alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the creation of a process via the Windows task manager. This might be an attempt to bypass UAC. Logsource: windows / process_creation. Rule: title: New Process Created Via Taskmgr.EXE id: 3d7679bd-0c00-440c-97b0-3f204273e6c7 status: test description: Detects the creation of a process via the Windows task manager. This might be an attempt to bypass UAC references: - https://twitter.com/ReneFreingruber/status/1172244989335810049 author: Florian Roth (Nextron Systems) date: 2018-03-13 modified: 2024-01-18 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \taskmgr.exe filter_main_generic: Image|endswith: - :\Windows\System32\mmc.exe - :\Windows\System32\resmon.exe - :\Windows\System32\Taskmgr.exe condition: selection and not 1 of filter_main_* falsepositives: - Administrative activity level: low
Near-miss passage: Sigma rule: Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been. Logsource: linux / process_creation. Rule: title: Remote Access Tool - Team Viewer Session Started On Linux Host id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d related: - id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357 type: similar - id: f459ccb4-9805-41ea-b5b2-55e279e2424a type: similar status: test description: 'Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder. ' references: - Internal Research author: Josh Nickels, Qi Nan date: 2024-03-11 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: process_creation product: linux detection: selection: ParentImage|endswith: /TeamViewer_Service Image|endswith: /TeamViewer_Desktop CommandLine|endswith: /TeamViewer_Desktop --IPCport 5939 --Module 1 condition: selection falsepositives: - Legitimate usage of TeamViewer level: low
Query: exploit A vulnerability, which was classified as critical, was found in ACI_Escola. This affects an unknown part. The manipulation leads to sql injection. The identifier of the patch is 34
Matching passage: CVE-2015-10037. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability, which was classified as critical, was found in ACI_Escola. This affects an unknown part. The manipulation leads to sql injection. The identifier of the patch is 34eed1f7b9295d1424912f79989d8aba5de41e9f. It is recommended to apply a patch to fix this issue. The identifier VDB-217965 was assigned to this vulnerability.
Near-miss passage: CVE-2015-9352. CWE: CWE-89. CVSS: 9.800000190734863. The wp-polls plugin before 2.72 for WordPress has SQL injection.
Query: exploit Use-after-free vulnerability in the Tablet Input Band in Windows Shell in Microsoft Windows Vista SP2 and Windows 7 SP1 allows remote attackers to execute arbitrary code via a craf
Matching passage: CVE-2015-2548. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in the Tablet Input Band in Windows Shell in Microsoft Windows Vista SP2 and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site, aka "Microsoft Tablet Input Band Use After Free Vulnerability."
Near-miss passage: CVE-2015-8069. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: detection engineering for Create Account
Matching passage: T1136 Create Account. Tactics: persistence. Description: Adversaries may create an account to maintain access to victim systems.(Citation: Symantec WastedLocker June 2020) With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system. Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.
Near-miss passage: T1136.001 Local Account. Tactics: persistence. Description: Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. For example, with a sufficient level of access, the Windows <code>net user /add</code> command can be used to create a local account. In Linux, the `useradd` command can be used, while on macOS systems, the <code>dscl -create</code> command can be used. Local accounts may also be added to network devices, often via common [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as <code>username</code>, to ESXi servers via `esxcli system account add`, or to Kubernetes clusters using the `kubectl` utility.(Citation: cisco_username_cmd)(Citation: Kubernetes Service Accounts Security) Adversaries may also create new local accounts on network firewall management consoles – for example, by exploiting a vulnerable firewall management system, threat actors may be able to establish super-admin accounts that could be used to modify firewall rules and gain further access to the network.(Citation: Cyber Security News) Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Query: exploit Windows Text Services (WTS) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 
Matching passage: CVE-2015-0081. CWE: CWE-19. CVSS: 9.300000190734863. Windows Text Services (WTS) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "WTS Remote Code Execution Vulnerability."
Near-miss passage: CVE-2015-0274. CWE: CWE-19. CVSS: 7.199999809265137. The XFS implementation in the Linux kernel before 3.15 improperly uses an old size value during remote attribute replacement, which allows local users to cause a denial of service (transaction overrun and data corruption) or possibly gain privileges by leveraging XFS filesystem access.
