alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: ATT&CK technique for Keychain
Matching passage: T1555.001 Keychain. Tactics: credential access. Description: Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The System Keychain stores items accessed by the operating system, such as items shared among users on a host. The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service. Keychains can be viewed and edited through the Keychain Access application or using the command-line utility <code>security</code>. Keychain files are located in <code>~/Library/Keychains/</code>, <code>/Library/Keychains/</code>, and <code>/Network/Library/Keychains/</code>.(Citation: Keychain Services Apple)(Citation: Keychain Decryption Passware)(Citation: OSX Keychain Schaumann) Adversaries may gather user credentials from Keychain storage/memory. For example, the command <code>security dump-keychain –d</code> will dump all Login Keychain credentials from <code>~/Library/Keychains/login.keychain-db</code>. Adversaries may also directly read Login Keychain credentials from the <code>~/Library/Keychains/login.keychain</code> file. Both methods require a password, where the default password for the Login Keychain is the current user’s password to login to the macOS host.(Citation: External to DA, the OS X Way)(Citation: Empire Keychain Decrypt)
Near-miss passage: T1555.002 Securityd Memory. Tactics: credential access. Description: An adversary with root access may gather credentials by reading `securityd`’s memory. `securityd` is a service/daemon responsible for implementing security protocols such as encryption and authorization.(Citation: Apple Dev SecurityD) A privileged adversary may be able to scan through `securityd`'s memory to find the correct sequence of keys to decrypt the user’s logon keychain. This may provide the adversary with various plaintext passwords, such as those for users, WiFi, mail, browsers, certificates, secure notes, etc.(Citation: OS X Keychain)(Citation: OSX Keydnap malware) In OS X prior to El Capitan, users with root access can read plaintext keychain passwords of logged-in users because Apple’s keychain implementation allows these credentials to be cached so that users are not repeatedly prompted for passwords.(Citation: OS X Keychain)(Citation: External to DA, the OS X Way) Apple’s `securityd` utility takes the user’s logon password, encrypts it with PBKDF2, and stores this master key in memory. Apple also uses a set of keys and algorithms to encrypt the user’s password, but once the master key is found, an adversary need only iterate over the other values to unlock the final password.(Citation: OS X Keychain)
Query: vulnerability: The Storage API module 7.x-1.x before 7.x-1.8 for Drupal does not properly restrict access to Storage API fields attached to entities that are not nodes, which allows remote attack
Matching passage: CVE-2015-5502. CWE: CWE-284. CVSS: 7.5. The Storage API module 7.x-1.x before 7.x-1.8 for Drupal does not properly restrict access to Storage API fields attached to entities that are not nodes, which allows remote attackers to have unspecified impact via unknown vectors.
Near-miss passage: CVE-2015-2008. CWE: CWE-284. CVSS: 4.400000095367432. IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 and 7.2.x before 7.2.6 includes SSH private keys during backup operations, which allows remote authenticated administrators to obtain sensitive information by reading a backup archive.
Query: detection rule: Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to
Matching passage: Sigma rule: Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to. Logsource: windows / process_creation. Rule: title: Esentutl Gather Credentials id: 7df1713a-1a5b-4a4b-a071-dc83b144a101 status: test description: Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab. references: - https://twitter.com/vxunderground/status/1423336151860002816 - https://thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike/ author: sam0x90 date: 2021-08-06 modified: 2022-10-09 tags: - attack.credential-access - attack.t1003 - attack.t1003.003 - attack.s0404 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - esentutl - ' /p' condition: selection falsepositives: - To be determined level: medium
Near-miss passage: Sigma rule: Detects AnyDesk writing binary files to disk other than "gcapi.dll". According to RedCanary research it is highly abnorm. Logsource: windows / file_event. Rule: title: Suspicious Binary Writes Via AnyDesk id: 2d367498-5112-4ae5-a06a-96e7bc33a211 status: test description: 'Detects AnyDesk writing binary files to disk other than "gcapi.dll". According to RedCanary research it is highly abnormal for AnyDesk to write executable files to disk besides gcapi.dll, which is a legitimate DLL that is part of the Google Chrome web browser used to interact with the Google Cloud API. (See reference section for more details) ' references: - https://redcanary.com/blog/misbehaving-rats/ - https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-28 modified: 2025-02-24 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows category: file_event detection: selection: Image|endswith: - \AnyDesk.exe - \AnyDeskMSI.exe TargetFilename|endswith: - .dll - .exe filter_dlls: TargetFilename|endswith: \gcapi.dll condition: selection and not 1 of filter_* falsepositives: - Unknown level: high
Query: risk of packages/Keyguard/res/layout/keyguard_password_view.xml in Lockscreen in Android 5.x before 5.1.1 LMY48M does not restrict the number of characters in the passwordEntry input field
Matching passage: CVE-2015-3860. CWE: CWE-284. CVSS: 7.199999809265137. packages/Keyguard/res/layout/keyguard_password_view.xml in Lockscreen in Android 5.x before 5.1.1 LMY48M does not restrict the number of characters in the passwordEntry input field, which allows physically proximate attackers to bypass intended access restrictions via a long password that triggers a SystemUI crash, aka internal bug 22214934.
Near-miss passage: CVE-2015-10057. CWE: CWE-284. CVSS: 9.800000190734863. A vulnerability was found in Little Apps Little Software Stats. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file inc/class.securelogin.php of the component Password Reset Handler. The manipulation leads to improper access controls. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.2 is able to address this issue. The identifier of the patch is 07ba8273a9311d1383f3686ac7cb32f20770ab1e. It is recommended to upgrade the affected component. The identifier VDB-218401 was assigned to this vulnerability.
Query: patch priority for CVE-2015-0763
Matching passage: CVE-2015-0763. CWE: CWE-200. CVSS: 5.0. Cisco Unified MeetingPlace 8.6(1.2) does not properly validate session IDs in http URLs, which allows remote attackers to obtain sensitive session information via a crafted URL, aka Bug ID CSCuu60338.
Near-miss passage: CVE-2015-4171. CWE: CWE-200. CVSS: 2.5999999046325684. strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.
Query: detection rule: Identifies when a service account is modified in Google Cloud.
Matching passage: Sigma rule: Identifies when a service account is modified in Google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud Service Account Modified id: 6b67c12e-5e40-47c6-b3b0-1e6b571184cc status: test description: Identifies when a service account is modified in Google Cloud. references: - https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts author: Austin Songer @austinsonger date: 2021-08-14 modified: 2022-10-09 tags: - attack.impact logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name|endswith: - .serviceAccounts.patch - .serviceAccounts.create - .serviceAccounts.update - .serviceAccounts.enable - .serviceAccounts.undelete condition: selection falsepositives: - Service Account being modified may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Service Account modified from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects blocked image load events with revoked certificates by code integrity.. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Blocked Image Load With Revoked Certificate id: 6f156c48-3894-4952-baf0-16193e9067d2 status: test description: Detects blocked image load events with revoked certificates by code integrity. references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-06 tags: - attack.privilege-escalation logsource: product: windows service: codeintegrity-operational detection: selection: EventID: 3036 condition: selection falsepositives: - Unlikely level: high
Query: exploit Memory leak in Cisco Headend System Release allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, aka Bug ID CSCus91854.
Matching passage: CVE-2015-4230. CWE: CWE-399. CVSS: 7.800000190734863. Memory leak in Cisco Headend System Release allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, aka Bug ID CSCus91854.
Near-miss passage: CVE-2015-0722. CWE: CWE-399. CVSS: 7.800000190734863. The network drivers in Cisco TelePresence T, Cisco TelePresence TE, and Cisco TelePresence TC before 7.3.2 allow remote attackers to cause a denial of service (process restart or device reload) via a flood of crafted IP packets, aka Bug ID CSCuj68952.
Query: weakness Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Matching passage: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'). The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Near-miss passage: CWE-330 Use of Insufficiently Random Values. The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
Query: what is T1078.002
Matching passage: T1078.002 Domain Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.(Citation: TechNet Credential Theft) Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.(Citation: Microsoft AD Accounts) Adversaries may compromise domain accounts, some with a high level of privileges, through various means such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or password reuse, allowing access to privileged resources of the domain.
Near-miss passage: T1078.003 Local Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. Local Accounts may also be abused to elevate privileges and harvest credentials through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement.
Query: weakness Improper Handling of Unexpected Data Type
Matching passage: CWE-241 Improper Handling of Unexpected Data Type. The product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (A-Z).
Near-miss passage: CWE-546 Suspicious Comment. The code contains comments that suggest the presence of bugs, incomplete functionality, or weaknesses.
Query: alert when Detects an installation of a device that is forbidden by the system policy
Matching passage: Sigma rule: Detects an installation of a device that is forbidden by the system policy. Logsource: windows / security. Rule: title: Device Installation Blocked id: c9eb55c3-b468-40ab-9089-db2862e42137 status: test description: Detects an installation of a device that is forbidden by the system policy references: - https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6423 author: frack113 date: 2022-10-14 tags: - attack.initial-access - attack.t1200 logsource: service: security product: windows detection: selection: EventID: 6423 condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in pos. Logsource: macos / process_creation. Rule: title: System Integrity Protection (SIP) Enumeration id: 53821412-17b0-4147-ade0-14faae67d54b status: test description: 'Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in post-exploit scenarios. ' references: - https://ss64.com/osx/csrutil.html - https://objective-see.org/blog/blog_0x6D.html - https://www.welivesecurity.com/2017/10/20/osx-proton-supply-chain-attack-elmedia/ - https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13caf9f60049760c312cd3/behavior author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2024-01-02 tags: - attack.discovery - attack.t1518.001 logsource: product: macos category: process_creation detection: selection: Image|endswith: /csrutil CommandLine|contains: status condition: selection falsepositives: - Legitimate administration activities level: low
Query: patch priority for CVE-2015-2653
Matching passage: CVE-2015-2653. CWE: UNKNOWN. CVSS: 6.400000095367432. Unspecified vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce Platform 3.1.1, 3.1.2, 11.0, and 11.1 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Content Acquisition System.
Near-miss passage: CVE-2015-7069. CWE: UNKNOWN. CVSS: 9.300000190734863. Mobile Replayer in GPUTools Framework in Apple iOS before 9.2 allows attackers to execute arbitrary code in a privileged context via an app that provides a crafted pathname, a different vulnerability than CVE-2015-7070.
Query: patch priority for CVE-2015-9440
Matching passage: CVE-2015-9440. CWE: CWE-352. CVSS: 6.5. The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new.
Near-miss passage: CVE-2015-6378. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability on Cisco DPQ3925 devices with EDVA 5.5.2 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuv05943.
Query: CVE similar to CVE-2015-0911
Matching passage: CVE-2015-0911. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in TAGAWA Takao TransmitMail 1.0.11 through 1.5.8 allows remote attackers to read arbitrary files via vectors related to attachment handling.
Near-miss passage: CVE-2015-4632. CWE: CWE-22. CVSS: 7.5. Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the template_path parameter to (1) svc/virtualshelves/search or (2) svc/members/search.
Query: exploit Multiple stack-based buffer overflows in Medicomp MEDCIN Engine 2.22.20142.166 might allow remote attackers to execute arbitrary code via a crafted packet on port 8190, related to 
Matching passage: CVE-2015-2901. CWE: CWE-119. CVSS: 6.800000190734863. Multiple stack-based buffer overflows in Medicomp MEDCIN Engine 2.22.20142.166 might allow remote attackers to execute arbitrary code via a crafted packet on port 8190, related to (1) the GetProperty info_getproperty function and (2) the GetProperty UdfCodeList function.
Near-miss passage: CVE-2015-6160. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6140, CVE-2015-6142, CVE-2015-6143, CVE-2015-6153, CVE-2015-6158, and CVE-2015-6159.
Query: SOC runbook when seeing Outbound C2 pattern associated with Protocol Tunneling
Matching passage: Playbook for T1572 Protocol Tunneling. 1) Validate alert telemetry against T1572. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: command and control. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to
Near-miss passage: Playbook for T1043 Commonly Used Port. Different response path focused on command and control.
Query: ATT&CK technique for Implant Internal Image
Matching passage: T1525 Implant Internal Image. Tactics: persistence. Description: Adversaries may implant cloud or container images with malicious code to establish persistence after gaining access to an environment. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be implanted or backdoored. Unlike [Upload Malware](https://attack.mitre.org/techniques/T1608/001), this technique focuses on adversaries implanting an image in a registry within a victim’s environment. Depending on how the infrastructure is provisioned, this could provide persistent access if the infrastructure provisioning tool is instructed to always use the latest image.(Citation: Rhino Labs Cloud Image Backdoor Technique Sept 2019) A tool has been developed to facilitate planting backdoors in cloud container images.(Citation: Rhino Labs Cloud Backdoor September 2019) If an adversary has access to a compromised AWS instance, and permissions to list the available container images, they may implant a backdoor such as a [Web Shell](https://attack.mitre.org/techniques/T1505/003).(Citation: Rhino Labs Cloud Image Backdoor Technique Sept 2019)
Near-miss passage: T1546.013 PowerShell Profile. Tactics: privilege escalation, persistence. Description: Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles. A PowerShell profile (<code>profile.ps1</code>) is a script that runs when [PowerShell](https://attack.mitre.org/techniques/T1059/001) starts and can be used as a logon script to customize user environments. [PowerShell](https://attack.mitre.org/techniques/T1059/001) supports several profiles depending on the user or host program. For example, there can be different profiles for [PowerShell](https://attack.mitre.org/techniques/T1059/001) host programs such as the PowerShell console, PowerShell ISE or Visual Studio Code. An administrator can also configure a profile that applies to all users and host programs on the local computer. (Citation: Microsoft About Profiles) Adversaries may modify these profiles to include arbitrary commands, functions, modules, and/or [PowerShell](https://attack.mitre.org/techniques/T1059/001) drives to gain persistence. Every time a user opens a [PowerShell](https://attack.mitre.org/techniques/T1059/001) session the modified script will be executed unless the <code>-NoProfile</code> flag is used when it is launched. (Citation: ESET Turla PowerShell May 2019) An adversary may also be able to escalate privileges if a script in a PowerShell profile is loaded and executed by an account with higher privileges, such as a domain administrator. (Citation: Wits End and Shady PowerShell Profiles)
Query: vulnerability: The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain se
Matching passage: CVE-2015-3153. CWE: CWE-200. CVSS: 5.0. The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.
Near-miss passage: CVE-2015-1680. CWE: CWE-200. CVSS: 2.0999999046325684. The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to bypass the ASLR protection mechanism via a crafted function call, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability," a different vulnerability than CVE-2015-1676, CVE-2015-1677, CVE-2015-1678, and CVE-2015-1679.
Query: patch priority for CVE-2015-2365
Matching passage: CVE-2015-2365. CWE: CWE-264. CVSS: 7.199999809265137. win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-0951. CWE: CWE-264. CVSS: 6.5. X-Cart before 5.1.11 allows remote authenticated users to read or delete address data of arbitrary accounts via a modified (1) update or (2) remove request.