alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects usage of "getcap" binary. This is often used during recon activity to determine potential binaries that can be a
Matching passage: Sigma rule: Detects usage of "getcap" binary. This is often used during recon activity to determine potential binaries that can be a. Logsource: linux / process_creation. Rule: title: Capabilities Discovery - Linux id: d8d97d51-122d-4cdd-9e2f-01b4b4933530 status: test description: Detects usage of "getcap" binary. This is often used during recon activity to determine potential binaries that can be abused as GTFOBins or other. references: - https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes - https://github.com/carlospolop/PEASS-ng - https://github.com/diego-treitos/linux-smart-enumeration author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-28 modified: 2026-01-24 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: linux detection: selection: Image|endswith: /getcap CommandLine|contains: ' -r ' condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Identifies when a Keyvault Key is modified or deleted in Azure.. Logsource: azure / activitylogs. Rule: title: Azure Keyvault Key Modified or Deleted id: 80eeab92-0979-4152-942d-96749e11df40 status: test description: Identifies when a Keyvault Key is modified or deleted in Azure. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-08-16 modified: 2022-08-23 tags: - attack.impact - attack.credential-access - attack.t1552 - attack.t1552.001 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KEYVAULT/VAULTS/KEYS/UPDATE/ACTION - MICROSOFT.KEYVAULT/VAULTS/KEYS/CREATE - MICROSOFT.KEYVAULT/VAULTS/KEYS/CREATE/ACTION - MICROSOFT.KEYVAULT/VAULTS/KEYS/IMPORT/ACTION - MICROSOFT.KEYVAULT/VAULTS/KEYS/RECOVER/ACTION - MICROSOFT.KEYVAULT/VAULTS/KEYS/RESTORE/ACTION - MICROSOFT.KEYVAULT/VAULTS/KEYS/DELETE - MICROSOFT.KEYVAULT/VAULTS/KEYS/BACKUP/ACTION - MICROSOFT.KEYVAULT/VAULTS/KEYS/PURGE/ACTION condition: selection falsepositives: - Key being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Key modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: vulnerability: Multiple cross-site request forgery (CSRF) vulnerabilities in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allow remote
Matching passage: CVE-2015-2759. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allow remote attackers to hijack the authentication of users for requests that (1) obtain sensitive information or (2) modify the database via unspecified vectors.
Near-miss passage: CVE-2015-2805. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in sec/content/sec_asa_users_local_db_add.html in the management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400, 6855, 6900, 10K, and 6860 with firmware 6.4.5.R02, 6.4.6.R01, 6.6.4.R01, 6.6.5.R02, 7.3.2.R01, 7.3.3.R01, 7.3.4.R01, and 8.1.1.R01 allows remote attackers to hijack the authentication of administrators for requests that create users via a crafted request.
Query: CVE similar to CVE-2015-1345
Matching passage: CVE-2015-1345. CWE: CWE-119. CVSS: 2.0999999046325684. The bmexec_trans function in kwset.c in grep 2.19 through 2.21 allows local users to cause a denial of service (out-of-bounds heap read and crash) via crafted input when using the -F option.
Near-miss passage: CVE-2015-5578. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5575, CVE-2015-5577, CVE-2015-5580, CVE-2015-5582, CVE-2015-5588, and CVE-2015-6677.
