alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Masquerading
Matching passage: T1036 Masquerading. Tactics: stealth. Description: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site)
Near-miss passage: T1036.003 Rename Legitimate Utilities. Tactics: stealth. Description: Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython.(Citation: LOLBAS Main Site)(Citation: Huntress Python Malware 2025)(Citation: The DFIR Report AutoHotKey 2023)(Citation: Splunk Detect Renamed PSExec) It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename <code>rundll32.exe</code>).(Citation: Elastic Masquerade Ball) An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.(Citation: F-Secure CozyDuke)
Query: describe CVE-2015-1668
Matching passage: CVE-2015-1668. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-1956. CWE: CWE-399. CVSS: 7.800000190734863. IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (disk consumption) via a crafted byte sequence in authentication data, a different vulnerability than CVE-2015-1958 and CVE-2015-1987.
Query: Sigma rule for Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation)
Matching passage: Sigma rule: Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation). Logsource: windows / process_creation. Rule: title: Shell Process Spawned by Java.EXE id: dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0 related: - id: 0d34ed8b-1c12-4ff2-828c-16fc860b766d type: similar status: test description: Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation) references: - https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/ author: Andreas Hunkeler (@Karneades), Nasreddine Bencherchali date: 2021-12-17 modified: 2024-01-18 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \java.exe Image|endswith: - \bash.exe - \cmd.exe - \powershell.exe - \pwsh.exe filter_main_build: ParentImage|contains: build CommandLine|contains: build condition: selection and not 1 of filter_main_* falsepositives: - Legitimate calls to system binaries - Company specific internal usage level: medium
Near-miss passage: Sigma rule: Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or othe. Logsource: windows / process_creation. Rule: title: Unusual Child Process of dns.exe id: a4e3d776-f12e-42c2-8510-9e6ed1f43ec3 status: test description: Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed) references: - https://www.elastic.co/guide/en/security/current/unusual-child-process-of-dns-exe.html author: Tim Rauch, Elastic (idea) date: 2022-09-27 modified: 2023-02-05 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \dns.exe filter: Image|endswith: \conhost.exe condition: selection and not filter falsepositives: - Unknown level: high
Query: vulnerability: IBM PowerVC Standard Edition 1.2.2.1 through 1.2.2.2 does not require authentication for access to the Python interpreter with nova credentials, which allows KVM guest OS users to 
Matching passage: CVE-2015-1950. CWE: CWE-255. CVSS: 4.599999904632568. IBM PowerVC Standard Edition 1.2.2.1 through 1.2.2.2 does not require authentication for access to the Python interpreter with nova credentials, which allows KVM guest OS users to discover certain PowerVC credentials and bypass intended access restrictions via unspecified Python code.
Near-miss passage: CVE-2015-6742. CWE: CWE-255. CVSS: 6.5. Basware Banking (Maksuliikenne) before 8.90.07.X uses a hardcoded password for the ANCO account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability types and different affected versions.
Query: SOC alert related to Windows Host Firewall
Matching passage: T1686.003 Windows Host Firewall. Tactics: defense impairment. Description: Adversaries may disable or modify the Windows host firewall to bypass controls limiting network usage. This can include disabling the Windows host firewall entirely, suppressing specific profiles (domain, private, public), or adding, deleting, and modifying firewall rules to allow or restrict traffic.(Citation: Nearest Neighbor Volexity) Adversaries may perform these modifications through multiple mechanisms depending on the Windows operating system and access level. For example, adversaries may use command-line utilities (e.g., `netsh advfirewall` or PowerShell cmdlets like `Set-NetFirewallProfile`, `New-NetFirewallRule`), Windows Registry modifications (e.g., altering firewall states and rule configurations via registry keys), or the Windows Control Panel to modify firewall settings through the Windows Security interface. By disabling or modifying Windows firewall services, adversaries may enable access to remote services, open ports for command and control traffic, or configure rules for further actions.
Near-miss passage: T1686.002 Network Device Firewall. Tactics: defense impairment. Description: Adversaries may disable network device-based firewall mechanisms entirely or add, delete, or modify particular rules in order to bypass controls limiting network usage. Adversaries may obtain access to devices such as routers, switches, or other perimeter/network devices and change access control lists (ACLs), security zones, or policy rules to permit otherwise blocked traffic. For example, adversaries may add new network firewall rules to allow access to all internal network subnets without restrictions. Allowing access to internal network subsets may enable unrestricted inbound/outbound connectivity or open paths for command and control and lateral movement. Adversaries may obtain access to network device management interfaces via [Valid Accounts](https://attack.mitre.org/techniques/T1078) or by exploiting vulnerabilities. In some cases, threat actors may target firewalls and other network infrastructure that are exposed to the internet by leveraging weaknesses in public-facing applications ([Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).(Citation: CVE-2024-55591 Detail) Adversaries may also modify host networking configurations that indirectly manipulate system firewalls, such as adjusting interface bandwidth or network connection request thresholds.
Query: describe CVE-2015-1418
Matching passage: CVE-2015-1418. CWE: CWE-200. CVSS: 7.800000190734863. The do_ed_script function in pch.c in GNU patch through 2.7.6, and patch in FreeBSD 10.1 before 10.1-RELEASE-p17, 10.2 before 10.2-BETA2-p3, 10.2-RC1 before 10.2-RC1-p2, and 0.2-RC2 before 10.2-RC2-p1, allows remote attackers to execute arbitrary commands via a crafted patch file, because a '!' character can be passed to the ed program.
Near-miss passage: CVE-2015-2076. CWE: CWE-200. CVSS: 5.0. The Auditing service in SAP BusinessObjects Edge 4.0 allows remote attackers to obtain sensitive information by reading an audit event, aka SAP Note 2011395.
Query: ATT&CK technique for Windows Management Instrumentation
Matching passage: T1047 Windows Management Instrumentation. Tactics: execution. Description: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems.(Citation: WMI 1-3) WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) and [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006).(Citation: WMI 1-3) Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.(Citation: WMI 1-3) (Citation: Mandiant WMI) An adversary can use WMI to interact with local and remote systems and use it as a means to execute various behaviors, such as gathering information for [Discovery](https://attack.mitre.org/tactics/TA0007) as well as [Execution](https://attack.mitre.org/tactics/TA0002) of commands and payloads.(Citation: Mandiant WMI) For example, `wmic.exe` can be abused by an adversary to delete shadow copies with the command `wmic.exe Shadowcopy Delete` (i.e., [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490)).(Citation: WMI 6) **Note:** `wmic.exe` is deprecated as of January of 2024, with the WMIC feature being “disabled by default” on Windows 11+. WMIC will be removed from subsequent Windows releases and replaced by [PowerShell](https://attack.mitre.org/techniques/T1059/001) as the primary WMI interface.(Citation: WMI 7,8) In addition to PowerShell and tools like `wbemtool.exe`, COM APIs can also be used to programmatically interact with WMI via C++, .NET, VBScript, etc.(Citation: WMI 7,8)
Near-miss passage: T1153 Source. Tactics: execution. Description: **This technique has been deprecated and should no longer be used.** The <code>source</code> command loads functions into the current shell or executes files in the current context. This built-in command can be run in two different ways <code>source /path/to/filename [arguments]</code> or <code>.**This technique has been deprecated and should no longer be used.** /path/to/filename [arguments]</code>. Take note of the space after the ".". Without a space, a new shell is created that runs the program instead of running the program within the current context. This is often used to make certain features or functions available to a shell or to update a specific shell's environment.(Citation: Source Manual) Adversaries can abuse this functionality to execute programs. The file executed with this technique does not need to be marked executable beforehand.
Query: CWE for Missing Initialization of Resource
Matching passage: CWE-909 Missing Initialization of Resource. The product does not initialize a critical resource.
Near-miss passage: CWE-240 Improper Handling of Inconsistent Structural Elements. The product does not handle or incorrectly handles when two or more structural elements should be consistent, but are not.
Query: describe CVE-2015-7696
Matching passage: CVE-2015-7696. CWE: CWE-119. CVSS: 6.800000190734863. Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly execute arbitrary code via a crafted password-protected ZIP archive, possibly related to an Extra-Field size value.
Near-miss passage: CVE-2015-3748. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Query: rule covering Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation att
Matching passage: Sigma rule: Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation att. Logsource: nginx. Rule: title: Nginx Core Dump id: 59ec40bb-322e-40ab-808d-84fa690d7e56 status: test description: Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts. references: - https://docs.nginx.com/nginx/admin-guide/monitoring/debugging/#enabling-core-dumps - https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/ author: Florian Roth (Nextron Systems) date: 2021-05-31 modified: 2023-05-08 tags: - attack.impact - attack.t1499.004 logsource: service: nginx detection: keywords: - exited on signal 6 (core dumped) condition: keywords falsepositives: - Serious issues with a configuration or plugin level: high
Near-miss passage: Sigma rule: Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0. Logsource: windows / ps_classic_start. Rule: title: PowerShell Downgrade Attack - PowerShell id: 6331d09b-4785-4c13-980f-f96661356249 status: test description: Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0 references: - http://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/ author: Florian Roth (Nextron Systems), Lee Holmes (idea), Harish Segar (improvements) date: 2017-03-22 modified: 2023-10-27 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_classic_start detection: selection: Data|contains: EngineVersion=2. filter_main: Data|contains: HostVersion=2. condition: selection and not filter_main falsepositives: - Unknown level: medium
Query: describe CVE-2015-0950
Matching passage: CVE-2015-0950. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in admin.php in X-Cart 5.1.6 through 5.1.10 allows remote attackers to inject arbitrary web script or HTML via the substring parameter.
Near-miss passage: CVE-2015-5625. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in OpenDocMan before 1.3.4 allows remote attackers to inject arbitrary web script or HTML via the redirection parameter.
Query: Sigma rule for Identifies user activities originating from geographically distant locations within a time period shorter than the time
Matching passage: Sigma rule: Identifies user activities originating from geographically distant locations within a time period shorter than the time. Logsource: azure / riskdetection. Rule: title: Impossible Travel id: b2572bf9-e20a-4594-b528-40bde666525a status: test description: Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#impossible-travel - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation - attack.initial-access logsource: product: azure service: riskdetection detection: selection: riskEventType: impossibleTravel condition: selection falsepositives: - Connecting to a VPN, performing activity and then dropping and performing additional activity. level: high
Near-miss passage: Sigma rule: Detects the usage of the "sftp.exe" binary as a LOLBIN by abusing the "-D" flag. Logsource: windows / process_creation. Rule: title: Use Of The SFTP.EXE Binary As A LOLBIN id: a85ffc3a-e8fd-4040-93bf-78aff284d801 status: test description: Detects the usage of the "sftp.exe" binary as a LOLBIN by abusing the "-D" flag references: - https://github.com/LOLBAS-Project/LOLBAS/pull/264 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-10 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: Image|endswith: \sftp.exe CommandLine|contains: - ' -D ..' - ' -D C:\' condition: selection falsepositives: - Unknown level: medium
Query: Sigma rule for Identifies when a service account is modified in Google Cloud.
Matching passage: Sigma rule: Identifies when a service account is modified in Google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud Service Account Modified id: 6b67c12e-5e40-47c6-b3b0-1e6b571184cc status: test description: Identifies when a service account is modified in Google Cloud. references: - https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts author: Austin Songer @austinsonger date: 2021-08-14 modified: 2022-10-09 tags: - attack.impact logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name|endswith: - .serviceAccounts.patch - .serviceAccounts.create - .serviceAccounts.update - .serviceAccounts.enable - .serviceAccounts.undelete condition: selection falsepositives: - Service Account being modified may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Service Account modified from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Potential adversaries accessing the microphone and webcam in an endpoint.. Logsource: windows / security. Rule: title: Processes Accessing the Microphone and Webcam id: 8cd538a4-62d5-4e83-810b-12d41e428d6e status: test description: Potential adversaries accessing the microphone and webcam in an endpoint. references: - https://twitter.com/duzvik/status/1269671601852813320 - https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-06-07 modified: 2021-11-27 tags: - attack.collection - attack.t1123 logsource: product: windows service: security detection: selection: EventID: - 4657 - 4656 - 4663 ObjectName|contains: - \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged - \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged condition: selection falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-7747
Matching passage: CVE-2015-7747. CWE: CWE-120. CVSS: 8.800000190734863. Buffer overflow in the afReadFrames function in audiofile (aka libaudiofile and Audio File Library) allows user-assisted remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted audio file, as demonstrated by sixteen-stereo-to-eight-mono.c.
Near-miss passage: CVE-2015-20109. CWE: CWE-120. CVSS: 5.5. end_pattern (called from internal_fnmatch) in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash), as demonstrated by use of the fnmatch library function with the **(!() pattern. NOTE: this is not the same as CVE-2015-8984; also, some Linux distributions have fixed CVE-2015-8984 but have not fixed this additional fnmatch issue.
Query: vulnerability: Samsung SBeam allows remote attackers to read arbitrary images by leveraging an NFC connection to access the HTTP server on port 15000.
Matching passage: CVE-2015-4033. CWE: CWE-200. CVSS: 3.299999952316284. Samsung SBeam allows remote attackers to read arbitrary images by leveraging an NFC connection to access the HTTP server on port 15000.
Near-miss passage: CVE-2015-1901. CWE: CWE-200. CVSS: 1.899999976158142. The installer in IBM InfoSphere Information Server 8.5 through 11.3 before 11.3.1.2 allows local users to obtain sensitive information via unspecified commands.
Query: detection rule: Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl. This activity m
Matching passage: Sigma rule: Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl. This activity m. Logsource: linux / process_creation. Rule: title: Kaspersky Endpoint Security Stopped Via CommandLine - Linux id: 36388120-b3f1-4ce9-b50b-280d9a7f4c04 status: experimental description: 'Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl. This activity may indicate a manual interruption of the antivirus service by an administrator, or it could be a sign of potential tampering or evasion attempts by malicious actors. ' references: - https://support.kaspersky.com/KES4Linux/12.0.0/en-US/197929.htm author: Milad Cheraghi date: 2025-10-18 tags: - attack.execution - attack.defense-impairment - attack.t1685 logsource: product: linux category: process_creation detection: selection: Image|endswith: - /systemctl - /bash - /sh CommandLine|contains|all: - stop - kesl condition: selection falsepositives: - System administrator manually stopping Kaspersky services level: high
Near-miss passage: Sigma rule: Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.. Logsource: azure / auditlogs. Rule: title: Certificate-Based Authentication Enabled id: c2496b41-16a9-4016-a776-b23f8910dc58 status: test description: Detects when certificate based authentication has been enabled in an Azure Active Directory tenant. references: - https://posts.specterops.io/passwordless-persistence-and-privilege-escalation-in-azure-98a01310be3f - https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/ author: Harjot Shah Singh, '@cyb3rjy0t' date: 2024-03-26 tags: - attack.credential-access - attack.persistence - attack.privilege-escalation - attack.defense-impairment - attack.t1556 logsource: product: azure service: auditlogs detection: selection: OperationName: Authentication Methods Policy Update TargetResources.modifiedProperties|contains: AuthenticationMethodsPolicy condition: selection falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-3835
Matching passage: CVE-2015-3835. CWE: CWE-119. CVSS: 9.300000190734863. Buffer overflow in the OMXNodeInstance::emptyBuffer function in omx/OMXNodeInstance.cpp in libstagefright in Android before 5.1.1 LMY48I allows attackers to execute arbitrary code via a crafted application, aka internal bug 20634516.
Near-miss passage: CVE-2015-6991. CWE: CWE-119. CVSS: 6.800000190734863. FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, CVE-2015-7010, and CVE-2015-7018.