alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Device Driver Discovery
Matching passage: T1652 Device Driver Discovery. Tactics: discovery. Description: Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) or other defenses (e.g., [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)), as well as potential exploitable vulnerabilities (e.g., [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)). Many OS utilities may provide information about local device drivers, such as `driverquery.exe` and the `EnumDeviceDrivers()` API function on Windows.(Citation: Microsoft Driverquery)(Citation: Microsoft EnumDeviceDrivers) Information about device drivers (as well as associated services, i.e., [System Service Discovery](https://attack.mitre.org/techniques/T1007)) may also be available in the Registry.(Citation: Microsoft Registry Drivers) On Linux/macOS, device drivers (in the form of kernel modules) may be visible within `/dev` or using utilities such as `lsmod` and `modinfo`.(Citation: Linux Kernel Programming)(Citation: lsmod man)(Citation: modinfo man)
Near-miss passage: T1087.004 Cloud Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. With authenticated access there are several tools that can be used to find accounts. The <code>Get-MsolRoleMember</code> PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365.(Citation: Microsoft msolrolemember)(Citation: GitHub Raindance) The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command <code>az ad user list</code> will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018) The AWS command <code>aws iam list-users</code> may be used to obtain a list of users in the current account while <code>aws iam list-roles</code> can obtain IAM roles that have a specified path prefix.(Citation: AWS List Roles)(Citation: AWS List Users) In GCP, <code>gcloud iam service-accounts list</code> and <code>gcloud projects get-iam-policy</code> may be used to obtain a listing of service accounts and users in a project.(Citation: Google Cloud - IAM Servie Accounts List API)
Query: Sigma rule for Loading unsigned image (DLL, EXE) into LSASS process
Matching passage: Sigma rule: Loading unsigned image (DLL, EXE) into LSASS process. Logsource: windows / image_load. Rule: title: Unsigned Image Loaded Into LSASS Process id: 857c8db3-c89b-42fb-882b-f681c7cf4da2 status: test description: Loading unsigned image (DLL, EXE) into LSASS process references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Teymur Kheirkhabarov, oscd.community date: 2019-10-22 modified: 2021-11-27 tags: - attack.credential-access - attack.t1003.001 logsource: category: image_load product: windows detection: selection: Image|endswith: \lsass.exe Signed: 'false' condition: selection falsepositives: - Valid user connecting using RDP level: medium
Near-miss passage: Sigma rule: Detects when a API token is created. Logsource: okta / okta. Rule: title: Okta API Token Created id: 19951c21-229d-4ccb-8774-b993c3ff3c5c status: test description: Detects when a API token is created references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-12 modified: 2026-04-27 tags: - attack.persistence logsource: product: okta service: okta detection: selection: eventType: system.api_token.create condition: selection falsepositives: - Legitimate creation of an API token by authorized users level: medium
Query: Sigma YAML for aws / cloudtrail
Matching passage: Sigma rule: Detects the use of TruffleHog for AWS credential validation by identifying GetCallerIdentity API calls where the userAge. Logsource: aws / cloudtrail. Rule: title: AWS STS GetCallerIdentity Enumeration Via TruffleHog id: 9b1b8e9b-0a5d-4af1-9d2f-4c4b6e7c2c9d status: experimental description: 'Detects the use of TruffleHog for AWS credential validation by identifying GetCallerIdentity API calls where the userAgent indicates TruffleHog. Threat actors leverage TruffleHog to enumerate and validate exposed AWS keys. Successful exploitation allows threat actors to confirm the validity of compromised AWS credentials, facilitating further unauthorized access and actions within the AWS environment. ' references: - https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/ - https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html - https://github.com/trufflesecurity/trufflehog author: Adan Alvarez @adanalvarez date: 2025-10-12 tags: - attack.discovery - attack.t1087.004 logsource: product: aws service: cloudtrail detection: selection: eventSource: sts.amazonaws.com eventName: GetCallerIdentity userAgent|contains: TruffleHog condition: selection falsepositives: - Legitimate internal security scanning or key validation that intentionally uses TruffleHog. Authorize and filter known scanner roles, IP ranges, or assumed roles as needed. level: medium
Near-miss passage: Sigma rule: Detects instances where an NTP service on an OpenCanary node has had a NTP monlist request.. Logsource: opencanary / application. Rule: title: OpenCanary - NTP Monlist Request id: 7cded4b3-f09e-405a-b96f-24248433ba44 status: test description: Detects instances where an NTP service on an OpenCanary node has had a NTP monlist request. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.impact - attack.t1498 logsource: category: application product: opencanary detection: selection: logtype: 11001 condition: selection falsepositives: - Unlikely level: high
Query: detect Detects Commandlet names from ShellIntel exploitation scripts. in logs
Matching passage: Sigma rule: Detects Commandlet names from ShellIntel exploitation scripts.. Logsource: windows / ps_script. Rule: title: Malicious ShellIntel PowerShell Commandlets id: 402e1e1d-ad59-47b6-bf80-1ee44985b3a7 status: test description: Detects Commandlet names from ShellIntel exploitation scripts. references: - https://github.com/Shellntel/scripts/ author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems) date: 2021-08-09 modified: 2023-01-02 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Invoke-SMBAutoBrute - Invoke-GPOLinks - Invoke-Potato condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when an attacker tries to disable User Account Control (UAC) by setting the registry value "EnableLUA" to 0.. Logsource: windows / registry_set. Rule: title: UAC Disabled id: 48437c39-9e5f-47fb-af95-3d663c3f2919 related: - id: c5f6a85d-b647-40f7-bbad-c10b66bab038 type: similar - id: 0d7ceeef-3539-4392-8953-3dc664912714 type: similar status: stable description: 'Detects when an attacker tries to disable User Account Control (UAC) by setting the registry value "EnableLUA" to 0. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/7e11e9b79583545f208a6dc3fa062f2ed443d999/atomics/T1548.002/T1548.002.md author: frack113 date: 2022-01-05 modified: 2024-05-10 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: medium
Query: describe CVE-2015-1076
Matching passage: CVE-2015-1076. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Near-miss passage: CVE-2015-6421. CWE: CWE-399. CVSS: 7.5. cifs-ao in the CIFS optimization functionality on Cisco Wide Area Application Service (WAAS) and Virtual WAAS (vWAAS) devices 5.x before 5.3.5d and 5.4 and 5.5 before 5.5.3 allows remote attackers to cause a denial of service (resource consumption and device reload) via crafted network traffic, aka Bug ID CSCus85330.
Query: exploit The SMB client in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified
Matching passage: CVE-2015-3773. CWE: CWE-119. CVSS: 7.5. The SMB client in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.
Near-miss passage: CVE-2015-1271. CWE: CWE-119. CVSS: 6.800000190734863. PDFium, as used in Google Chrome before 44.0.2403.89, does not properly handle certain out-of-memory conditions, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted PDF document that triggers a large memory allocation.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. RMM tools suc. Logsource: windows / process_creation. Rule: title: Remote Access Tool - Renamed MeshAgent Execution - Windows id: b471f462-eb0d-4832-be35-28d94bdb4780 related: - id: bd3b5eaa-439d-4a42-8f35-a49f5c8a2582 type: similar - id: 2fbbe9ff-0afc-470b-bdc0-592198339968 type: derived status: experimental description: 'Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management. However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems. ' references: - https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access - https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/ - https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/ - https://www.security.com/threat-intelligence/medusa-ransomware-attacks author: Norbert Jaśniewicz (AlphaSOC) date: 2025-05-19 tags: - attack.command-and-control - attack.stealth - attack.t1219.002 - attack.t1036.003 logsource: category: process_creation product: windows detection: selection_meshagent: - CommandLine|contains: --meshServiceName - OriginalFileName|contains: meshagent filter_main_legitimate: Image|endswith: \meshagent.exe condition: selection_meshagent and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of. Logsource: windows / process_creation. Rule: title: Detection of PowerShell Execution via Sqlps.exe id: 0152550d-3a26-4efd-9f0e-54a0b28ae2f3 status: test description: 'This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs. ' references: - https://learn.microsoft.com/en-us/sql/tools/sqlps-utility?view=sql-server-ver15 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqlps/ - https://twitter.com/bryon_/status/975835709587075072 author: Agro (@agro_sev) oscd.community date: 2020-10-10 modified: 2022-12-09 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1127 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \sqlps.exe selection_image: - Image|endswith: \sqlps.exe - OriginalFileName: sqlps.exe filter_image: ParentImage|endswith: \sqlagent.exe condition: selection_parent or (selection_image and not filter_image) falsepositives: - Direct PS command execution through SQLPS.exe is uncommon, childprocess sqlps.exe spawned by sqlagent.exe is a legitimate action. level: medium
Query: patch priority for CVE-2015-5670
Matching passage: CVE-2015-5670. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Techno Project Japan Enisys Gw before 1.4.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-1979. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in the Error dialog in IBM Case Manager 5.2.1 before 5.2.1.2 allow remote authenticated users to inject arbitrary web script or HTML via crafted input to the (1) addressability or (2) comments component.
Query: exploit IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF20, and 8.5.0 before CF09 allows remote attackers to
Matching passage: CVE-2015-7447. CWE: CWE-200. CVSS: 5.300000190734863. IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF20, and 8.5.0 before CF09 allows remote attackers to bypass intended Portal AccessControl REST API access restrictions and obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-1602. CWE: CWE-200. CVSS: 2.0999999046325684. Siemens SIMATIC STEP 7 (TIA Portal) 12 and 13 before 13 SP1 Upd1 improperly stores password data within project files, which makes it easier for local users to determine cleartext (1) protection-level passwords or (2) web-server passwords by leveraging the ability to read these files.
Query: stealth using Process Injection
Matching passage: T1055 Process Injection. Tactics: stealth, privilege escalation. Description: Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. There are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific. More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.
Near-miss passage: T1055.003 Thread Execution Hijacking. Tactics: stealth, privilege escalation. Description: Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. Thread Execution Hijacking is a method of executing arbitrary code in the address space of a separate live process. Thread Execution Hijacking is commonly performed by suspending an existing process then unmapping/hollowing its memory, which can then be replaced with malicious code or the path to a DLL. A handle to an existing victim process is first created with native Windows API calls such as <code>OpenThread</code>. At this point the process can be suspended then written to, realigned to the injected code, and resumed via <code>SuspendThread </code>, <code>VirtualAllocEx</code>, <code>WriteProcessMemory</code>, <code>SetThreadContext</code>, then <code>ResumeThread</code> respectively.(Citation: Elastic Process Injection July 2017) This is very similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012) but targets an existing process rather than creating a process in a suspended state. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via Thread Execution Hijacking may also evade detection from security products since the execution is masked under a legitimate process.
Query: vulnerability: The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-
Matching passage: CVE-2015-9428. CWE: CWE-352. CVSS: 6.5. The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address, or lp-niche parameters.
Near-miss passage: CVE-2015-5075. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of administrators for requests that create an administrative account via a crafted request to index.php/users/create.
Query: risk of Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer.
Matching passage: CVE-2015-4800. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer.
Near-miss passage: CVE-2015-8432. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects when an attacker register a new SIP provider for persistence and defense evasion. Logsource: windows / registry_set. Rule: title: Persistence Via New SIP Provider id: 5a2b21ee-6aaa-4234-ac9d-59a59edf90a1 status: test description: Detects when an attacker register a new SIP provider for persistence and defense evasion references: - https://persistence-info.github.io/Data/codesigning.html - https://github.com/gtworek/PSBits/tree/master/SIP - https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1553.003 logsource: category: registry_set product: windows detection: selection_root: TargetObject|contains: - \SOFTWARE\Microsoft\Cryptography\Providers\ - \SOFTWARE\Microsoft\Cryptography\OID\EncodingType - \SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\ - \SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType selection_dll: TargetObject|contains: - \Dll - \$DLL filter: Details: - WINTRUST.DLL - mso.dll filter_poqexec: Image: C:\Windows\System32\poqexec.exe TargetObject|contains: \CryptSIPDll Details: C:\Windows\System32\PsfSip.dll condition: all of selection_* and not 1 of filter* falsepositives: - Legitimate SIP being registered by the OS or different software. level: medium
Near-miss passage: Sigma rule: Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossibl. Logsource: m365 / threat_management. Rule: title: Microsoft 365 - Impossible Travel Activity id: d7eab125-5f94-43df-8710-795b80fa1189 status: test description: Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel. references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: Austin Songer @austinsonger date: 2020-07-06 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: Impossible travel activity status: success condition: selection falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-9122
Matching passage: CVE-2015-9122. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, and SD 835, possible buffer overflow if SIM card sends a response greater than 64KB of data for stream APDU command.
Near-miss passage: CVE-2015-2521. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: exploit Heap-based buffer overflow in SceneKit in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code via a crafted Collada file.
Matching passage: CVE-2015-5772. CWE: CWE-119. CVSS: 6.800000190734863. Heap-based buffer overflow in SceneKit in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code via a crafted Collada file.
Near-miss passage: CVE-2015-0795. CWE: CWE-119. CVSS: 6.800000190734863. Multiple stack-based buffer overflows in the SafeShellExecute method in the NetIQExecObject.NetIQExec.1 ActiveX control in NetIQExec.dll in NetIQ Security Solutions for iSeries 8.1 allow remote attackers to execute arbitrary code via long arguments, aka ZDI-CAN-2699.