alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-6321
Matching passage: CVE-2015-6321. CWE: CWE-399. CVSS: 7.800000190734863. Cisco AsyncOS before 8.5.7-042, 9.x before 9.1.0-032, 9.1.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-042 on Email Security Appliance (ESA) devices; before 9.1.0-032, 9.1.1 before 9.1.1-005, and 9.5.x before 9.5.0-025 on Content Security Management Appliance (SMA) devices; and before 7.7.0-725 and 8.x before 8.0.8-113 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via a flood of TCP packets, aka Bug IDs CSCus79774, CSCus79777, and CSCzv95795.
Near-miss passage: CVE-2015-0772. CWE: CWE-399. CVSS: 7.099999904632568. Cisco TelePresence Video Communication Server (VCS) X8.5RC4 allows remote attackers to cause a denial of service (CPU consumption or device outage) via a crafted SDP parameter-negotiation request in an SDP session during a SIP connection, aka Bug ID CSCut42422.
Query: detect Detects suspicious usage of the cmd.exe 'for /f' loop combined with the 'tokens=' parameter and a recursive directory li in logs
Matching passage: Sigma rule: Detects suspicious usage of the cmd.exe 'for /f' loop combined with the 'tokens=' parameter and a recursive directory li. Logsource: windows / process_creation. Rule: title: Suspicious Usage of For Loop with Recursive Directory Search in CMD id: 2782fbd8-b662-4eb5-9962-5bfbfb671e7b status: experimental description: 'Detects suspicious usage of the cmd.exe ''for /f'' loop combined with the ''tokens='' parameter and a recursive directory listing. This pattern may indicate an attempt to discover and execute system binaries dynamically, for example powershell, a technique sometimes used by attackers to evade detection. This behavior has been observed in various malicious lnk files. ' references: - https://www.virustotal.com/gui/file/29837d0d3202758063185828c8f8d9e0b7b42b365c8941cc926d2d7c7bae2fb3 author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2025-11-12 tags: - attack.execution - attack.stealth - attack.t1059.003 - attack.t1027.010 logsource: category: process_creation product: windows detection: selection_tokens: CommandLine|contains|all: - for /f - tokens= - in ( - dir selection_tokens_parent: ParentCommandLine|contains|all: - for /f - tokens= - in ( - dir condition: 1 of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over. Logsource: windows / security. Rule: title: DCOM InternetExplorer.Application Iertutil DLL Hijack - Security id: c39f0c81-7348-4965-ab27-2fde35a1b641 status: test description: Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario. references: - https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR) date: 2020-10-12 modified: 2022-11-26 tags: - attack.lateral-movement - attack.t1021.002 - attack.t1021.003 logsource: product: windows service: security detection: selection: EventID: 5145 RelativeTargetName|endswith: \Internet Explorer\iertutil.dll filter: SubjectUserName|endswith: $ condition: selection and not filter falsepositives: - Unknown level: high
Query: Multiple failed authentications followed by Social Media
Matching passage: T1593.001 Social Media. Tactics: reconnaissance. Description: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. [Spearphishing Service](https://attack.mitre.org/techniques/T1598/001)).(Citation: Cyware Social Media) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).
Near-miss passage: T1593.003 Code Repositories. Tactics: reconnaissance. Description: Adversaries may search public code repositories for information about victims that can be used during targeting. Victims may store code in repositories on various third-party websites such as GitHub, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git. Adversaries may search various public code repositories for various information about a victim. Public code repositories can often be a source of various general information about victims, such as commonly used programming languages and libraries as well as the names of employees. Adversaries may also identify more sensitive data, including accidentally leaked credentials or API keys.(Citation: GitHub Cloud Service Credentials) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Valid Accounts](https://attack.mitre.org/techniques/T1078) or [Phishing](https://attack.mitre.org/techniques/T1566)). **Note:** This is distinct from [Code Repositories](https://attack.mitre.org/techniques/T1213/003), which focuses on [Collection](https://attack.mitre.org/tactics/TA0009) from private and internally hosted code repositories.
Query: playbook for alert: Outbound C2 pattern associated with Mail Protocols
Matching passage: Playbook for T1071.003 Mail Protocols. 1) Validate alert telemetry against T1071.003. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: command and control. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as SMTP/S, POP3/S, and IMAP that carry electronic mail may
Near-miss passage: Playbook for T1071.002 File Transfer Protocols. Different response path focused on command and control.
Query: risk of ACEmanager in Sierra Wireless ALEOS 4.4.2 and earlier on ES440, ES450, GX400, GX440, GX450, and LS300 devices allows remote attackers to read the filteredlogs.txt file, and consequ
Matching passage: CVE-2015-6479. CWE: UNKNOWN. CVSS: 4.300000190734863. ACEmanager in Sierra Wireless ALEOS 4.4.2 and earlier on ES440, ES450, GX400, GX440, GX450, and LS300 devices allows remote attackers to read the filteredlogs.txt file, and consequently discover potentially sensitive boot-sequence information, via unspecified vectors.
Near-miss passage: CVE-2015-0459. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JavaFX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2015-0491.
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36). Logsource: windows / file_event. Rule: title: UAC Bypass Using NTFS Reparse Point - File id: 7fff6773-2baa-46de-a24a-b6eec1aba2d1 status: test description: Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: C:\Users\ TargetFilename|endswith: \AppData\Local\Temp\api-ms-win-core-kernel32-legacy-l1.DLL condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when an access policy that is applied to a GCP cloud resource is deleted. An adversary would be able to remove a. Logsource: gcp / gcp.audit. Rule: title: GCP Access Policy Deleted id: 32438676-1dba-4ac7-bf69-b86cba995e05 status: test description: 'Detects when an access policy that is applied to a GCP cloud resource is deleted. An adversary would be able to remove access policies to gain access to a GCP cloud resource. ' references: - https://cloud.google.com/access-context-manager/docs/audit-logging - https://cloud.google.com/logging/docs/audit/understanding-audit-logs - https://cloud.google.com/logging/docs/reference/audit/auditlog/rest/Shared.Types/AuditLog author: Bryan Lim date: 2024-01-12 tags: - attack.persistence - attack.privilege-escalation - attack.t1098 logsource: product: gcp service: gcp.audit detection: selection: data.protoPayload.authorizationInfo.permission: - accesscontextmanager.accessPolicies.delete - accesscontextmanager.accessPolicies.accessLevels.delete - accesscontextmanager.accessPolicies.accessZones.delete - accesscontextmanager.accessPolicies.authorizedOrgsDescs.delete data.protoPayload.authorizationInfo.granted: 'true' data.protoPayload.serviceName: accesscontextmanager.googleapis.com condition: selection falsepositives: - Legitimate administrative activities level: medium
Query: alert when Detects incoming connections to AnyDesk. This could indicate a potential remote attacker trying to connect to a listenin
Matching passage: Sigma rule: Detects incoming connections to AnyDesk. This could indicate a potential remote attacker trying to connect to a listenin. Logsource: windows / network_connection. Rule: title: Remote Access Tool - AnyDesk Incoming Connection id: d58ba5c6-0ed7-4b9d-a433-6878379efda9 status: experimental description: 'Detects incoming connections to AnyDesk. This could indicate a potential remote attacker trying to connect to a listening instance of AnyDesk and use it as potential command and control channel. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows - https://asec.ahnlab.com/en/40263/ author: '@d4ns4n_ (Wuerth-Phoenix)' date: 2024-09-02 modified: 2025-02-24 tags: - attack.persistence - attack.command-and-control - attack.t1219.002 logsource: category: network_connection product: windows detection: selection: Image|endswith: - \AnyDesk.exe - \AnyDeskMSI.exe Initiated: 'false' condition: selection falsepositives: - Legitimate incoming connections (e.g. sysadmin activity). Most of the time I would expect outgoing connections (initiated locally). level: medium
Near-miss passage: Sigma rule: Detects usage of SoftPerfect's "netscan.exe". An application for scanning networks. It is actively used in-the-wild by t. Logsource: windows / process_creation. Rule: title: PUA - SoftPerfect Netscan Execution id: ca387a8e-1c84-4da3-9993-028b45342d30 status: test description: 'Detects usage of SoftPerfect''s "netscan.exe". An application for scanning networks. It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim. ' references: - https://www.protect.airbus.com/blog/uncovering-cyber-intruders-netscan/ - https://secjoes-reports.s3.eu-central-1.amazonaws.com/Sockbot%2Bin%2BGoLand.pdf - https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/yanluowang-ransomware-attacks-continue - https://research.nccgroup.com/2022/07/13/climbing-mount-everest-black-byte-bytes-back/ - https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-hive-ransomware/ - https://www.softperfect.com/products/networkscanner/ author: '@d4ns4n_ (Wuerth-Phoenix)' date: 2024-04-25 tags: - attack.discovery - attack.t1046 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \netscan.exe - Product: Network Scanner - Description: Application for scanning networks condition: selection falsepositives: - Legitimate administrator activity level: medium
