alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.
Matching passage: Sigma rule: Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Firewall Rule Collection Modified or Deleted id: 025c9fe7-db72-49f9-af0d-31341dd7dd57 status: test description: Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-08-08 modified: 2022-08-23 tags: - attack.impact - attack.defense-impairment - attack.t1686.001 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.NETWORK/AZUREFIREWALLS/APPLICATIONRULECOLLECTIONS/WRITE - MICROSOFT.NETWORK/AZUREFIREWALLS/APPLICATIONRULECOLLECTIONS/DELETE - MICROSOFT.NETWORK/AZUREFIREWALLS/NATRULECOLLECTIONS/WRITE - MICROSOFT.NETWORK/AZUREFIREWALLS/NATRULECOLLECTIONS/DELETE - MICROSOFT.NETWORK/AZUREFIREWALLS/NETWORKRULECOLLECTIONS/WRITE - MICROSOFT.NETWORK/AZUREFIREWALLS/NETWORKRULECOLLECTIONS/DELETE condition: selection falsepositives: - Rule Collections (Application, NAT, and Network) being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Rule Collections (Application, NAT, and Network) modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects when the 'AllowMultipleTSSessions' value is enabled. Which allows for multiple Remote Desktop connection session. Logsource: windows / registry_set. Rule: title: Winlogon AllowMultipleTSSessions Enable id: f7997770-92c3-4ec9-b112-774c4ef96f96 status: test description: 'Detects when the ''AllowMultipleTSSessions'' value is enabled. Which allows for multiple Remote Desktop connection sessions to be opened at once. This is often used by attacker as a way to connect to an RDP session without disconnecting the other users ' references: - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-09 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions Details|endswith: DWORD (0x00000001) condition: selection falsepositives: - Legitimate use of the multi session functionality level: medium
Query: vulnerability: Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before
Matching passage: CVE-2015-3123. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3117, CVE-2015-3130, CVE-2015-3133, CVE-2015-3134, and CVE-2015-4431.
Near-miss passage: CVE-2015-3734. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Query: risk of Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, and 6.3.5 allows remo
Matching passage: CVE-2015-0422. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, and 6.3.5 allows remote authenticated users to affect confidentiality via unknown vectors related to UI Infrastructure.
Near-miss passage: CVE-2015-1172. CWE: UNKNOWN. CVSS: 7.5. Unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme (aka holding_pattern) 0.6 and earlier for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in an unspecified directory.
Query: exploit Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vecto
Matching passage: CVE-2015-7498. CWE: CWE-119. CVSS: 5.0. Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors related to extracting errors after an encoding conversion failure.
Near-miss passage: CVE-2015-6031. CWE: CWE-119. CVSS: 6.800000190734863. Buffer overflow in the IGDstartelt function in igd_desc_parse.c in the MiniUPnP client (aka MiniUPnPc) before 1.9.20150917 allows remote UPNP servers to cause a denial of service (application crash) and possibly execute arbitrary code via an "oversized" XML element name.
Query: Encoded PowerShell / command-line abuse matching Domain Account
Matching passage: T1136.002 Domain Account. Tactics: persistence. Description: Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the <code>net user /add /domain</code> command can be used to create a domain account.(Citation: Savill 1999) Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Near-miss passage: T1136.001 Local Account. Tactics: persistence. Description: Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. For example, with a sufficient level of access, the Windows <code>net user /add</code> command can be used to create a local account. In Linux, the `useradd` command can be used, while on macOS systems, the <code>dscl -create</code> command can be used. Local accounts may also be added to network devices, often via common [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as <code>username</code>, to ESXi servers via `esxcli system account add`, or to Kubernetes clusters using the `kubectl` utility.(Citation: cisco_username_cmd)(Citation: Kubernetes Service Accounts Security) Adversaries may also create new local accounts on network firewall management consoles – for example, by exploiting a vulnerable firewall management system, threat actors may be able to establish super-admin accounts that could be used to modify firewall rules and gain further access to the network.(Citation: Cyber Security News) Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Query: exploit The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop)
Matching passage: CVE-2015-8853. CWE: CWE-20. CVSS: 7.5. The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80."
Near-miss passage: CVE-2015-9048. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in the processing of lost RTP packets.
Query: describe CVE-2015-5906
Matching passage: CVE-2015-5906. CWE: CWE-200. CVSS: 5.0. The HTML form implementation in WebKit in Apple iOS before 9 does not prevent QuickType access to the final character of a password, which might make it easier for remote attackers to discover a password by leveraging a later prediction containing that character.
Near-miss passage: CVE-2015-0076. CWE: CWE-200. CVSS: 4.300000190734863. The photo-decoder implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly initialize memory for rendering of JXR images, which allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "JPEG XR Parser Information Disclosure Vulnerability."
Query: patch priority for CVE-2015-10067
Matching passage: CVE-2015-10067. CWE: CWE-366. CVSS: 8.100000381469727. A vulnerability was found in oznetmaster SSharpSmartThreadPool. It has been classified as problematic. This affects an unknown part of the file SSharpSmartThreadPool/SmartThreadPool.cs. The manipulation leads to race condition within a thread. The complexity of an attack is rather high. The exploitability is told to be difficult. The patch is named 0e58073c831093aad75e077962e9fb55cad0dc5f. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218463.
Near-miss passage: CVE-2015-6547. CWE: CWE-77. CVSS: 8.300000190734863. The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands at boot time via unspecified vectors.
Query: CVE similar to CVE-2015-0740
Matching passage: CVE-2015-0740. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco Unified Intelligence Center 10.6(1) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus28826.
Near-miss passage: CVE-2015-6655. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Pligg CMS 2.0.2 allows remote attackers to hijack the authentication of administrators for requests that add an administrator via a request to admin/admin_users.php.
Query: write Sigma for Detects potential LethalHTA technique where the "mshta.exe" is spawned by an "svchost.exe" process
Matching passage: Sigma rule: Detects potential LethalHTA technique where the "mshta.exe" is spawned by an "svchost.exe" process. Logsource: windows / process_creation. Rule: title: Potential LethalHTA Technique Execution id: ed5d72a6-f8f4-479d-ba79-02f6a80d7471 status: test description: Detects potential LethalHTA technique where the "mshta.exe" is spawned by an "svchost.exe" process references: - https://codewhitesec.blogspot.com/2018/07/lethalhta.html author: Markus Neis date: 2018-06-07 modified: 2023-02-07 tags: - attack.stealth - attack.t1218.005 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \svchost.exe Image|endswith: \mshta.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePo. Logsource: linux / process_creation. Rule: title: PUA - TruffleHog Execution - Linux id: d7a650c4-226c-451e-948f-cc490db506aa related: - id: 44030449-b0df-4c94-aae1-502359ab28ee type: similar status: experimental description: 'Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously. While it is a legitimate tool, intended for use in CI pipelines and security assessments, It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information. ' references: - https://github.com/trufflesecurity/trufflehog - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-09-24 tags: - attack.discovery - attack.credential-access - attack.t1083 - attack.t1552.001 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /trufflehog selection_cli_platform: CommandLine|contains: - ' docker --image ' - ' Git ' - ' GitHub ' - ' Jira ' - ' Slack ' - ' Confluence ' - ' SharePoint ' - ' s3 ' - ' gcs ' selection_cli_verified: CommandLine|contains: ' --results=verified' condition: selection_img or all of selection_cli_* falsepositives: - Legitimate use of TruffleHog by security teams or developers. level: medium
Query: incident response steps for Suspicious Serverless execution detected on endpoint
Matching passage: Playbook for T1583.007 Serverless. 1) Validate alert telemetry against T1583.007. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: resource development. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may purchase and configure serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them. Once acquired, the serverless runtime environment can be leveraged to eithe
Near-miss passage: Playbook for T1583.004 Server. Different response path focused on resource development.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump th. Logsource: windows / process_creation. Rule: title: Process Access via TrolleyExpress Exclusion id: 4c0aaedc-154c-4427-ada0-d80ef9c9deb6 status: test description: Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump the lsass process memory references: - https://twitter.com/_xpn_/status/1491557187168178176 - https://www.youtube.com/watch?v=Ie831jF0bb0 author: Florian Roth (Nextron Systems) date: 2022-02-10 modified: 2022-05-13 tags: - attack.stealth - attack.t1218.011 - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - \TrolleyExpress 7 - \TrolleyExpress 8 - \TrolleyExpress 9 - \TrolleyExpress.exe 7 - \TrolleyExpress.exe 8 - \TrolleyExpress.exe 9 - '\TrolleyExpress.exe -ma ' renamed: Image|endswith: \TrolleyExpress.exe filter_renamed: OriginalFileName|contains: CtxInstall filter_empty: OriginalFileName: null condition: selection or ( renamed and not 1 of filter* ) falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension. Logsource: windows / process_creation. Rule: title: Cscript/Wscript Uncommon Script Extension Execution id: 99b7460d-c9f1-40d7-a316-1f36f61d52ee status: test description: Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-15 modified: 2023-06-19 tags: - attack.execution - attack.t1059.005 - attack.t1059.007 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: - wscript.exe - cscript.exe - Image|endswith: - \wscript.exe - \cscript.exe selection_extension: CommandLine|contains: - .csv - .dat - .doc - .gif - .jpeg - .jpg - .png - .ppt - .txt - .xls - .xml condition: all of selection_* falsepositives: - Unknown level: high
Query: exploit The MSM camera driver in the Qualcomm components in Android before 2016-08-05 on Nexus 6 devices does not validate input parameters, which allows attackers to gain privileges via a
Matching passage: CVE-2015-8938. CWE: CWE-264. CVSS: 7.800000190734863. The MSM camera driver in the Qualcomm components in Android before 2016-08-05 on Nexus 6 devices does not validate input parameters, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28804030 and Qualcomm internal bug CR766022.
Near-miss passage: CVE-2015-3164. CWE: CWE-264. CVSS: 3.5999999046325684. The authentication setup in XWayland 1.16.x and 1.17.x before 1.17.2 starts the server in non-authenticating mode, which allows local users to read from or send information to arbitrary X11 clients via vectors involving a UNIX socket.
Query: CWE for URL Redirection to Untrusted Site ('Open Redirect')
Matching passage: CWE-601 URL Redirection to Untrusted Site ('Open Redirect'). The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Near-miss passage: CWE-210 Self-generated Error Message Containing Sensitive Information. The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.
Query: risk of Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted e-m
Matching passage: CVE-2015-7989. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted e-mail address, a different vulnerability than CVE-2015-5714.
Near-miss passage: CVE-2015-4292. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the management interface in Cisco Prime Central for Hosted Collaboration Solution (PC4HCS) 10.6(2) allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCuv45818.
Query: risk of OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Py
Matching passage: CVE-2015-5306. CWE: CWE-254. CVSS: 6.800000190734863. OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.
Near-miss passage: CVE-2015-7330. CWE: CWE-254. CVSS: 8.800000190734863. Puppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist protection mechanism by leveraging the Puppet communications protocol.
Query: common weakness: Missing Lock Check
Matching passage: CWE-414 Missing Lock Check. A product does not check to see if a lock is present before performing sensitive operations on a resource.
Near-miss passage: CWE-1257 Improper Access Control Applied to Mirrored or Aliased Memory Regions. Aliased or mirrored memory regions in hardware designs may have inconsistent read/write permissions enforced by the hardware. A possible result is that an untrusted agent is blocked from accessing a memory region but is not blocked from accessing the corresponding aliased memory region.
Query: vulnerability: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment
Matching passage: CVE-2015-2664. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.
Near-miss passage: CVE-2015-8640. CWE: UNKNOWN. CVSS: 8.800000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
Query: alert when Detects a commandline containing references to the Microsoft Teams database or cookies files from a process other than T
Matching passage: Sigma rule: Detects a commandline containing references to the Microsoft Teams database or cookies files from a process other than T. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Command Targeting Teams Sensitive Files id: d2eb17db-1d39-41dc-b57f-301f6512fa75 status: test description: 'Detects a commandline containing references to the Microsoft Teams database or cookies files from a process other than Teams. The database might contain authentication tokens and other sensitive information about the logged in accounts. ' references: - https://www.bleepingcomputer.com/news/security/microsoft-teams-stores-auth-tokens-as-cleartext-in-windows-linux-macs/ - https://www.vectra.ai/blogpost/undermining-microsoft-teams-security-by-mining-tokens author: '@SerkinValery' date: 2022-09-16 modified: 2023-12-18 tags: - attack.credential-access - attack.t1528 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - \Microsoft\Teams\Cookies - \Microsoft\Teams\Local Storage\leveldb filter_main_legit_locations: Image|endswith: \Microsoft\Teams\current\Teams.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process inj. Logsource: windows / process_creation. Rule: title: Uncommon Child Process Of Conhost.EXE id: 7dc2dedd-7603-461a-bc13-15803d132355 related: - id: dfa03a09-8b92-4d83-8e74-f72839b1c407 type: similar status: test description: Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process injection activity. references: - http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/ author: omkar72 date: 2020-10-25 modified: 2023-12-11 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \conhost.exe filter_main_conhost: Image|endswith: :\Windows\System32\conhost.exe filter_main_null: Image: null filter_main_empty: Image: '' filter_optional_provider: Provider_Name: SystemTraceProvider-Process condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium