alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Persistence mechanism resembling Web Services
Matching passage: T1583.006 Web Services. Tactics: resource development. Description: Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)), [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567), or [Phishing](https://attack.mitre.org/techniques/T1566). Using common services, such as those offered by Google, GitHub, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: FireEye APT29)(Citation: Hacker News GitHub Abuse 2024) By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.
Near-miss passage: T1583.008 Malvertising. Tactics: resource development. Description: Adversaries may purchase online advertisements that can be abused to distribute malware to victims. Ads can be purchased to plant as well as favorably position artifacts in specific locations online, such as prominently placed within search engine results. These ads may make it more difficult for users to distinguish between actual search results and advertisements.(Citation: spamhaus-malvertising) Purchased ads may also target specific audiences using the advertising network’s capabilities, potentially further taking advantage of the trust inherently given to search engines and popular websites. Adversaries may purchase ads and other resources to help distribute artifacts containing malicious code to victims. Purchased ads may attempt to impersonate or spoof well-known brands. For example, these spoofed ads may trick victims into clicking the ad which could then send them to a malicious domain that may be a clone of official websites containing trojanized versions of the advertised software.(Citation: Masquerads-Guardio)(Citation: FBI-search) Adversary’s efforts to create malicious domains and purchase advertisements may also be automated at scale to better resist cleanup efforts.(Citation: sentinelone-malvertising) Malvertising may be used to support [Drive-by Target](https://attack.mitre.org/techniques/T1608/004) and [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), potentially requiring limited interaction from the user if the ad contains code/exploits that infect the target system's web browser.(Citation: BBC-malvertising) Adversaries may also employ several techniques to evade detection by the advertising network. For example, adversaries may dynamically route ad clicks to send automated crawler/policy enforcer traffic to benign sites while validating potential targets then sending victims referred from real ad clicks to malicious pages. This infection vector may therefore remain hidden from the ad network as well as any visitor not reaching th
Query: weakness Improper Following of a Certificate's Chain of Trust
Matching passage: CWE-296 Improper Following of a Certificate's Chain of Trust. The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate.
Near-miss passage: CWE-1333 Inefficient Regular Expression Complexity. The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Query: risk of OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty), when using libvirt to spawn instances and use_cow_images is set to false, allow remote authentic
Matching passage: CVE-2015-7548. CWE: CWE-200. CVSS: 3.5. OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty), when using libvirt to spawn instances and use_cow_images is set to false, allow remote authenticated users to read arbitrary files by overwriting an instance disk with a crafted image and requesting a snapshot.
Near-miss passage: CVE-2015-5878. CWE: CWE-200. CVSS: 2.0999999046325684. Notes in Apple OS X before 10.11 misparses links, which allows local users to obtain sensitive information via unspecified vectors.
Query: CVE similar to CVE-2015-7637
Matching passage: CVE-2015-7637. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.
Near-miss passage: CVE-2015-0207. CWE: UNKNOWN. CVSS: 5.0. The dtls1_listen function in d1_lib.c in OpenSSL 1.0.2 before 1.0.2a does not properly isolate the state information of independent data streams, which allows remote attackers to cause a denial of service (application crash) via crafted DTLS traffic, as demonstrated by DTLS 1.0 traffic to a DTLS 1.2 server.
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote auth
Matching passage: CVE-2015-5336. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey answer.
Near-miss passage: CVE-2015-2315. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the target parameter in a reminder_popup action to the default URI.
