alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects disabling security tools
Matching passage: Sigma rule: Detects disabling security tools. Logsource: linux / syslog. Rule: title: Disabling Security Tools - Builtin id: 49f5dfc1-f92e-4d34-96fa-feba3f6acf36 related: - id: e3a8a052-111f-4606-9aee-f28ebeb76776 type: derived status: test description: Detects disabling security tools references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md author: Ömer Günal, Alejandro Ortuno, oscd.community date: 2020-06-17 modified: 2022-11-26 tags: - attack.defense-impairment - attack.t1686 logsource: product: linux service: syslog detection: keywords: - stopping iptables - stopping ip6tables - stopping firewalld - stopping cbdaemon - stopping falcon-sensor condition: keywords falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This. Logsource: windows / process_creation. Rule: title: ManageEngine Endpoint Central Dctask64.EXE Potential Abuse id: 6345b048-8441-43a7-9bed-541133633d7a status: test description: 'Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution. ' references: - https://twitter.com/gN3mes1s/status/1222088214581825540 - https://twitter.com/gN3mes1s/status/1222095963789111296 - https://twitter.com/gN3mes1s/status/1222095371175911424 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2020-01-28 modified: 2025-01-22 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \dctask64.exe - Hashes|contains: - IMPHASH=6834B1B94E49701D77CCB3C0895E1AFD - IMPHASH=1BB6F93B129F398C7C4A76BB97450BBA - IMPHASH=FAA2AC19875FADE461C8D89DCF2710A3 - IMPHASH=F1039CED4B91572AB7847D26032E6BBF selection_cli: CommandLine|contains: - ' executecmd64 ' - ' invokeexe ' - ' injectDll ' condition: all of selection_* falsepositives: - Unknown level: high
Query: weakness Improper Handling of Single Event Upsets
Matching passage: CWE-1261 Improper Handling of Single Event Upsets. The hardware logic does not effectively handle when single-event upsets (SEUs) occur.
Near-miss passage: CWE-104 Struts: Form Bean Does Not Extend Validation Class. If a form bean does not extend an ActionForm subclass of the Validator framework, it can expose the application to other weaknesses related to insufficient input validation.
Query: risk of The HTMLSourceElement::BindToTree function in Mozilla Firefox before 37.0 does not properly constrain a data type after omitting namespace validation during certain tree-binding op
Matching passage: CVE-2015-0804. CWE: CWE-264. CVSS: 7.5. The HTMLSourceElement::BindToTree function in Mozilla Firefox before 37.0 does not properly constrain a data type after omitting namespace validation during certain tree-binding operations, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document containing a SOURCE element.
Near-miss passage: CVE-2015-3844. CWE: CWE-264. CVSS: 6.800000190734863. The getProcessRecordLocked method in services/core/java/com/android/server/am/ActivityManagerService.java in ActivityManager in Android before 5.1.1 LMY48I allows attackers to trigger incorrect process loading via a crafted application, as demonstrated by interfering with use of the Settings application, aka internal bug 21669445.
Query: patch priority for CVE-2015-3091
Matching passage: CVE-2015-3091. CWE: CWE-200. CVSS: 5.0. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2015-3092.
Near-miss passage: CVE-2015-3412. CWE: CWE-200. CVSS: 5.300000190734863. PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the stream_resolve_include_path function in ext/standard/streamsfuncs.c, as demonstrated by a filename\0.extension attack that bypasses an intended configuration in which client users may read files with only one specific extension.
Query: how to detect Search Threat Vendor Data
Matching passage: T1681 Search Threat Vendor Data. Tactics: reconnaissance. Description: Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations. Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week.(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023) Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation.(Citation: Sentinel One Contagious Interview ClickFix September 2025) This technique is distinct from [Threat Intel Vendors](https://attack.mitre.org/techniques/T1597/001) in that it describes threat actors performing reconnaissance on their own activity, not in search of victim information.
Near-miss passage: T1595.003 Wordlist Scanning. Tactics: reconnaissance. Description: Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques. While this technique employs similar methods to [Brute Force](https://attack.mitre.org/techniques/T1110), its goal is the identification of content and infrastructure rather than the discovery of valid credentials. Wordlists used in these scans may contain generic, commonly used names and file extensions or terms specific to a particular software. Adversaries may also create custom, target-specific wordlists using data gathered from other Reconnaissance techniques (ex: [Gather Victim Org Information](https://attack.mitre.org/techniques/T1591), or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)). For example, adversaries may use web content discovery tools such as Dirb, DirBuster, and GoBuster and generic or custom wordlists to enumerate a website’s pages and directories.(Citation: ClearSky Lebanese Cedar Jan 2021) This can help them to discover old, vulnerable pages or hidden administrative portals that could become the target of further operations (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [Brute Force](https://attack.mitre.org/techniques/T1110)). As cloud storage solutions typically use globally unique names, adversaries may also use target-specific wordlists and tools such as s3recon and GCPBucketBrute to enumerate public and private buckets on cloud infrastructure.(Citation: S3Recon GitHub)(Citation: GCPBucketBrute) Once storage objects are discovered, adversaries may leverage [Data from Cloud Storage](https://attack.mitre.org/techniques/T1530) to access valuable information that can be exfiltrated or used to escalate privileges and move laterally.
Query: CVE similar to CVE-2015-6658
Matching passage: CVE-2015-6658. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files.
Near-miss passage: CVE-2015-5481. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter in the gdbbpress_attachments page to wp-admin/edit.php.
Query: exploit Juniper Junos 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D15, and 12.3X48 before 12.3X48-D10 on SRX series devices does not properly enforce the
Matching passage: CVE-2015-3002. CWE: CWE-17. CVSS: 6.900000095367432. Juniper Junos 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D15, and 12.3X48 before 12.3X48-D10 on SRX series devices does not properly enforce the log-out-on-disconnect feature when configured in the [system port console] stanza, which allows physically proximate attackers to reconnect to the console port and gain administrative access by leveraging access to the device.
Near-miss passage: CVE-2015-4700. CWE: CWE-17. CVSS: 4.900000095367432. The bpf_int_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 4.0.6 allows local users to cause a denial of service (system crash) by creating a packet filter and then loading crafted BPF instructions that trigger late convergence by the JIT compiler.
Query: exploit The puppet manifests in the Red Hat openstack-puppet-modules package before 2014.2.13-2 uses a default password of CHANGEME for the pcsd daemon, which allows remote attackers to ex
Matching passage: CVE-2015-1842. CWE: CWE-255. CVSS: 10.0. The puppet manifests in the Red Hat openstack-puppet-modules package before 2014.2.13-2 uses a default password of CHANGEME for the pcsd daemon, which allows remote attackers to execute arbitrary shell commands via unspecified vectors.
Near-miss passage: CVE-2015-1320. CWE: CWE-255. CVSS: 9.800000190734863. The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects Ubuntu MAAS versions prior to 1.9.2.
Query: patch priority for CVE-2015-3114
Matching passage: CVE-2015-3114. CWE: CWE-284. CVSS: 5.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-1937. CWE: CWE-284. CVSS: 7.5. IBM PowerVC 1.2.0.x through 1.2.0.4, 1.2.1.x through 1.2.1.2, and 1.2.2.x through 1.2.2.2 does not require authentication for the ceilometer NoSQL database, which allows remote attackers to read or write to arbitrary database records, and consequently obtain administrator privileges, via a session on port 27017.
Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.. Logsource: windows / registry_set. Rule: title: Potential SentinelOne Shell Context Menu Scan Command Tampering id: 6c304b02-06e6-402d-8be4-d5833cdf8198 status: test description: Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne. references: - https://mrd0x.com/sentinelone-persistence-via-menu-context/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-03-06 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \shell\SentinelOneScan\command\ filter_main_sentinelone_default_scan_binary: Details|startswith: - C:\Program Files\SentinelOne\Sentinel Agent - C:\Program Files (x86)\SentinelOne\Sentinel Agent Details|contains: \SentinelScanFromContextMenu.exe filter_main_sentinelone_binary: Image|endswith: - C:\Program Files\SentinelOne\ - C:\Program Files (x86)\SentinelOne\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate. Logsource: windows / pipe_created. Rule: title: PsExec Tool Execution From Suspicious Locations - PipeName id: 41504465-5e3a-4a5b-a5b4-2a0baadd4463 related: - id: f3f3a972-f982-40ad-b63c-bca6afdfad7c type: derived status: test description: Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate that the tool is being used in an attack references: - https://www.jpcert.or.jp/english/pub/sr/ir_research.html - https://jpcertcc.github.io/ToolAnalysisResultSheet author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-04 modified: 2023-09-20 tags: - attack.execution - attack.t1569.002 - attack.s0029 logsource: category: pipe_created product: windows definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName: \PSEXESVC Image|contains: - :\Users\Public\ - :\Windows\Temp\ - \AppData\Local\Temp\ - \Desktop\ - \Downloads\ condition: selection falsepositives: - Rare legitimate use of psexec from the locations mentioned above. This will require initial tuning based on your environment. level: medium
Query: vulnerability: Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to rmformat.
Matching passage: CVE-2015-2631. CWE: UNKNOWN. CVSS: 7.199999809265137. Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to rmformat.
Near-miss passage: CVE-2015-0884. CWE: UNKNOWN. CVSS: 6.900000095367432. Unquoted Windows search path vulnerability in Toshiba Bluetooth Stack for Windows before 9.10.32(T) and Service Station before 2.2.14 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character.
Query: hunt for Electron Applications activity
Matching passage: T1218.015 Electron Applications. Tactics: stealth. Description: Adversaries may abuse components of the Electron framework to execute malicious code. The Electron framework hosts many common applications such as Signal, Slack, and Microsoft Teams.(Citation: Electron 2) Originally developed by GitHub, Electron is a cross-platform desktop application development framework that employs web technologies like JavaScript, HTML, and CSS.(Citation: Electron 3) The Chromium engine is used to display web content and Node.js runs the backend code.(Citation: Electron 1) Due to the functional mechanics of Electron (such as allowing apps to run arbitrary commands), adversaries may also be able to perform malicious functions in the background potentially disguised as legitimate tools within the framework.(Citation: Electron 1) For example, the abuse of `teams.exe` and `chrome.exe` may allow adversaries to execute malicious commands as child processes of the legitimate application (e.g., `chrome.exe --disable-gpu-sandbox --gpu-launcher="C:\Windows\system32\cmd.exe /c calc.exe`).(Citation: Electron 6-8) Adversaries may also execute malicious content by planting malicious [JavaScript](https://attack.mitre.org/techniques/T1059/007) within Electron applications.(Citation: Electron Security)
Near-miss passage: T1218.007 Msiexec. Tactics: stealth. Description: Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).(Citation: Microsoft msiexec) The Msiexec.exe binary may also be digitally signed by Microsoft. Adversaries may abuse msiexec.exe to launch local or network accessible MSI files. Msiexec.exe can also execute DLLs.(Citation: LOLBAS Msiexec)(Citation: TrendMicro Msiexec Feb 2018) Since it may be signed and native on Windows systems, msiexec.exe can be used to bypass application control solutions that do not account for its potential abuse. Msiexec.exe execution may also be elevated to SYSTEM privileges if the <code>AlwaysInstallElevated</code> policy is enabled.(Citation: Microsoft AlwaysInstallElevated 2018)
Query: vulnerability: McPvDrv.sys 4.6.111.0 in McAfee File Lock 5.x in McAfee Total Protection allows local users to obtain sensitive information from kernel memory or cause a denial of service (system 
Matching passage: CVE-2015-8772. CWE: CWE-19. CVSS: 9.100000381469727. McPvDrv.sys 4.6.111.0 in McAfee File Lock 5.x in McAfee Total Protection allows local users to obtain sensitive information from kernel memory or cause a denial of service (system crash) via a large VERIFY_INFORMATION.Length value in an IOCTL_DISK_VERIFY ioctl call.
Near-miss passage: CVE-2015-5348. CWE: CWE-19. CVSS: 8.100000381469727. Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
Query: describe CVE-2015-1688
Matching passage: CVE-2015-1688. CWE: CWE-264. CVSS: 6.800000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-7489. CWE: CWE-264. CVSS: 7.800000190734863. IBM SPSS Statistics 22.0.0.2 before IF10 and 23.0.0.2 before IF7 uses weak permissions (Everyone: Write) for Python scripts, which allows local users to gain privileges by modifying a script.
Query: describe CVE-2015-3351
Matching passage: CVE-2015-3351. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Log Watcher module before 6.x-1.2 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) enable, (2) disable, or (3) delete a report via unspecified vectors.
Near-miss passage: CVE-2015-6541. CWE: CWE-352. CVSS: 8.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Mail interface in Zimbra Collaboration Server (ZCS) before 8.5 allow remote attackers to hijack the authentication of arbitrary users for requests that change account preferences via a SOAP request to service/soap/BatchRequest.
Query: alert when Detects requests to exclude files, folders or processes from Antivirus scanning using PowerShell cmdlets
Matching passage: Sigma rule: Detects requests to exclude files, folders or processes from Antivirus scanning using PowerShell cmdlets. Logsource: windows / process_creation. Rule: title: Powershell Defender Exclusion id: 17769c90-230e-488b-a463-e05c08e9d48f related: - id: c1344fa2-323b-4d2e-9176-84b4d4821c88 type: similar status: test description: Detects requests to exclude files, folders or processes from Antivirus scanning using PowerShell cmdlets references: - https://learn.microsoft.com/en-us/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://twitter.com/AdamTheAnalyst/status/1483497517119590403 author: Florian Roth (Nextron Systems) date: 2021-04-29 modified: 2022-05-12 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection1: CommandLine|contains: - 'Add-MpPreference ' - 'Set-MpPreference ' selection2: CommandLine|contains: - ' -ExclusionPath ' - ' -ExclusionExtension ' - ' -ExclusionProcess ' - ' -ExclusionIpAddress ' condition: all of selection* falsepositives: - Possible Admin Activity - Other Cmdlets that may use the same parameters level: medium
Near-miss passage: Sigma rule: Detects remote RPC calls to create or execute a scheduled task via SASec. Logsource: rpc_firewall / application. Rule: title: Remote Schedule Task Lateral Movement via SASec id: aff229ab-f8cd-447b-b215-084d11e79eb0 status: test description: Detects remote RPC calls to create or execute a scheduled task via SASec references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.privilege-escalation - attack.lateral-movement - attack.execution - attack.persistence - attack.t1053 - attack.t1053.002 logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:378e52b0-c0a9-11cf-822d-00aa0051e40f"' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 378e52b0-c0a9-11cf-822d-00aa0051e40f OpNum: - 0 - 1 condition: selection falsepositives: - Unknown level: high
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to inject
Matching passage: CVE-2015-8755. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to inject arbitrary web script or HTML via unknown vectors.
Near-miss passage: CVE-2015-2241. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.
Query: patch priority for CVE-2015-7492
Matching passage: CVE-2015-7492. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Reference Data Management (RDM) in IBM InfoSphere Master Data Management 10.1, 11.0 before FP5, 11.3, 11.4, and 11.5 before FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-9407. CWE: CWE-79. CVSS: 6.099999904632568. The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS.