alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for aws / cloudtrail
Matching passage: Sigma rule: Detects when an instance identity has taken an action that isn't inside SSM. This can indicate that a compromised EC2 in. Logsource: aws / cloudtrail. Rule: title: Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure id: 352a918a-34d8-4882-8470-44830c507aa3 status: test description: 'Detects when an instance identity has taken an action that isn''t inside SSM. This can indicate that a compromised EC2 instance is being used as a pivot point. ' references: - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-identity-roles.html - https://ermetic.com/blog/aws/aws-ec2-imds-what-you-need-to-know/ - https://www.packetmischief.ca/2023/07/31/amazon-ec2-credential-exfiltration-how-it-happens-and-how-to-mitigate-it/#lifting-credentials-from-imds-this-is-why-we-cant-have-nice-things author: jamesc-grafana date: 2024-07-11 tags: - attack.privilege-escalation - attack.initial-access - attack.persistence - attack.stealth - attack.t1078 - attack.t1078.002 logsource: product: aws service: cloudtrail detection: selection: userIdentity.arn|re: .+:assumed-role/aws:.+ filter_main_generic: - eventSource: ssm.amazonaws.com - eventName: RegisterManagedInstance - sourceIPAddress: AWS Internal condition: selection and not 1 of filter_main_* falsepositives: - A team has configured an EC2 instance to use instance profiles that grant the option for the EC2 instance to talk to other AWS Services level: high
Near-miss passage: Sigma rule: Detects creation of a malicious DLL file in the location where the OneDrive or Team applications Upon execution of the T. Logsource: windows / file_event. Rule: title: Malicious DLL File Dropped in the Teams or OneDrive Folder id: 1908fcc1-1b92-4272-8214-0fbaf2fa5163 status: test description: 'Detects creation of a malicious DLL file in the location where the OneDrive or Team applications Upon execution of the Teams or OneDrive application, the dropped malicious DLL file ("iphlpapi.dll") is sideloaded ' references: - https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading/ author: frack113 date: 2022-08-12 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: file_event product: windows detection: selection: TargetFilename|contains|all: - iphlpapi.dll - \AppData\Local\Microsoft condition: selection falsepositives: - Unknown level: high
Query: indicators of Network Device Configuration Dump
Matching passage: T1602.002 Network Device Configuration Dump. Tactics: collection. Description: Adversaries may access network configuration files to collect sensitive data about the device and the network. The network configuration is a file containing parameters that determine the operation of the device. The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset. Adversaries can inspect the configuration files to reveal information about the target network and its layout, the network device and its software, or identifying legitimate accounts and credentials for later use. Adversaries can use common management tools and protocols, such as Simple Network Management Protocol (SNMP) and Smart Install (SMI), to access network configuration files.(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks) These tools may be used to query specific data from a configuration repository or configure the device to export the configuration for later analysis.
Near-miss passage: T1602 Data from Configuration Repository. Tactics: collection. Description: Adversaries may collect data related to managed devices from configuration repositories. Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems. Configuration repositories may also facilitate remote access and administration of devices. Adversaries may target these repositories in order to collect large quantities of sensitive system administration data. Data from configuration repositories may be exposed by various protocols and software and can store a wide variety of data, much of which may align with adversary Discovery objectives.(Citation: US-CERT-TA18-106A)(Citation: US-CERT TA17-156A SNMP Abuse 2017)
Query: vulnerability: The TripleO Heat templates (tripleo-heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 7.0, do not properly use the configured RabbitMQ credentials, which make
Matching passage: CVE-2015-5329. CWE: CWE-264. CVSS: 7.300000190734863. The TripleO Heat templates (tripleo-heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 7.0, do not properly use the configured RabbitMQ credentials, which makes it easier for remote attackers to obtain access to services in deployed overclouds by leveraging knowledge of the default credentials.
Near-miss passage: CVE-2015-3028. CWE: CWE-264. CVSS: 5.5. McAfee Advanced Threat Defense (MATD) before 3.4.4.63 allows remote authenticated users to bypass intended restrictions and change or update configuration settings via crafted parameters.
Query: describe CVE-2015-0351
Matching passage: CVE-2015-0351. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0349, CVE-2015-0358, and CVE-2015-3039.
Near-miss passage: CVE-2015-4906. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 8u60 and JavaFX 2.2.85 allows remote attackers to affect confidentiality via unknown vectors related to JavaFX, a different vulnerability than CVE-2015-4908 and CVE-2015-4916.
Query: CVE similar to CVE-2015-8226
Matching passage: CVE-2015-8226. CWE: CWE-20. CVSS: 5.5. The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with software before V100R001C233B111 allows remote attackers to cause a denial of service (crash) via a crafted application with the system or camera permission, a different vulnerability than CVE-2015-8225.
Near-miss passage: CVE-2015-0753. CWE: CWE-20. CVSS: 6.800000190734863. SQL injection vulnerability in Cisco Unified Email Interaction Manager (EIM) and Unified Web Interaction Manager (WIM) 9.0(2) allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuu30028.
Query: vulnerability: Task Scheduler in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, 
Matching passage: CVE-2015-2525. CWE: CWE-264. CVSS: 7.199999809265137. Task Scheduler in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to bypass intended filesystem restrictions and delete arbitrary files via unspecified vectors, aka "Windows Task File Deletion Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-6755. CWE: CWE-264. CVSS: 7.5. The ContainerNode::parserInsertBefore function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 46.0.2490.71, proceeds with a DOM tree insertion in certain cases where a parent node no longer contains a child node, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.
Query: detection engineering for System Location Discovery
Matching passage: T1614 System Location Discovery. Tactics: discovery. Description: Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from [System Location Discovery](https://attack.mitre.org/techniques/T1614) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.(Citation: FBI Ragnar Locker 2020)(Citation: Sophos Geolocation 2016)(Citation: Bleepingcomputer RAT malware 2020) Windows API functions such as <code>GetLocaleInfoW</code> can also be used to determine the locale of the host.(Citation: FBI Ragnar Locker 2020) In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.(Citation: AWS Instance Identity Documents)(Citation: Microsoft Azure Instance Metadata 2021) Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.(Citation: Securelist Trasparent Tribe 2020)(Citation: Sophos Geolocation 2016)
Near-miss passage: T1614.001 System Language Discovery. Tactics: discovery. Description: Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host. This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions. This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities.(Citation: Malware System Language Check) There are various sources of data an adversary could use to infer system language, such as system defaults and keyboard layouts. Specific checks will vary based on the target and/or adversary, but may involve behaviors such as [Query Registry](https://attack.mitre.org/techniques/T1012) and calls to [Native API](https://attack.mitre.org/techniques/T1106) functions.(Citation: CrowdStrike Ryuk January 2019) For example, on a Windows system adversaries may attempt to infer the language of a system by querying the registry key <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language</code> or parsing the outputs of Windows API functions <code>GetUserDefaultUILanguage</code>, <code>GetSystemDefaultUILanguage</code>, <code>GetKeyboardLayoutList</code> and <code>GetUserDefaultLangID</code>.(Citation: Darkside Ransomware Cybereason)(Citation: Securelist JSWorm)(Citation: SecureList SynAck Doppelgänging May 2018) On a macOS or Linux system, adversaries may query <code>locale</code> to retrieve the value of the <code>$LANG</code> environment variable.
Query: detect Attempts to load dismcore.dll after dropping it in logs
Matching passage: Sigma rule: Attempts to load dismcore.dll after dropping it. Logsource: windows / image_load. Rule: title: UAC Bypass With Fake DLL id: a5ea83a7-05a5-44c1-be2e-addccbbd8c03 status: test description: Attempts to load dismcore.dll after dropping it references: - https://steemit.com/utopian-io/@ah101/uac-bypassing-utility author: oscd.community, Dmitry Uchakin date: 2020-10-06 modified: 2022-12-25 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1548.002 - attack.t1574.001 logsource: category: image_load product: windows detection: selection: Image|endswith: \dism.exe ImageLoaded|endswith: \dismcore.dll filter: ImageLoaded: C:\Windows\System32\Dism\dismcore.dll condition: selection and not filter falsepositives: - Actions of a legitimate telnet client level: high
Near-miss passage: Sigma rule: Detects registry key established after masqueraded .scr file execution using Rundll32 through desk.cpl. Logsource: windows / registry_set. Rule: title: ScreenSaver Registry Key Set id: 40b6e656-4e11-4c0c-8772-c1cc6dae34ce status: test description: Detects registry key established after masqueraded .scr file execution using Rundll32 through desk.cpl references: - https://twitter.com/VakninHai/status/1517027824984547329 - https://twitter.com/pabraeken/status/998627081360695297 - https://jstnk9.github.io/jstnk9/research/InstallScreenSaver-SCR-files author: Jose Luis Sanchez Martinez (@Joseliyo_Jstnk) date: 2022-05-04 modified: 2023-08-17 tags: - attack.stealth - attack.t1218.011 logsource: product: windows category: registry_set detection: selection: Image|endswith: \rundll32.exe registry: TargetObject|contains: \Control Panel\Desktop\SCRNSAVE.EXE Details|endswith: .scr filter: Details|contains: - C:\Windows\System32\ - C:\Windows\SysWOW64\ condition: selection and registry and not filter falsepositives: - Legitimate use of screen saver level: medium
Query: vulnerability: A vulnerability, which was classified as critical, was found in tutrantta project_todolist. Affected is the function getAffectedRows/where/insert/update in the library library/Data
Matching passage: CVE-2015-10045. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability, which was classified as critical, was found in tutrantta project_todolist. Affected is the function getAffectedRows/where/insert/update in the library library/Database.php. The manipulation leads to sql injection. The name of the patch is 194a0411bbe11aa4813f13c66b9e8ea403539141. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218352.
Near-miss passage: CVE-2015-5703. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the public key discovery API call in Open-Xchange OX Guard before 2.0.0-rev8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Query: describe CVE-2015-3729
Matching passage: CVE-2015-3729. CWE: CWE-254. CVSS: 4.300000190734863. Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not indicate what web site originated an input prompt, which allows remote attackers to conduct spoofing attacks via a crafted site.
Near-miss passage: CVE-2015-1269. CWE: CWE-254. CVSS: 4.300000190734863. The DecodeHSTSPreloadRaw function in net/http/transport_security_state.cc in Google Chrome before 43.0.2357.130 does not properly canonicalize DNS hostnames before making comparisons to HSTS or HPKP preload entries, which allows remote attackers to bypass intended access restrictions via a string that (1) ends in a . (dot) character or (2) is not entirely lowercase.
Query: exploit The kamcmd administrative utility and default configuration in kamailio before 4.3.0 use /tmp/kamailio_ctl.
Matching passage: CVE-2015-1590. CWE: CWE-264. CVSS: 7.800000190734863. The kamcmd administrative utility and default configuration in kamailio before 4.3.0 use /tmp/kamailio_ctl.
Near-miss passage: CVE-2015-7229. CWE: CWE-264. CVSS: 3.5. The Twitter module 6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, and 7.x-6.x before 7.x-6.0 for Drupal does not properly check access permissions, which allows remote authenticated users to post tweets to arbitrary accounts by leveraging the (1) "post to twitter" permission or change the options for arbitrary attached accounts by leveraging the (2) "add twitter accounts" or (3) "add authenticated twitter accounts" permission.
Query: detect Detects a set of suspicious network related commands often used in recon stages in logs
Matching passage: Sigma rule: Detects a set of suspicious network related commands often used in recon stages. Logsource: windows / process_creation. Rule: title: Network Reconnaissance Activity id: e6313acd-208c-44fc-a0ff-db85d572e90e status: test description: Detects a set of suspicious network related commands often used in recon stages references: - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ author: Florian Roth (Nextron Systems) date: 2022-02-07 tags: - attack.discovery - attack.t1087 - attack.t1082 - car.2016-03-001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - nslookup - _ldap._tcp.dc._msdcs. condition: selection falsepositives: - False positives depend on scripts and administrative tools used in the monitored environment level: high
Near-miss passage: Sigma rule: Detects WMI command line event consumers. Logsource: windows / image_load. Rule: title: WMI Persistence - Command Line Event Consumer id: 05936ce2-ee05-4dae-9d03-9a391cf2d2c6 status: test description: Detects WMI command line event consumers references: - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ author: Thomas Patzke date: 2018-03-07 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.t1546.003 - attack.persistence logsource: category: image_load product: windows detection: selection: Image: C:\Windows\System32\wbem\WmiPrvSE.exe ImageLoaded|endswith: \wbemcons.dll condition: selection falsepositives: - Unknown (data set is too small; further testing needed) level: high
Query: CVE similar to CVE-2015-8842
Matching passage: CVE-2015-8842. CWE: CWE-264. CVSS: 3.299999952316284. tmpfiles.d/systemd.conf in systemd before 229 uses weak permissions for /var/log/journal/%m/system.journal, which allows local users to obtain sensitive information by reading the file.
Near-miss passage: CVE-2015-6034. CWE: CWE-264. CVSS: 6.900000095367432. EPSON Network Utility 4.10 uses weak permissions (Everyone: Full Control) for eEBSVC.exe, which allows local users to gain privileges via a Trojan horse file.
Query: write Sigma for Indicates sign-in from a malicious IP address based on high failure rates.
Matching passage: Sigma rule: Indicates sign-in from a malicious IP address based on high failure rates.. Logsource: azure / riskdetection. Rule: title: Malicious IP Address Sign-In Failure Rate id: a3f55ebd-0c01-4ed6-adc0-8fb76d8cd3cd status: test description: Indicates sign-in from a malicious IP address based on high failure rates. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malicious-ip-address - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-07 tags: - attack.t1090 - attack.command-and-control logsource: product: azure service: riskdetection detection: selection: riskEventType: maliciousIPAddress condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Near-miss passage: Sigma rule: Detects the usage of wmic.exe to enumerate or read Windows registry via the WMI StdRegProv class read methods (EnumKey,. Logsource: windows / process_creation. Rule: title: Registry Enumeration via WMI Stdregprov id: a0e417e2-2fa1-40da-b6d2-e094cd5e1191 related: - id: c453ab7a-1f5c-4716-a3b4-dea8135fb43a type: similar status: experimental description: 'Detects the usage of wmic.exe to enumerate or read Windows registry via the WMI StdRegProv class read methods (EnumKey, EnumValues, GetStringValue, etc.). While registry reads are common, attackers may use this technique to perform reconnaissance and discover sensitive configuration values, credentials, or installed software. The use of WMI as an alternative to standard tools like reg.exe can indicate an attempt to evade detection focused on traditional registry query commands. ' references: - https://trustedsec.com/blog/command-line-underdog-wmic-in-action - https://trustedsec.com/blog/wmi-for-script-kiddies - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-07-30 modified: 2026-06-19 tags: - attack.execution - attack.t1047 - attack.discovery - attack.t1012 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains|all: - stdregprov - call CommandLine|contains: - CheckAccess - EnumKey - EnumValues - GetBinaryValue - GetDWORDValue - GetExpandedStringValue - GetMultiStringValue - GetQWORDValue - GetSecurityDescriptor - GetStringValue condition: all of selection_* falsepositives: - Legitimate administrative activity level: medium
Query: risk of CoreTelephony in Apple iOS before 8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and device restart) via a Class 0 SMS message.
Matching passage: CVE-2015-1063. CWE: UNKNOWN. CVSS: 7.800000190734863. CoreTelephony in Apple iOS before 8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and device restart) via a Class 0 SMS message.
Near-miss passage: CVE-2015-3623. CWE: UNKNOWN. CVSS: 6.400000095367432. XML external entity (XXE) vulnerability in QlikTech Qlikview before 11.20 SR12 allows remote attackers to conduct server-side request forgery (SSRF) attacks and read arbitrary files via crafted XML data in a request to AccessPoint.aspx.
Query: CVE similar to CVE-2015-2093
Matching passage: CVE-2015-2093. CWE: CWE-119. CVSS: 6.800000190734863. Stack-based buffer overflow in the Connect function in the WebGate WebEyeAudio ActiveX control allows remote attackers to execute arbitrary code via a crafted value.
Near-miss passage: CVE-2015-3684. CWE: CWE-119. CVSS: 6.800000190734863. The HTTPAuthentication implementation in CFNetwork in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted credentials in a URL.
Query: risk of Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Ex
Matching passage: CVE-2015-0043. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-6287. CWE: CWE-399. CVSS: 5.0. Cisco Web Security Appliance (WSA) 8.0.6-078 and 8.0.6-115 allows remote attackers to cause a denial of service (service outage) via a flood of TCP traffic that leads to DNS resolution delays, aka Bug IDs CSCur32005 and CSCur07907.
Query: exploit Cisco Emergency Responder 10.5(3.10000.9) allows remote attackers to upload files to arbitrary locations via a crafted parameter, aka Bug ID CSCuv25501.
Matching passage: CVE-2015-6407. CWE: CWE-20. CVSS: 4.0. Cisco Emergency Responder 10.5(3.10000.9) allows remote attackers to upload files to arbitrary locations via a crafted parameter, aka Bug ID CSCuv25501.
Near-miss passage: CVE-2015-6849. CWE: CWE-20. CVSS: 7.800000190734863. EMC NetWorker before 8.0.4.5, 8.1.x before 8.1.3.6, 8.2.x before 8.2.2.2, and 9.0 before build 407 allows remote attackers to cause a denial of service (process outage) via malformed RPC authentication messages.