alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: indicators of Internal Defacement
Matching passage: T1491.001 Internal Defacement. Tactics: impact. Description: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites or server login messages, or directly to user systems with the replacement of the desktop wallpaper.(Citation: Novetta Blockbuster)(Citation: Varonis) Disturbing or offensive images may be used as a part of [Internal Defacement](https://attack.mitre.org/techniques/T1491/001) in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.(Citation: Novetta Blockbuster Destructive Malware)
Near-miss passage: T1491.002 External Defacement. Tactics: impact. Description: An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users. [External Defacement](https://attack.mitre.org/techniques/T1491/002) may ultimately cause users to distrust the systems and to question/discredit the system’s integrity. Externally-facing websites are a common victim of defacement; often targeted by adversary and hacktivist groups in order to push a political message or spread propaganda.(Citation: FireEye Cyber Threats to Media Industries)(Citation: Kevin Mandia Statement to US Senate Committee on Intelligence)(Citation: Anonymous Hackers Deface Russian Govt Site) [External Defacement](https://attack.mitre.org/techniques/T1491/002) may be used as a catalyst to trigger events, or as a response to actions taken by an organization or government. Similarly, website defacement may also be used as setup, or a precursor, for future attacks such as [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).(Citation: Trend Micro Deep Dive Into Defacement)
Query: patch priority for CVE-2015-2414
Matching passage: CVE-2015-2414. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 8 through 11 allows remote attackers to obtain sensitive browsing-history information via vectors related to image caching, aka "Internet Explorer Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-1676. CWE: CWE-200. CVSS: 2.0999999046325684. The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to bypass the ASLR protection mechanism via a crafted function call, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability," a different vulnerability than CVE-2015-1677, CVE-2015-1678, CVE-2015-1679, and CVE-2015-1680.
Query: playbook for alert: SIEM correlation: resource development activity consistent with Code Signing Certificates
Matching passage: Playbook for T1587.002 Code Signing Certificates. 1) Validate alert telemetry against T1587.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: resource development. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may create self-signed code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered wit
Near-miss passage: Playbook for T1587 Develop Capabilities. Different response path focused on resource development.
Query: exploit Unisys Libra 43xx, 63xx, and 83xx, and FS600 class systems with MCP-FIRMWARE 40.0 before 40.0IC4 Build 270 might allow remote authenticated users to cause a denial of service (data
Matching passage: CVE-2015-4049. CWE: CWE-119. CVSS: 6.800000190734863. Unisys Libra 43xx, 63xx, and 83xx, and FS600 class systems with MCP-FIRMWARE 40.0 before 40.0IC4 Build 270 might allow remote authenticated users to cause a denial of service (data corruption or system crash) via vectors related to using program operators during EPSILON (level 5) based codefiles at peak memory usage, which triggers CPM stack corruption.
Near-miss passage: CVE-2015-6136. CWE: CWE-119. CVSS: 9.300000190734863. The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to execute arbitrary code via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
Query: alert when Detects MsiExec loading a DLL and calling its DllUnregisterServer function
Matching passage: Sigma rule: Detects MsiExec loading a DLL and calling its DllUnregisterServer function. Logsource: windows / process_creation. Rule: title: DllUnregisterServer Function Call Via Msiexec.EXE id: 84f52741-8834-4a8c-a413-2eb2269aa6c8 status: test description: Detects MsiExec loading a DLL and calling its DllUnregisterServer function references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md - https://lolbas-project.github.io/lolbas/Binaries/Msiexec/ - https://twitter.com/_st0pp3r_/status/1583914515996897281 author: frack113 date: 2022-04-24 modified: 2024-03-13 tags: - attack.stealth - attack.t1218.007 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \msiexec.exe - OriginalFileName: \msiexec.exe selection_flag: CommandLine|contains|windash: ' -z ' selection_dll: CommandLine|contains: .dll condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects WRITE_DAC access to a domain object. Logsource: windows / security. Rule: title: AD Object WriteDAC Access id: 028c7842-4243-41cd-be6f-12f3cf1a26c7 status: test description: Detects WRITE_DAC access to a domain object references: - https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html - https://threathunterplaybook.com/library/windows/active_directory_replication.html - https://threathunterplaybook.com/hunts/windows/190101-ADModDirectoryReplication/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-09-12 modified: 2021-11-27 tags: - attack.defense-impairment - attack.t1222.001 logsource: product: windows service: security detection: selection: EventID: 4662 ObjectServer: DS AccessMask: '0x40000' ObjectType: - 19195a5b-6da0-11d0-afd3-00c04fd930c9 - domainDNS condition: selection falsepositives: - Unknown level: critical
Query: CVE similar to CVE-2015-4935
Matching passage: CVE-2015-4935. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a different vulnerability than CVE-2015-4931, CVE-2015-4932, CVE-2015-4933, and CVE-2015-4934.
Near-miss passage: CVE-2015-3797. CWE: CWE-119. CVSS: 7.5. The TRE library in Libc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows context-dependent attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted regular expression, a different vulnerability than CVE-2015-3796 and CVE-2015-3798.
Query: exploit Cross-site scripting (XSS) vulnerability in Cisco IM and Presence Service before 10.5 MR1 allows remote attackers to inject arbitrary web script or HTML by constructing a crafted U
Matching passage: CVE-2015-4294. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Cisco IM and Presence Service before 10.5 MR1 allows remote attackers to inject arbitrary web script or HTML by constructing a crafted URL that leverages incomplete filtering of HTML elements, aka Bug ID CSCut41766.
Near-miss passage: CVE-2015-1888. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Content Navigator 2.0.2 before 2.0.2-ICN-FP007 and 2.0.3 before 2.0.3-ICN-FP003, as used in Content Manager, FileNet Content Manager, Content Foundation, Content Manager OnDemand, and other products, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: describe CVE-2015-0364
Matching passage: CVE-2015-0364. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect availability via unknown vectors related to Integration Business Services.
Near-miss passage: CVE-2015-4728. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle Sourcing component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect confidentiality via unknown vectors related to Bid/Quote creation.
Query: EDR alert: possible Break Process Trees (T1036.009)
Matching passage: T1036.009 Break Process Trees. Tactics: stealth. Description: An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID). If endpoint protection software leverages the “parent-child" relationship for detection, breaking this relationship could result in the adversary’s behavior not being associated with previous process tree activity. On Unix-based systems breaking this process tree is common practice for administrators to execute software using scripts and programs.(Citation: 3OHA double-fork 2022) On Linux systems, adversaries may execute a series of [Native API](https://attack.mitre.org/techniques/T1106) calls to alter malware's process tree. For example, adversaries can execute their payload without any arguments, call the `fork()` API call twice, then have the parent process exit. This creates a grandchild process with no parent process that is immediately adopted by the `init` system process (PID 1), which successfully disconnects the execution of the adversary's payload from its previous process tree. Another example is using the “daemon” syscall to detach from the current parent process and run in the background.(Citation: Sandfly BPFDoor 2022)(Citation: Microsoft XorDdos Linux Stealth 2022)
Near-miss passage: T1036.005 Match Legitimate Resource Name or Location. Tactics: stealth. Description: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: `svchost.exe`). Alternatively, a Windows Registry key may be given a close approximation to a key used by a legitimate program. In containerized environments, a threat actor may create a resource in a trusted namespace or one that matches the naming convention of a container pod or cluster.(Citation: Aquasec Kubernetes Backdoor 2023)
Query: detection rule: Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service"
Matching passage: Sigma rule: Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service". Logsource: windows / process_creation. Rule: title: Stop Windows Service Via PowerShell Stop-Service id: c49c5062-0966-4170-9efd-9968c913a6cf related: - id: eb87818d-db5d-49cc-a987-d5da331fbd90 type: obsolete status: test description: Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service" references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/stop-service?view=powershell-7.4 author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2023-03-05 tags: - attack.impact - attack.t1489 logsource: category: process_creation product: windows detection: selection_sc_net_img: - OriginalFileName: - PowerShell.EXE - pwsh.dll - Image|endswith: - \powershell.exe - \pwsh.exe selection_cli: CommandLine|contains: 'Stop-Service ' condition: all of selection_* falsepositives: - There are many legitimate reasons to stop a service. This rule isn't looking for any suspicious behaviour in particular. Filter legitimate activity accordingly level: low