Query: mitigate Screen Capture
Matching passage: T1113 Screen Capture. Tactics: collection. Description: Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.(Citation: CopyFromScreen .NET)(Citation: Antiquated Mac Malware)
Near-miss passage: T1530 Data from Cloud Storage. Tactics: collection. Description: Adversaries may access data from cloud storage. Many IaaS providers offer solutions for online data object storage such as Amazon S3, Azure Storage, and Google Cloud Storage. Similarly, SaaS enterprise platforms such as Office 365 and Google Workspace provide cloud-based document storage to users through services such as OneDrive and Google Drive, while SaaS application providers such as Slack, Confluence, Salesforce, and Dropbox may provide cloud storage solutions as a peripheral or primary use case of their platform. In some cases, as with IaaS-based cloud storage, there exists no overarching application (such as SQL or Elasticsearch) with which to interact with the stored objects: instead, data from these solutions is retrieved directly though the [Cloud API](https://attack.mitre.org/techniques/T1059/009). In SaaS applications, adversaries may be able to collect this data directly from APIs or backend cloud storage objects, rather than through their front-end application or interface (i.e., [Data from Information Repositories](https://attack.mitre.org/techniques/T1213)). Adversaries may collect sensitive data from these cloud storage solutions. Providers typically offer security guides to help end users configure systems, though misconfigurations are a common problem.(Citation: Amazon S3 Security, 2019)(Citation: Microsoft Azure Storage Security, 2019)(Citation: Google Cloud Storage Best Practices, 2019) There have been numerous incidents where cloud storage has been improperly secured, typically by unintentionally allowing public access to unauthenticated users, overly-broad access by all users, or even access for any anonymous person outside the control of the Identity Access Management system without even needing basic user permissions. This open access may expose various types of sensitive data, such as credit cards, personally identifiable information, or medical records.(Citation: Trend Micro S3 Exposed PII, 2017)(Citation: Wired Magecart S3 Buckets, 2019)(
Query: weakness Variable Extraction Error
Matching passage: CWE-621 Variable Extraction Error. The product uses external input to determine the names of variables into which information is extracted, without verifying that the names of the specified variables are valid. This could cause the program to overwrite unintended variables.
Near-miss passage: CWE-771 Missing Reference to Active Allocated Resource. The product does not properly maintain a reference to a resource that has been allocated, which prevents the resource from being reclaimed.
Query: alert when Detects global permissions change activity.
Matching passage: Sigma rule: Detects global permissions change activity.. Logsource: bitbucket / audit. Rule: title: Bitbucket Global Permission Changed id: aac6c4f4-87c7-4961-96ac-c3fd3a42c310 status: test description: Detects global permissions change activity. references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html - https://confluence.atlassian.com/bitbucketserver/global-permissions-776640369.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.persistence - attack.privilege-escalation - attack.t1098 logsource: product: bitbucket service: audit definition: 'Requirements: "Advance" log level is required to receive these audit events.' detection: selection: auditType.category: Permissions auditType.action: - Global permission remove request - Global permission removed - Global permission granted - Global permission requested condition: selection falsepositives: - Legitimate user activity. level: medium
Near-miss passage: Sigma rule: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities. Logsource: windows / process_creation. Rule: title: Compress Data and Lock With Password for Exfiltration With 7-ZIP id: 9fbf5927-5261-4284-a71d-f681029ea574 status: test description: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md author: frack113 date: 2021-07-27 modified: 2026-06-05 tags: - attack.collection - attack.t1560.001 logsource: category: process_creation product: windows detection: selection_img: - Description|contains: 7-Zip - Image|endswith: - \7z.exe - \7zr.exe - \7za.exe - OriginalFileName: - 7z.exe - 7za.exe - 7zr.exe selection_password: CommandLine|contains: ' -p' selection_action: CommandLine|contains: - ' a ' - ' u ' condition: all of selection_* falsepositives: - Legitimate activity is expected since compressing files with a password is common. level: medium
Query: CVE similar to CVE-2015-0065
Matching passage: CVE-2015-0065. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Word 2007 SP3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "OneTableDocumentStream Remote Code Execution Vulnerability."
Near-miss passage: CVE-2015-1744. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1735, CVE-2015-1740, CVE-2015-1745, and CVE-2015-1766.
Query: CVE similar to CVE-2015-7460
Matching passage: CVE-2015-7460. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108356.
Near-miss passage: CVE-2015-9366. CWE: CWE-79. CVSS: 6.099999904632568. Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Query: detect Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processe in logs
Matching passage: Sigma rule: Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processe. Logsource: linux / file_event. Rule: title: Suspicious Filename with Embedded Base64 Commands id: 179b3686-6271-4d87-807d-17d843a8af73 status: experimental description: 'Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts. These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns. ' references: - https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/ author: '@kostastsale' date: 2025-11-22 tags: - attack.execution - attack.stealth - attack.t1059.004 - attack.t1027 logsource: product: linux category: file_event detection: selection: TargetFilename|contains: - '{echo' - '{base64,-d}' condition: selection falsepositives: - Legitimate files with similar naming patterns (very unlikely). level: high
Near-miss passage: Sigma rule: Detects a file ending in jse, vbe, js, vba, vbs, wsf, wsh written by cscript.exe or wscript.exe. Logsource: windows / file_event. Rule: title: WScript or CScript Dropper - File id: 002bdb95-0cf1-46a6-9e08-d38c128a6127 related: - id: cea72823-df4d-4567-950c-0b579eaf0846 type: derived status: test description: Detects a file ending in jse, vbe, js, vba, vbs, wsf, wsh written by cscript.exe or wscript.exe references: - WScript or CScript Dropper (cea72823-df4d-4567-950c-0b579eaf0846) author: Tim Shelton date: 2022-01-10 modified: 2026-02-17 tags: - attack.execution - attack.t1059.005 - attack.t1059.007 logsource: category: file_event product: windows detection: selection: Image|endswith: - \wscript.exe - \cscript.exe TargetFilename|contains: - :\Perflogs\ - :\ProgramData\ - :\Temp\ - :\Tmp\ - :\Users\ - :\Windows\Temp\ - \AppData\Local\Temp - \AppData\Roaming\Temp - \Start Menu\Programs\Startup\ - \Temporary Internet TargetFilename|endswith: - .js - .jse - .vba - .vbe - .vbs - .wsf - .wsh condition: selection falsepositives: - Unknown level: high
Query: vulnerability: The user interface in Safari in Apple iOS before 9 allows remote attackers to spoof URLs via unspecified vectors, a different vulnerability than CVE-2015-5764 and CVE-2015-5767.
Matching passage: CVE-2015-5765. CWE: CWE-20. CVSS: 4.300000190734863. The user interface in Safari in Apple iOS before 9 allows remote attackers to spoof URLs via unspecified vectors, a different vulnerability than CVE-2015-5764 and CVE-2015-5767.
Near-miss passage: CVE-2015-9146. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, MDM9645, MDM9650, MDM9655, SD 400, SD 800, SD 835, SD 845, SD 850, and SDX20, when QDI read, write, or ioctl are called, the passed-in pointer is not properly validated before accessing it for the delayed response.
Query: describe CVE-2015-1283
Matching passage: CVE-2015-1283. CWE: CWE-190. CVSS: 6.800000190734863. Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716.
Near-miss passage: CVE-2015-1529. CWE: CWE-190. CVSS: 7.5. Integer overflow in soundtrigger/ISoundTriggerHwService.cpp in Android allows attacks to cause a denial of service via unspecified vectors.
Query: Outbound C2 pattern associated with Port Monitors
Matching passage: T1547.010 Port Monitors. Tactics: persistence, privilege escalation. Description: Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the <code>AddMonitor</code> API call to set a DLL to be loaded at startup.(Citation: AddMonitor) This DLL can be located in <code>C:\Windows\System32</code> and will be loaded and run by the print spooler service, `spoolsv.exe`, under SYSTEM level permissions on boot.(Citation: Bloxham) Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to the `Driver` value of an existing or new arbitrarily named subkey of <code>HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors</code>. The Registry key contains entries for the following: * Local Port * Standard TCP/IP Port * USB Monitor * WSD Port
Near-miss passage: T1547 Boot or Logon Autostart Execution. Tactics: persistence, privilege escalation. Description: Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming) These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel. Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.
Query: patch priority for CVE-2015-4774
Matching passage: CVE-2015-4774. CWE: UNKNOWN. CVSS: 3.299999952316284. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect integrity and availability via unknown vectors, a different vulnerability than CVE-2015-4779 and CVE-2015-4788.
Near-miss passage: CVE-2015-0476. CWE: UNKNOWN. CVSS: 5.5. Unspecified vulnerability in the SQL Trace Analyzer component in Oracle Support Tools before 12.1.11 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
Query: risk of Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote attackers to obtain sensitive debugging information by entering a crafted URL to trigger a
Matching passage: CVE-2015-7900. CWE: CWE-200. CVSS: 4.300000190734863. Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote attackers to obtain sensitive debugging information by entering a crafted URL to trigger an exception, and then visiting a certain status page.
Near-miss passage: CVE-2015-3195. CWE: CWE-200. CVSS: 5.300000190734863. The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.
Query: rule covering Detects command line parameter very often used with coin miners
Matching passage: Sigma rule: Detects command line parameter very often used with coin miners. Logsource: linux / auditd. Rule: title: Possible Coin Miner CPU Priority Param id: 071d5e5a-9cef-47ec-bc4e-a42e34d8d0ed status: test description: Detects command line parameter very often used with coin miners references: - https://xmrig.com/docs/miner/command-line-options author: Florian Roth (Nextron Systems) date: 2021-10-09 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.t1068 logsource: product: linux service: auditd detection: cmd1: a1|startswith: --cpu-priority cmd2: a2|startswith: --cpu-priority cmd3: a3|startswith: --cpu-priority cmd4: a4|startswith: --cpu-priority cmd5: a5|startswith: --cpu-priority cmd6: a6|startswith: --cpu-priority cmd7: a7|startswith: --cpu-priority condition: 1 of cmd* falsepositives: - Other tools that use a --cpu-priority flag level: critical
Near-miss passage: Sigma rule: Detects enumeration of Kubernetes secrets.. Logsource: kubernetes / application / audit. Rule: title: Kubernetes Secrets Enumeration id: eeb3e9e1-b685-44e4-9232-6bb701f925b5 related: - id: 7ee0b4aa-d8d4-4088-b661-20efdf41a04c type: derived status: test description: Detects enumeration of Kubernetes secrets. references: - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/List%20K8S%20secrets/ author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.t1552.007 - attack.credential-access logsource: category: application product: kubernetes service: audit detection: selection: verb: list objectRef.resource: secrets condition: selection falsepositives: - The Kubernetes dashboard occasionally accesses the kubernetes-dashboard-key-holder secret level: low