alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-3613
Matching passage: CVE-2015-3613. CWE: CWE-269. CVSS: 9.800000190734863. A vulnerability exists in in FortiManager 5.2.1 and earlier and 5.0.10 and earlier in the WebUI FTP backup page
Near-miss passage: CVE-2015-7334. CWE: CWE-269. CVSS: 7.800000190734863. MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior where the SUService.exe /type COMMAND type could allow a user to execute arbitrary code with elevated privileges.
Query: intelligence brief on T1059.001
Matching passage: T1059.001 PowerShell. Tactics: execution. Description: Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems). PowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk. A number of PowerShell-based offensive testing tools are available, including [Empire](https://attack.mitre.org/software/S0363), [PowerSploit](https://attack.mitre.org/software/S0194), [PoshC2](https://attack.mitre.org/software/S0378), and PSAttack.(Citation: Github PSAttack) PowerShell commands/scripts can also be executed without directly invoking the <code>powershell.exe</code> binary through interfaces to PowerShell's underlying <code>System.Management.Automation</code> assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).(Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)(Citation: Microsoft PSfromCsharp APR 2014)
Near-miss passage: T1059.011 Lua. Tactics: execution. Description: Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line (through the stand-alone lua interpreter), via scripts (<code>.lua</code>), or from Lua-embedded programs (through the <code>struct lua_State</code>).(Citation: Lua main page)(Citation: Lua state) Lua scripts may be executed by adversaries for malicious purposes. Adversaries may incorporate, abuse, or replace existing Lua interpreters to allow for malicious Lua command execution at runtime.(Citation: PoetRat Lua)(Citation: Lua Proofpoint Sunseed)(Citation: Cyphort EvilBunny)(Citation: Kaspersky Lua)
Query: write Sigma for Detects System Information Discovery commands
Matching passage: Sigma rule: Detects System Information Discovery commands. Logsource: linux / auditd. Rule: title: System Information Discovery - Auditd id: f34047d9-20d3-4e8b-8672-0a35cc50dc71 status: test description: Detects System Information Discovery commands references: - https://github.com/redcanaryco/atomic-red-team/blob/f296668303c29d3f4c07e42bdd2b28d8dd6625f9/atomics/T1082/T1082.md author: Pawel Mazur date: 2021-09-03 modified: 2023-03-06 tags: - attack.discovery - attack.t1082 logsource: product: linux service: auditd detection: selection_1: type: PATH name: - /etc/lsb-release - /etc/redhat-release - /etc/issue selection_2: type: EXECVE a0: - uname - uptime - lsmod - hostname - env selection_3: type: EXECVE a0: grep a1|contains: - vbox - vm - xen - virtio - hv selection_4: type: EXECVE a0: kmod a1: list condition: 1 of selection_* falsepositives: - Likely level: low
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via RUNDLL LAUNCHER. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell id: e6cb92b4-b470-4eb8-8a9d-d63e8583aae0 status: test description: Detects Obfuscated Powershell via RUNDLL LAUNCHER references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|contains|all: - rundll32.exe - shell32.dll - shellexec_rundll - powershell condition: selection_4104 falsepositives: - Unknown level: medium
Query: Sigma rule for This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health A
Matching passage: Sigma rule: This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health A. Logsource: azure / activitylogs. Rule: title: Azure Active Directory Hybrid Health AD FS Service Delete id: 48739819-8230-4ee3-a8ea-e0289d1fb0ff status: test description: 'This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant. A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs. The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure. ' references: - https://o365blog.com/post/hybridhealthagent/ author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC date: 2021-08-26 modified: 2023-10-11 tags: - attack.defense-impairment - attack.t1578.003 logsource: product: azure service: activitylogs detection: selection: CategoryValue: Administrative ResourceProviderValue: Microsoft.ADHybridHealthService ResourceId|contains: AdFederationService OperationNameValue: Microsoft.ADHybridHealthService/services/delete condition: selection falsepositives: - Legitimate AAD Health AD FS service instances being deleted in a tenant level: medium
Near-miss passage: Sigma rule: Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload abo. Logsource: linux / process_creation. Rule: title: Linux Base64 Encoded Shebang In CLI id: fe2f9663-41cb-47e2-b954-8a228f3b9dff status: test description: Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload about to be decoded references: - https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html - https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-15 tags: - attack.stealth - attack.t1140 logsource: product: linux category: process_creation detection: selection: CommandLine|contains: - IyEvYmluL2Jhc2 - IyEvYmluL2Rhc2 - IyEvYmluL3pza - IyEvYmluL2Zpc2 - IyEvYmluL3No condition: selection falsepositives: - Legitimate administration activities level: medium
Query: exploit Multiple stack-based buffer overflows in json parsing in PostgreSQL before 9.3.x before 9.3.10 and 9.4.x before 9.4.5 allow attackers to cause a denial of service (server crash) vi
Matching passage: CVE-2015-5289. CWE: CWE-119. CVSS: 6.400000095367432. Multiple stack-based buffer overflows in json parsing in PostgreSQL before 9.3.x before 9.3.10 and 9.4.x before 9.4.5 allow attackers to cause a denial of service (server crash) via unspecified vectors, which are not properly handled in (1) json or (2) jsonb values.
Near-miss passage: CVE-2015-3674. CWE: CWE-119. CVSS: 7.5. afpserver in Apple OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Query: actor TTPs: Boot or Logon Initialization Scripts
Matching passage: T1037 Boot or Logon Initialization Scripts. Tactics: persistence, privilege escalation. Description: Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke March 2019) Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely. Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.
Near-miss passage: T1037.005 Startup Items. Tactics: persistence, privilege escalation. Description: Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.(Citation: Startup Items) This is technically a deprecated technology (superseded by [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)), and thus the appropriate folder, <code>/Library/StartupItems</code> isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. A startup item is a directory whose executable and configuration property list (plist), <code>StartupParameters.plist</code>, reside in the top-level directory. An adversary can create the appropriate folders/files in the StartupItems directory to register their own persistence mechanism.(Citation: Methods of Mac Malware Persistence) Additionally, since StartupItems run during the bootup phase of macOS, they will run as the elevated root user.
Query: risk of Cross-site scripting (XSS) vulnerability on Chiyu BF-630, BF-630W, and BF-660C fingerprint access-control devices allows remote attackers to inject arbitrary web script or HTML via
Matching passage: CVE-2015-2870. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability on Chiyu BF-630, BF-630W, and BF-660C fingerprint access-control devices allows remote attackers to inject arbitrary web script or HTML via a SCRIPT element.
Near-miss passage: CVE-2015-8935. CWE: CWE-79. CVSS: 6.099999904632568. The sapi_header_op function in main/SAPI.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 supports deprecated line folding without considering browser compatibility, which allows remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer by leveraging (1) %0A%20 or (2) %0D%0A%20 mishandling in the header function.
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects LOLBINs and applications that should not legitimately drop executable or executable-equivalent files to disk. Th. Logsource: windows / file_event. Rule: title: Legitimate Application Dropped Executable id: f0540f7e-2db3-4432-b9e0-3965486744bc status: test description: 'Detects LOLBINs and applications that should not legitimately drop executable or executable-equivalent files to disk. This may indicate malware staging, process injection, or abuse of a trusted binary for payload delivery. ' references: - https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326 - https://dmpdump.github.io/posts/TelegramRat/ - https://www.virustotal.com/gui/file/a0d5b30578acd1df9139e7a8a4bfc659dc2cf48f4dc0c5804b70890adeb9fa21/behavior author: frack113, Florian Roth (Nextron Systems) date: 2022-08-21 modified: 2026-05-11 tags: - attack.stealth - attack.t1218 logsource: product: windows category: file_event detection: selection: Image|endswith: - \eqnedt32.exe - \wordpad.exe - \wordview.exe - \certutil.exe - \certoc.exe - \CertReq.exe - \Desktopimgdownldr.exe - \esentutl.exe - \mshta.exe - \AcroRd32.exe - \RdrCEF.exe - \hh.exe - \finger.exe TargetFilename|endswith: - .com - .dll - .exe - .jar - .ocx - .pyc condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_exe/info.yml
Near-miss passage: Sigma rule: Detects default RemCom pipe creation. Logsource: windows / pipe_created. Rule: title: PUA - RemCom Default Named Pipe id: d36f87ea-c403-44d2-aa79-1a0ac7c24456 related: - id: 9e77ed63-2ecf-4c7b-b09d-640834882028 type: obsolete status: test description: Detects default RemCom pipe creation references: - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view - https://github.com/kavika13/RemCom author: Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2023-08-07 modified: 2023-11-30 tags: - attack.lateral-movement - attack.t1021.002 - attack.execution - attack.t1569.002 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName|contains: \RemCom condition: selection falsepositives: - Legitimate Administrator activity level: medium
Query: rule covering Execution of plink to perform data exfiltration and tunneling
Matching passage: Sigma rule: Execution of plink to perform data exfiltration and tunneling. Logsource: windows / process_creation. Rule: title: Potential RDP Tunneling Via Plink id: f38ce0b9-5e97-4b47-a211-7dc8d8b871da related: - id: f7d7ebd5-a016-46e2-9c54-f9932f2d386d type: similar status: test description: Execution of plink to perform data exfiltration and tunneling references: - https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/ author: Florian Roth (Nextron Systems) date: 2022-08-04 modified: 2023-01-27 tags: - attack.command-and-control - attack.t1572 logsource: category: process_creation product: windows detection: selection_a: Image|endswith: \plink.exe CommandLine|contains: :127.0.0.1:3389 selection_b1: Image|endswith: \plink.exe CommandLine|contains: :3389 selection_b2: CommandLine|contains: - ' -P 443' - ' -P 22' condition: selection_a or all of selection_b* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a Powershell process that contains download commands in its command line string. Logsource: windows / process_creation. Rule: title: PowerShell Download Pattern id: 3b6ab547-8ec2-4991-b9d2-2b06702a48d7 related: - id: e6c54d94-498c-4562-a37c-b469d8e9a275 type: derived - id: 8f70ac5f-1f6f-4f8e-b454-db19561216c5 type: obsolete status: test description: Detects a Powershell process that contains download commands in its command line string references: - https://blog.redteam.pl/2020/06/black-kingdom-ransomware.html - https://lab52.io/blog/winter-vivern-all-summer/ - https://hatching.io/blog/powershell-analysis/ author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro date: 2019-01-16 modified: 2025-10-20 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell_ISE.EXE - PowerShell.EXE - pwsh.dll selection_cli: CommandLine|contains|all: - new-object - net.webclient). - download CommandLine|contains: - string( - file( condition: all of selection_* falsepositives: - Unknown level: medium
Query: containment actions for EDR alert: possible Multi-Factor Authentication (T1556.006)
Matching passage: Playbook for T1556.006 Multi-Factor Authentication. 1) Validate alert telemetry against T1556.006. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: defense impairment, persistence, credential access. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts. Once adversaries have gained access to a network by either compromising an account lacking MFA or by employing an MFA bypass method such as [Multi-Factor Authentication Request Generation](https://attack.mitre.org/techniques/T1621), adversaries may leverage their acce
Near-miss passage: Playbook for T1556.008 Network Provider DLL. Different response path focused on defense impairment, persistence, credential access.
Query: ATT&CK technique for Process Argument Spoofing
Matching passage: T1564.010 Process Argument Spoofing. Tactics: stealth. Description: Adversaries may attempt to hide process command-line arguments by overwriting process memory. Process command-line arguments are stored in the process environment block (PEB), a data structure used by Windows to store various information about/used by a process. The PEB includes the process command-line arguments that are referenced when executing the process. When a process is created, defensive tools/sensors that monitor process creations may retrieve the process arguments from the PEB.(Citation: Microsoft PEB 2021)(Citation: Xpn Argue Like Cobalt 2019) Adversaries may manipulate a process PEB to evade defenses. For example, [Process Hollowing](https://attack.mitre.org/techniques/T1055/012) can be abused to spawn a process in a suspended state with benign arguments. After the process is spawned and the PEB is initialized (and process information is potentially logged by tools/sensors), adversaries may override the PEB to modify the command-line arguments (ex: using the [Native API](https://attack.mitre.org/techniques/T1106) <code>WriteProcessMemory()</code> function) then resume process execution with malicious arguments.(Citation: Cobalt Strike Arguments 2019)(Citation: Xpn Argue Like Cobalt 2019)(Citation: Nviso Spoof Command Line 2020) Adversaries may also execute a process with malicious command-line arguments then patch the memory with benign arguments that may bypass subsequent process memory analysis.(Citation: FireEye FiveHands April 2021) This behavior may also be combined with other tricks (such as [Parent PID Spoofing](https://attack.mitre.org/techniques/T1134/004)) to manipulate or further evade process-based detections.
Near-miss passage: T1564 Hide Artifacts. Tactics: stealth. Description: Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.(Citation: Sofacy Komplex Trojan)(Citation: Cybereason OSX Pirrit)(Citation: MalwareBytes ADS July 2015) Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation, such as through the use of virtualization technology.(Citation: Sophos Ragnar May 2020)
Query: detection rule: Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unau
Matching passage: Sigma rule: Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unau. Logsource: linux / process_creation. Rule: title: Shell Invocation Via Ssh - Linux id: 8737b7f6-8df3-4bb7-b1da-06019b99b687 status: test description: 'Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. ' references: - https://gtfobins.github.io/gtfobins/ssh/ - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-08-29 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /ssh CommandLine|contains: - ProxyCommand=; - permitlocalcommand=yes - localhost selection_cli: CommandLine|contains: - /bin/bash - /bin/dash - /bin/fish - /bin/sh - /bin/zsh - sh 0<&2 1>&2 - sh 1>&2 0<&2 condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of various CLI utilities exfiltrating data via web requests. Logsource: windows / process_creation. Rule: title: Potential Data Exfiltration Activity Via CommandLine Tools id: 7d1aaf3d-4304-425c-b7c3-162055e0b3ab status: test description: Detects the use of various CLI utilities exfiltrating data via web requests references: - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-02 modified: 2025-10-19 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_iwr: Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - \cmd.exe CommandLine|contains: - 'curl ' - Invoke-RestMethod - Invoke-WebRequest - 'irm ' - 'iwr ' - 'wget ' CommandLine|contains|all: - ' -ur' - ' -me' - ' -b' - ' POST ' selection_curl: Image|endswith: \curl.exe CommandLine|contains: --ur selection_curl_data: CommandLine|contains: - ' -d ' - ' --data ' selection_wget: Image|endswith: \wget.exe CommandLine|contains: - --post-data - --post-file payloads: - CommandLine|re: - net\s+view - sc\s+query - CommandLine|contains: - Get-Content - GetBytes - hostname - ifconfig - ipconfig - netstat - nltest - qprocess - systeminfo - tasklist - ToBase64String - whoami - CommandLine|contains|all: - 'type ' - ' > ' - ' C:\' condition: (selection_iwr or all of selection_curl* or selection_wget) and payloads falsepositives: - Unlikely level: high
Query: vulnerability: Off-by-one error in IOAcceleratorFamily in Apple OS X through 10.10.2 allows attackers to execute arbitrary code in a privileged context via a crafted app.
Matching passage: CVE-2015-1066. CWE: CWE-189. CVSS: 10.0. Off-by-one error in IOAcceleratorFamily in Apple OS X through 10.10.2 allows attackers to execute arbitrary code in a privileged context via a crafted app.
Near-miss passage: CVE-2015-6130. CWE: CWE-189. CVSS: 9.300000190734863. Integer underflow in Uniscribe in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows remote attackers to execute arbitrary code via a crafted font, aka "Windows Integer Underflow Vulnerability."