alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection engineering for Wordlist Scanning
Matching passage: T1595.003 Wordlist Scanning. Tactics: reconnaissance. Description: Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques. While this technique employs similar methods to [Brute Force](https://attack.mitre.org/techniques/T1110), its goal is the identification of content and infrastructure rather than the discovery of valid credentials. Wordlists used in these scans may contain generic, commonly used names and file extensions or terms specific to a particular software. Adversaries may also create custom, target-specific wordlists using data gathered from other Reconnaissance techniques (ex: [Gather Victim Org Information](https://attack.mitre.org/techniques/T1591), or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)). For example, adversaries may use web content discovery tools such as Dirb, DirBuster, and GoBuster and generic or custom wordlists to enumerate a website’s pages and directories.(Citation: ClearSky Lebanese Cedar Jan 2021) This can help them to discover old, vulnerable pages or hidden administrative portals that could become the target of further operations (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [Brute Force](https://attack.mitre.org/techniques/T1110)). As cloud storage solutions typically use globally unique names, adversaries may also use target-specific wordlists and tools such as s3recon and GCPBucketBrute to enumerate public and private buckets on cloud infrastructure.(Citation: S3Recon GitHub)(Citation: GCPBucketBrute) Once storage objects are discovered, adversaries may leverage [Data from Cloud Storage](https://attack.mitre.org/techniques/T1530) to access valuable information that can be exfiltrated or used to escalate privileges and move laterally.
Near-miss passage: T1595 Active Scanning. Tactics: reconnaissance. Description: Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction. Adversaries may perform different forms of active scanning depending on what information they seek to gather. These scans can also be performed in various ways, including using native features of network protocols such as ICMP.(Citation: Botnet Scan)(Citation: OWASP Fingerprinting) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).
Query: describe CVE-2015-2850
Matching passage: CVE-2015-2850. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in index-login.ant in the ANTlabs InnGate firmware on IG 3100, InnGate 3.01 E, InnGate 3.10 E, InnGate 3.10 M, SG 4, and SSG 4 devices allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
Near-miss passage: CVE-2015-9372. CWE: CWE-79. CVSS: 6.099999904632568. Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Query: write Sigma for Attackers may leverage fsutil to enumerated connected drives.
Matching passage: Sigma rule: Attackers may leverage fsutil to enumerated connected drives.. Logsource: windows / process_creation. Rule: title: Fsutil Drive Enumeration id: 63de06b9-a385-40b5-8b32-73f2b9ef84b6 status: test description: Attackers may leverage fsutil to enumerated connected drives. references: - Turla has used fsutil fsinfo drives to list connected drives. - https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/discovery_peripheral_device.toml author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' date: 2022-03-29 modified: 2022-07-14 tags: - attack.discovery - attack.t1120 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \fsutil.exe - OriginalFileName: fsutil.exe selection_cli: CommandLine|contains: drives condition: all of selection_* falsepositives: - Certain software or administrative tasks may trigger false positives. level: low
Near-miss passage: Sigma rule: Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or netwo. Logsource: windows / security. Rule: title: Failed Logon From Public IP id: f88e112a-21aa-44bd-9b01-6ee2a2bbbed1 status: test description: Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625 author: NVISO date: 2020-05-06 modified: 2024-03-11 tags: - attack.privilege-escalation - attack.initial-access - attack.persistence - attack.stealth - attack.t1078 - attack.t1190 - attack.t1133 logsource: product: windows service: security detection: selection: EventID: 4625 filter_main_ip_unknown: IpAddress|contains: '-' filter_main_local_ranges: IpAddress|cidr: - ::1/128 - 10.0.0.0/8 - 127.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - fc00::/7 - fe80::/10 condition: selection and not 1 of filter_main_* falsepositives: - Legitimate logon attempts over the internet - IPv4-to-IPv6 mapped IPs level: medium
Query: vulnerability: Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA record defined locally.
Matching passage: CVE-2015-8899. CWE: CWE-20. CVSS: 7.5. Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA record defined locally.
Near-miss passage: CVE-2015-8331. CWE: CWE-20. CVSS: 7.400000095367432. The Operation and Maintenance Unit (OMU) in Huawei VCN500 with software before V100R002C00SPC200 does not properly invalidate the session ID when an "abnormal exit" occurs, which allows remote attackers to conduct replay attacks via the session ID.
Query: Encoded PowerShell / command-line abuse matching Runtime Data Manipulation
Matching passage: T1565.003 Runtime Data Manipulation. Tactics: impact. Description: Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating runtime data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Adversaries may alter application binaries used to display data in order to cause runtime manipulations. Adversaries may also conduct [Change Default File Association](https://attack.mitre.org/techniques/T1546/001) and [Masquerading](https://attack.mitre.org/techniques/T1036) to cause a similar effect. The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Near-miss passage: T1565.001 Stored Data Manipulation. Tactics: impact. Description: Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Query: CVE similar to CVE-2015-1050
Matching passage: CVE-2015-1050. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in F5 BIG-IP Application Security Manager (ASM) before 11.6 allows remote attackers to inject arbitrary web script or HTML via the Response Body field when creating a new user account.
Near-miss passage: CVE-2015-9414. CWE: CWE-79. CVSS: 6.099999904632568. The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter.
Query: CWE for Download of Code Without Integrity Check
Matching passage: CWE-494 Download of Code Without Integrity Check. The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
Near-miss passage: CWE-215 Insertion of Sensitive Information Into Debugging Code. The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
Query: alert when Detects registry modifications to the 'ms-settings' protocol handler, which is frequently targeted for UAC bypass or per
Matching passage: Sigma rule: Detects registry modifications to the 'ms-settings' protocol handler, which is frequently targeted for UAC bypass or per. Logsource: windows / process_creation. Rule: title: Registry Modification of MS-settings Protocol Handler id: dd3ee8cc-f751-41c9-ba53-5a32ed47e563 related: - id: 152f3630-77c1-4284-bcc0-4cc68ab2f6e7 type: similar status: test description: 'Detects registry modifications to the ''ms-settings'' protocol handler, which is frequently targeted for UAC bypass or persistence. Attackers can modify this registry to execute malicious code with elevated privileges by hijacking the command execution path. ' references: - https://thedfirreport.com/2021/12/13/diavol-ransomware/ - https://www.trendmicro.com/en_us/research/25/f/water-curse.html author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2021-12-20 modified: 2026-01-24 tags: - attack.privilege-escalation - attack.persistence - attack.defense-impairment - attack.t1548.002 - attack.t1546.001 - attack.t1112 logsource: category: process_creation product: windows detection: selection_reg_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_pwsh_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - powershell.exe - pwsh.dll selection_reg_cli: CommandLine|contains: add selection_pwsh_cli: CommandLine|contains: - New-ItemProperty - Set-ItemProperty - 'ni ' - 'sp ' selection_cli_key: CommandLine|contains: \ms-settings\shell\open\command condition: (all of selection_reg_* or all of selection_pwsh_*) and selection_cli_key falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT). Logsource: windows / process_creation. Rule: title: Invocation of Active Directory Diagnostic Tool (ntdsutil.exe) id: 2afafd61-6aae-4df4-baed-139fa1f4c345 status: test description: Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT) references: - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/ntdsutil.htm author: Thomas Patzke date: 2019-01-16 modified: 2022-03-11 tags: - attack.credential-access - attack.t1003.003 logsource: category: process_creation product: windows detection: selection: Image|endswith: \ntdsutil.exe condition: selection falsepositives: - NTDS maintenance level: medium
Query: describe CVE-2015-7567
Matching passage: CVE-2015-7567. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary SQL commands via the "passwordreset&token" parameter.
Near-miss passage: CVE-2015-10042. CWE: CWE-89. CVSS: 9.800000190734863. ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in Dovgalyuk AIBattle. Affected by this vulnerability is the function registerUser of the file site/procedures.php. The manipulation of the argument postLogin leads to sql injection. The identifier of the patch is 448e9880aac18ae7832f8d065e03e46ce0f1d3e3. It is recommended to apply a patch to fix this issue. The identifier VDB-218305 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects legitimate applications writing any type of file to uncommon or suspicious locations that are not typical for ap. Logsource: windows / file_event. Rule: title: Legitimate Application Writing Files In Uncommon Location id: 1cf465a1-2609-4c15-9b66-c32dbe4bfd67 related: - id: 2ddef153-167b-4e89-86b6-757a9e65dcac type: similar status: experimental description: 'Detects legitimate applications writing any type of file to uncommon or suspicious locations that are not typical for application data storage or execution. Adversaries may leverage legitimate applications (Living off the Land Binaries - LOLBins) to drop or download malicious files to uncommon locations on the system to evade detection by security solutions. ' references: - https://lolbas-project.github.io/#/download author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-12-10 tags: - attack.stealth - attack.t1218 - attack.command-and-control - attack.t1105 logsource: product: windows category: file_event detection: selection_img: Image|endswith: - \eqnedt32.exe - \wordpad.exe - \wordview.exe - \cmdl32.exe - \certutil.exe - \certoc.exe - \CertReq.exe - \bitsadmin.exe - \Desktopimgdownldr.exe - \esentutl.exe - \expand.exe - \extrac32.exe - \replace.exe - \mshta.exe - \ftp.exe - \Ldifde.exe - \RdrCEF.exe - \hh.exe - \finger.exe - \findstr.exe selection_locations: TargetFilename|contains: - :\Perflogs - :\ProgramData\ - :\Temp\ - :\Users\Public\ - :\Windows\ - \$Recycle.Bin\ - \AppData\Local\ - \AppData\Roaming\ - \Contacts\ - \Desktop\ - \Favorites\ - \Favourites\ - \inetpub\wwwroot\ - \Music\ - \Pictures\ - \Start Menu\Programs\Startup\ - \Users\Default\ - \Videos\ condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_in_uncommon_location/info.yml
Near-miss passage: Sigma rule: Detects AWS Config Service disabling. Logsource: aws / cloudtrail. Rule: title: AWS Config Disabling Channel/Recorder id: 07330162-dba1-4746-8121-a9647d49d297 status: test description: Detects AWS Config Service disabling references: - https://docs.aws.amazon.com/config/latest/developerguide/cloudtrail-log-files-for-aws-config.html author: vitaliy0x1 date: 2020-01-21 modified: 2022-10-09 tags: - attack.defense-impairment - attack.t1685.002 logsource: product: aws service: cloudtrail detection: selection: eventSource: config.amazonaws.com eventName: - DeleteDeliveryChannel - StopConfigurationRecorder condition: selection falsepositives: - Valid change in AWS Config Service level: high
Query: weakness Improper Handling of Extra Parameters
Matching passage: CWE-235 Improper Handling of Extra Parameters. The product does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.
Near-miss passage: CWE-829 Inclusion of Functionality from Untrusted Control Sphere. The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
Query: common weakness: Untrusted Pointer Dereference
Matching passage: CWE-822 Untrusted Pointer Dereference. The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.
Near-miss passage: CWE-567 Unsynchronized Access to Shared Data in a Multithreaded Context. The product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes.
Query: rule covering Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.
Matching passage: Sigma rule: Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes Secret or Config Object Access id: 7ee0b4aa-d8d4-4088-b661-20efdf41a04c status: test description: Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1 author: Austin Songer @austinsonger date: 2021-08-07 modified: 2022-08-23 tags: - attack.impact - attack.t1485 - attack.t1496 - attack.t1489 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/CONFIGMAPS/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/CONFIGMAPS/DELETE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SECRETS/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SECRETS/DELETE condition: selection falsepositives: - Sensitive objects may be accessed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Sensitive objects accessed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Identifies when a service principal is created in Azure.. Logsource: azure / auditlogs. Rule: title: Azure Service Principal Created id: 0ddcff6d-d262-40b0-804b-80eb592de8e3 status: test description: Identifies when a service principal is created in Azure. references: - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory - https://analyticsrules.exchange/analyticrules/79566f41-df67-4e10-a703-c38a6213afd8/ author: Austin Songer @austinsonger date: 2021-09-02 modified: 2026-04-30 tags: - attack.stealth logsource: product: azure service: auditlogs detection: selection: operationName: Add service principal condition: selection falsepositives: - Service principal being created may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Service principal created from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: CVE similar to CVE-2015-7189
Matching passage: CVE-2015-7189. CWE: CWE-119. CVSS: 6.800000190734863. Race condition in the JPEGEncoder function in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via vectors involving a CANVAS element and crafted JavaScript code.
Near-miss passage: CVE-2015-3703. CWE: CWE-119. CVSS: 6.800000190734863. ImageIO in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted TIFF image.
Query: Lateral movement indicators for Bandwidth Hijacking
Matching passage: T1496.002 Bandwidth Hijacking. Tactics: impact. Description: Adversaries may leverage the network bandwidth resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Adversaries may also use malware that leverages a system's network bandwidth as part of a botnet in order to facilitate [Network Denial of Service](https://attack.mitre.org/techniques/T1498) campaigns and/or to seed malicious torrents.(Citation: GoBotKR) Alternatively, they may engage in proxyjacking by selling use of the victims' network bandwidth and IP address to proxyware services.(Citation: Sysdig Proxyjacking) Finally, they may engage in internet-wide scanning in order to identify additional targets for compromise.(Citation: Unit 42 Leaked Environment Variables 2024) In addition to incurring potential financial costs or availability disruptions, this technique may cause reputational damage if a victim’s bandwidth is used for illegal activities.(Citation: Sysdig Proxyjacking)
Near-miss passage: T1496.003 SMS Pumping. Tactics: impact. Description: Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted service availability.(Citation: Twilio SMS Pumping) SMS pumping is a type of telecommunications fraud whereby a threat actor first obtains a set of phone numbers from a telecommunications provider, then leverages a victim’s messaging infrastructure to send large amounts of SMS messages to numbers in that set. By generating SMS traffic to their phone number set, a threat actor may earn payments from the telecommunications provider.(Citation: Twilio SMS Pumping Fraud) Threat actors often use publicly available web forms, such as one-time password (OTP) or account verification fields, in order to generate SMS traffic. These fields may leverage services such as Twilio, AWS SNS, and Amazon Cognito in the background.(Citation: Twilio SMS Pumping)(Citation: AWS RE:Inforce Threat Detection 2024) In response to the large quantity of requests, SMS costs may increase and communication channels may become overwhelmed.(Citation: Twilio SMS Pumping)
Query: exploit The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.
Matching passage: CVE-2015-9350. CWE: CWE-79. CVSS: 6.099999904632568. The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.
Near-miss passage: CVE-2015-6005. CWE: CWE-79. CVSS: 6.900000095367432. Multiple cross-site scripting (XSS) vulnerabilities in IPSwitch WhatsUp Gold before 16.4 allow remote attackers to inject arbitrary web script or HTML via (1) an SNMP OID object, (2) an SNMP trap message, (3) the View Names field, (4) the Group Names field, (5) the Flow Monitor Credentials field, (6) the Flow Monitor Threshold Name field, (7) the Task Library Name field, (8) the Task Library Description field, (9) the Policy Library Name field, (10) the Policy Library Description field, (11) the Template Library Name field, (12) the Template Library Description field, (13) the System Script Library Name field, (14) the System Script Library Description field, or (15) the CLI Settings Library Description field.
Query: vulnerability: The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.
Matching passage: CVE-2015-9304. CWE: CWE-79. CVSS: 6.099999904632568. The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.
Near-miss passage: CVE-2015-2198. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in edit_prefs.php in Beehive Forum 1.4.4 allow remote attackers to inject arbitrary web script or HTML via the (1) homepage_url, (2) pic_url, or (3) avatar_url parameter, which are not properly handled in an error message.