Near-miss passage: Sigma rule: Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of the "MiniDumpWriteDum. Logsource: windows / process_creation. Rule: title: DumpMinitool Execution id: dee0a7a3-f200-4112-a99b-952196d81e42 status: test description: Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of the "MiniDumpWriteDump" references: - https://twitter.com/mrd0x/status/1511415432888131586 - https://twitter.com/mrd0x/status/1511489821247684615 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/DumpMinitool/ - https://gist.github.com/nasbench/6d58c3c125e2fa1b8f7a09754c1b087f author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) date: 2022-04-06 modified: 2023-04-12 tags: - attack.stealth - attack.t1036 - attack.t1003.001 - attack.credential-access logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \DumpMinitool.exe - \DumpMinitool.x86.exe - \DumpMinitool.arm64.exe - OriginalFileName: - DumpMinitool.exe - DumpMinitool.x86.exe - DumpMinitool.arm64.exe selection_cli: CommandLine|contains: - ' Full' - ' Mini' - ' WithHeap' condition: all of selection_* falsepositives: - Unknown level: medium
Query: exploit The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or poss
Matching passage: CVE-2015-2325. CWE: CWE-125. CVSS: 7.800000190734863. The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier.
Near-miss passage: CVE-2015-8629. CWE: CWE-125. CVSS: 5.300000190734863. The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensitive information or cause a denial of service (out-of-bounds read) via a crafted string.
Query: exploit Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a di
Matching passage: CVE-2015-7091. CWE: CWE-119. CVSS: 6.599999904632568. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7092, and CVE-2015-7117.
Near-miss passage: CVE-2015-2097. CWE: CWE-119. CVSS: 7.5. Multiple buffer overflows in WebGate Embedded Standard Protocol (WESP) SDK allow remote attackers to execute arbitrary code via unspecified vectors to the (1) LoadImage or (2) LoadImageEx function in the WESPMonitor.WESPMonitorCtrl.1 control, (3) ChangePassword function in the WESPCONFIGLib.UserItem control, Connect function in the (4) WESPSerialPort.WESPSerialPortCtrl.1 or (5) WESPPLAYBACKLib.WESPPlaybackCtrl control, or (6) AddID function in the WESPCONFIGLib.IDList control or a (7) long string to the second argument to the ConnectEx3 function in the WESPPLAYBACKLib.WESPPlaybackCtrl control.
Query: exploit A vulnerability has been found in luelista miniConf up to 1.7.6 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file miniConf/Messa
Matching passage: CVE-2015-10025. CWE: CWE-404. CVSS: 7.5. A vulnerability has been found in luelista miniConf up to 1.7.6 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file miniConf/MessageView.cs of the component URL Scanning. The manipulation leads to denial of service. Upgrading to version 1.7.7 and 1.8.0 is able to address this issue. The patch is named c06c2e5116c306e4e1bc79779f0eda2d1182f655. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217615.
Near-miss passage: CVE-2015-10085. CWE: CWE-404. CVSS: 7.5. A vulnerability was found in GoPistolet. It has been declared as problematic. This vulnerability affects unknown code of the component MTA. The manipulation leads to denial of service. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as b91aa4674d460993765884e8463c70e6d886bc90. It is recommended to apply a patch to fix this issue. VDB-221506 is the identifier assigned to this vulnerability.
Query: exploit Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 ignores the permission to deny snapshot creation during live storage migration between domains, which allows remote au
Matching passage: CVE-2015-0237. CWE: CWE-264. CVSS: 6.800000190734863. Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 ignores the permission to deny snapshot creation during live storage migration between domains, which allows remote authenticated users to cause a denial of service (prevent host start) by creating a long snapshot chain.
Near-miss passage: CVE-2015-2953. CWE: CWE-264. CVSS: 5.0. Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to bypass intended access restrictions and read files via unspecified vectors, a different vulnerability than CVE-2015-2952 and CVE-2015-2958.
