alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function.
Matching passage: CVE-2015-3254. CWE: CWE-20. CVSS: 6.5. The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function.
Near-miss passage: CVE-2015-0679. CWE: CWE-20. CVSS: 6.099999904632568. The web-authentication functionality on Cisco Wireless LAN Controller (WLC) devices 7.3(103.8) and 7.4(110.0) allows remote attackers to cause a denial of service (device reload) via a malformed password, aka Bug ID CSCui57980.
Query: explain T1568.003 DNS Calculation
Matching passage: T1568.003 DNS Calculation. Tactics: command and control. Description: Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address. A IP and/or port number calculation can be used to bypass egress filtering on a C2 channel.(Citation: Meyers Numbered Panda) One implementation of [DNS Calculation](https://attack.mitre.org/techniques/T1568/003) is to take the first three octets of an IP address in a DNS response and use those values to calculate the port for command and control traffic.(Citation: Meyers Numbered Panda)(Citation: Moran 2014)(Citation: Rapid7G20Espionage)
Near-miss passage: T1568.002 Domain Generation Algorithms. Tactics: command and control. Description: Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders to block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Unit 42 DGA Feb 2019) DGAs can take the form of apparently random or “gibberish” strings (ex: istgmxdejdnxuyla.ru) when they construct domain names by generating each letter. Alternatively, some DGAs employ whole words as the unit by concatenating words together instead of letters (ex: cityjulydish.net). Many DGAs are time-based, generating a different domain for each time period (hourly, daily, monthly, etc). Others incorporate a seed value as well to make predicting future domains more difficult for defenders.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Talos CCleanup 2017)(Citation: Akamai DGA Mitigation) Adversaries may use DGAs for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ a DGA as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)
Query: Outbound C2 pattern associated with OS Credential Dumping
Matching passage: T1003 OS Credential Dumping. Tactics: credential access. Description: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures.(Citation: Brining MimiKatz to Unix) Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.
Near-miss passage: T1003.006 DCSync. Tactics: credential access. Description: Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) (Citation: Wine API samlib.dll) to simulate the replication process from a remote domain controller using a technique called DCSync. Members of the Administrators, Domain Admins, and Enterprise Admin groups or computer accounts on the domain controller are able to run DCSync to pull password data(Citation: ADSecurity Mimikatz DCSync) from Active Directory, which may include current and historical hashes of potentially useful accounts such as KRBTGT and Administrators. The hashes can then in turn be used to create a [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) for use in [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003)(Citation: Harmj0y Mimikatz and DCSync) or change an account's password as noted in [Account Manipulation](https://attack.mitre.org/techniques/T1098).(Citation: InsiderThreat ChangeNTLM July 2017) DCSync functionality has been included in the "lsadump" module in [Mimikatz](https://attack.mitre.org/software/S0002).(Citation: GitHub Mimikatz lsadump Module) Lsadump also includes NetSync, which performs DCSync over a legacy replication protocol.(Citation: Microsoft NRPC Dec 2017)
Query: exploit PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a c
Matching passage: CVE-2015-3217. CWE: CWE-119. CVSS: 7.5. PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\.|([^\\\\W_])?)+)+$/.
Near-miss passage: CVE-2015-4484. CWE: CWE-119. CVSS: 5.0. The js::jit::AssemblerX86Shared::lock_addl function in the JavaScript implementation in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to cause a denial of service (application crash) by leveraging the use of shared memory and accessing (1) an Atomics object or (2) a SharedArrayBuffer object.
Query: detect Detects modification of autostart extensibility point (ASEP) in registry. in logs
Matching passage: Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: Session Manager Autorun Keys Modification id: 046218bd-e0d8-4113-a3c3-895a12b2b298 related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: obsolete status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 - attack.t1546.009 logsource: category: registry_set product: windows detection: session_manager_base: TargetObject|contains: \System\CurrentControlSet\Control\Session Manager session_manager: TargetObject|contains: - \SetupExecute - \S0InitialCommand - \KnownDlls - \Execute - \BootExecute - \AppCertDlls filter: Details: (Empty) condition: session_manager_base and session_manager and not filter falsepositives: - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason - Legitimate administrator sets up autorun keys for legitimate reason level: medium
Near-miss passage: Sigma rule: Detects installation of NalDrv or PROCEXP152 services via registry-keys to non-system32 folders. Both services are used. Logsource: windows / registry_set. Rule: title: Suspicious Service Installed id: f2485272-a156-4773-82d7-1d178bc4905b status: test description: 'Detects installation of NalDrv or PROCEXP152 services via registry-keys to non-system32 folders. Both services are used in the tool Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU (https://github.com/hfiref0x/KDU) ' references: - https://web.archive.org/web/20200419024230/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/ author: xknow (@xknow_infosec), xorxes (@xor_xes) date: 2019-04-08 modified: 2026-06-29 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject: - HKLM\System\CurrentControlSet\Services\NalDrv\ImagePath - HKLM\System\CurrentControlSet\Services\PROCEXP152\ImagePath filter: Image|endswith: - \procexp64.exe - \procexp64a.exe - \procexp.exe - \procmon64.exe - \procmon64a.exe - \procmon.exe - \handle.exe - \handle64.exe - \handle64a.exe Details|contains: \WINDOWS\system32\Drivers\PROCEXP152.SYS condition: selection and not filter falsepositives: - Other legimate tools using this service names and drivers. Note - clever attackers may easily bypass this detection by just renaming the services. Therefore just Medium-level and don't rely on it. level: medium
Query: vulnerability: The log viewer in McAfee Agent (MA) before 4.8.0 Patch 3 and 5.0.0, when the "Accept connections only from the ePO server" option is disabled, allows remote attackers to conduct cl
Matching passage: CVE-2015-2053. CWE: CWE-20. CVSS: 4.300000190734863. The log viewer in McAfee Agent (MA) before 4.8.0 Patch 3 and 5.0.0, when the "Accept connections only from the ePO server" option is disabled, allows remote attackers to conduct clickjacking attacks via a crafted web page, aka an "http-generic-click-jacking" vulnerability.
Near-miss passage: CVE-2015-9068. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, an argument to a mink syscall is not properly validated.
Query: patch priority for CVE-2015-7101
Matching passage: CVE-2015-7101. CWE: CWE-119. CVSS: 6.800000190734863. WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7102, and CVE-2015-7103.
Near-miss passage: CVE-2015-1345. CWE: CWE-119. CVSS: 2.0999999046325684. The bmexec_trans function in kwset.c in grep 2.19 through 2.21 allows local users to cause a denial of service (out-of-bounds heap read and crash) via crafted input when using the -F option.
Query: rule covering Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including: - Use of the `personality`
Matching passage: Sigma rule: Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including: - Use of the `personality`. Logsource: linux / auditd. Rule: title: ASLR Disabled Via Sysctl or Direct Syscall - Linux id: e497a24e-9345-4a62-9803-b06d7d7cb132 status: experimental description: "Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:\n - Use of the\ \ `personality` syscall with the ADDR_NO_RANDOMIZE flag (0x0040000)\n - Modification of the /proc/sys/kernel/randomize_va_space\ \ file\n - Execution of the `sysctl` command to set `kernel.randomize_va_space=0`\nDisabling ASLR is often used by attackers\ \ during exploit development or to bypass memory protection mechanisms.\nA successful use of these methods can reduce the\ \ effectiveness of ASLR and make memory corruption attacks more reliable.\n" references: - https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/personality-syscall/README.md - https://man7.org/linux/man-pages/man2/personality.2.html - https://manual.cs50.io/2/personality - https://linux-audit.com/linux-aslr-and-kernelrandomize_va_space-setting/ author: Milad Cheraghi date: 2025-05-26 modified: 2025-12-05 tags: - attack.privilege-escalation - attack.stealth - attack.defense-impairment - attack.t1685 - attack.t1055.009 logsource: product: linux service: auditd detection: selection_syscall: type: SYSCALL SYSCALL: personality a0: 40000 selection_sysctl: type: EXECVE a0: sysctl a1: -w a2: kernel.randomize_va_space=0 condition: 1 of selection_* falsepositives: - Debugging or legitimate software testing level: high
Near-miss passage: Sigma rule: Storing files in Alternate Data Stream (ADS) similar to Astaroth malware.. Logsource: windows / ps_script. Rule: title: Powershell Store File In Alternate Data Stream id: a699b30e-d010-46c8-bbd1-ee2e26765fe9 status: test description: Storing files in Alternate Data Stream (ADS) similar to Astaroth malware. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md author: frack113 date: 2021-09-02 modified: 2022-12-25 tags: - attack.stealth - attack.t1564.004 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_compspec: ScriptBlockText|contains|all: - Start-Process - '-FilePath "$env:comspec" ' - '-ArgumentList ' - '>' condition: selection_compspec falsepositives: - Unknown level: medium
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary contro. Logsource: windows / process_creation. Rule: title: Root Certificate Installed From Susp Locations id: 5f6a601c-2ecb-498b-9c33-660362323afa status: test description: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. references: - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/ - https://learn.microsoft.com/en-us/powershell/module/pki/import-certificate?view=windowsserver2022-ps author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-09 modified: 2023-01-16 tags: - attack.defense-impairment - attack.t1553.004 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - Import-Certificate - ' -FilePath ' - Cert:\LocalMachine\Root CommandLine|contains: - \AppData\Local\Temp\ - :\Windows\TEMP\ - \Desktop\ - \Downloads\ - \Perflogs\ - :\Users\Public\ condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to. Logsource: windows / ps_module. Rule: title: Suspicious Get Information for SMB Share - PowerShell Module id: 6942bd25-5970-40ab-af49-944247103358 status: test description: 'Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md author: frack113 date: 2021-12-15 modified: 2022-12-02 tags: - attack.discovery - attack.t1069.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection: - Payload|contains: get-smbshare - ContextInfo|contains: get-smbshare condition: selection falsepositives: - Administrator script level: low
Query: Sigma rule for Detects the execution of netsh with the "trace" flag in order to start a network capture
Matching passage: Sigma rule: Detects the execution of netsh with the "trace" flag in order to start a network capture. Logsource: windows / process_creation. Rule: title: New Network Trace Capture Started Via Netsh.EXE id: d3c3861d-c504-4c77-ba55-224ba82d0118 status: test description: Detects the execution of netsh with the "trace" flag in order to start a network capture references: - https://blogs.msdn.microsoft.com/canberrapfe/2012/03/30/capture-a-network-trace-without-installing-anything-capture-a-network-trace-of-a-reboot/ - https://klausjochem.me/2016/02/03/netsh-the-cyber-attackers-tool-of-choice/ author: Kutepov Anton, oscd.community date: 2019-10-24 modified: 2023-02-13 tags: - attack.discovery - attack.credential-access - attack.t1040 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: CommandLine|contains|all: - trace - start condition: all of selection_* falsepositives: - Legitimate administration activity level: medium
Near-miss passage: Sigma rule: Detects update to a scheduled task event that contain suspicious keywords.. Logsource: windows / security. Rule: title: Suspicious Scheduled Task Update id: 614cf376-6651-47c4-9dcc-6b9527f749f4 related: - id: 1c0e41cd-21bb-4433-9acc-4a2cd6367b9b type: similar status: test description: Detects update to a scheduled task event that contain suspicious keywords. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-05 tags: - attack.execution - attack.privilege-escalation - attack.persistence - attack.t1053.005 logsource: product: windows service: security definition: The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data. detection: selection_eid: EventID: 4702 selection_paths: TaskContentNew|contains: - \AppData\Local\Temp\ - \AppData\Roaming\ - \Users\Public\ - \WINDOWS\Temp\ - C:\Temp\ - \Desktop\ - \Downloads\ - \Temporary Internet - C:\ProgramData\ - C:\Perflogs\ selection_commands: TaskContentNew|contains: - regsvr32 - rundll32 - cmd.exe</Command> - cmd</Command> - '<Arguments>/c ' - '<Arguments>/k ' - '<Arguments>/r ' - powershell - pwsh - mshta - wscript - cscript - certutil - bitsadmin - bash.exe - 'bash ' - scrcons - 'wmic ' - wmic.exe - forfiles - scriptrunner - hh.exe condition: all of selection_* falsepositives: - Unknown level: high
Query: exploit The MessageBrokerServlet servlet in Moxa OnCell Central Manager before 2.2 does not require authentication, which allows remote attackers to obtain administrative access via a comm
Matching passage: CVE-2015-6480. CWE: CWE-287. CVSS: 8.300000190734863. The MessageBrokerServlet servlet in Moxa OnCell Central Manager before 2.2 does not require authentication, which allows remote attackers to obtain administrative access via a command, as demonstrated by the addUserAndGroup action.
Near-miss passage: CVE-2015-2033. CWE: CWE-287. CVSS: 10.0. Anyterm Daemon in Infoblox Network Automation NetMRI before NETMRI-23483 allows remote attackers to execute arbitrary commands with root privileges via a crafted terminal/anyterm-module request.
Query: exploit The httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allows remote attackers to execute arbitrary code.
Matching passage: CVE-2015-1443. CWE: CWE-20. CVSS: 8.800000190734863. The httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allows remote attackers to execute arbitrary code.
Near-miss passage: CVE-2015-5014. CWE: CWE-20. CVSS: 9.300000190734863. IBM Cognos Disclosure Management (CDM) 10.1.x and 10.2.x before 10.2.4 IF10 allows man-in-the-middle attackers to obtain access by spoofing an executable file during a client upload operation.
Query: Sigma rule for Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authenticatio
Matching passage: Sigma rule: Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authenticatio. Logsource: kubernetes / audit. Rule: title: Kubernetes Unauthorized or Unauthenticated Access id: 0d933542-1f1f-420d-97d4-21b2c3c492d9 status: test description: 'Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used. This may indicate an attacker attempting to leverage credentials they have obtained. ' references: - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/ - https://www.datadoghq.com/blog/monitor-kubernetes-audit-logs/#monitor-api-authentication-issues author: kelnage date: 2024-04-12 tags: - attack.privilege-escalation logsource: product: kubernetes service: audit detection: selection: responseStatus.code: - 401 - 403 condition: selection falsepositives: - A misconfigured RBAC policy, a mistake by a valid user, or a wider issue with authentication tokens can also generate these errors. level: low
Near-miss passage: Sigma rule: Detects file write event from/to a fake recycle bin folder that is often used as a staging directory for malware. Logsource: windows / file_event. Rule: title: Suspicious File Creation Activity From Fake Recycle.Bin Folder id: cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca related: - id: 5ce0f04e-3efc-42af-839d-5b3a543b76c0 type: derived status: test description: Detects file write event from/to a fake recycle bin folder that is often used as a staging directory for malware references: - https://www.mandiant.com/resources/blog/infected-usb-steal-secrets - https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/ author: X__Junior (Nextron Systems) date: 2023-07-12 modified: 2023-12-11 tags: - attack.persistence - attack.stealth logsource: category: file_event product: windows detection: selection: - Image|contains: - RECYCLERS.BIN\ - RECYCLER.BIN\ - TargetFilename|contains: - RECYCLERS.BIN\ - RECYCLER.BIN\ condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_recycle_bin_fake_exec/info.yml
Query: patch priority for CVE-2015-1378
Matching passage: CVE-2015-1378. CWE: CWE-264. CVSS: 7.5. cmdlineopts.clp in grml-debootstrap in Debian 0.54, 0.68.x before 0.68.1, 0.7x before 0.78 is sourced without checking that the local directory is writable by non-root users.
Near-miss passage: CVE-2015-7408. CWE: CWE-264. CVSS: 3.700000047683716. The server in IBM Spectrum Protect (aka Tivoli Storage Manager) 5.5 and 6.x before 6.3.5.1 and 7.x before 7.1.4 does not properly restrict use of the ASNODENAME option, which allows remote attackers to read or write to backup data by leveraging proxy authority.
Query: exploit Mozilla Network Security Services (NSS) before 3.19, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, Thunderbird before 38.1, and other p
Matching passage: CVE-2015-2721. CWE: CWE-310. CVSS: 4.300000190734863. Mozilla Network Security Services (NSS) before 3.19, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, Thunderbird before 38.1, and other products, does not properly determine state transitions for the TLS state machine, which allows man-in-the-middle attackers to defeat cryptographic protection mechanisms by blocking messages, as demonstrated by removing a forward-secrecy property by blocking a ServerKeyExchange message, aka a "SMACK SKIP-TLS" issue.
Near-miss passage: CVE-2015-5012. CWE: CWE-310. CVSS: 7.5. The SSH implementation on IBM Security Access Manager for Web appliances 7.0 before 7.0.0 FP19, 8.0 before 8.0.1.3 IF3, and 9.0 before 9.0.0.0 IF1 does not properly restrict the set of MAC algorithms, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.