alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is differ
Matching passage: CVE-2015-4021. CWE: CWE-189. CVSS: 5.0. The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service (integer underflow and memory corruption) via a crafted entry in a tar archive.
Near-miss passage: CVE-2015-4491. CWE: CWE-189. CVSS: 6.800000190734863. Integer overflow in the make_filter_table function in pixops/pixops.c in gdk-pixbuf before 2.31.5, as used in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Linux, Google Chrome on Linux, and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via crafted bitmap dimensions that are mishandled during scaling.
Query: risk of EMC Documentum Content Server before 7.0 P20, 7.1 before P18, and 7.2 before P02, when RPC tracing is configured, stores certain obfuscated password data in a log file, which allow
Matching passage: CVE-2015-4536. CWE: CWE-200. CVSS: 3.5. EMC Documentum Content Server before 7.0 P20, 7.1 before P18, and 7.2 before P02, when RPC tracing is configured, stores certain obfuscated password data in a log file, which allows remote authenticated users to obtain sensitive information by reading this file.
Near-miss passage: CVE-2015-8555. CWE: CWE-200. CVSS: 8.600000381469727. Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state, which allows local guest domains to obtain sensitive information from other domains via unspecified vectors.
Query: detect Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials in logs
Matching passage: Sigma rule: Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials. Logsource: windows / security. Rule: title: Active Directory Replication from Non Machine Account - DcSync Indicator id: 17d619c1-e020-4347-957e-1d1207455c93 related: - id: 611eab06-a145-4dfa-a295-3ccc5c20f59a type: similar status: test description: Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials. references: - https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html - https://threathunterplaybook.com/library/windows/active_directory_replication.html - https://threathunterplaybook.com/hunts/windows/190101-ADModDirectoryReplication/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-07-26 modified: 2026-07-30 tags: - attack.credential-access - attack.t1003.006 logsource: product: windows service: security definition: 'Requirements: A SACL must be configured on the domain NC root object (e.g. DC=domain,DC=com) to generate Event 4662. Add via ADSI Edit: navigate to the domain NC root → Properties → Security → Advanced → Auditing → add an ACE for Everyone, Type: Success, Applies to: This object only, rights: DS-Replication-Get-Changes and DS-Replication-Get-Changes-All. The OS audit subcategory must also be enabled: auditpol /set /subcategory:"Directory Service Access" /success:enable ' detection: selection: EventID: 4662 Properties|contains: - 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 - 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 - 9923a32a-3607-11d2-b9be-0000f87a36b2 - 89e95b76-444d-4c62-991a-0facbeda640c filter_main_machine_accounts: SubjectUserName|endswith: $ filter_optional_subject_domain: SubjectDomainName: Window Manager filter_optional_subject_usersid: SubjectUserName|startswith: - NT AUT - MSOL_ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects tampering with EventLog service "file" key. In order to change the default location of an Evtx file. This techni. Logsource: windows / registry_set. Rule: title: Potential EventLog File Location Tampering id: 0cb8d736-995d-4ce7-a31e-1e8d452a1459 status: test description: Detects tampering with EventLog service "file" key. In order to change the default location of an Evtx file. This technique is used to tamper with log collection and alerting references: - https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key author: D3F7A5105 date: 2023-01-02 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SYSTEM\CurrentControlSet\Services\EventLog\ TargetObject|endswith: \File filter: Details|contains: \System32\Winevt\Logs\ condition: selection and not filter falsepositives: - Unknown level: high
Query: rule covering Detects potential DLL sideloading of "wwlib.dll"
Matching passage: Sigma rule: Detects potential DLL sideloading of "wwlib.dll". Logsource: windows / image_load. Rule: title: Potential WWlib.DLL Sideloading id: e2e01011-5910-4267-9c3b-4149ed5479cf status: test description: Detects potential DLL sideloading of "wwlib.dll" references: - https://twitter.com/WhichbufferArda/status/1658829954182774784 - https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/ - https://securelist.com/apt-luminousmoth/103332/ author: X__Junior (Nextron Systems) date: 2023-05-18 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \wwlib.dll filter_main_path: Image|startswith: - C:\Program Files (x86)\Microsoft Office\ - C:\Program Files\Microsoft Office\ Image|endswith: \winword.exe ImageLoaded|startswith: - C:\Program Files (x86)\Microsoft Office\ - C:\Program Files\Microsoft Office\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects potentially uncommon child processes of SndVol.exe (the Windows volume mixer). Logsource: windows / process_creation. Rule: title: Uncommon Child Processes Of SndVol.exe id: ba42babc-0666-4393-a4f7-ceaf5a69191e status: test description: Detects potentially uncommon child processes of SndVol.exe (the Windows volume mixer) references: - https://twitter.com/Max_Mal_/status/1661322732456353792 author: X__Junior (Nextron Systems) date: 2023-06-09 tags: - attack.execution logsource: product: windows category: process_creation detection: selection: ParentImage|endswith: \SndVol.exe filter_main_rundll32: Image|endswith: \rundll32.exe CommandLine|contains: ' shell32.dll,Control_RunDLL ' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: Encoded PowerShell / command-line abuse matching Cached Domain Credentials
Matching passage: T1003.005 Cached Domain Credentials. Tactics: credential access. Description: Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.(Citation: Microsoft - Cached Creds) On Windows Vista and newer, the hash format is DCC2 (Domain Cached Credentials version 2) hash, also known as MS-Cache v2 hash.(Citation: PassLib mscache) The number of default cached credentials varies and can be altered per system. This hash does not allow pass-the-hash style attacks, and instead requires [Password Cracking](https://attack.mitre.org/techniques/T1110/002) to recover the plaintext password.(Citation: ired mscache) On Linux systems, Active Directory credentials can be accessed through caches maintained by software like System Security Services Daemon (SSSD) or Quest Authentication Services (formerly VAS). Cached credential hashes are typically located at `/var/lib/sss/db/cache.[domain].ldb` for SSSD or `/var/opt/quest/vas/authcache/vas_auth.vdb` for Quest. Adversaries can use utilities, such as `tdbdump`, on these database files to dump the cached hashes and use [Password Cracking](https://attack.mitre.org/techniques/T1110/002) to obtain the plaintext password.(Citation: Brining MimiKatz to Unix) With SYSTEM or sudo access, the tools/utilities such as [Mimikatz](https://attack.mitre.org/software/S0002), [Reg](https://attack.mitre.org/software/S0075), and secretsdump.py for Windows or Linikatz for Linux can be used to extract the cached credentials.(Citation: Brining MimiKatz to Unix) Note: Cached credentials for Windows Vista are derived using PBKDF2.(Citation: PassLib mscache)
Near-miss passage: T1003.004 LSA Secrets. Tactics: credential access. Description: Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.(Citation: Passcape LSA Secrets)(Citation: Microsoft AD Admin Tier Model)(Citation: Tilbury Windows Credentials) LSA secrets are stored in the registry at <code>HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets</code>. LSA secrets can also be dumped from memory.(Citation: ired Dumping LSA Secrets) [Reg](https://attack.mitre.org/software/S0075) can be used to extract from the Registry. [Mimikatz](https://attack.mitre.org/software/S0002) can be used to extract secrets from memory.(Citation: ired Dumping LSA Secrets)
Query: adversary uses Exfiltration to Code Repository
Matching passage: T1567.001 Exfiltration to Code Repository. Tactics: exfiltration. Description: Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection. Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network.
Near-miss passage: T1567.003 Exfiltration to Text Storage Sites. Tactics: exfiltration. Description: Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as <code>pastebin[.]com</code>, are commonly used by developers to share code and other information. Text storage sites are often used to host malicious code for C2 communication (e.g., [Stage Capabilities](https://attack.mitre.org/techniques/T1608)), but adversaries may also use these sites to exfiltrate collected data. Furthermore, paid features and encryption options may allow adversaries to conceal and store data more securely.(Citation: Pastebin EchoSec) **Note:** This is distinct from [Exfiltration to Code Repository](https://attack.mitre.org/techniques/T1567/001), which highlight access to code repositories via APIs.
Query: common weakness: Improper Neutralization of Record Delimiters
Matching passage: CWE-143 Improper Neutralization of Record Delimiters. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as record delimiters when they are sent to a downstream component.
Near-miss passage: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'). The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
Query: secure coding against Improper Neutralization of Data within XPath Expressions ('XPath Injection')
Matching passage: CWE-643 Improper Neutralization of Data within XPath Expressions ('XPath Injection'). The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.
Near-miss passage: CWE-1119 Excessive Use of Unconditional Branching. The code uses too many unconditional branches (such as goto).
Query: Sigma rule for Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged pro
Matching passage: Sigma rule: Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged pro. Logsource: windows / process_creation. Rule: title: Bypass UAC via Fodhelper.exe id: 7f741dcf-fc22-4759-87b4-9ae8376676a2 status: test description: Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes. references: - https://eqllib.readthedocs.io/en/latest/analytics/e491ce22-792f-11e9-8f5c-d46d6d62a49e.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md author: E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community date: 2019-10-24 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \fodhelper.exe condition: selection falsepositives: - Legitimate use of fodhelper.exe utility by legitimate user level: high
Near-miss passage: Sigma rule: Detects the execution of the "cloudflared" binary from a non standard location.. Logsource: windows / process_creation. Rule: title: Cloudflared Portable Execution id: fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd status: test description: 'Detects the execution of the "cloudflared" binary from a non standard location. ' references: - https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/ - https://github.com/cloudflare/cloudflared - https://www.intrinsec.com/akira_ransomware/ - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/ - https://github.com/cloudflare/cloudflared/releases author: Nasreddine Bencherchali (Nextron Systems) tags: - attack.command-and-control - attack.t1090.001 date: 2023-12-20 logsource: category: process_creation product: windows detection: selection: Image|endswith: \cloudflared.exe filter_main_admin_location: Image|contains: - :\Program Files (x86)\cloudflared\ - :\Program Files\cloudflared\ condition: selection and not 1 of filter_main_* falsepositives: - Legitimate usage of Cloudflared portable versions level: medium
Query: describe CVE-2015-0701
Matching passage: CVE-2015-0701. CWE: CWE-20. CVSS: 10.0. Cisco UCS Central Software before 1.3(1a) allows remote attackers to execute arbitrary commands via a crafted HTTP request, aka Bug ID CSCut46961.
Near-miss passage: CVE-2015-2187. CWE: CWE-20. CVSS: 5.0. The dissect_atn_cpdlc_heur function in asn1/atn-cpdlc/packet-atn-cpdlc-template.c in the ATN-CPDLC dissector in Wireshark 1.12.x before 1.12.4 does not properly follow the TRY/ENDTRY code requirements, which allows remote attackers to cause a denial of service (stack memory corruption and application crash) via a crafted packet.
Query: playbook for alert: Multiple failed authentications followed by Scheduled Task
Matching passage: Playbook for T1053.005 Scheduled Task. 1) Validate alert telemetry against T1053.005. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: execution, persistence, privilege escalation. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The [schtasks](https://attack.mitre.org/software/S0111) utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Co
Near-miss passage: Playbook for T1053 Scheduled Task/Job. Different response path focused on execution, persistence, privilege escalation.
Query: Sigma rule for Detects removing immutable file attribute.
Matching passage: Sigma rule: Detects removing immutable file attribute.. Logsource: linux / auditd. Rule: title: Remove Immutable File Attribute - Auditd id: a5b977d6-8a81-4475-91b9-49dbfcd941f7 status: test description: Detects removing immutable file attribute. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.002/T1222.002.md author: Jakob Weinzettl, oscd.community date: 2019-09-23 modified: 2022-11-26 tags: - attack.defense-impairment - attack.t1222.002 logsource: product: linux service: auditd detection: selection: type: EXECVE a0|contains: chattr a1|contains: -i condition: selection falsepositives: - Administrator interacting with immutable files (e.g. for instance backups). level: medium simulation: - type: atomic-red-team name: Remove immutable file attribute technique: T1222.002 atomic_guid: e7469fe2-ad41-4382-8965-99b94dd3c13f
Near-miss passage: Sigma rule: Detects Obfuscated use of stdin to execute PowerShell. Logsource: windows / security. Rule: title: Invoke-Obfuscation STDIN+ Launcher - Security id: 0c718a5e-4284-4fb9-b4d9-b9a50b3a1974 related: - id: 72862bf2-0eb1-11eb-adc1-0242ac120002 type: derived status: test description: Detects Obfuscated use of stdin to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceFileName|contains|all: - cmd - powershell selection2: ServiceFileName|contains: - ${input} - noexit selection3: ServiceFileName|contains: - ' /c ' - ' /r ' condition: all of selection* falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-6688
Matching passage: CVE-2015-6688. CWE: CWE-416. CVSS: 6.800000190734863. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via a crafted Optional Content Groups (OCG) object in a WillSave document action, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6687, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7615, CVE-2015-7617, and CVE-2015-7621.
Near-miss passage: CVE-2015-6690. CWE: CWE-416. CVSS: 6.800000190734863. Use-after-free vulnerability in the popUpMenuEx method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via crafted arguments, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6691, CVE-2015-7615, CVE-2015-7617, and CVE-2015-7621.
Query: write Sigma for Detects incoming connections to AnyDesk. This could indicate a potential remote attacker trying to connect to a listenin
Matching passage: Sigma rule: Detects incoming connections to AnyDesk. This could indicate a potential remote attacker trying to connect to a listenin. Logsource: windows / network_connection. Rule: title: Remote Access Tool - AnyDesk Incoming Connection id: d58ba5c6-0ed7-4b9d-a433-6878379efda9 status: experimental description: 'Detects incoming connections to AnyDesk. This could indicate a potential remote attacker trying to connect to a listening instance of AnyDesk and use it as potential command and control channel. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows - https://asec.ahnlab.com/en/40263/ author: '@d4ns4n_ (Wuerth-Phoenix)' date: 2024-09-02 modified: 2025-02-24 tags: - attack.persistence - attack.command-and-control - attack.t1219.002 logsource: category: network_connection product: windows detection: selection: Image|endswith: - \AnyDesk.exe - \AnyDeskMSI.exe Initiated: 'false' condition: selection falsepositives: - Legitimate incoming connections (e.g. sysadmin activity). Most of the time I would expect outgoing connections (initiated locally). level: medium
Near-miss passage: Sigma rule: Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App woul. Logsource: windows / applocker. Rule: title: AppLocker Application Would Have Been Blocked id: 557e3bd3-7f21-495d-8d50-7c8bdfb8041c status: experimental description: 'Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled. ' references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker - https://www.splunk.com/en_us/blog/security/deploy-test-monitor-mastering-microsoft-applocker-part-2.html - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/ee844150(v=ws.11) author: heyyanu date: 2026-03-26 tags: - attack.execution - attack.t1204.002 - attack.t1059.001 - attack.t1059.003 - attack.t1059.005 - attack.t1059.006 - attack.t1059.007 logsource: product: windows service: applocker detection: selection: EventID: - 8003 - 8006 - 8021 - 8024 condition: selection falsepositives: - Expected during AppLocker policy testing and audit mode deployments level: medium