Query: alert when Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "Remo
Matching passage: Sigma rule: Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "Remo. Logsource: windows / process_creation. Rule: title: RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses id: a6fc3c46-23b8-4996-9ea2-573f4c4d88c5 related: - id: f65e22f9-819e-4f96-9c7b-498364ae7a25 type: similar - id: 38a7625e-b2cb-485d-b83d-aff137d859f4 type: similar - id: cacef8fc-9d3d-41f7-956d-455c6e881bc5 type: similar status: test description: Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "RemoteFXvGPUDisablement.exe" binary to run custom PowerShell code via module load-order hijacking. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md - https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1 author: frack113 date: 2021-07-13 modified: 2023-05-09 tags: - attack.stealth - attack.t1218 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - Invoke-ATHRemoteFXvGPUDisablementCommand - Invoke-ATHRemoteFXvGPUDisableme condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of netsh with the "trace" flag in order to start a network capture. Logsource: windows / process_creation. Rule: title: New Network Trace Capture Started Via Netsh.EXE id: d3c3861d-c504-4c77-ba55-224ba82d0118 status: test description: Detects the execution of netsh with the "trace" flag in order to start a network capture references: - https://blogs.msdn.microsoft.com/canberrapfe/2012/03/30/capture-a-network-trace-without-installing-anything-capture-a-network-trace-of-a-reboot/ - https://klausjochem.me/2016/02/03/netsh-the-cyber-attackers-tool-of-choice/ author: Kutepov Anton, oscd.community date: 2019-10-24 modified: 2023-02-13 tags: - attack.discovery - attack.credential-access - attack.t1040 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: CommandLine|contains|all: - trace - start condition: all of selection_* falsepositives: - Legitimate administration activity level: medium
Query: detection rule: Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility
Matching passage: Sigma rule: Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility. Logsource: macos / process_creation. Rule: title: Potential Persistence Via PlistBuddy id: 65d506d3-fcfe-4071-b4b2-bcefe721bbbb status: test description: Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility references: - https://redcanary.com/blog/clipping-silver-sparrows-wings/ - https://www.manpagez.com/man/8/PlistBuddy/ author: Sohan G (D4rkCiph3r) date: 2023-02-18 tags: - attack.privilege-escalation - attack.persistence - attack.t1543.001 - attack.t1543.004 logsource: category: process_creation product: macos detection: selection: Image|endswith: /PlistBuddy CommandLine|contains|all: - RunAtLoad - 'true' CommandLine|contains: - LaunchAgents - LaunchDaemons condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a netw. Logsource: windows / process_creation. Rule: title: Suspicious Scan Loop Network id: f8ad2e2c-40b6-4117-84d7-20b89896ab23 status: test description: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md - https://ss64.com/nt/for.html - https://ss64.com/ps/foreach-object.html author: frack113 date: 2022-03-12 tags: - attack.execution - attack.t1059 - attack.discovery - attack.t1018 logsource: category: process_creation product: windows detection: selection_loop: CommandLine|contains: - 'for ' - 'foreach ' selection_tools: CommandLine|contains: - nslookup - ping condition: all of selection_* falsepositives: - Legitimate script level: medium
Query: describe CVE-2015-1400
Matching passage: CVE-2015-1400. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in search.php in NPDS Revolution 13 allows remote attackers to execute arbitrary SQL commands via the query parameter.
Near-miss passage: CVE-2015-1560. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the isUserAdmin function in include/common/common-Func.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in Centreon web 2.7.0) allows remote attackers to execute arbitrary SQL commands via the sid parameter to include/common/XmlTree/GetXmlTree.php.
Query: risk of The Special:DeletedContributions page in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to determine if an IP is autoblocked via t
Matching passage: CVE-2015-6727. CWE: CWE-200. CVSS: 5.0. The Special:DeletedContributions page in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to determine if an IP is autoblocked via the "Change block" text.
Near-miss passage: CVE-2015-1600. CWE: CWE-200. CVSS: 7.5. Information disclosure vulnerability in Netatmo Indoor Module firmware 100 and earlier.