alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects when someone is adding or removing applications or folders from exploit guard "ProtectedFolders" or "AllowedAppl in logs
Matching passage: Sigma rule: Detects when someone is adding or removing applications or folders from exploit guard "ProtectedFolders" or "AllowedAppl. Logsource: windows / windefend. Rule: title: Windows Defender Exploit Guard Tamper id: a3ab73f1-bd46-4319-8f06-4b20d0617886 status: test description: 'Detects when someone is adding or removing applications or folders from exploit guard "ProtectedFolders" or "AllowedApplications" ' references: - https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-controlled-folder-access-event-search/ba-p/2326088 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 modified: 2022-12-06 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: allowed_apps_key: EventID: 5007 NewValue|contains: \Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications\ allowed_apps_path: NewValue|contains: - \Users\Public\ - \AppData\Local\Temp\ - \Desktop\ - \PerfLogs\ - \Windows\Temp\ protected_folders: EventID: 5007 OldValue|contains: \Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders\ condition: all of allowed_apps* or protected_folders falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activit. Logsource: aws / cloudtrail. Rule: title: AWS KMS Imported Key Material Usage id: 1279262f-1464-422f-ac0d-5b545320c526 status: experimental description: 'Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal. ' references: - https://www.chrisfarris.com/post/effective-aws-ransomware/ - https://docs.aws.amazon.com/kms/latest/developerguide/ct-importkeymaterial.html - https://docs.aws.amazon.com/kms/latest/developerguide/ct-deleteimportedkeymaterial.html author: toopricey date: 2025-10-18 tags: - attack.impact - attack.t1486 - attack.resource-development - attack.t1608.003 logsource: product: aws service: cloudtrail detection: selection: eventSource: kms.amazonaws.com eventName: - ImportKeyMaterial - DeleteImportedKeyMaterial condition: selection falsepositives: - Legitimate use cases for imported key material are rare, but may include, Organizations with hybrid cloud architectures that import external key material for compliance requirements. - Development or testing environments that simulate external key management scenarios. Even in these cases, such activity is typically infrequent and should not add significant noise. level: high
Query: SIEM correlation: resource development activity consistent with DNS Server
Matching passage: T1583.002 DNS Server. Tactics: resource development. Description: Adversaries may set up their own Domain Name System (DNS) servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: [Application Layer Protocol](https://attack.mitre.org/techniques/T1071)). Instead of hijacking existing DNS servers, adversaries may opt to configure and run their own DNS servers in support of operations. By running their own DNS servers, adversaries can have more control over how they administer server-side DNS C2 traffic ([DNS](https://attack.mitre.org/techniques/T1071/004)). With control over a DNS server, adversaries can configure DNS applications to provide conditional responses to malware and, generally, have more flexibility in the structure of the DNS-based C2 channel.(Citation: Unit42 DNS Mar 2019)
Near-miss passage: T1583.001 Domains. Tactics: resource development. Description: Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free. Adversaries may use acquired domains for a variety of purposes, including for [Phishing](https://attack.mitre.org/techniques/T1566), [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), and Command and Control.(Citation: CISA MSS Sep 2020) Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD).(Citation: FireEye APT28)(Citation: PaypalScam) Typosquatting may be used to aid in delivery of payloads via [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute "IDN homograph attacks," creating visually similar lookalike domains used to deliver malware to victim machines.(Citation: CISA IDN ST05-016)(Citation: tt_httrack_fake_domains)(Citation: tt_obliqueRAT)(Citation: httrack_unhcr)(Citation: lazgroup_idn_phishing) Different URIs/URLs may also be dynamically generated to uniquely serve malicious content to victims (including one-time, single use domain names).(Citation: iOS URL Scheme)(Citation: URI)(Citation: URI Use)(Citation: URI Unique) Adversaries may also acquire and repurpose expired domains, which may be potentially already allowlisted/trusted by defenders based on an existing reputation/history.(Citation: Categorisation_not_boundary)(Citation: Domain_Steal_CC)(Citation: Redirectors_Domain_Fronting)(Citation: bypass_webproxy_filtering) Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain. Adversaries may use such pr
Query: detect Data from Configuration Repository
Matching passage: T1602 Data from Configuration Repository. Tactics: collection. Description: Adversaries may collect data related to managed devices from configuration repositories. Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems. Configuration repositories may also facilitate remote access and administration of devices. Adversaries may target these repositories in order to collect large quantities of sensitive system administration data. Data from configuration repositories may be exposed by various protocols and software and can store a wide variety of data, much of which may align with adversary Discovery objectives.(Citation: US-CERT-TA18-106A)(Citation: US-CERT TA17-156A SNMP Abuse 2017)
Near-miss passage: T1602.001 SNMP (MIB Dump). Tactics: collection. Description: Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP). The MIB is a configuration repository that stores variable information accessible via SNMP in the form of object identifiers (OID). Each OID identifies a variable that can be read or set and permits active management tasks, such as configuration changes, through remote modification of these variables. SNMP can give administrators great insight in their systems, such as, system information, description of hardware, physical location, and software packages(Citation: SANS Information Security Reading Room Securing SNMP Securing SNMP). The MIB may also contain device operational information, including running configuration, routing table, and interface details. Adversaries may use SNMP queries to collect MIB content directly from SNMP-managed devices in order to collect network information that allows the adversary to build network maps and facilitate future targeted exploitation.(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks)
Query: describe CVE-2015-4204
Matching passage: CVE-2015-4204. CWE: CWE-399. CVSS: 6.800000190734863. Memory leak in Cisco IOS 12.2 in the Performance Routing Engine (PRE) module on uBR10000 devices allows remote authenticated users to cause a denial of service (memory consumption or PXF process crash) by sending docsIfMCmtsMib SNMP requests quickly, aka Bug ID CSCue65051.
Near-miss passage: CVE-2015-0672. CWE: CWE-399. CVSS: 5.0. The DHCPv4 server in Cisco IOS XR 5.2.2 on ASR 9000 devices allows remote attackers to cause a denial of service (service outage) via a flood of crafted DHCP packets, aka Bug ID CSCup67822.
Query: vulnerability: Cisco NX-OS 4.0 through 6.1 on Nexus 1000V 3000, 4000, 5000, 6000, and 7000 devices and Unified Computing System (UCS) platforms allows remote attackers to cause a denial of servic
Matching passage: CVE-2015-0718. CWE: CWE-399. CVSS: 7.5. Cisco NX-OS 4.0 through 6.1 on Nexus 1000V 3000, 4000, 5000, 6000, and 7000 devices and Unified Computing System (UCS) platforms allows remote attackers to cause a denial of service (TCP stack reload) by sending crafted TCP packets to a device that has a TIME_WAIT TCP session, aka Bug ID CSCub70579.
Near-miss passage: CVE-2015-6311. CWE: CWE-399. CVSS: 6.099999904632568. Cisco Wireless LAN Controller (WLC) devices with software 7.0(240.0), 7.3(101.0), and 7.4(1.19) allow remote attackers to cause a denial of service (device outage) by sending malformed 802.11i management data to a managed access point, aka Bug ID CSCub65236.
Query: patch priority for CVE-2015-7568
Matching passage: CVE-2015-7568. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in the password recovery feature in Yeager CMS 1.2.1 allows remote attackers to change the account credentials of known users via the "userEmail" parameter.
Near-miss passage: CVE-2015-1000003. CWE: CWE-89. CVSS: 9.800000190734863. Blind SQL Injection in filedownload v1.4 wordpress plugin
Query: CWE for Uninitialized Value on Reset for Registers Holding Security Settings
Matching passage: CWE-1271 Uninitialized Value on Reset for Registers Holding Security Settings. Security-critical logic is not set to a known value on reset.
Near-miss passage: CWE-291 Reliance on IP Address for Authentication. The product uses an IP address for authentication.
Query: Sigma rule for Detects usage of the copy builtin cmd command to copy files with the ".dmp"/".dump" extension from a remote share
Matching passage: Sigma rule: Detects usage of the copy builtin cmd command to copy files with the ".dmp"/".dump" extension from a remote share. Logsource: windows / process_creation. Rule: title: Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE id: 044ba588-dff4-4918-9808-3f95e8160606 status: test description: Detects usage of the copy builtin cmd command to copy files with the ".dmp"/".dump" extension from a remote share references: - https://thedfirreport.com/2022/09/26/bumblebee-round-two/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-27 modified: 2023-09-12 tags: - attack.credential-access logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cli: CommandLine|contains|all: - 'copy ' - ' \\\\' CommandLine|contains: - .dmp - .dump - .hdmp condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects PowerShell creating a binary executable or a script file.. Logsource: windows / file_event. Rule: title: Potential Binary Or Script Dropper Via PowerShell id: 7047d730-036f-4f40-b9d8-1c63e36d5e62 status: test description: Detects PowerShell creating a binary executable or a script file. references: - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-03-17 modified: 2025-07-04 tags: - attack.persistence logsource: product: windows category: file_event detection: selection: Image|endswith: - \powershell.exe - \powershell_ise.exe - \pwsh.exe TargetFilename|endswith: - .bat - .chm - .cmd - .com - .dll - .exe - .hta - .jar - .js - .ocx - .scr - .sys - .vbe - .vbs - .wsf filter_main_user_temp: TargetFilename|startswith: C:\Users\ TargetFilename|contains: \AppData\Local\Temp\ TargetFilename|endswith: - .dll - .exe filter_main_other_temp: TargetFilename|startswith: - C:\Windows\Temp\ - C:\Windows\SystemTemp\ TargetFilename|endswith: - .dll - .exe filter_main_powershell_module: TargetFilename|startswith: C:\Users\ TargetFilename|contains: \WindowsPowerShell\Modules\ TargetFilename|endswith: .dll filter_main_nuget: TargetFilename|startswith: C:\Program Files\PackageManagement\ProviderAssemblies\nuget\ TargetFilename|endswith: \Microsoft.PackageManagement.NuGetProvider.dll condition: selection and not 1 of filter_main_* falsepositives: - False positives will differ depending on the environment and scripts used. Apply additional filters accordingly. level: medium
Query: describe CVE-2015-5529
Matching passage: CVE-2015-5529. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Free Reprintables ArticleFR 3.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) name parameter to dashboard/settings/categories/, (2) title or (3) rel parameter to dashboard/settings/links/, or (4) url parameter to dashboard/tools/pingservers/.
Near-miss passage: CVE-2015-7726. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in role deletion in the Web-based Development Workbench in SAP HANA DB 1.00.091.00.1418659308 allows remote authenticated users to inject arbitrary web script or HTML via the role name, aka SAP Security Note 2153898.
Query: vulnerability: The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows re
Matching passage: CVE-2015-2317. CWE: CWE-79. CVSS: 4.300000190734863. The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL.
Near-miss passage: CVE-2015-6509. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) proxypass parameter to system_advanced_misc.php; (2) adaptiveend, (3) adaptivestart, (4) maximumstates, (5) maximumtableentries, or (6) aliasesresolveinterval parameter to system_advanced_firewall.php; (7) proxyurl, (8) proxyuser, or (9) proxyport parameter to system_advanced_misc.php; or (10) name, (11) notification_name, (12) ipaddress, (13) password, (14) smtpipaddress, (15) smtpport, (16) smtpfromaddress, (17) smtpnotifyemailaddress, (18) smtpusername, or (19) smtppassword parameter to system_advanced_notifications.php.
Query: patch priority for CVE-2015-7876
Matching passage: CVE-2015-7876. CWE: CWE-89. CVSS: 7.5. The escapeLike function in sqlsrv/database.inc in the Drupal 7 driver for SQL Server and SQL Azure 7.x-1.x before 7.x-1.4 does not properly escape certain characters, which allows remote attackers to execute arbitrary SQL commands via vectors involving a module using the db_like function.
Near-miss passage: CVE-2015-0780. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in the GetReRequestData method of the GetStoredResult class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Query: Multiple failed authentications followed by AppCert DLLs
Matching passage: T1546.009 AppCert DLLs. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the <code>AppCertDLLs</code> Registry key under <code>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\</code> are loaded into every process that calls the ubiquitously used application programming interface (API) functions <code>CreateProcess</code>, <code>CreateProcessAsUser</code>, <code>CreateProcessWithLoginW</code>, <code>CreateProcessWithTokenW</code>, or <code>WinExec</code>. (Citation: Elastic Process Injection July 2017) Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), this value can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. Malicious AppCert DLLs may also provide persistence by continuously being triggered by API activity.
Near-miss passage: T1546.015 Component Object Model Hijacking. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system.(Citation: Microsoft Component Object Model) References to various COM objects are stored in the Registry. Adversaries may use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead.(Citation: GDATA COM Hijacking) An adversary is likely to hijack objects that are used frequently enough to maintain a consistent level of persistence, but are unlikely to break noticeable functionality within the system as to avoid system instability that could lead to detection. One variation of COM hijacking involves abusing Type Libraries (TypeLibs), which provide metadata about COM objects, such as their interfaces and methods. Adversaries may modify Registry keys associated with TypeLibs to redirect legitimate COM object functionality to malicious scripts or payloads. Unlike traditional COM hijacking, which commonly uses local DLLs, this variation may leverage the "script:" moniker to execute remote scripts hosted on external servers.(Citation: RELIAQUEST) This approach enables stealthy execution of code while maintaining persistence, as the remote payload would be automatically downloaded whenever the hijacked COM object is accessed.
Query: exploit The SIP implementation in Cisco IOS 15.5(3)M on Cisco Unified Border Element (CUBE) devices allows remote attackers to cause a denial of service via crafted SIP messages, aka Bug I
Matching passage: CVE-2015-6343. CWE: CWE-399. CVSS: 5.0. The SIP implementation in Cisco IOS 15.5(3)M on Cisco Unified Border Element (CUBE) devices allows remote attackers to cause a denial of service via crafted SIP messages, aka Bug ID CSCuv79202.
Near-miss passage: CVE-2015-8959. CWE: CWE-399. CVSS: 6.5. coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (CPU consumption) via a crafted DDS file.
Query: CWE for Unlock of a Resource that is not Locked
Matching passage: CWE-832 Unlock of a Resource that is not Locked. The product attempts to unlock a resource that is not locked.
Near-miss passage: CWE-336 Same Seed in Pseudo-Random Number Generator (PRNG). A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is initialized.
Query: risk of The xmlParseMisc function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via unspecified vectors rela
Matching passage: CVE-2015-7500. CWE: CWE-119. CVSS: 5.0. The xmlParseMisc function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via unspecified vectors related to incorrect entities boundaries and start tags.
Near-miss passage: CVE-2015-5927. CWE: CWE-119. CVSS: 6.800000190734863. FontParser in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-5942.
Query: Persistence mechanism resembling File/Path Exclusions
Matching passage: T1564.012 File/Path Exclusions. Tactics: stealth. Description: Adversaries may attempt to hide their file-based artifacts by writing them to specific folders or file names excluded from antivirus (AV) scanning and other defensive capabilities. AV and other file-based scanners often include exclusions to optimize performance as well as ease installation and legitimate use of applications. These exclusions may be contextual (e.g., scans are only initiated in response to specific triggering events/alerts), but are also often hardcoded strings referencing specific folders and/or files assumed to be trusted and legitimate.(Citation: Microsoft File Folder Exclusions) Adversaries may abuse these exclusions to hide their file-based artifacts. For example, rather than tampering with tool settings to add a new exclusion (i.e., [Disable or Modify Tools](https://attack.mitre.org/techniques/T1685)), adversaries may drop their file-based payloads in default or otherwise well-known exclusions. Adversaries may also use [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) and other [Discovery](https://attack.mitre.org/tactics/TA0007)/[Reconnaissance](https://attack.mitre.org/tactics/TA0043) activities to both discover and verify existing exclusions in a victim environment.
Near-miss passage: T1564.013 Bind Mounts. Tactics: stealth. Description: Adversaries may abuse bind mounts on file structures to hide their activity and artifacts from native utilities. A bind mount maps a directory or file from one location on the filesystem to another, similar to a shortcut on Windows. It’s commonly used to provide access to specific files or directories across different environments, such as inside containers or chroot environments, and requires sudo access. Adversaries may use bind mounts to map either an empty directory or a benign `/proc` directory to a malicious process’s `/proc` directory. Using the commands `mount –o bind /proc/benign-process /proc/malicious-process` (or `mount –B`), the malicious process's `/proc` directory is overlayed with the contents of a benign process's `/proc` directory. When system utilities query process activity, such as `ps` and `top`, the kernel follows the bind mount and presents the benign directory’s contents instead of the malicious process's actual `/proc` directory. As a result, these utilities display information that appears to come from the benign process, effectively hiding the malicious process's metadata, executable, or other artifacts from detection.(Citation: Cado Security Commando Cat 2024)(Citation: Ahn Lab CoinMiner 2023)
Query: patch priority for CVE-2015-7877
Matching passage: CVE-2015-7877. CWE: CWE-89. CVSS: 9.800000190734863. Multiple SQL injection vulnerabilities in the User Dashboard module 7.x before 7.x-1.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-5078. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the insert function in application/controllers/admin/dataentry.php in LimeSurvey 2.06+ allows remote authenticated users to execute arbitrary SQL commands via the closedate parameter.