alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects when the "index" value of a scheduled task is removed or deleted from the registry. Which effectively hides it f in logs
Matching passage: Sigma rule: Detects when the "index" value of a scheduled task is removed or deleted from the registry. Which effectively hides it f. Logsource: windows / registry_delete. Rule: title: Removal Of Index Value to Hide Schedule Task - Registry id: 526cc8bc-1cdc-48ad-8b26-f19bff969cec related: - id: acd74772-5f88-45c7-956b-6a7b36c294d2 type: similar - id: 5b16df71-8615-4f7f-ac9b-6c43c0509e61 type: similar status: test description: Detects when the "index" value of a scheduled task is removed or deleted from the registry. Which effectively hides it from any tooling such as "schtasks /query" references: - https://blog.qualys.com/vulnerabilities-threat-research/2022/06/20/defending-against-scheduled-task-attacks-in-windows-environments author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-26 modified: 2025-10-25 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_delete detection: selection: TargetObject|contains|all: - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ - Index condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_index_value_removal/info.yml
Near-miss passage: Sigma rule: Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Us. Logsource: windows / registry_set. Rule: title: Hiding User Account Via SpecialAccounts Registry Key id: f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd related: - id: 8a58209c-7ae6-4027-afb0-307a78e4589a type: obsolete - id: 9ec9fb1b-e059-4489-9642-f270c207923d type: similar status: test description: Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen. references: - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1564.002/T1564.002.md#atomic-test-3---create-hidden-user-in-registry author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2022-07-12 modified: 2023-01-26 tags: - attack.stealth - attack.t1564.002 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_special_accounts/info.yml simulation: - type: atomic-red-team name: Create Hidden User in Registry technique: T1564.002 atomic_guid: 173126b7-afe4-45eb-8680-fa9f6400431c
Query: CVE similar to CVE-2015-0232
Matching passage: CVE-2015-0232. CWE: UNKNOWN. CVSS: 6.800000190734863. The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer free and application crash) via crafted EXIF data in a JPEG image.
Near-miss passage: CVE-2015-6986. CWE: UNKNOWN. CVSS: 9.300000190734863. com.apple.driver.AppleVXD393 in the Graphics Driver subsystem in Apple iOS before 9.1 allows attackers to execute arbitrary code via a crafted app that leverages an unspecified "type confusion."
Query: CVE similar to CVE-2015-1295
Matching passage: CVE-2015-1295. CWE: UNKNOWN. CVSS: 7.5. Multiple use-after-free vulnerabilities in the PrintWebViewHelper class in components/printing/renderer/print_web_view_helper.cc in Google Chrome before 45.0.2454.85 allow user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact by triggering nested IPC messages during preparation for printing, as demonstrated by messages associated with PDF documents in conjunction with messages about printer capabilities.
Near-miss passage: CVE-2015-0395. CWE: UNKNOWN. CVSS: 9.300000190734863. Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
Query: CVE similar to CVE-2015-7970
Matching passage: CVE-2015-7970. CWE: CWE-399. CVSS: 4.900000095367432. The p2m_pod_emergency_sweep function in arch/x86/mm/p2m-pod.c in Xen 3.4.x, 3.5.x, and 3.6.x is not preemptible, which allows local x86 HVM guest administrators to cause a denial of service (CPU consumption and possibly reboot) via crafted memory contents that triggers a "time-consuming linear scan," related to Populate-on-Demand.
Near-miss passage: CVE-2015-4651. CWE: CWE-399. CVSS: 5.0. The dissect_wccp2r1_address_table_info function in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.12.x before 1.12.6 does not properly determine whether enough memory is available for storing IP address strings, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Query: detect Detects instances where an HTTPPROXY service on an OpenCanary node has had an attempt to proxy another page. in logs
Matching passage: Sigma rule: Detects instances where an HTTPPROXY service on an OpenCanary node has had an attempt to proxy another page.. Logsource: opencanary / application. Rule: title: OpenCanary - HTTPPROXY Login Attempt id: 5498fc09-adc6-4804-b9d9-5cca1f0b8760 status: test description: 'Detects instances where an HTTPPROXY service on an OpenCanary node has had an attempt to proxy another page. ' references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.initial-access - attack.command-and-control - attack.t1090 logsource: category: application product: opencanary detection: selection: logtype: 7001 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects usage of crontab to list the tasks of the user. Logsource: linux / process_creation. Rule: title: Crontab Enumeration id: 403ed92c-b7ec-4edd-9947-5b535ee12d46 status: test description: Detects usage of crontab to list the tasks of the user references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.discovery - attack.t1007 logsource: product: linux category: process_creation detection: selection: Image|endswith: /crontab CommandLine|contains: ' -l' condition: selection falsepositives: - Legitimate use of crontab level: low
Query: CVE similar to CVE-2015-2106
Matching passage: CVE-2015-2106. CWE: UNKNOWN. CVSS: 6.400000095367432. Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 2 before 2.27, 3 before 1.82, and 4 before 2.10 allows remote attackers to bypass intended access restrictions or cause a denial of service via unknown vectors.
Near-miss passage: CVE-2015-0440. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle Knowledge component in Oracle Right Now Service Cloud 8.2.3.10.1 and 8.4.7.2 allows remote attackers to affect integrity via unknown vectors related to Information Manager Console.
Query: detection rule: Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity
Matching passage: Sigma rule: Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Blocked Image/Driver Load For Policy Violation id: e4be5675-4a53-426a-8c81-a8bb2387e947 status: test description: Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy. references: - https://twitter.com/wdormann/status/1590434950335320065 - https://github.com/MicrosoftDocs/windows-itpro-docs/blob/40fe118976734578f83e5e839b9c63ae7a4af82d/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md#windows-codeintegrity-operational-log - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-10 modified: 2023-06-07 tags: - attack.persistence - attack.privilege-escalation - attack.t1543 logsource: product: windows service: codeintegrity-operational detection: selection: EventID: 3077 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects actions taken by Windows Defender malware detection engines. Logsource: windows / windefend. Rule: title: Windows Defender Threat Detected id: 57b649ef-ff42-4fb0-8bf6-62da243a1708 status: stable description: Detects actions taken by Windows Defender malware detection engines references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus author: Ján Trenčanský date: 2020-07-28 tags: - attack.execution - attack.t1059 logsource: product: windows service: windefend detection: selection: EventID: - 1006 - 1015 - 1116 - 1117 condition: selection falsepositives: - Unlikely level: high
Query: vulnerability: IBM SPSS Statistics 22.0.0.2 before IF10 and 23.0.0.2 before IF7 uses weak permissions (Everyone: Write) for Python scripts, which allows local users to gain privileges by modifyin
Matching passage: CVE-2015-7489. CWE: CWE-264. CVSS: 7.800000190734863. IBM SPSS Statistics 22.0.0.2 before IF10 and 23.0.0.2 before IF7 uses weak permissions (Everyone: Write) for Python scripts, which allows local users to gain privileges by modifying a script.
Near-miss passage: CVE-2015-1644. CWE: CWE-264. CVSS: 7.199999809265137. Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Windows MS-DOS Device Name Vulnerability."
Query: patch priority for CVE-2015-8998
Matching passage: CVE-2015-8998. CWE: CWE-190. CVSS: 7.800000190734863. In TrustZone an integer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel.
Near-miss passage: CVE-2015-2519. CWE: CWE-190. CVSS: 9.300000190734863. Integer overflow in Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted .jnt file, aka "Windows Journal Integer Overflow RCE Vulnerability."
Query: write Sigma for An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities
Matching passage: Sigma rule: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities. Logsource: windows / process_creation. Rule: title: Compress Data and Lock With Password for Exfiltration With WINZIP id: e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d status: test description: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md author: frack113 date: 2021-07-27 modified: 2022-12-25 tags: - attack.collection - attack.t1560.001 logsource: category: process_creation product: windows detection: selection_winzip: CommandLine|contains: - winzip.exe - winzip64.exe selection_password: CommandLine|contains: -s" selection_other: CommandLine|contains: - ' -min ' - ' -a ' condition: all of selection* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects possible suspicious glue development endpoint activity.. Logsource: aws / cloudtrail. Rule: title: AWS Glue Development Endpoint Activity id: 4990c2e3-f4b8-45e3-bc3c-30b14ff0ed26 status: test description: Detects possible suspicious glue development endpoint activity. references: - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/ - https://docs.aws.amazon.com/glue/latest/webapi/API_CreateDevEndpoint.html author: Austin Songer @austinsonger date: 2021-10-03 modified: 2022-12-18 tags: - attack.privilege-escalation logsource: product: aws service: cloudtrail detection: selection: eventSource: glue.amazonaws.com eventName: - CreateDevEndpoint - DeleteDevEndpoint - UpdateDevEndpoint condition: selection falsepositives: - Glue Development Endpoint Activity may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - If known behavior is causing false positives, it can be exempted from the rule. level: low
Query: containment actions for Encoded PowerShell / command-line abuse matching Office Template Macros
Matching passage: Playbook for T1137.001 Office Template Macros. 1) Validate alert telemetry against T1137.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: persistence. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Microsoft Office contains templates that are part of common Office applications and are used to customize styles. The base templates within the application are used each time an application starts. (Citation: Microsoft Change Normal Template) Office Visual Basic for Applications (VBA) macros (Citation:
Near-miss passage: Playbook for T1137.005 Outlook Rules. Different response path focused on persistence.
Query: Encoded PowerShell / command-line abuse matching Data Obfuscation
Matching passage: T1001 Data Obfuscation. Tactics: command and control. Description: Adversaries may obfuscate command and control traffic to make it more difficult to detect.(Citation: Bitdefender FunnyDream Campaign November 2020) Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Near-miss passage: T1001.002 Steganography. Tactics: command and control. Description: Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.
Query: vulnerability: Cross-site request forgery (CSRF) vulnerability in Cisco Unified Communications Domain Manager (UCDM) 10 allows remote attackers to hijack the authentication of arbitrary users, ak
Matching passage: CVE-2015-0588. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco Unified Communications Domain Manager (UCDM) 10 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuo77055.
Near-miss passage: CVE-2015-3350. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Todo Filter module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that toggle a task via unspecified vectors.
Query: CVE similar to CVE-2015-7642
Matching passage: CVE-2015-7642. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7643, and CVE-2015-7644.
Near-miss passage: CVE-2015-0397. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability via unknown vectors related to File System, a different vulnerability than CVE-2014-6570 and CVE-2014-6600.
Query: intelligence brief on T1021
Matching passage: T1021 Remote Services. Tactics: lateral movement. Description: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user. In an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP).(Citation: SSH Secure Shell)(Citation: TechNet Remote Desktop Services) They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain, or management platforms for internal virtualization environments such as VMware vCenter. Legitimate applications (such as [Software Deployment Tools](https://attack.mitre.org/techniques/T1072) and other administrative programs) may utilize [Remote Services](https://attack.mitre.org/techniques/T1021) to access remote hosts. For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management. ARD leverages a blend of protocols, including [VNC](https://attack.mitre.org/techniques/T1021/005) to send the screen and control buffers and [SSH](https://attack.mitre.org/techniques/T1021/004) for secure file transfer.(Citation: Remote Management MDM macOS)(Citation: Kickstart Apple Remote Desktop commands)(Citation: Apple Remote Desktop Admin Guide 3.3) Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement. In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.(Citation: FireEye 2019 Apple Remote Desktop)(
Near-miss passage: T1021.006 Windows Remote Management. Tactics: lateral movement. Description: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services).(Citation: Microsoft WinRM) It may be called with the `winrm` command or by any number of programs such as PowerShell.(Citation: Jacobsen 2014) WinRM can be used as a method of remotely interacting with [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).(Citation: MSDN WMI)
Query: risk of The prctl_set_vma_anon_name function in kernel/sys.c in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 does not ensure that only one vma is accessed in a certain update acti
Matching passage: CVE-2015-6640. CWE: CWE-264. CVSS: 7.800000190734863. The prctl_set_vma_anon_name function in kernel/sys.c in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 does not ensure that only one vma is accessed in a certain update action, which allows attackers to gain privileges or cause a denial of service (vma list corruption) via a crafted application, aka internal bug 20017123.
Near-miss passage: CVE-2015-7875. CWE: CWE-264. CVSS: 7.5. ctools 6.x-1.x before 6.x-1.14 and 7.x-1.x before 7.x-1.8 in Drupal does not verify the "edit" permission for the "content type" plugins that are used on Panels and similar systems to place content and functionality on a page.
Query: risk of The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameter.
Matching passage: CVE-2015-9451. CWE: CWE-89. CVSS: 9.800000190734863. The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameter.
Near-miss passage: CVE-2015-4109. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin before 1.5.16 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) data_target or (2) data_vote parameter in a rating_vote (wp_ajax_nopriv_rating_vote) action to wp-admin/admin-ajax.php.
Query: weakness Excessive Use of Unconditional Branching
Matching passage: CWE-1119 Excessive Use of Unconditional Branching. The code uses too many unconditional branches (such as goto).
Near-miss passage: CWE-1105 Insufficient Encapsulation of Machine-Dependent Functionality. The product or code uses machine-dependent functionality, but it does not sufficiently encapsulate or isolate this functionality from the rest of the code.
Query: CVE similar to CVE-2015-9150
Matching passage: CVE-2015-9150. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, SD 400, and SD 800, while computing the length of memory allocated for a Diag event, if the buffer length is very small or greater than the maximum, an integer overflow may occur, which later results in a buffer overflow.
Near-miss passage: CVE-2015-1964. CWE: CWE-119. CVSS: 7.800000190734863. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, and CVE-2015-1965.
Query: CWE for Client-Side Enforcement of Server-Side Security
Matching passage: CWE-602 Client-Side Enforcement of Server-Side Security. The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
Near-miss passage: CWE-31 Path Traversal: 'dir....filename'. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize 'dir....filename' (multiple internal backslash dot dot) sequences that can resolve to a location that is outside of that directory.