alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Multiple failed authentications followed by Port Monitors
Matching passage: T1547.010 Port Monitors. Tactics: persistence, privilege escalation. Description: Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the <code>AddMonitor</code> API call to set a DLL to be loaded at startup.(Citation: AddMonitor) This DLL can be located in <code>C:\Windows\System32</code> and will be loaded and run by the print spooler service, `spoolsv.exe`, under SYSTEM level permissions on boot.(Citation: Bloxham) Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to the `Driver` value of an existing or new arbitrarily named subkey of <code>HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors</code>. The Registry key contains entries for the following: * Local Port * Standard TCP/IP Port * USB Monitor * WSD Port
Near-miss passage: T1547.002 Authentication Package. Tactics: persistence, privilege escalation. Description: Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system.(Citation: MSDN Authentication Packages) Adversaries can use the autostart mechanism provided by LSA authentication packages for persistence by placing a reference to a binary in the Windows Registry location <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\</code> with the key value of <code>"Authentication Packages"=&lt;target binary&gt;</code>. The binary will then be executed by the system when the authentication packages are loaded.
Query: vulnerability: Vordel XML Gateway (acquired by Axway) version 7.2.2 could allow remote attackers to cause a denial of service via a specially crafted request.
Matching passage: CVE-2015-5606. CWE: CWE-20. CVSS: 7.5. Vordel XML Gateway (acquired by Axway) version 7.2.2 could allow remote attackers to cause a denial of service via a specially crafted request.
Near-miss passage: CVE-2015-3411. CWE: CWE-20. CVSS: 6.5. PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument load method, (2) the xmlwriter_open_uri function, (3) the finfo_file function, or (4) the hash_hmac_file function, as demonstrated by a filename\0.xml attack that bypasses an intended configuration in which client users may read only .xml files.
Query: mitigate Software Packing
Matching passage: T1027.002 Software Packing. Tactics: stealth. Description: Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018) Utilities used to perform software packing are called packers. Example packers are MPRESS and UPX. A more comprehensive list of known packers is available, but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses.(Citation: Awesome Executable Packing)
Near-miss passage: T1027.009 Embedded Payloads. Tactics: stealth. Description: Adversaries may embed payloads within other files to conceal malicious content from defenses. Otherwise seemingly benign files (such as scripts and executables) may be abused to carry and obfuscate malicious payloads and content. In some cases, embedded payloads may also enable adversaries to [Subvert Trust Controls](https://attack.mitre.org/techniques/T1553) by not impacting execution controls such as digital signatures and notarization tickets.(Citation: Sentinel Labs) Adversaries may embed payloads in various file formats to hide payloads.(Citation: Microsoft Learn) This is similar to [Steganography](https://attack.mitre.org/techniques/T1027/003), though does not involve weaving malicious content into specific bytes and patterns related to legitimate digital media formats.(Citation: GitHub PSImage) For example, adversaries have been observed embedding payloads within or as an overlay of an otherwise benign binary.(Citation: Securelist Dtrack2) Adversaries have also been observed nesting payloads (such as executables and run-only scripts) inside a file of the same format.(Citation: SentinelLabs reversing run-only applescripts 2021) Embedded content may also be used as [Process Injection](https://attack.mitre.org/techniques/T1055) payloads used to infect benign system processes.(Citation: Trend Micro) These embedded then injected payloads may be used as part of the modules of malware designed to provide specific features such as encrypting C2 communications in support of an orchestrator module. For example, an embedded module may be injected into default browsers, allowing adversaries to then communicate via the network.(Citation: Malware Analysis Report ComRAT)
Query: patch priority for CVE-2015-0565
Matching passage: CVE-2015-0565. CWE: CWE-119. CVSS: 10.0. NaCl in 2015 allowed the CLFLUSH instruction, making rowhammer attacks possible.
Near-miss passage: CVE-2015-2991. CWE: CWE-119. CVSS: 6.800000190734863. Buffer overflow in NScripter before 3.00 allows remote attackers to execute arbitrary code via crafted save data.
Query: exploit The default configuration of sshd_config in Cisco Mobility Services Engine (MSE) through 8.0.120.7 allows logins by the oracle account, which makes it easier for remote attackers t
Matching passage: CVE-2015-6316. CWE: CWE-255. CVSS: 6.5. The default configuration of sshd_config in Cisco Mobility Services Engine (MSE) through 8.0.120.7 allows logins by the oracle account, which makes it easier for remote attackers to obtain access by entering this account's hardcoded password in an SSH session, aka Bug ID CSCuv40501.
Near-miss passage: CVE-2015-6424. CWE: CWE-255. CVSS: 7.199999809265137. The boot manager in Cisco Application Policy Infrastructure Controller (APIC) 1.1(0.920a) allows local users to bypass intended access restrictions and obtain single-user-mode root access via unspecified vectors, aka Bug ID CSCuu83985.
Query: rule covering Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework
Matching passage: Sigma rule: Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework. Logsource: windows / process_creation. Rule: title: HackTool - Potential Impacket Lateral Movement Activity id: 10c14723-61c7-4c75-92ca-9af245723ad2 related: - id: e31f89f7-36fb-4697-8ab6-48823708353b type: obsolete status: stable description: Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework references: - https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/wmiexec.py - https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/atexec.py - https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/smbexec.py - https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/dcomexec.py - https://www.elastic.co/guide/en/security/current/suspicious-cmd-execution-via-wmi.html author: Ecco, oscd.community, Jonhnathan Ribeiro, Tim Rauch date: 2019-09-03 modified: 2023-02-21 tags: - attack.execution - attack.t1047 - attack.lateral-movement - attack.t1021.003 logsource: category: process_creation product: windows detection: selection_other: ParentImage|endswith: - \wmiprvse.exe - \mmc.exe - \explorer.exe - \services.exe CommandLine|contains|all: - cmd.exe - /Q - /c - \\\\127.0.0.1\\ - '&1' selection_atexec: ParentCommandLine|contains: - svchost.exe -k netsvcs - taskeng.exe CommandLine|contains|all: - cmd.exe - /C - Windows\Temp\ - '&1' condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious invocation of the Get-ADDBAccount script that reads from a ntds.dit file and may be used to get acces. Logsource: windows / ps_module. Rule: title: Suspicious Get-ADDBAccount Usage id: b140afd9-474b-4072-958e-2ebb435abd68 status: test description: Detects suspicious invocation of the Get-ADDBAccount script that reads from a ntds.dit file and may be used to get access to credentials without using any credential dumpers references: - https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/ - https://github.com/MichaelGrafnetter/DSInternals/blob/7ba59c12ee9a1cb430d7dc186a3366842dd612c8/Documentation/PowerShell/Get-ADDBAccount.md author: Florian Roth (Nextron Systems) date: 2022-03-16 tags: - attack.credential-access - attack.t1003.003 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection: Payload|contains|all: - Get-ADDBAccount - 'BootKey ' - 'DatabasePath ' condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-4491
Matching passage: CVE-2015-4491. CWE: CWE-189. CVSS: 6.800000190734863. Integer overflow in the make_filter_table function in pixops/pixops.c in gdk-pixbuf before 2.31.5, as used in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Linux, Google Chrome on Linux, and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via crafted bitmap dimensions that are mishandled during scaling.
Near-miss passage: CVE-2015-7222. CWE: CWE-189. CVSS: 6.800000190734863. Integer underflow in the Metadata::setData function in MetaData.cpp in libstagefright in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect memory allocation and application crash) via an MP4 video file with crafted covr metadata that triggers a buffer overflow.
Query: describe CVE-2015-4727
Matching passage: CVE-2015-4727. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in Oracle Virtualization Sun Ray Software before 5.4.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Web Console.
Near-miss passage: CVE-2015-3383. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the Node basket module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Query: risk of ImageIO in Apple OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted metadata in an image.
Matching passage: CVE-2015-5938. CWE: CWE-119. CVSS: 6.800000190734863. ImageIO in Apple OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted metadata in an image.
Near-miss passage: CVE-2015-2666. CWE: CWE-119. CVSS: 6.900000095367432. Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to the initrd.
Query: risk of ImageIO in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) v
Matching passage: CVE-2015-5758. CWE: CWE-119. CVSS: 6.800000190734863. ImageIO in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted TIFF image.
Near-miss passage: CVE-2015-7986. CWE: CWE-119. CVSS: 7.5. The index server (hdbindexserver) in SAP HANA 1.00.095 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via an HTTP request, aka SAP Security Note 2197428.
Query: Sigma rule for Detects execution of the bash shell with the interactive flag "-i".
Matching passage: Sigma rule: Detects execution of the bash shell with the interactive flag "-i".. Logsource: linux / process_creation. Rule: title: Bash Interactive Shell id: 6104e693-a7d6-4891-86cb-49a258523559 status: test description: Detects execution of the bash shell with the interactive flag "-i". references: - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet - https://www.revshells.com/ - https://linux.die.net/man/1/bash author: '@d4ns4n_' date: 2023-04-07 tags: - attack.execution logsource: category: process_creation product: linux detection: selection: Image|endswith: /bash CommandLine|contains: ' -i ' condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.. Logsource: windows / process_creation. Rule: title: Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe) id: a58353df-af43-4753-bad0-cd83ef35eef5 related: - id: 2afafd61-6aae-4df4-baed-139fa1f4c345 type: derived status: test description: Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731620(v=ws.11) - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-14 tags: - attack.credential-access - attack.t1003.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \ntdsutil.exe - OriginalFileName: ntdsutil.exe selection_cli: - CommandLine|contains|all: - snapshot - 'mount ' - CommandLine|contains|all: - ac - ' i' - ' ntds' condition: all of selection_* falsepositives: - Legitimate usage to restore snapshots - Legitimate admin activity level: medium
Query: ATT&CK technique for Exfiltration Over Physical Medium
Matching passage: T1052 Exfiltration Over Physical Medium. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
Near-miss passage: T1052.001 Exfiltration over USB. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
Query: patch priority for CVE-2015-2918
Matching passage: CVE-2015-2918. CWE: CWE-20. CVSS: 6.099999904632568. The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
Near-miss passage: CVE-2015-1443. CWE: CWE-20. CVSS: 8.800000190734863. The httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allows remote attackers to execute arbitrary code.
Query: CVE similar to CVE-2015-4112
Matching passage: CVE-2015-4112. CWE: CWE-254. CVSS: 4.300000190734863. The Management Console in BlackBerry Enterprise Server (BES) 12 before 12.2 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site, related to a "cross frame scripting" issue.
Near-miss passage: CVE-2015-6999. CWE: CWE-254. CVSS: 5.0. The OCSP client in Apple iOS before 9.1 does not check for certificate expiry, which allows remote attackers to spoof a valid certificate by leveraging access to a revoked certificate.
Query: describe CVE-2015-6475
Matching passage: CVE-2015-6475. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in IBC Solar ServeMaster TLP+ and Danfoss TLX Pro+ allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-5002. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in IBM Host On-Demand 11.0 through 11.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Query: patch priority for CVE-2015-8356
Matching passage: CVE-2015-8356. CWE: CWE-89. CVSS: 8.0. Multiple SQL injection vulnerabilities in the mcart.xls module 6.5.2 and earlier for Bitrix allow remote authenticated users to execute arbitrary SQL commands via the (1) xls_profile parameter to admin/mcart_xls_import.php or the (2) xls_iblock_id, (3) xls_iblock_section_id, (4) firstRow, (5) titleRow, (6) firstColumn, (7) highestColumn, (8) sku_iblock_id, or (9) xls_iblock_section_id_new parameter to admin/mcart_xls_import_step_2.php.
Near-miss passage: CVE-2015-7714. CWE: CWE-89. CVSS: 7.199999809265137. Multiple SQL injection vulnerabilities in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allow remote administrators to execute arbitrary SQL commands via the (1) id, (2) copy_field in a data_copy action, (3) pshow in an update_field action, (4) css, (5) tip, (6) cat_id, (7) text_search, (8) plisting, or (9) pwizard parameter to administrator/index.php.
Query: risk of Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and A
Matching passage: CVE-2015-5101. CWE: CWE-416. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-4448, CVE-2015-5095, CVE-2015-5099, CVE-2015-5111, CVE-2015-5113, and CVE-2015-5114.
Near-miss passage: CVE-2015-8822. CWE: CWE-416. CVSS: 8.800000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via crafted MPEG-4 data, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, CVE-2015-8454, CVE-2015-8653, CVE-2015-8655, and CVE-2015-8821.
Query: alert when Detects BGP failures which may be indicative of brute force attacks to manipulate routing
Matching passage: Sigma rule: Detects BGP failures which may be indicative of brute force attacks to manipulate routing. Logsource: cisco / bgp. Rule: title: Cisco BGP Authentication Failures id: 56fa3cd6-f8d6-4520-a8c7-607292971886 status: test description: Detects BGP failures which may be indicative of brute force attacks to manipulate routing references: - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf author: Tim Brown date: 2023-01-09 modified: 2023-01-23 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.credential-access - attack.collection - attack.stealth - attack.t1078 - attack.t1110 - attack.t1557 logsource: product: cisco service: bgp definition: 'Requirements: cisco bgp logs need to be enabled and ingested' detection: keywords_bgp_cisco: '|all': - :179 - IP-TCP-3-BADAUTH condition: keywords_bgp_cisco falsepositives: - Unlikely. Except due to misconfigurations level: low
Near-miss passage: Sigma rule: Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts. This command li. Logsource: windows / ps_script. Rule: title: DMSA Link Attributes Modified id: 9b111d8e-92e0-4153-88bc-daefc1333aba related: - id: 6c9eb492-e477-4df9-b0f4-571fc9db29cd type: similar status: experimental description: 'Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts. This command line pattern could be an indicator an attempt to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025. ' references: - https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-05-24 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078.002 - attack.t1098 logsource: category: ps_script product: windows detection: selection: ScriptBlockText|contains|all: - .Put("msDS-ManagedAccountPrecededByLink - CN= condition: selection falsepositives: - Legitimate administrative tasks modifying these attributes. level: low