alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: mitigate Data Manipulation
Matching passage: T1565 Data Manipulation. Tactics: impact. Description: Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: Sygnia Elephant Beetle Jan 2022) By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making. The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Near-miss passage: T1565.002 Transmitted Data Manipulation. Tactics: impact. Description: Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Manipulation may be possible over a network connection or between system processes where there is an opportunity deploy a tool that will intercept and change information. The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Query: Suspicious Remote Access Hardware execution detected on endpoint
Matching passage: T1219.003 Remote Access Hardware. Tactics: command and control. Description: An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks. These services, including IP-based keyboard, video, or mouse (KVM) devices such as TinyPilot and PiKVM, are commonly used as legitimate tools and may be allowed by peripheral device policies within a target environment. Remote access hardware may be physically installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote session with the target system. Using hardware-based remote access tools may allow threat actors to bypass software security solutions and gain more control over the compromised device(s).(Citation: Palo Alto Unit 42 North Korean IT Workers 2024)(Citation: Google Cloud Threat Intelligence DPRK IT Workers 2024)
Near-miss passage: T1219.001 IDE Tunneling. Tactics: command and control. Description: Adversaries may abuse Integrated Development Environment (IDE) software with remote development features to establish an interactive command and control channel on target systems within a network. IDE tunneling combines SSH, port forwarding, file sharing, and debugging into a single secure connection, letting developers work on remote systems as if they were local. Unlike SSH and port forwarding, IDE tunneling encapsulates an entire session and may use proprietary tunneling protocols alongside SSH, allowing adversaries to blend in with legitimate development workflows. Some IDEs, like Visual Studio Code, also provide CLI tools (e.g., `code tunnel`) that adversaries may use to programmatically establish tunnels and generate web-accessible URLs for remote access. These tunnels can be authenticated through accounts such as GitHub, enabling the adversary to control the compromised system via a legitimate developer portal.(Citation: sentinelone operationDigitalEye Dec 2024)(Citation: Unit42 Chinese VSCode 06 September 2024)(Citation: Thornton tutorial VSCode shell September 2023) Additionally, adversaries may use IDE tunneling for persistence. Some IDEs, such as Visual Studio Code and JetBrains, support automatic reconnection. Adversaries may configure the IDE to auto-launch at startup, re-establishing the tunnel upon execution. Compromised developer machines may also be exploited as jump hosts to move further into the network. IDE tunneling tools may be built-in or installed as [IDE Extensions](https://attack.mitre.org/techniques/T1176/002).
Query: rule covering Detects when a user is removed from a privileged role. Bulk changes should be investigated.
Matching passage: Sigma rule: Detects when a user is removed from a privileged role. Bulk changes should be investigated.. Logsource: azure / auditlogs. Rule: title: Bulk Deletion Changes To Privileged Account Permissions id: 102e11e3-2db5-4c9e-bc26-357d42585d21 status: test description: Detects when a user is removed from a privileged role. Bulk changes should be investigated. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H' date: 2022-08-05 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: azure service: auditlogs detection: selection: properties.message: - Remove eligible member (permanent) - Remove eligible member (eligible) condition: selection falsepositives: - Legtimate administrator actions of removing members from a role level: high
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22). Logsource: windows / file_event. Rule: title: UAC Bypass Using Consent and Comctl32 - File id: 62ed5b55-f991-406a-85d9-e8e8fdf18789 status: test description: Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-23 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: C:\Windows\System32\consent.exe.@ TargetFilename|endswith: \comctl32.dll condition: selection falsepositives: - Unknown level: high
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects execution of the Windows Kernel Debugger "kd.exe".. Logsource: windows / process_creation. Rule: title: Windows Kernel Debugger Execution id: 27ee9438-90dc-4bef-904b-d3ef927f5e7e status: test description: Detects execution of the Windows Kernel Debugger "kd.exe". references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-15 modified: 2024-04-24 tags: - attack.privilege-escalation - attack.stealth logsource: category: process_creation product: windows detection: selection: - Image|endswith: \kd.exe - OriginalFileName: kd.exe condition: selection falsepositives: - Rare occasions of legitimate cases where kernel debugging is necessary in production. Investigation is required level: medium
Near-miss passage: Sigma rule: Detects rundll32 loading a renamed comsvcs.dll to dump process memory. Logsource: windows / image_load. Rule: title: Suspicious Renamed Comsvcs DLL Loaded By Rundll32 id: 8cde342c-ba48-4b74-b615-172c330f2e93 status: test description: Detects rundll32 loading a renamed comsvcs.dll to dump process memory references: - https://twitter.com/sbousseaden/status/1555200155351228419 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-14 modified: 2023-02-17 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: image_load detection: selection: Image|endswith: \rundll32.exe Hashes|contains: - IMPHASH=eed93054cb555f3de70eaa9787f32ebb - IMPHASH=5e0dbdec1fce52daae251a110b4f309d - IMPHASH=eadbccbb324829acb5f2bbe87e5549a8 - IMPHASH=407ca0f7b523319d758a40d7c0193699 - IMPHASH=281d618f4e6271e527e6386ea6f748de filter: ImageLoaded|endswith: \comsvcs.dll condition: selection and not filter falsepositives: - Unlikely level: high
Query: describe CVE-2015-2500
Matching passage: CVE-2015-2500. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-5624. CWE: CWE-119. CVSS: 6.800000190734863. Buffer overflow in the ExecCall method in c2lv6.ocx in the FreeBit ELPhoneBtnV6 ActiveX control allows remote attackers to execute arbitrary code via a crafted HTML document, related to the discontinued "Click to Live" service.
Query: vulnerability: arch/arm64/kernel/sys.c in the Linux kernel before 4.0 allows local users to bypass the "strict page permissions" protection mechanism and modify the system-call table, and consequ
Matching passage: CVE-2015-8967. CWE: CWE-264. CVSS: 7.800000190734863. arch/arm64/kernel/sys.c in the Linux kernel before 4.0 allows local users to bypass the "strict page permissions" protection mechanism and modify the system-call table, and consequently gain privileges, by leveraging write access.
Near-miss passage: CVE-2015-8994. CWE: CWE-264. CVSS: 7.5. An issue was discovered in PHP 5.x and 7.x, when the configuration uses apache2handler/mod_php or php-fpm with OpCache enabled. With 5.x after 5.6.28 or 7.x after 7.0.13, the issue is resolved in a non-default configuration with the opcache.validate_permission=1 setting. The vulnerability details are as follows. In PHP SAPIs where PHP interpreters share a common parent process, Zend OpCache creates a shared memory object owned by the common parent during initialization. Child PHP processes inherit the SHM descriptor, using it to cache and retrieve compiled script bytecode ("opcode" in PHP jargon). Cache keys vary depending on configuration, but filename is a central key component, and compiled opcode can generally be run if a script's filename is known or can be guessed. Many common shared-hosting configurations change EUID in child processes to enforce privilege separation among hosted users (for example using mod_ruid2 for the Apache HTTP Server, or php-fpm user settings). In these scenarios, the default Zend OpCache behavior defeats script file permissions by sharing a single SHM cache among all child PHP processes. PHP scripts often contain sensitive information: Think of CMS configurations where reading or running another user's script usually means gaining privileges to the CMS database.
Query: detection rule: Detects an installation of a device that is forbidden by the system policy
Matching passage: Sigma rule: Detects an installation of a device that is forbidden by the system policy. Logsource: windows / security. Rule: title: Device Installation Blocked id: c9eb55c3-b468-40ab-9089-db2862e42137 status: test description: Detects an installation of a device that is forbidden by the system policy references: - https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6423 author: frack113 date: 2022-10-14 tags: - attack.initial-access - attack.t1200 logsource: service: security product: windows detection: selection: EventID: 6423 condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious locations that are publicly w. Logsource: windows / image_load. Rule: title: BaaUpdate.exe Suspicious DLL Load id: 6e8fe0a8-ba0b-4a93-8f9e-82657e7a5984 related: - id: 9f38c1db-e2ae-40bf-81d0-5b68f73fb512 type: similar status: experimental description: 'Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious locations that are publicly writable which could indicate an attempt to lateral movement via BitLocker DCOM & COM Hijacking. This technique abuses COM Classes configured as INTERACTIVE USER to spawn processes in the context of the logged-on user''s session. Specifically, it targets the BDEUILauncher Class (CLSID ab93b6f1-be76-4185-a488-a9001b105b94) which can launch BaaUpdate.exe, which is vulnerable to COM Hijacking when started with input parameters. This allows attackers to execute code in the user''s context without needing to steal credentials or use additional techniques to compromise the account. ' references: - https://github.com/rtecCyberSec/BitlockMove author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-10-18 tags: - attack.stealth - attack.t1218 - attack.lateral-movement - attack.t1021.003 logsource: category: image_load product: windows detection: selection: Image|endswith: \BaaUpdate.exe ImageLoaded|endswith: .dll ImageLoaded|contains: - :\Perflogs\ - :\Users\Default\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\Local\Temp\ - \AppData\Roaming\ - \Contacts\ - \Favorites\ - \Favourites\ - \Links\ - \Music\ - \Pictures\ - \ProgramData\ - \Temporary Internet - \Videos\ condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-2425
Matching passage: CVE-2015-2425. CWE: CWE-787. CVSS: 8.800000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2383 and CVE-2015-2384.
Near-miss passage: CVE-2015-8458. CWE: CWE-787. CVSS: 6.800000190734863. Heap-based buffer overflow in AGM.dll in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via a multiple-layer PDF document, a different vulnerability than CVE-2015-6696 and CVE-2015-6698.
Query: CVE similar to CVE-2015-4974
Matching passage: CVE-2015-4974. CWE: CWE-77. CVSS: 7.199999809265137. IBM General Parallel File System (GPFS) 3.5.x before 3.5.0.27 and 4.1.x before 4.1.1.2 and Spectrum Scale 4.1.1.x before 4.1.1.2 allow local users to obtain root privileges for command execution via unspecified vectors.
Near-miss passage: CVE-2015-20108. CWE: CWE-77. CVSS: 9.800000190734863. xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.
Query: describe CVE-2015-1320
Matching passage: CVE-2015-1320. CWE: CWE-255. CVSS: 9.800000190734863. The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects Ubuntu MAAS versions prior to 1.9.2.
Near-miss passage: CVE-2015-2766. CWE: CWE-255. CVSS: 5.0. The Personal Email Manager (PEM) in Websense TRITON AP-EMAIL before 8.0.0 allows attackers to have unspecified impact via a brute force attack.
Query: alert when Detects the start, reload or restart of a service.
Matching passage: Sigma rule: Detects the start, reload or restart of a service.. Logsource: linux / auditd. Rule: title: Service Reload or Start - Linux id: 2625cc59-0634-40d0-821e-cb67382a3dd7 status: test description: Detects the start, reload or restart of a service. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.002/T1543.002.md author: Jakob Weinzettl, oscd.community, CheraghiMilad date: 2019-09-23 modified: 2025-03-03 tags: - attack.privilege-escalation - attack.persistence - attack.t1543.002 logsource: product: linux service: auditd detection: selection: type: EXECVE a0|contains: - systemctl - service a1|contains: - reload - start condition: selection falsepositives: - Installation of legitimate service. - Legitimate reconfiguration of service. - Command line contains daemon-reload. level: low
Near-miss passage: Sigma rule: Detects enumeration of local system accounts. This information can help adversaries determine which local accounts exist. Logsource: linux / process_creation. Rule: title: Local System Accounts Discovery - Linux id: b45e3d6f-42c6-47d8-a478-df6bd6cf534c status: test description: Detects enumeration of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.001/T1087.001.md - https://my.f5.com/manage/s/article/K589 - https://man.freebsd.org/cgi/man.cgi?pwd_mkdb author: Alejandro Ortuno, oscd.community, CheraghiMilad date: 2020-10-08 modified: 2024-12-10 tags: - attack.discovery - attack.t1087.001 logsource: category: process_creation product: linux detection: selection_1: Image|endswith: /lastlog selection_2: CommandLine|contains: '''x:0:''' selection_3: Image|endswith: - /cat - /ed - /head - /more - /nano - /tail - /vi - /vim - /less - /emacs - /sqlite3 - /makemap CommandLine|contains: - /etc/passwd - /etc/shadow - /etc/sudoers - /etc/spwd.db - /etc/pwd.db - /etc/master.passwd selection_4: Image|endswith: /id selection_5: Image|endswith: /lsof CommandLine|contains: -u condition: 1 of selection* falsepositives: - Legitimate administration activities level: low
Query: Sigma YAML for okta / okta
Matching passage: Sigma rule: Detects when Okta identifies new activity in the Admin Console.. Logsource: okta / okta. Rule: title: Okta New Admin Console Behaviours id: a0b38b70-3cb5-484b-a4eb-c4d8e7bcc0a9 status: test description: Detects when Okta identifies new activity in the Admin Console. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection author: kelnage date: 2023-09-07 modified: 2026-04-27 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078.004 logsource: product: okta service: okta detection: selection_event: eventType: policy.evaluate_sign_on target.displayName: Okta Admin Console selection_positive: - debugContext.debugData.behaviors|contains: POSITIVE - debugContext.debugData.logOnlySecurityData|contains: POSITIVE condition: all of selection_* falsepositives: - When an admin begins using the Admin Console and one of Okta's heuristics incorrectly identifies the behavior as being unusual. level: high
Near-miss passage: Sigma rule: Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472.. Logsource: windows / system. Rule: title: Vulnerable Netlogon Secure Channel Connection Allowed id: a0cb7110-edf0-47a4-9177-541a4083128a status: test description: Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472. references: - https://support.microsoft.com/en-us/help/4557222/how-to-manage-the-changes-in-netlogon-secure-channel-connections-assoc author: NVISO date: 2020-09-15 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.t1548 logsource: product: windows service: system detection: selection: Provider_Name: NetLogon EventID: 5829 condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-9061
Matching passage: CVE-2015-9061. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, playReady DRM failed to check a length potentially leading to unauthorized access to secure memory.
Near-miss passage: CVE-2015-1607. CWE: CWE-20. CVSS: 5.5. kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not properly handle bitwise left-shifts, which allows remote attackers to cause a denial of service (invalid read operation) via a crafted keyring file, related to sign extensions and "memcpy with overlapping ranges."
Query: describe CVE-2015-1935
Matching passage: CVE-2015-1935. CWE: CWE-17. CVSS: 8.0. The scalar-function implementation in IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-0173. CWE: CWE-17. CVSS: 4.300000190734863. The HTTP connection-management functionality in Internet Pass-Thru (IPT) before 2.1.0.2 in IBM WebSphere MQ, when HTTPS is disabled, does not properly generate MQIPT Session IDs, which makes it easier for remote attackers to bypass intended restrictions on MQ message data by predicting an ID value.
Query: risk of Cross-site request forgery (CSRF) vulnerability in SearchBlox before 8.2 allows remote attackers to hijack the authentication of arbitrary users.
Matching passage: CVE-2015-0970. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in SearchBlox before 8.2 allows remote attackers to hijack the authentication of arbitrary users.
Near-miss passage: CVE-2015-9388. CWE: CWE-352. CVSS: 6.5. The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS.
Query: CVE similar to CVE-2015-6815
Matching passage: CVE-2015-6815. CWE: CWE-835. CVSS: 3.5. The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to cause a denial of service (infinite loop and guest crash) via unspecified vectors.
Near-miss passage: CVE-2015-10103. CWE: CWE-835. CVSS: 5.5. A vulnerability, which was classified as problematic, was found in InternalError503 Forget It up to 1.3. This affects an unknown part of the file js/settings.js. The manipulation of the argument setForgetTime with the input 0 leads to infinite loop. It is possible to launch the attack on the local host. Upgrading to version 1.4 is able to address this issue. The patch is named adf0c7fd59b9c935b4fd675c556265620124999c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-226119.
Query: risk of Stack-based buffer overflow in the isofs_real_readdir function in isofs.c in FuseISO 20070708 allows remote attackers to cause a denial of service (application crash) or possibly e
Matching passage: CVE-2015-8837. CWE: CWE-119. CVSS: 7.300000190734863. Stack-based buffer overflow in the isofs_real_readdir function in isofs.c in FuseISO 20070708 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long pathname in an ISO file.
Near-miss passage: CVE-2015-5121. CWE: CWE-119. CVSS: 10.0. Adobe Shockwave Player before 12.1.9.159 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5120.
Query: exploit Unspecified vulnerability in the Oracle Endeca Information Discovery Studio component in Oracle Fusion Middleware 2.2.2, 2.3, 2.4, 3.0, and 3.1 allows remote attackers to affect co
Matching passage: CVE-2015-2602. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in the Oracle Endeca Information Discovery Studio component in Oracle Fusion Middleware 2.2.2, 2.3, 2.4, 3.0, and 3.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Integrator, a different vulnerability than CVE-2015-2603, CVE-2015-2604, CVE-2015-2605, CVE-2015-2606, and CVE-2015-4745.
Near-miss passage: CVE-2015-0491. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and Java FX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2015-0459.