Query: detection rule: Detects well-known credential dumping tools execution via service execution events
Matching passage: Sigma rule: Detects well-known credential dumping tools execution via service execution events. Logsource: windows / security. Rule: title: Credential Dumping Tools Service Execution - Security id: f0d1feba-4344-4ca9-8121-a6c97bd6df52 related: - id: 4976aa50-8f41-45c6-8b15-ab3fc10e79ed type: derived status: test description: Detects well-known credential dumping tools execution via service execution events references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community date: 2017-03-05 modified: 2022-11-29 tags: - attack.credential-access - attack.execution - attack.t1003.001 - attack.t1003.002 - attack.t1003.004 - attack.t1003.005 - attack.t1003.006 - attack.t1569.002 - attack.s0005 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceFileName|contains: - cachedump - dumpsvc - fgexec - gsecdump - mimidrv - pwdump - servpw condition: selection falsepositives: - Legitimate Administrator using credential dumping tool for password recovery level: high
Near-miss passage: Sigma rule: Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common d. Logsource: windows / process_creation. Rule: title: IIS WebServer Log Deletion via CommandLine Utilities id: 0649be4a-aeb0-45b0-b89e-7f1668f6d9c0 related: - id: 3eb8c339-a765-48cc-a150-4364c04652bf type: similar status: experimental description: 'Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks. Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection. ' references: - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/managing-iis-log-file-storage author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-09-02 tags: - attack.stealth - attack.t1070 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \cmd.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - cmd.exe - powershell.exe - powershell_ise.exe - pwsh.dll selection_cli_del: CommandLine|contains: - 'del ' - 'erase ' - 'rm ' - 'remove-item ' - 'rmdir ' selection_cli_iis_dir: CommandLine|contains: \inetpub\logs\ condition: all of selection_* falsepositives: - Deletion of IIS logs that are older than a certain retention period as part of regular maintenance activities. - Legitimate schedule tasks or scripts that clean up log files regularly. level: medium
Query: vulnerability: Cisco Aironet 1800 devices with software 7.2, 7.3, 7.4, 8.1(112.3), 8.1(112.4), and 8.1(15.14) have a default account, which makes it easier for remote attackers to obtain access v
Matching passage: CVE-2015-6336. CWE: CWE-255. CVSS: 7.300000190734863. Cisco Aironet 1800 devices with software 7.2, 7.3, 7.4, 8.1(112.3), 8.1(112.4), and 8.1(15.14) have a default account, which makes it easier for remote attackers to obtain access via unspecified vectors, aka Bug ID CSCuw58062.
Near-miss passage: CVE-2015-1842. CWE: CWE-255. CVSS: 10.0. The puppet manifests in the Red Hat openstack-puppet-modules package before 2014.2.13-2 uses a default password of CHANGEME for the pcsd daemon, which allows remote attackers to execute arbitrary shell commands via unspecified vectors.
Query: alert when Detects logs clearing attempts on Linux systems via utilities such as 'rm', 'rmdir', 'shred', and 'unlink' targeting log
Matching passage: Sigma rule: Detects logs clearing attempts on Linux systems via utilities such as 'rm', 'rmdir', 'shred', and 'unlink' targeting log. Logsource: linux / process_creation. Rule: title: Linux Logs Clearing Attempts id: 80915f59-9b56-4616-9de0-fd0dea6c12fe status: stable description: 'Detects logs clearing attempts on Linux systems via utilities such as ''rm'', ''rmdir'', ''shred'', and ''unlink'' targeting log files and directories. Adversaries often try to clear logs to cover their tracks after performing malicious activities. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md author: Ömer Günal, oscd.community date: 2020-10-07 modified: 2026-03-18 tags: - attack.defense-impairment - attack.t1685.006 logsource: product: linux category: process_creation detection: selection: Image|endswith: - /rm - /rmdir - /shred - /unlink CommandLine|contains: - /var/log - /var/spool/mail filter_main_legit_systat: Image|endswith: /rm CommandLine|startswith: rm -f /var/log/sysstat/ filter_main_dmseg: Image|endswith: /rm CommandLine|startswith: rm -f -- /var/log//dmesg condition: selection and not 1 of filter_main_* falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects different hacktools used for relay attacks on Windows for privilege escalation. Logsource: windows / process_creation. Rule: title: Potential SMB Relay Attack Tool Execution id: 5589ab4f-a767-433c-961d-c91f3f704db1 status: test description: Detects different hacktools used for relay attacks on Windows for privilege escalation references: - https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/ - https://pentestlab.blog/2017/04/13/hot-potato/ - https://github.com/ohpe/juicy-potato - https://hunter2.gitbook.io/darthsidious/other/war-stories/domain-admin-in-30-minutes - https://hunter2.gitbook.io/darthsidious/execution/responder-with-ntlm-relay-and-empire - https://www.localpotato.com/ author: Florian Roth (Nextron Systems) date: 2021-07-24 modified: 2023-02-14 tags: - attack.collection - attack.execution - attack.credential-access - attack.t1557.001 logsource: category: process_creation product: windows detection: selection_pe: Image|contains: - PetitPotam - RottenPotato - HotPotato - JuicyPotato - \just_dce_ - Juicy Potato - \temp\rot.exe - \Potato.exe - \SpoolSample.exe - \Responder.exe - \smbrelayx - \ntlmrelayx - \LocalPotato selection_script: CommandLine|contains: - Invoke-Tater - ' smbrelay' - ' ntlmrelay' - 'cme smb ' - ' /ntlm:NTLMhash ' - Invoke-PetitPotam - '.exe -t * -p ' selection_juicypotato_enum: CommandLine|contains: .exe -c "{ CommandLine|endswith: '}" -z' filter_hotpotatoes: Image|contains: - HotPotatoes6 - HotPotatoes7 - 'HotPotatoes ' condition: 1 of selection_* and not 1 of filter_* falsepositives: - Legitimate files with these rare hacktool names level: critical
Query: CVE similar to CVE-2015-2690
Matching passage: CVE-2015-2690. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in views/add-license-form.php in the Digium Addons module (digiumaddoninstaller) before 2.11.0.7 for FreePBX allow remote attackers to inject arbitrary web script or HTML via the (1) add_license_key, (2) add_license_first_name, (3) add_license_last_name, (4) add_license_company, (5) add_license_address1, (6) add_license_address2, (7) add_license_city, (8) add_license_state, (9) add_license_post_code, (10) add_license_country, (11) add_license_phone, or (12) add_license_email parameter in an add-license-form page to admin/config.php.
Near-miss passage: CVE-2015-6753. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in the Quick Edit module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an (1) entity title, related to in-place editing, or a (2) node title.
Query: risk of Integer underflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2, when the configuration setting "Load printer settings with the document" is enabled, allows remote
Matching passage: CVE-2015-5212. CWE: CWE-191. CVSS: 6.800000190734863. Integer underflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2, when the configuration setting "Load printer settings with the document" is enabled, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via crafted PrinterSetup data in an ODF document.
Near-miss passage: CVE-2015-2311. CWE: CWE-191. CVSS: 9.800000190734863. Integer underflow in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 might allow remote peers to cause a denial of service or possibly obtain sensitive information from memory or execute arbitrary code via a crafted message.
Query: write Sigma for Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)
Matching passage: Sigma rule: Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36). Logsource: windows / process_creation. Rule: title: UAC Bypass Using NTFS Reparse Point - Process id: 39ed3c80-e6a1-431b-9df3-911ac53d08a7 status: test description: Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection1: CommandLine|startswith: '"C:\Windows\system32\wusa.exe" /quiet C:\Users\' CommandLine|endswith: \AppData\Local\Temp\update.msu IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 selection2: ParentCommandLine: '"C:\Windows\system32\dism.exe" /online /quiet /norestart /add-package /packagepath:"C:\Windows\system32\pe386" /ignorecheck' IntegrityLevel: - High - System CommandLine|contains|all: - C:\Users\ - \AppData\Local\Temp\ - \dismhost.exe { Image|endswith: \DismHost.exe condition: 1 of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects loading of a DLL by the VMware Xfer utility from the non-default directory which may be an attempt to sideload a. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Via VMware Xfer id: 9313dc13-d04c-46d8-af4a-a930cc55d93b status: test description: Detects loading of a DLL by the VMware Xfer utility from the non-default directory which may be an attempt to sideload arbitrary DLL references: - https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-02 modified: 2023-02-17 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: image_load detection: selection: Image|endswith: \VMwareXferlogs.exe ImageLoaded|endswith: \glib-2.0.dll filter: ImageLoaded|startswith: C:\Program Files\VMware\ condition: selection and not filter falsepositives: - Unlikely level: high
Query: containment actions for Encoded PowerShell / command-line abuse matching Search Open Websites/Domains
Matching passage: Playbook for T1593 Search Open Websites/Domains. 1) Validate alert telemetry against T1593. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: reconnaissance. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.(Citation: Cyware Social Media)(Citation: SecurityTrails Google Hack
Near-miss passage: Playbook for T1593.001 Social Media. Different response path focused on reconnaissance.
Query: write Sigma for Detects modification of autostart extensibility point (ASEP) in registry.
Matching passage: Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: WinSock2 Autorun Keys Modification id: d6c2ce7e-afb5-4337-9ca4-4b5254ed0565 related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: derived status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: winsock_parameters_base: TargetObject|contains: \System\CurrentControlSet\Services\WinSock2\Parameters winsock_parameters: TargetObject|contains: - \Protocol_Catalog9\Catalog_Entries - \NameSpace_Catalog5\Catalog_Entries filter: - Details: (Empty) - Image: C:\Windows\System32\MsiExec.exe - Image: C:\Windows\syswow64\MsiExec.exe condition: winsock_parameters_base and winsock_parameters and not filter falsepositives: - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason - Legitimate administrator sets up autorun keys for legitimate reason level: medium
Near-miss passage: Sigma rule: Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. System pod. Logsource: kubernetes / application / audit. Rule: title: Creation Of Pod In System Namespace id: a80d927d-ac6e-443f-a867-e8d6e3897318 status: test description: 'Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. System pods, created by controllers such as Deployments or DaemonSets have random suffixes in their names. Attackers can use this fact and name their backdoor pods as if they were created by these controllers to avoid detection. Deployment of such a backdoor container e.g. named kube-proxy-bv61v, could be attempted in the kube-system namespace alongside the other administrative containers. ' references: - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Pod%20or%20container%20name%20similarily/ author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.stealth - attack.t1036.005 logsource: category: application product: kubernetes service: audit detection: selection: verb: create objectRef.resource: pods objectRef.namespace: kube-system condition: selection falsepositives: - System components such as daemon-set-controller and kube-scheduler also create pods in the kube-system namespace level: medium
Query: exploit Cross-site scripting (XSS) vulnerability in the Exceptions and Scanning Exceptions Pages in Websense TRITON AP-WEB before 8.0.0 allows remote attackers to inject arbitrary web scri
Matching passage: CVE-2015-2761. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Exceptions and Scanning Exceptions Pages in Websense TRITON AP-WEB before 8.0.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-2332. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in member.php in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: exploit Open redirect vulnerability in the Node Invite module before 6.x-2.5 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via th
Matching passage: CVE-2015-3371. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the Node Invite module before 6.x-2.5 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the destination parameter.
Near-miss passage: CVE-2015-1251. CWE: UNKNOWN. CVSS: 6.800000190734863. Use-after-free vulnerability in the SpeechRecognitionClient implementation in the Speech subsystem in Google Chrome before 43.0.2357.65 allows remote attackers to execute arbitrary code via a crafted document.
Query: CVE similar to CVE-2015-0588
Matching passage: CVE-2015-0588. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco Unified Communications Domain Manager (UCDM) 10 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuo77055.
Near-miss passage: CVE-2015-3350. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Todo Filter module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that toggle a task via unspecified vectors.
Query: risk of Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter. NOTE: 
Matching passage: CVE-2015-4181. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this vulnerability exists due to an incomplete fix to CVE-2015-4180.
Near-miss passage: CVE-2015-1199. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in ppmd 10.1-5.