Query: write Sigma for Detects installation of suspicious packages using system installation utilities
Matching passage: Sigma rule: Detects installation of suspicious packages using system installation utilities. Logsource: linux / process_creation. Rule: title: Suspicious Package Installed - Linux id: 700fb7e8-2981-401c-8430-be58e189e741 status: test description: Detects installation of suspicious packages using system installation utilities references: - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-03 modified: 2026-01-01 tags: - attack.defense-impairment - attack.t1553.004 logsource: product: linux category: process_creation detection: selection_tool_apt: Image|endswith: - /apt - /apt-get CommandLine|contains: install selection_tool_yum: Image|endswith: /yum CommandLine|contains: - localinstall - install selection_tool_rpm: Image|endswith: /rpm CommandLine|contains: -i selection_tool_dpkg: Image|endswith: /dpkg CommandLine|contains: - --install - -i selection_keyword: CommandLine|contains: - nmap - ' nc' - netcat - wireshark - tshark - openconnect - proxychains - socat condition: 1 of selection_tool_* and selection_keyword falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Erro. Logsource: windows / process_creation. Rule: title: Potential Credential Dumping Via WER id: 9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3 status: test description: Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Error Reporting to dump lsass references: - https://github.com/deepinstinct/Lsass-Shtinkering - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf author: '@pbssubhash , Nasreddine Bencherchali' date: 2022-12-08 modified: 2022-12-09 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \Werfault.exe - OriginalFileName: WerFault.exe selection_cli: ParentUser|contains: - AUTHORI - AUTORI User|contains: - AUTHORI - AUTORI CommandLine|contains|all: - ' -u -p ' - ' -ip ' - ' -s ' filter_lsass: ParentImage: C:\Windows\System32\lsass.exe condition: all of selection_* and not 1 of filter_* falsepositives: - Windows Error Reporting might produce similar behavior. In that case, check the PID associated with the "-p" parameter in the CommandLine. level: high
Query: alert when Detects remote RPC calls to create or execute a scheduled task via ATSvc
Matching passage: Sigma rule: Detects remote RPC calls to create or execute a scheduled task via ATSvc. Logsource: rpc_firewall / application. Rule: title: Remote Schedule Task Lateral Movement via ATSvc id: 0fcd1c79-4eeb-4746-aba9-1b458f7a79cb status: test description: Detects remote RPC calls to create or execute a scheduled task via ATSvc references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.privilege-escalation - attack.lateral-movement - attack.execution - attack.persistence - attack.t1053 - attack.t1053.002 logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:1ff70682-0a51-30e8-076d-740be8cee98b"' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 1ff70682-0a51-30e8-076d-740be8cee98b OpNum: - 0 - 1 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Indicates access attempt to the PRT resource which can be used to move laterally into an organization or perform credent. Logsource: azure / riskdetection. Rule: title: Primary Refresh Token Access Attempt id: a84fc3b1-c9ce-4125-8e74-bdcdb24021f1 status: test description: Indicates access attempt to the PRT resource which can be used to move laterally into an organization or perform credential theft references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#possible-attempt-to-access-primary-refresh-token-prt - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-07 tags: - attack.t1528 - attack.credential-access logsource: product: azure service: riskdetection detection: selection: riskEventType: attemptedPrtAccess condition: selection falsepositives: - This detection is low-volume and is seen infrequently in most organizations. When this detection appears it's high risk, and users should be remediated. level: high
Query: secure coding against Unexpected Sign Extension
Matching passage: CWE-194 Unexpected Sign Extension. The product performs an operation on a number that causes it to be sign extended when it is transformed into a larger data type. When the original number is negative, this can produce unexpected values that lead to resultant weaknesses.
Near-miss passage: CWE-755 Improper Handling of Exceptional Conditions. The product does not handle or incorrectly handles an exceptional condition.
Query: CVE similar to CVE-2015-1133
Matching passage: CVE-2015-1133. CWE: CWE-20. CVSS: 7.199999809265137. fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1131, CVE-2015-1132, CVE-2015-1134, and CVE-2015-1135.
Near-miss passage: CVE-2015-5883. CWE: CWE-20. CVSS: 5.0. The bidirectional text-display and text-selection implementations in Terminal in Apple OS X before 10.11 interpret directional override formatting characters differently, which allows remote attackers to spoof the content of a text document via a crafted character sequence.
Query: rule covering Detects service installation with suspicious folder patterns
Matching passage: Sigma rule: Detects service installation with suspicious folder patterns. Logsource: windows / system. Rule: title: Service Installation with Suspicious Folder Pattern id: 1b2ae822-6fe1-43ba-aa7c-d1a3b3d1d5f2 status: test description: Detects service installation with suspicious folder patterns references: - Internal Research author: pH-T (Nextron Systems) date: 2022-03-18 modified: 2022-03-24 tags: - attack.persistence - attack.privilege-escalation - car.2013-09-005 - attack.t1543.003 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7045 selection_img_paths: - ImagePath|re: ^[Cc]:\\[Pp]rogram[Dd]ata\\.{1,9}\.exe - ImagePath|re: ^[Cc]:\\.{1,9}\.exe condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of the lesser known remote execution tool named CsExec a PsExec alternative. Logsource: windows / process_creation. Rule: title: PUA - CsExec Execution id: d08a2711-ee8b-4323-bdec-b7d85e892b31 status: test description: Detects the use of the lesser known remote execution tool named CsExec a PsExec alternative references: - https://github.com/malcomvetter/CSExec - https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/ author: Florian Roth (Nextron Systems) date: 2022-08-22 modified: 2023-02-21 tags: - attack.resource-development - attack.t1587.001 - attack.execution - attack.t1569.002 logsource: category: process_creation product: windows detection: selection: Image|endswith: \csexec.exe selection_pe: Description: csexec condition: 1 of selection* falsepositives: - Unknown level: high
Query: exploit The kamailio build in kamailio before 4.2.0-2 process allows local users to gain privileges.
Matching passage: CVE-2015-1591. CWE: CWE-264. CVSS: 7.800000190734863. The kamailio build in kamailio before 4.2.0-2 process allows local users to gain privileges.
Near-miss passage: CVE-2015-5888. CWE: CWE-264. CVSS: 7.199999809265137. The Install Framework Legacy component in Apple OS X before 10.11 allows local users to obtain root privileges via vectors involving a privileged executable file.
Query: risk of EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3 and RSA BSAFE SSL-C 2.8.9 and earlier, when client authentication and an ephemeral Diffie-Hellman 
Matching passage: CVE-2015-0536. CWE: UNKNOWN. CVSS: 7.5. EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3 and RSA BSAFE SSL-C 2.8.9 and earlier, when client authentication and an ephemeral Diffie-Hellman ciphersuite are enabled, allow remote attackers to cause a denial of service (daemon crash) via a ClientKeyExchange message with a length of zero, a similar issue to CVE-2015-1787.
Near-miss passage: CVE-2015-0356. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion."