alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actor in logs
Matching passage: Sigma rule: Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actor. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Logon Scripts - Registry id: 9ace0707-b560-49b8-b6ca-5148b42f39fb status: test description: Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actors references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1037.001/T1037.001.md author: Tom Ueltschi (@c_APT_ure) date: 2019-01-12 modified: 2025-10-26 tags: - attack.privilege-escalation - attack.t1037.001 - attack.persistence - attack.lateral-movement logsource: category: registry_set product: windows detection: selection: TargetObject|contains: UserInitMprLogonScript condition: selection falsepositives: - Investigate the contents of the "UserInitMprLogonScript" value to determine of the added script is legitimate level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_persistence_logon_scripts_userinitmprlogonscript/info.yml simulation: - type: atomic-red-team name: Logon Scripts technique: T1037.001 atomic_guid: d6042746-07d4-4c92-9ad8-e644c114a231
Near-miss passage: Sigma rule: Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.. Logsource: azure / riskdetection. Rule: title: Malicious IP Address Sign-In Suspicious id: 36440e1c-5c22-467a-889b-593e66498472 status: test description: Indicates sign-in from a malicious IP address known to be malicious at time of sign-in. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malicious-ip-address - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-07 tags: - attack.t1090 - attack.command-and-control logsource: product: azure service: riskdetection detection: selection: riskEventType: suspiciousIPAddress condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Query: exploit Cross-site scripting (XSS) vulnerability in the product deployment feature in the Java core web services in Intel McAfee ePolicy Orchestrator (ePO) before 5.1.2 allows remote attac
Matching passage: CVE-2015-4559. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the product deployment feature in the Java core web services in Intel McAfee ePolicy Orchestrator (ePO) before 5.1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-1966. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before FP17, 6.2.1 before FP9, and 6.2.2 before FP15, as used in Security Access Manager for Mobile and other products, allow remote attackers to inject arbitrary web script or HTML via a crafted URL, related to the (1) ERROR_DESCRIPTION and (2) TOKEN:RelayState macros.
Query: write Sigma for Detects execution of "curl.exe" with the "-c" flag in order to save cookie data.
Matching passage: Sigma rule: Detects execution of "curl.exe" with the "-c" flag in order to save cookie data.. Logsource: windows / process_creation. Rule: title: Potential Cookies Session Hijacking id: 5a6e1e16-07de-48d8-8aae-faa766c05e88 status: test description: Detects execution of "curl.exe" with the "-c" flag in order to save cookie data. references: - https://curl.se/docs/manpage.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-07-27 tags: - attack.execution logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \curl.exe - OriginalFileName: curl.exe selection_cli: - CommandLine|re: \s-c\s - CommandLine|contains: --cookie-jar condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_cookie_hijacking/info.yml
Near-miss passage: Sigma rule: Detects commands that temporarily turn off Volume Snapshots. Logsource: windows / process_creation. Rule: title: Disabled Volume Snapshots id: dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a status: test description: Detects commands that temporarily turn off Volume Snapshots references: - https://twitter.com/0gtweet/status/1354766164166115331 author: Florian Roth (Nextron Systems) date: 2021-01-28 modified: 2023-12-15 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - \Services\VSS\Diag - /d Disabled condition: selection falsepositives: - Legitimate administration level: high
Query: describe CVE-2015-3755
Matching passage: CVE-2015-3755. CWE: CWE-254. CVSS: 4.300000190734863. WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, allows remote attackers to spoof the user interface via a malformed URL.
Near-miss passage: CVE-2015-2114. CWE: CWE-254. CVSS: 6.800000190734863. HP Support Solution Framework before 11.51.0049 allows remote attackers to download an arbitrary program onto a client machine and execute this program via unspecified vectors.
Query: telemetry for T1548
Matching passage: T1548 Abuse Elevation Control Mechanism. Tactics: privilege escalation. Description: Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.(Citation: TechNet How UAC Works)(Citation: sudo man page 2018) An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.(Citation: OSX Keydnap malware)(Citation: Fortinet Fareit)
Near-miss passage: T1548.005 Temporary Elevated Cloud Access. Tactics: privilege escalation. Description: Adversaries may abuse permission configurations that allow them to gain temporarily elevated access to cloud resources. Many cloud environments allow administrators to grant user or service accounts permission to request just-in-time access to roles, impersonate other accounts, pass roles onto resources and services, or otherwise gain short-term access to a set of privileges that may be distinct from their own. Just-in-time access is a mechanism for granting additional roles to cloud accounts in a granular, temporary manner. This allows accounts to operate with only the permissions they need on a daily basis, and to request additional permissions as necessary. Sometimes just-in-time access requests are configured to require manual approval, while other times the desired permissions are automatically granted.(Citation: Azure Just in Time Access 2023) Account impersonation allows user or service accounts to temporarily act with the permissions of another account. For example, in GCP users with the `iam.serviceAccountTokenCreator` role can create temporary access tokens or sign arbitrary payloads with the permissions of a service account, while service accounts with domain-wide delegation permission are permitted to impersonate Google Workspace accounts.(Citation: Google Cloud Service Account Authentication Roles)(Citation: Hunters Domain Wide Delegation Google Workspace 2023)(Citation: Google Cloud Just in Time Access 2023)(Citation: Palo Alto Unit 42 Google Workspace Domain Wide Delegation 2023) In Exchange Online, the `ApplicationImpersonation` role allows a service account to use the permissions associated with specified user accounts.(Citation: Microsoft Impersonation and EWS in Exchange) Many cloud environments also include mechanisms for users to pass roles to resources that allow them to perform tasks and authenticate to other services. While the user that creates the resource does not directly assume the role they pass to it, they may still be able to take adv
Query: EDR alert: possible Modify or Spoof Tool UI (T1685.003)
Matching passage: T1685.003 Modify or Spoof Tool UI. Tactics: defense impairment. Description: Adversaries may spoof or manipulate security tool user interfaces (UIs) to falsely indicate tools are functioning normally and delay detection and response. Adversaries may present misleading or falsified security tool interfaces (UIs) that display normal or healthy status indicators, even when underlying security tools have been disabled, degraded, or otherwise tampered with. Security tools typically provide visibility into system health, alerting, and operational status; by misrepresenting this information, adversaries can undermine defender trust in these signals and obscure the true security posture of the system. This behavior is often used in conjunction with efforts to disable or modify tools, where adversaries first impair the functionality of defenses (e.g., EDR, logging agents) and then replace or mimic their interfaces to conceal the loss of visibility. By maintaining the appearance of normal operations, such as showing active protection, successful updates, or absence of threats, adversaries can delay investigation and response, enabling continued malicious activity. For example, adversaries may display a fake Windows Security interface or system tray icon indicating a “protected” or “healthy” state after disabling Windows Defender or related services.(Citation: BlackBasta)
Near-miss passage: T1685 Disable or Modify Tools. Tactics: defense impairment. Description: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.(Citation: SCADAfence_ransomware) In addition to directly targeting tools, adversaries may block or manipulate indicators and telemetry used for detection. This includes maliciously disabling or redirecting sensors such as Event Tracing for Windows (ETW), modifying event log configurations (e.g., redirecting Security logs), or interfering with logging pipelines and forwarding mechanisms (e.g., SIEM ingestion).(Citation: Microsoft Lamin Sept 2017)(Citation: ETW Palantir) More advanced techniques include leveraging legitimate drivers or debugging mechanisms to render tools non-functional, bypassing anti-tampering protections, and targeting specific defenses such as Sysmon or cloud monitoring agents. Adversaries may also disrupt broader defensive operations, including update mechanisms, logging infrastructure (e.g., syslog), or event aggregation, further degrading an organization’s ability to detect and respond to malicious activity.(Citation: Cocomazzi FIN7 Reboot)
Query: CVE similar to CVE-2015-7241
Matching passage: CVE-2015-7241. CWE: CWE-611. CVSS: 9.800000190734863. XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.
Near-miss passage: CVE-2015-0194. CWE: CWE-611. CVSS: 6.5. XML External Entity (XXE) vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and IBM Sterling File Gateway 2.1 and 2.2 allows remote attackers to read arbitrary files via a crafted XML data.
Query: vulnerability: The Field as Block module 7.x-1.x before 7.x-1.4 for Drupal might allow remote attackers to obtain sensitive field information by reading a cached block.
Matching passage: CVE-2015-8081. CWE: CWE-200. CVSS: 5.0. The Field as Block module 7.x-1.x before 7.x-1.4 for Drupal might allow remote attackers to obtain sensitive field information by reading a cached block.
Near-miss passage: CVE-2015-7437. CWE: CWE-200. CVSS: 5.5. Queue Watcher in IBM Sterling B2B Integrator 5.2 allows local users to obtain sensitive information via unspecified vectors.
Query: patch priority for CVE-2015-8431
Matching passage: CVE-2015-8431. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-6388. CWE: UNKNOWN. CVSS: 5.0. Cisco Unified Computing System (UCS) Central software 1.3(0.1) allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted request, aka Bug ID CSCux33575.
Query: describe CVE-2015-1000003
Matching passage: CVE-2015-1000003. CWE: CWE-89. CVSS: 9.800000190734863. Blind SQL Injection in filedownload v1.4 wordpress plugin
Near-miss passage: CVE-2015-4073. CWE: CWE-89. CVSS: 9.800000190734863. Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) ticket_code or (2) email parameter or (3) remote authenticated users to execute arbitrary SQL commands via the filter_order parameter.
