alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: The ANShareFile2 method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acroba
Matching passage: CVE-2015-7619. CWE: CWE-416. CVSS: 6.800000190734863. The ANShareFile2 method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7620, and CVE-2015-7623.
Near-miss passage: CVE-2015-6673. CWE: CWE-416. CVSS: 9.800000190734863. Use-after-free vulnerability in Decoder.cpp in libpgf before 6.15.32.
Query: Sigma rule for Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as us
Matching passage: Sigma rule: Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as us. Logsource: windows / process_creation. Rule: title: Command Line Execution with Suspicious URL and AppData Strings id: 1ac8666b-046f-4201-8aba-1951aaec03a3 status: test description: Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell) references: - https://www.hybrid-analysis.com/sample/3a1f01206684410dbe8f1900bbeaaa543adfcd07368ba646b499fa5274b9edf6?environmentId=100 - https://www.hybrid-analysis.com/sample/f16c729aad5c74f19784a24257236a8bbe27f7cdc4a89806031ec7f1bebbd475?environmentId=100 author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community date: 2019-01-16 modified: 2021-11-27 tags: - attack.execution - attack.command-and-control - attack.t1059.003 - attack.t1059.001 - attack.t1105 logsource: category: process_creation product: windows detection: selection: Image|endswith: \cmd.exe CommandLine|contains|all: - http - :// - '%AppData%' condition: selection falsepositives: - High level: medium
Near-miss passage: Sigma rule: Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation b. Logsource: windows / process_creation. Rule: title: Potential PowerShell Obfuscation Via Reversed Commands id: b6b49cd1-34d6-4ead-b1bf-176e9edba9a4 status: test description: Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers references: - https://2019.offzone.moscow/ru/report/hunting-for-powershell-abuses/ - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=66 author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton date: 2020-10-11 modified: 2023-05-31 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli: CommandLine|contains: - hctac - kaerb - dnammoc - ekovn - eliFd - rahc - etirw - golon - tninon - eddih - tpircS - ssecorp - llehsrewop - esnopser - daolnwod - tneilCbeW - tneilc - ptth - elifotevas - 46esab - htaPpmeTteG - tcejbO - maerts - hcaerof - retupmoc filter_main_encoded_keyword: CommandLine|contains: - ' -EncodedCommand ' - ' -enc ' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unlikely level: high
Query: exploit eWON devices with firmware before 10.1s0 do not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging a
Matching passage: CVE-2015-7928. CWE: CWE-200. CVSS: 8.5. eWON devices with firmware before 10.1s0 do not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
Near-miss passage: CVE-2015-7675. CWE: CWE-200. CVSS: 6.5. The "Send as attachment" feature in Ipswitch MOVEit DMZ before 8.2 and MOVEit Mobile before 1.2.2 allow remote authenticated users to bypass authorization and read uploaded files via a valid FileID in the (1) serverFileIds parameter to mobile/sendMsg or (2) arg01 parameter to human.aspx.
Query: Sigma rule for Detects potential execution of MeshAgent which is a tool used for remote access. Historical data shows that threat actor
Matching passage: Sigma rule: Detects potential execution of MeshAgent which is a tool used for remote access. Historical data shows that threat actor. Logsource: macos / process_creation. Rule: title: Remote Access Tool - Potential MeshAgent Execution - MacOS id: 22c45af6-f590-4d44-bab3-b5b2d2a2b6d9 related: - id: 2fbbe9ff-0afc-470b-bdc0-592198339968 type: similar status: experimental description: 'Detects potential execution of MeshAgent which is a tool used for remote access. Historical data shows that threat actors rename MeshAgent binary to evade detection. Matching command lines with the ''--meshServiceName'' argument can indicate that the MeshAgent is being used for remote access. ' references: - https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access - https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/ - https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/ - https://www.security.com/threat-intelligence/medusa-ransomware-attacks author: Norbert Jaśniewicz (AlphaSOC) date: 2025-05-19 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: macos detection: selection: CommandLine|contains: --meshServiceName condition: selection falsepositives: - Environments that legitimately use MeshAgent level: medium
Near-miss passage: Sigma rule: Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash. Logsource: windows / create_stream_hash. Rule: title: Hidden Executable In NTFS Alternate Data Stream id: b69888d4-380c-45ce-9cf9-d9ce46e67821 status: test description: Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash references: - https://twitter.com/0xrawsec/status/1002478725605273600?s=21 author: Florian Roth (Nextron Systems), @0xrawsec date: 2018-06-03 modified: 2023-02-10 tags: - attack.stealth - attack.s0139 - attack.t1564.004 logsource: product: windows category: create_stream_hash definition: 'Requirements: Sysmon or equivalent configured with Imphash logging' detection: selection: Hash|contains: IMPHASH= filter_main_null: Hash|contains: IMPHASH=00000000000000000000000000000000 condition: selection and not 1 of filter_main_* falsepositives: - This rule isn't looking for any particular binary characteristics. As legitimate installers and programs were seen embedding hidden binaries in their ADS. Some false positives are expected from browser processes and similar. level: medium
Query: describe CVE-2015-0609
Matching passage: CVE-2015-0609. CWE: CWE-362. CVSS: 7.099999904632568. Race condition in the Common Classification Engine (CCE) in the Measurement, Aggregation, and Correlation Engine (MACE) implementation in Cisco IOS 15.4(2)T3 and earlier allows remote attackers to cause a denial of service (device reload) via crafted network traffic that triggers improper handling of the timing of process switching and Cisco Express Forwarding (CEF) switching, aka Bug ID CSCuj96752.
Near-miss passage: CVE-2015-0245. CWE: CWE-362. CVSS: 1.899999976158142. D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.
Query: risk of Cross-site request forgery (CSRF) vulnerability in HP StoreOnce Backup system software before 3.13.1 allows remote authenticated users to hijack the authentication of unspecified v
Matching passage: CVE-2015-5445. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in HP StoreOnce Backup system software before 3.13.1 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
Near-miss passage: CVE-2015-5483. CWE: CWE-352. CVSS: 8.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add users, (2) delete posts, or (3) modify PHP files via unspecified vectors, or (4) conduct cross-site scripting (XSS) attacks via the po_logo parameter in the privateonly.php page to wp-admin/options-general.php.
Query: detect Detects when a new identity provider is created for Okta. in logs
Matching passage: Sigma rule: Detects when a new identity provider is created for Okta.. Logsource: okta / okta. Rule: title: Okta Identity Provider Created id: 969c7590-8c19-4797-8c1b-23155de6e7ac status: test description: Detects when a new identity provider is created for Okta. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection author: kelnage date: 2023-09-07 modified: 2026-04-27 tags: - attack.privilege-escalation - attack.persistence - attack.t1098.001 logsource: product: okta service: okta detection: selection: eventType: system.idp.lifecycle.create condition: selection falsepositives: - When an admin creates a new, authorised identity provider. level: medium
Near-miss passage: Sigma rule: Detects execution of the "mshta" utility with an argument containing the "http" keyword, which could indicate that an at. Logsource: windows / process_creation. Rule: title: Remotely Hosted HTA File Executed Via Mshta.EXE id: b98d0db6-511d-45de-ad02-e82a98729620 status: test description: Detects execution of the "mshta" utility with an argument containing the "http" keyword, which could indicate that an attacker is executing a remotely hosted malicious hta file references: - https://www.trendmicro.com/en_us/research/22/e/avoslocker-ransomware-variant-abuses-driver-file-to-disable-anti-Virus-scans-log4shell.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-08 modified: 2023-02-06 tags: - attack.execution - attack.stealth - attack.t1218.005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mshta.exe - OriginalFileName: MSHTA.EXE selection_cli: CommandLine|contains: - http:// - https:// - ftp:// condition: all of selection_* falsepositives: - Unknown level: high
Query: detect Cloud Services
Matching passage: T1021.007 Cloud Services. Tactics: lateral movement. Description: Adversaries may log into accessible cloud services within a compromised environment using [Valid Accounts](https://attack.mitre.org/techniques/T1078) that are synchronized with or federated to on-premises user identities. The adversary may then perform management actions or access cloud-hosted resources as the logged-on user. Many enterprises federate centrally managed user identities to cloud services, allowing users to login with their domain credentials in order to access the cloud control plane. Similarly, adversaries may connect to available cloud services through the web console or through the cloud command line interface (CLI) (e.g., [Cloud API](https://attack.mitre.org/techniques/T1059/009)), using commands such as <code>Connect-AZAccount</code> for Azure PowerShell, <code>Connect-MgGraph</code> for Microsoft Graph PowerShell, and <code>gcloud auth login</code> for the Google Cloud CLI. In some cases, adversaries may be able to authenticate to these services via [Application Access Token](https://attack.mitre.org/techniques/T1550/001) instead of a username and password.
Near-miss passage: T1021.006 Windows Remote Management. Tactics: lateral movement. Description: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services).(Citation: Microsoft WinRM) It may be called with the `winrm` command or by any number of programs such as PowerShell.(Citation: Jacobsen 2014) WinRM can be used as a method of remotely interacting with [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).(Citation: MSDN WMI)
Query: exploit The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page parameter.
Matching passage: CVE-2015-9429. CWE: CWE-352. CVSS: 6.5. The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page parameter.
Near-miss passage: CVE-2015-9307. CWE: CWE-352. CVSS: 8.800000190734863. The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.
Query: describe CVE-2015-6689
Matching passage: CVE-2015-6689. CWE: CWE-416. CVSS: 6.800000190734863. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via a crafted WillSave document action, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6687, CVE-2015-6688, CVE-2015-6690, CVE-2015-6691, CVE-2015-7615, CVE-2015-7617, and CVE-2015-7621.
Near-miss passage: CVE-2015-6042. CWE: CWE-416. CVSS: 9.300000190734863. Use-after-free vulnerability in the CWindow object implementation in Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Query: describe CVE-2015-9339
Matching passage: CVE-2015-9339. CWE: CWE-434. CVSS: 7.5. The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files.
Near-miss passage: CVE-2015-8249. CWE: CWE-434. CVSS: 9.800000190734863. The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary files via the ConnectionId parameter.
Query: describe CVE-2015-8789
Matching passage: CVE-2015-8789. CWE: UNKNOWN. CVSS: 9.600000381469727. Use-after-free vulnerability in the EbmlMaster::Read function in libEBML before 1.3.3 allows context-dependent attackers to have unspecified impact via a "deeply nested element with infinite size" followed by another element of an upper level in an EBML document.
Near-miss passage: CVE-2015-4916. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 8u60 and JavaFX 2.2.85 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2015-4906 and CVE-2015-4908.
Query: risk of Cross-site request forgery (CSRF) vulnerability in the Watchdog Aggregator module for Drupal allows remote attackers to hijack the authentication of administrators for requests tha
Matching passage: CVE-2015-4355. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Watchdog Aggregator module for Drupal allows remote attackers to hijack the authentication of administrators for requests that enable or disable monitoring sites via unspecified vectors.
Near-miss passage: CVE-2015-3946. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in Advantech WebAccess before 8.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Query: detect Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. It was seen used by BlackCat in logs
Matching passage: Sigma rule: Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. It was seen used by BlackCat. Logsource: windows / process_creation. Rule: title: DirLister Execution id: b4dc61f5-6cce-468e-a608-b48b469feaa2 status: test description: Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. It was seen used by BlackCat ransomware to create a list of accessible directories and files. references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1083/T1083.md - https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/ author: frack113 date: 2022-08-20 modified: 2023-02-04 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: DirLister.exe - Image|endswith: \DirLister.exe condition: selection falsepositives: - Legitimate use by users level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_dirlister_execution/info.yml simulation: - type: atomic-red-team name: Launch DirLister Executable technique: T1083 atomic_guid: c5bec457-43c9-4a18-9a24-fe151d8971b7
Near-miss passage: Sigma rule: Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate. Logsource: windows / pipe_created. Rule: title: PsExec Tool Execution From Suspicious Locations - PipeName id: 41504465-5e3a-4a5b-a5b4-2a0baadd4463 related: - id: f3f3a972-f982-40ad-b63c-bca6afdfad7c type: derived status: test description: Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate that the tool is being used in an attack references: - https://www.jpcert.or.jp/english/pub/sr/ir_research.html - https://jpcertcc.github.io/ToolAnalysisResultSheet author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-04 modified: 2023-09-20 tags: - attack.execution - attack.t1569.002 - attack.s0029 logsource: category: pipe_created product: windows definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName: \PSEXESVC Image|contains: - :\Users\Public\ - :\Windows\Temp\ - \AppData\Local\Temp\ - \Desktop\ - \Downloads\ condition: selection falsepositives: - Rare legitimate use of psexec from the locations mentioned above. This will require initial tuning based on your environment. level: medium
Query: CVE similar to CVE-2015-6494
Matching passage: CVE-2015-6494. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-9306. CWE: CWE-79. CVSS: 6.099999904632568. The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.
Query: intelligence brief on T1685
Matching passage: T1685 Disable or Modify Tools. Tactics: defense impairment. Description: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.(Citation: SCADAfence_ransomware) In addition to directly targeting tools, adversaries may block or manipulate indicators and telemetry used for detection. This includes maliciously disabling or redirecting sensors such as Event Tracing for Windows (ETW), modifying event log configurations (e.g., redirecting Security logs), or interfering with logging pipelines and forwarding mechanisms (e.g., SIEM ingestion).(Citation: Microsoft Lamin Sept 2017)(Citation: ETW Palantir) More advanced techniques include leveraging legitimate drivers or debugging mechanisms to render tools non-functional, bypassing anti-tampering protections, and targeting specific defenses such as Sysmon or cloud monitoring agents. Adversaries may also disrupt broader defensive operations, including update mechanisms, logging infrastructure (e.g., syslog), or event aggregation, further degrading an organization’s ability to detect and respond to malicious activity.(Citation: Cocomazzi FIN7 Reboot)
Near-miss passage: T1685.005 Clear Windows Event Logs. Tactics: defense impairment. Description: Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit. With administrator privileges, the event logs can be cleared with the following utility commands: * `wevtutil cl system` * `wevtutil cl application` * `wevtutil cl security` These logs may also be cleared through other mechanisms, such as the event viewer GUI or [PowerShell](https://attack.mitre.org/techniques/T1059/001). For example, adversaries may use the PowerShell command `Remove-EventLog -LogName Security` to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot.(Citation: disable_win_evt_logging) Adversaries may also attempt to clear logs by directly deleting the stored log files within `C:\Windows\System32\winevt\logs\`.
Query: CVE similar to CVE-2015-7222
Matching passage: CVE-2015-7222. CWE: CWE-189. CVSS: 6.800000190734863. Integer underflow in the Metadata::setData function in MetaData.cpp in libstagefright in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect memory allocation and application crash) via an MP4 video file with crafted covr metadata that triggers a buffer overflow.
Near-miss passage: CVE-2015-1538. CWE: CWE-189. CVSS: 10.0. Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code via crafted atoms in MP4 data that trigger an unchecked multiplication, aka internal bug 20139950, a related issue to CVE-2015-4496.