (0x00000000) condition: selection falsepositives: - Unlikely level: high
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on. Logsource: windows / process_creation. Rule: title: HackTool - winPEAS Execution id: 98b53e78-ebaf-46f8-be06-421aafd176d9 status: test description: WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz references: - https://github.com/carlospolop/PEASS-ng - https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation author: Georg Lauenstein (sure[secure]) date: 2022-09-19 modified: 2023-03-23 tags: - attack.privilege-escalation - attack.discovery - attack.t1082 - attack.t1087 - attack.t1046 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: winPEAS.exe - Image|endswith: - \winPEASany_ofs.exe - \winPEASany.exe - \winPEASx64_ofs.exe - \winPEASx64.exe - \winPEASx86_ofs.exe - \winPEASx86.exe selection_cli_option: CommandLine|contains: - ' applicationsinfo' - ' browserinfo' - ' eventsinfo' - ' fileanalysis' - ' filesinfo' - ' processinfo' - ' servicesinfo' - ' windowscreds' selection_cli_dl: CommandLine|contains: https://github.com/carlospolop/PEASS-ng/releases/latest/download/ selection_cli_specific: - ParentCommandLine|endswith: ' -linpeas' - CommandLine|endswith: ' -linpeas' condition: 1 of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects uses of the createdump.exe LOLOBIN utility to dump process memory. Logsource: windows / process_creation. Rule: title: CreateDump Process Dump id: 515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48 related: - id: 1a1ed54a-2ba4-4221-94d5-01dee560d71e type: similar status: test description: Detects uses of the createdump.exe LOLOBIN utility to dump process memory references: - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/ - https://twitter.com/bopin2020/status/1366400799199272960 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-01-04 modified: 2022-08-19 tags: - attack.stealth - attack.t1036 - attack.t1003.001 - attack.credential-access logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \createdump.exe - OriginalFileName: FX_VER_INTERNALNAME_STR selection_cli: CommandLine|contains: - ' -u ' - ' --full ' - ' -f ' - ' --name ' - '.dmp ' condition: all of selection_* falsepositives: - Command lines that use the same flags level: high
Query: exploit The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users via obtaining the target ticketId, and navigating to http://
Matching passage: CVE-2015-4071. CWE: CWE-200. CVSS: 5.300000190734863. The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users via obtaining the target ticketId, and navigating to http://{target}/component/helpdeskpro/?view=ticket&id={ticketId}.
Near-miss passage: CVE-2015-5004. CWE: CWE-200. CVSS: 4.0. The Edge Component Caching Proxy in IBM WebSphere Application Server (WAS) 8.0 before 8.0.0.12 and 8.5 before 8.5.5.8 does not properly encrypt data, which allows remote authenticated users to obtain sensitive information via unspecified vectors.