Query: threat report mentioning Office Template Macros
Matching passage: T1137.001 Office Template Macros. Tactics: persistence. Description: Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Microsoft Office contains templates that are part of common Office applications and are used to customize styles. The base templates within the application are used each time an application starts. (Citation: Microsoft Change Normal Template) Office Visual Basic for Applications (VBA) macros (Citation: MSDN VBA in Office) can be inserted into the base template and used to execute code when the respective Office application starts in order to obtain persistence. Examples for both Word and Excel have been discovered and published. By default, Word has a Normal.dotm template created that can be modified to include a malicious macro. Excel does not have a template file created by default, but one can be added that will automatically be loaded.(Citation: enigma0x3 normal.dotm)(Citation: Hexacorn Office Template Macros) Shared templates may also be stored and pulled from remote locations.(Citation: GlobalDotName Jun 2019) Word Normal.dotm location:<br> <code>C:\Users\&lt;username&gt;\AppData\Roaming\Microsoft\Templates\Normal.dotm</code> Excel Personal.xlsb location:<br> <code>C:\Users\&lt;username&gt;\AppData\Roaming\Microsoft\Excel\XLSTART\PERSONAL.XLSB</code> Adversaries may also change the location of the base template to point to their own by hijacking the application's search order, e.g. Word 2016 will first look for Normal.dotm under <code>C:\Program Files (x86)\Microsoft Office\root\Office16\</code>, or by modifying the GlobalDotName registry key. By modifying the GlobalDotName registry key an adversary can specify an arbitrary location, file name, and file extension to use for the template that will be loaded on application startup. To abuse GlobalDotName, adversaries may first need to register the template as a trusted document or place it in a trusted location.(Citation: GlobalDotName Jun 2019) An adversary may need to enable macros to execute unrestricted depending
Near-miss passage: T1137.004 Outlook Home Page. Tactics: persistence. Description: Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system. Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders. This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened. A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page.(Citation: SensePost Outlook Home Page) Once malicious home pages have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious Home Pages will execute when the right Outlook folder is loaded/reloaded.(Citation: SensePost Outlook Home Page)
Query: patch priority for CVE-2015-3454
Matching passage: CVE-2015-3454. CWE: CWE-200. CVSS: 7.5. TelescopeJS before 0.15 leaks user bcrypt password hashes in websocket messages, which might allow remote attackers to obtain password hashes via a cross-site scripting attack.
Near-miss passage: CVE-2015-4171. CWE: CWE-200. CVSS: 2.5999999046325684. strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.
Query: intelligence brief on T1546.006
Matching passage: T1546.006 LC_LOAD_DYLIB Addition. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence by executing malicious content triggered by the execution of tainted binaries. Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded. The LC_LOAD_DYLIB header in a Mach-O binary tells macOS and OS X which dynamic libraries (dylibs) to load during execution time. These can be added ad-hoc to the compiled binary as long as adjustments are made to the rest of the fields and dependencies.(Citation: Writing Bad Malware for OSX) There are tools available to perform these changes. Adversaries may modify Mach-O binary headers to load and execute malicious dylibs every time the binary is executed. Although any changes will invalidate digital signatures on binaries because the binary is being modified, this can be remediated by simply removing the LC_CODE_SIGNATURE command from the binary so that the signature isn’t checked at load time.(Citation: Malware Persistence on OS X)
Near-miss passage: T1546.015 Component Object Model Hijacking. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system.(Citation: Microsoft Component Object Model) References to various COM objects are stored in the Registry. Adversaries may use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead.(Citation: GDATA COM Hijacking) An adversary is likely to hijack objects that are used frequently enough to maintain a consistent level of persistence, but are unlikely to break noticeable functionality within the system as to avoid system instability that could lead to detection. One variation of COM hijacking involves abusing Type Libraries (TypeLibs), which provide metadata about COM objects, such as their interfaces and methods. Adversaries may modify Registry keys associated with TypeLibs to redirect legitimate COM object functionality to malicious scripts or payloads. Unlike traditional COM hijacking, which commonly uses local DLLs, this variation may leverage the "script:" moniker to execute remote scripts hosted on external servers.(Citation: RELIAQUEST) This approach enables stealthy execution of code while maintaining persistence, as the remote payload would be automatically downloaded whenever the hijacked COM object is accessed.
Query: Sigma rule for Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class. T
Matching passage: Sigma rule: Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class. T. Logsource: windows / ps_classic_start. Rule: title: PowerShell Download Via Net.WebClient - PowerShell Classic id: 3236fcd0-b7e3-4433-b4f8-86ad61a9af2d related: - id: 65531a81-a694-4e31-ae04-f8ba5bc33759 type: derived status: test description: 'Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class. This technique is often abused by attackers to download additional payloads. ' references: - https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html author: Florian Roth (Nextron Systems) date: 2017-03-05 modified: 2026-04-28 tags: - attack.execution - attack.command-and-control - attack.t1059.001 - attack.t1105 logsource: product: windows category: ps_classic_start detection: selection_webclient: Data|contains: Net.WebClient selection_download: Data|contains: - .DownloadFile( - .DownloadString( condition: all of selection_* falsepositives: - This activity may be used by legitimate software, such as patch management tools or software updaters. Investigate any such activity and apply the necessary filter. level: low
Near-miss passage: Sigma rule: Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute. Logsource: windows / process_creation. Rule: title: Perl Inline Command Execution id: f426547a-e0f7-441a-b63e-854ac5bdf54d status: test description: Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute live perl code. references: - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet - https://www.revshells.com/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-02 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \perl.exe - OriginalFileName: perl.exe selection_cli: CommandLine|contains: ' -e' condition: all of selection_* falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-2735
Matching passage: CVE-2015-2735. CWE: CWE-17. CVSS: 9.300000190734863. nsZipArchive.cpp in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which allows remote attackers to have an unspecified impact via a crafted ZIP archive.
Near-miss passage: CVE-2015-0806. CWE: CWE-17. CVSS: 7.5. The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 attempts to use memset for a memory region of negative length during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors that trigger rendering of 2D graphics content.
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in edit_prefs.php in Beehive Forum 1.4.4 allow remote attackers to inject arbitrary web script or HTML via the (1) homepage_url,
Matching passage: CVE-2015-2198. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in edit_prefs.php in Beehive Forum 1.4.4 allow remote attackers to inject arbitrary web script or HTML via the (1) homepage_url, (2) pic_url, or (3) avatar_url parameter, which are not properly handled in an error message.
Near-miss passage: CVE-2015-2321. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Job Manager plugin 0.7.22 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the email field.
Query: risk of Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control MOS 12.1.0.5 and 12.1.0.6 allows remote attackers to affect in
Matching passage: CVE-2015-0473. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control MOS 12.1.0.5 and 12.1.0.6 allows remote attackers to affect integrity via unknown vectors related to My Oracle Support Plugin.
Near-miss passage: CVE-2015-1095. CWE: UNKNOWN. CVSS: 7.199999809265137. IOHIDFamily in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted HID device.
Query: CVE similar to CVE-2015-4944
Matching passage: CVE-2015-4944. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX003, and 7.6.0 before 7.6.0.1 IFIX001; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX003 and 7.6.0 before 7.6.0.1 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-9311. CWE: CWE-79. CVSS: 6.099999904632568. The newstatpress plugin before 1.0.6 for WordPress has reflected XSS.
Query: rule covering Identifies when a device in azure is no longer managed or compliant
Matching passage: Sigma rule: Identifies when a device in azure is no longer managed or compliant. Logsource: azure / auditlogs. Rule: title: Azure Device No Longer Managed or Compliant id: 542b9912-c01f-4e3f-89a8-014c48cdca7d status: test description: Identifies when a device in azure is no longer managed or compliant references: - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory author: Austin Songer @austinsonger date: 2021-09-03 modified: 2026-04-30 tags: - attack.impact logsource: product: azure service: auditlogs detection: selection: operationName: - Device no longer compliant - Device no longer managed condition: selection falsepositives: - Administrator may have forgotten to review the device. level: medium
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64). Logsource: windows / process_creation. Rule: title: UAC Bypass Using IEInstal - Process id: 80fc36aa-945e-4181-89f2-2f907ab6775d status: test description: Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 ParentImage|endswith: \ieinstal.exe Image|contains: \AppData\Local\Temp\ Image|endswith: consent.exe condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-0362
Matching passage: CVE-2015-0362. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 11.1.1.7 allows remote attackers to affect confidentiality via unknown vectors related to BI Publisher Security.
Near-miss passage: CVE-2015-4952. CWE: UNKNOWN. CVSS: 8.800000190734863. The on-demand plugin in IBM Endpoint Manager for Remote Control 9.0.1 and 9.1.0 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors. IBM X-Force ID: 105196.
Query: write Sigma for Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This cou
Matching passage: Sigma rule: Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This cou. Logsource: windows / security. Rule: title: Failed Code Integrity Checks id: 470ec5fa-7b4e-4071-b200-4c753100f49b status: stable description: 'Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This could be a sign of tampered binaries. ' references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5038 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6281 author: Thomas Patzke date: 2019-12-03 modified: 2025-01-19 tags: - attack.stealth - attack.t1027.001 logsource: product: windows service: security detection: selection: EventID: - 5038 - 6281 filter_optional_crowdstrike: param1|contains: - \CSFalconServiceUninstallTool_ - \Program Files\CrowdStrike\ - \System32\drivers\CrowdStrike\ - \Windows\System32\ScriptControl64_ filter_optional_sophos: param1|contains: \Program Files\Sophos\ condition: selection and not 1 of filter_optional_* falsepositives: - Disk device errors level: informational
Near-miss passage: Sigma rule: Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE.. Logsource: windows / process_creation. Rule: title: Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE id: d80d5c81-04ba-45b4-84e4-92eba40e0ad3 status: test description: Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE. references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dotnet/ - https://twitter.com/_felamos/status/1204705548668555264 - https://bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/ author: Beyu Denis, oscd.community date: 2020-10-18 modified: 2025-10-08 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \dotnet.exe - OriginalFileName: .NET Host selection_cli: CommandLine|endswith: - .csproj - .csproj" - .dll - .dll" - .csproj' - .dll' filter_optional_notepadplus_plus: ParentImage: - C:\Program Files (x86)\Notepad++\notepad++.exe - C:\Program Files\Notepad++\notepad++.exe CommandLine|contains|all: - C:\ProgramData\CSScriptNpp\ - '-cscs_path:' - \cs-script\cscs.dll condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Legitimate administrator usage level: medium
Query: threat report mentioning Network Devices
Matching passage: T1584.008 Network Devices. Tactics: resource development. Description: Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not [Initial Access](https://attack.mitre.org/tactics/TA0001) to that environment, but rather to leverage these devices to support additional targeting. Once an adversary has control, compromised network devices can be used to launch additional operations, such as hosting payloads for [Phishing](https://attack.mitre.org/techniques/T1566) campaigns (i.e., [Link Target](https://attack.mitre.org/techniques/T1608/005)) or enabling the required access to execute [Content Injection](https://attack.mitre.org/techniques/T1659) operations. Adversaries may also be able to harvest reusable credentials (i.e., [Valid Accounts](https://attack.mitre.org/techniques/T1078)) from compromised network devices. Adversaries often target Internet-facing edge devices and related network appliances that specifically do not support robust host-based defenses.(Citation: Mandiant Fortinet Zero Day)(Citation: Wired Russia Cyberwar) Compromised network devices may be used to support subsequent [Command and Control](https://attack.mitre.org/tactics/TA0011) activity, such as [Hide Infrastructure](https://attack.mitre.org/techniques/T1665) through an established [Proxy](https://attack.mitre.org/techniques/T1090) and/or [Botnet](https://attack.mitre.org/techniques/T1584/005) network.(Citation: Justice GRU 2024)
Near-miss passage: T1584.003 Virtual Private Server. Tactics: resource development. Description: Adversaries may compromise third-party Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. Adversaries may compromise VPSs purchased by third-party entities. By compromising a VPS to use as infrastructure, adversaries can make it difficult to physically tie back operations to themselves.(Citation: NSA NCSC Turla OilRig) Compromising a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers as well as that added by the compromised third-party.