Query: adversary uses Non-Standard Encoding
Matching passage: T1132.002 Non-Standard Encoding. Tactics: command and control. Description: Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a non-standard data encoding system that diverges from existing protocol specifications. Non-standard data encoding schemes may be based on or related to standard data encoding schemes, such as a modified Base64 encoding for the message body of an HTTP request.(Citation: Wikipedia Binary-to-text Encoding)(Citation: Wikipedia Character Encoding)
Near-miss passage: T1132 Data Encoding. Tactics: command and control. Description: Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.(Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.
Query: risk of SQL injection vulnerability in WordPress Community Events plugin before 1.4.
Matching passage: CVE-2015-3313. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in WordPress Community Events plugin before 1.4.
Near-miss passage: CVE-2015-1479. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to execute arbitrary SQL commands via the site parameter.
Query: alert when Detects the execution of rundll32 with a command line that doesn't contain a common extension
Matching passage: Sigma rule: Detects the execution of rundll32 with a command line that doesn't contain a common extension. Logsource: windows / process_creation. Rule: title: Rundll32 Execution With Uncommon DLL Extension id: c3a99af4-35a9-4668-879e-c09aeb4f2bdf status: test description: Detects the execution of rundll32 with a command line that doesn't contain a common extension references: - https://twitter.com/mrd0x/status/1481630810495139841?s=12 author: Tim Shelton, Florian Roth (Nextron Systems), Yassine Oukessou date: 2022-01-13 modified: 2024-04-04 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE filter_main_null: CommandLine: null filter_main_empty: CommandLine: '' filter_main_known_extension: - CommandLine|contains: - '.cpl ' - .cpl, - .cpl" - .cpl' - '.dll ' - .dll, - .dll" - .dll' - '.inf ' - .inf, - .inf" - .inf' - CommandLine|endswith: - .cpl - .dll - '.inf' filter_main_localserver: CommandLine|contains: ' -localserver ' filter_main_zzzzInvokeManagedCustomActionOutOfProc: ParentImage|endswith: \msiexec.exe CommandLine|contains|all: - :\Windows\Installer\ - .tmp - zzzzInvokeManagedCustomActionOutOfProc filter_optional_EdgeUpdate: ParentCommandLine|contains|all: - :\Users\ - \AppData\Local\Microsoft\EdgeUpdate\Install\{ - \EDGEMITMP_ - .tmp\setup.exe - --install-archive= - --previous-version= - --msedgewebview --verbose-logging --do-not-launch-msedge --user-level condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when highly privileged delegated permissions are granted on behalf of all users. Logsource: azure / auditlogs. Rule: title: Delegated Permissions Granted For All Users id: a6355fbe-f36f-45d8-8efc-ab42465cbc52 status: test description: Detects when highly privileged delegated permissions are granted on behalf of all users references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-granted-highly-privileged-permissions author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow' date: 2022-07-28 tags: - attack.credential-access - attack.t1528 logsource: product: azure service: auditlogs detection: selection: properties.message: Add delegated permission grant condition: selection falsepositives: - When the permission is legitimately needed for the app level: high
Query: what is T1602
Matching passage: T1602 Data from Configuration Repository. Tactics: collection. Description: Adversaries may collect data related to managed devices from configuration repositories. Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems. Configuration repositories may also facilitate remote access and administration of devices. Adversaries may target these repositories in order to collect large quantities of sensitive system administration data. Data from configuration repositories may be exposed by various protocols and software and can store a wide variety of data, much of which may align with adversary Discovery objectives.(Citation: US-CERT-TA18-106A)(Citation: US-CERT TA17-156A SNMP Abuse 2017)
Near-miss passage: T1602.001 SNMP (MIB Dump). Tactics: collection. Description: Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP). The MIB is a configuration repository that stores variable information accessible via SNMP in the form of object identifiers (OID). Each OID identifies a variable that can be read or set and permits active management tasks, such as configuration changes, through remote modification of these variables. SNMP can give administrators great insight in their systems, such as, system information, description of hardware, physical location, and software packages(Citation: SANS Information Security Reading Room Securing SNMP Securing SNMP). The MIB may also contain device operational information, including running configuration, routing table, and interface details. Adversaries may use SNMP queries to collect MIB content directly from SNMP-managed devices in order to collect network information that allows the adversary to build network maps and facilitate future targeted exploitation.(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks)
Query: CVE similar to CVE-2015-6155
Matching passage: CVE-2015-6155. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-3791. CWE: CWE-119. CVSS: 6.800000190734863. QuickTime 7 in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-3765, CVE-2015-3779, CVE-2015-3788, CVE-2015-3789, CVE-2015-3790, CVE-2015-3792, CVE-2015-5751, CVE-2015-5753, and CVE-2015-5779.
Query: patch priority for CVE-2015-8393
Matching passage: CVE-2015-8393. CWE: CWE-200. CVSS: 7.5. pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file, as demonstrated by a CGI script that sends stdout data to a client.
Near-miss passage: CVE-2015-5276. CWE: CWE-200. CVSS: 5.0. The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors.