alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects Obfuscated Powershell via use MSHTA in Scripts
Matching passage: Sigma rule: Detects Obfuscated Powershell via use MSHTA in Scripts. Logsource: windows / security. Rule: title: Invoke-Obfuscation Via Use MSHTA - Security id: 9b8d9203-4e0f-4cd9-bb06-4cc4ea6d0e9a related: - id: 7e9c7999-0f9b-4d4a-a6ed-af6d553d4af4 type: derived status: test description: Detects Obfuscated Powershell via use MSHTA in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-09 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceFileName|contains|all: - mshta - vbscript:createobject - .run - window.close condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety controls and allow un. Logsource: aws / cloudtrail. Rule: title: AWS Bedrock Guardrail Updated id: 1c722651-254a-4b04-a9f4-99b62a2d0a1f status: experimental description: 'Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety controls and allow unsafe or unauthorized model responses. ' references: - https://docs.aws.amazon.com/bedrock/latest/APIReference/API_UpdateGuardrail.html author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2026-07-10 tags: - attack.defense-impairment - attack.t1685 logsource: product: aws service: cloudtrail detection: selection: eventName: UpdateGuardrail eventSource: bedrock.amazonaws.com condition: selection falsepositives: - Legitimate guardrail updates by authorized identities. level: medium
Query: SOC runbook when seeing Persistence mechanism resembling Indicator Removal from Tools
Matching passage: Playbook for T1027.005 Indicator Removal from Tools. 1) Validate alert telemetry against T1027.005. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems. A good example of this is when malware is detected with a file signature
Near-miss passage: Playbook for T1027.016 Junk Code Insertion. Different response path focused on stealth.
Query: describe CVE-2015-4755
Matching passage: CVE-2015-4755. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 12.1.0.2 allows remote attackers to affect confidentiality via unknown vectors.
Near-miss passage: CVE-2015-2595. CWE: UNKNOWN. CVSS: 6.5. Unspecified vulnerability in the Oracle OLAP component in Oracle Database Server 12.1.0.1 and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
Query: risk of Unrestricted file upload vulnerability in the Panel component in Bastian Allgeier Kirby before 2.1.2 allows remote authenticated users to execute arbitrary PHP code by uploading a 
Matching passage: CVE-2015-7773. CWE: UNKNOWN. CVSS: 6.5. Unrestricted file upload vulnerability in the Panel component in Bastian Allgeier Kirby before 2.1.2 allows remote authenticated users to execute arbitrary PHP code by uploading a file that lacks an extension, and then renaming this file to have a .php extension.
Near-miss passage: CVE-2015-1992. CWE: UNKNOWN. CVSS: 7.199999809265137. IBM Systems Director 5.2.x, 6.1.x, 6.2.0.x, 6.2.1.x, 6.3.0.0, 6.3.1.x, 6.3.2.x, 6.3.3.x, 6.3.5.0, and 6.3.6.0 improperly processes events, which allows local users to gain privileges via unspecified vectors.
Query: common weakness: Same Seed in Pseudo-Random Number Generator (PRNG)
Matching passage: CWE-336 Same Seed in Pseudo-Random Number Generator (PRNG). A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is initialized.
Near-miss passage: CWE-446 UI Discrepancy for Security Feature. The user interface does not correctly enable or configure a security feature, but the interface provides feedback that causes the user to believe that the feature is in a secure state.
Query: CVE similar to CVE-2015-4895
Matching passage: CVE-2015-4895. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.
Near-miss passage: CVE-2015-8818. CWE: UNKNOWN. CVSS: 5.5. The cpu_physical_memory_write_rom_internal function in exec.c in QEMU (aka Quick Emulator) does not properly skip MMIO regions, which allows local privileged guest users to cause a denial of service (guest crash) via unspecified vectors.
Query: campaign using Archive via Custom Method
Matching passage: T1560.003 Archive via Custom Method. Tactics: collection. Description: An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.(Citation: ESET Sednit Part 2)
Near-miss passage: T1560 Archive Collected Data. Tactics: collection. Description: An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.(Citation: DOJ GRU Indictment Jul 2018) Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender. Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.
Query: write Sigma for Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.
Matching passage: Sigma rule: Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.. Logsource: windows / process_creation. Rule: title: InfDefaultInstall.exe .inf Execution id: ce7cf472-6fcc-490a-9481-3786840b5d9b status: test description: Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md#atomic-test-4---infdefaultinstallexe-inf-execution - https://lolbas-project.github.io/lolbas/Binaries/Infdefaultinstall/ author: frack113 date: 2021-07-13 modified: 2022-10-09 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - 'InfDefaultInstall.exe ' - '.inf' condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects various indicators of Microsoft Connection Manager Profile Installer execution. Logsource: windows / process_access. Rule: title: CMSTP Execution Process Access id: 3b4b232a-af90-427c-a22f-30b0c0837b95 status: stable description: Detects various indicators of Microsoft Connection Manager Profile Installer execution references: - https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/ author: Nik Seetharaman date: 2018-07-16 modified: 2021-06-27 tags: - attack.stealth - attack.t1218.003 - attack.execution - attack.t1559.001 - attack.g0069 - attack.g0080 - car.2019-04-001 logsource: product: windows category: process_access detection: selection: CallTrace|contains: cmlua.dll condition: selection falsepositives: - Legitimate CMSTP use (unlikely in modern enterprise environments) level: high
Query: detect Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID in logs
Matching passage: Sigma rule: Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID. Logsource: azure / signinlogs. Rule: title: Account Lockout id: 2b7d6fc0-71ac-4cf7-8ed1-b5788ee5257a status: test description: Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts author: AlertIQ date: 2021-10-10 modified: 2022-12-25 tags: - attack.credential-access - attack.t1110 logsource: product: azure service: signinlogs detection: selection: ResultType: 50053 condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects process access events where WerFaultSecure accesses MsMpEng.exe with dbgcore.dll or dbghelp.dll in the call trac. Logsource: windows / process_access. Rule: title: Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze id: 387df17d-3b04-448f-8669-9e7fd5e5fd8c related: - id: 8a2f4b1c-3d5e-4f7a-9b2c-1e4f6d8a9c2b type: similar - id: 1f0b4cac-9c81-41f4-95d0-8475ff46b3e2 type: similar status: experimental description: 'Detects process access events where WerFaultSecure accesses MsMpEng.exe with dbgcore.dll or dbghelp.dll in the call trace, indicating potential EDR freeze techniques. This technique leverages WerFaultSecure.exe running as a Protected Process Light (PPL) with WinTCB protection level to call MiniDumpWriteDump and suspend EDR/AV processes, allowing malicious activity to execute undetected during the suspension period. ' references: - https://blog.axelarator.net/hunting-for-edr-freeze/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-27 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_access product: windows definition: "Requires Sysmon Event ID 10 (ProcessAccess) with CallTrace enabled.\nExample sysmon config snippet with grouping,\ \ as logging individual ProcessAccess events can generate excessive logs:\n<ProcessAccess onmatch=\"include\">\n <Rule\ \ groupRelation=\"and\">\n <TargetImage condition=\"end with\">\\MsMpEng.exe</TargetImage>\n <SourceImage condition=\"\ end with\">\\WerFaultSecure.exe</SourceImage>\n </Rule>\n</ProcessAccess>\n" detection: selection: SourceImage|endswith: \WerFaultSecure.exe TargetImage|endswith: \MsMpEng.exe CallTrace|contains: - \dbgcore.dll - \dbghelp.dll condition: selection falsepositives: - Legitimate Windows Error Reporting operations level: high regression_tests_path: regression_data/rules/windows/process_access/proc_access_win_werfaultsecure_msmpeng_access/info.yml
Query: patch priority for CVE-2015-6987
Matching passage: CVE-2015-6987. CWE: CWE-20. CVSS: 2.0999999046325684. The File Bookmark component in Apple OS X before 10.11.1 allows local users to cause a denial of service (application crash) via crafted bookmark metadata in a folder.
Near-miss passage: CVE-2015-2924. CWE: CWE-20. CVSS: 3.299999952316284. The receive_ra function in rdisc/nm-lndp-rdisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in NetworkManager 1.x allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message, a similar issue to CVE-2015-2922.
Query: explain CWE-580
Matching passage: CWE-580 clone() Method Without super.clone(). The product contains a clone() method that does not call super.clone() to obtain the new object.
Near-miss passage: CWE-1115 Source Code Element without Standard Prologue. The source code contains elements such as source files that do not consistently provide a prologue or header that has been standardized for the project.
Query: describe CVE-2015-9318
Matching passage: CVE-2015-9318. CWE: CWE-254. CVSS: 7.5. The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies.
Near-miss passage: CVE-2015-1297. CWE: CWE-254. CVSS: 7.5. The WebRequest API implementation in extensions/browser/api/web_request/web_request_api.cc in Google Chrome before 45.0.2454.85 does not properly consider a request's source before accepting the request, which allows remote attackers to bypass intended access restrictions via a crafted (1) app or (2) extension.
Query: common weakness: Use of Weak Hash
Matching passage: CWE-328 Use of Weak Hash. The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).
Near-miss passage: CWE-1048 Invokable Control Element with Large Number of Outward Calls. The code contains callable control elements that contain an excessively large number of references to other application objects external to the context of the callable, i.e. a Fan-Out value that is excessively large.
Query: CVE similar to CVE-2015-3644
Matching passage: CVE-2015-3644. CWE: CWE-284. CVSS: 5.800000190734863. Stunnel 5.00 through 5.13, when using the redirect option, does not redirect client connections to the expected server after the initial connection, which allows remote attackers to bypass authentication.
Near-miss passage: CVE-2015-3806. CWE: CWE-284. CVSS: 7.199999809265137. Apple iOS before 8.4.1 and OS X before 10.10.5 allow local users to bypass a code-signing protection mechanism by appending code to a crafted executable file.
Query: patch priority for CVE-2015-1936
Matching passage: CVE-2015-1936. CWE: CWE-284. CVSS: 6.0. The administrative console in IBM WebSphere Application Server (WAS) 8.0.0 before 8.0.0.11 and 8.5 before 8.5.5.6, when the Security feature is disabled, allows remote authenticated users to hijack sessions via the JSESSIONID parameter.
Near-miss passage: CVE-2015-6848. CWE: CWE-284. CVSS: 8.5. EMC Isilon OneFS 7.1.x before 7.1.1.5, 7.2.0.x before 7.2.0.3, and 7.2.1.x before 7.2.1.1, when the RFC 2307 feature is configured but SFU is not universally present, allows remote authenticated AD users to obtain root privileges via unspecified vectors.
Query: detection engineering for System Network Connections Discovery
Matching passage: T1049 System Network Connections Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. An adversary who gains access to a system that is part of a cloud-based environment may map out Virtual Private Clouds or Virtual Networks in order to determine what systems and services are connected. The actions performed are likely the same types of discovery techniques depending on the operating system, but the resulting information may include details about the networked cloud environment relevant to the adversary's goals. Cloud providers may have different ways in which their virtual networks operate.(Citation: Amazon AWS VPC Guide)(Citation: Microsoft Azure Virtual Network Overview)(Citation: Google VPC Overview) Similarly, adversaries who gain access to network devices may also perform similar discovery activities to gather information about connected systems and services. Utilities and commands that acquire this information include [netstat](https://attack.mitre.org/software/S0104), "net use," and "net session" with [Net](https://attack.mitre.org/software/S0039). In Mac and Linux, [netstat](https://attack.mitre.org/software/S0104) and <code>lsof</code> can be used to list current connections. <code>who -a</code> and <code>w</code> can be used to show which users are currently logged in, similar to "net session". Additionally, built-in features native to network devices and [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) may be used (e.g. <code>show ip sockets</code>, <code>show tcp brief</code>).(Citation: US-CERT-TA18-106A) On ESXi servers, the command `esxi network ip connection list` can be used to list active network connections.(Citation: Sygnia ESXi Ransomware 2025)
Near-miss passage: T1010 Application Window Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.(Citation: Prevailion DarkWatchman 2021) For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ([Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) to evade.(Citation: ESET Grandoreiro April 2020) Adversaries typically abuse system features for this type of enumeration. For example, they may gather information through native system features such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) commands and [Native API](https://attack.mitre.org/techniques/T1106) functions.
Query: write Sigma for Detects the use of iexpress.exe to create binaries via Self Extraction Directive (SED) files located in potentially susp
Matching passage: Sigma rule: Detects the use of iexpress.exe to create binaries via Self Extraction Directive (SED) files located in potentially susp. Logsource: windows / process_creation. Rule: title: Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location id: b2b048b0-7857-4380-b0fb-d3f0ab820b71 status: test description: 'Detects the use of iexpress.exe to create binaries via Self Extraction Directive (SED) files located in potentially suspicious locations. This behavior has been observed in-the-wild by different threat actors. ' references: - https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html - https://en.wikipedia.org/wiki/IExpress - https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/ - https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior author: Joseliyo Sanchez, @Joseliyo_Jstnk, Nasreddine Bencherchali (Nextron Systems) date: 2024-02-05 modified: 2024-06-04 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \iexpress.exe - OriginalFileName: IEXPRESS.exe selection_cli: CommandLine|contains|windash: ' /n ' selection_paths: CommandLine|contains: - :\ProgramData\ - :\Temp\ - :\Windows\System32\Tasks\ - :\Windows\Tasks\ - :\Windows\Temp\ - \AppData\Local\Temp\ condition: all of selection_* falsepositives: - Administrators building packages using iexpress.exe level: high
Near-miss passage: Sigma rule: List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe. Logsource: windows / process_creation. Rule: title: Windows Credential Manager Access via VaultCmd id: 58f50261-c53b-4c88-bd12-1d71f12eda4c status: test description: List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.004/T1555.004.md#atomic-test-1---access-saved-credentials-via-vaultcmd author: frack113 date: 2022-04-08 modified: 2022-05-13 tags: - attack.credential-access - attack.t1555.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \VaultCmd.exe - OriginalFileName: VAULTCMD.EXE selection_cli: CommandLine|contains: '/listcreds:' condition: all of selection* falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-6758
Matching passage: CVE-2015-6758. CWE: CWE-17. CVSS: 6.800000190734863. The CPDF_Document::GetPage function in fpdfapi/fpdf_parser/fpdf_parser_document.cpp in PDFium, as used in Google Chrome before 46.0.2490.71, does not properly perform a cast of a dictionary object, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.
Near-miss passage: CVE-2015-7045. CWE: CWE-17. CVSS: 5.0. Keychain Access in Apple OS X before 10.11.2 and tvOS before 9.1 improperly interacts with Keychain Agent, which allows attackers to spoof the Keychain Server via unspecified vectors.
Query: vulnerability: Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Mem
Matching passage: CVE-2015-0025. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0023.
Near-miss passage: CVE-2015-1083. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Query: patch priority for CVE-2015-4843
Matching passage: CVE-2015-4843. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
Near-miss passage: CVE-2015-7638. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.