alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: adversary uses SNMP (MIB Dump)
Matching passage: T1602.001 SNMP (MIB Dump). Tactics: collection. Description: Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP). The MIB is a configuration repository that stores variable information accessible via SNMP in the form of object identifiers (OID). Each OID identifies a variable that can be read or set and permits active management tasks, such as configuration changes, through remote modification of these variables. SNMP can give administrators great insight in their systems, such as, system information, description of hardware, physical location, and software packages(Citation: SANS Information Security Reading Room Securing SNMP Securing SNMP). The MIB may also contain device operational information, including running configuration, routing table, and interface details. Adversaries may use SNMP queries to collect MIB content directly from SNMP-managed devices in order to collect network information that allows the adversary to build network maps and facilitate future targeted exploitation.(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks)
Near-miss passage: T1602.002 Network Device Configuration Dump. Tactics: collection. Description: Adversaries may access network configuration files to collect sensitive data about the device and the network. The network configuration is a file containing parameters that determine the operation of the device. The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset. Adversaries can inspect the configuration files to reveal information about the target network and its layout, the network device and its software, or identifying legitimate accounts and credentials for later use. Adversaries can use common management tools and protocols, such as Simple Network Management Protocol (SNMP) and Smart Install (SMI), to access network configuration files.(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks) These tools may be used to query specific data from a configuration repository or configure the device to export the configuration for later analysis.
Query: CVE similar to CVE-2015-5749
Matching passage: CVE-2015-5749. CWE: CWE-200. CVSS: 4.300000190734863. The Sandbox_profiles component in Apple iOS before 8.4.1 allows attackers to bypass the third-party app-sandbox protection mechanism and read arbitrary managed preferences via a crafted app.
Near-miss passage: CVE-2015-7846. CWE: CWE-200. CVSS: 4.599999904632568. Huawei S7700, S9700, S9300 before V200R07C00SPC500, and AR200, AR1200, AR2200, AR3200 before V200R005C20SPC200 allows attackers with physical access to the CF card to obtain sensitive information.
Query: detection rule: Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility
Matching passage: Sigma rule: Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility. Logsource: windows / process_creation. Rule: title: Potential Suspicious Registry File Imported Via Reg.EXE id: 62e0298b-e994-4189-bc87-bc699aa62d97 related: - id: 73bba97f-a82d-42ce-b315-9182e76c57b1 type: derived status: test description: Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/reg-import author: frack113, Nasreddine Bencherchali date: 2022-08-01 modified: 2023-02-05 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_cli: CommandLine|contains: ' import ' selection_paths: CommandLine|contains: - C:\Users\ - '%temp%' - '%tmp%' - '%appdata%' - \AppData\Local\Temp\ - C:\Windows\Temp\ - C:\ProgramData\ condition: all of selection_* falsepositives: - Legitimate import of keys level: medium
Near-miss passage: Sigma rule: Detects usage of SoftPerfect's "netscan.exe". An application for scanning networks. It is actively used in-the-wild by t. Logsource: windows / process_creation. Rule: title: PUA - SoftPerfect Netscan Execution id: ca387a8e-1c84-4da3-9993-028b45342d30 status: test description: 'Detects usage of SoftPerfect''s "netscan.exe". An application for scanning networks. It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim. ' references: - https://www.protect.airbus.com/blog/uncovering-cyber-intruders-netscan/ - https://secjoes-reports.s3.eu-central-1.amazonaws.com/Sockbot%2Bin%2BGoLand.pdf - https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/yanluowang-ransomware-attacks-continue - https://research.nccgroup.com/2022/07/13/climbing-mount-everest-black-byte-bytes-back/ - https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-hive-ransomware/ - https://www.softperfect.com/products/networkscanner/ author: '@d4ns4n_ (Wuerth-Phoenix)' date: 2024-04-25 tags: - attack.discovery - attack.t1046 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \netscan.exe - Product: Network Scanner - Description: Application for scanning networks condition: selection falsepositives: - Legitimate administrator activity level: medium
Query: detect Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the c in logs
Matching passage: Sigma rule: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the c. Logsource: windows / system. Rule: title: Invoke-Obfuscation Obfuscated IEX Invocation - System id: 51aa9387-1c53-4153-91cc-d73c59ae1ca9 status: test description: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references references: - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888 author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community date: 2019-11-08 modified: 2022-11-27 tags: - attack.stealth - attack.t1027 logsource: product: windows service: system detection: selection_eid: EventID: 7045 selection_imagepath: - ImagePath|re: \$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\[ - ImagePath|re: \$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\[ - ImagePath|re: \$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\[ - ImagePath|re: \$env:ComSpec\[(\s*\d{1,3}\s*,){2} - ImagePath|re: \\*mdr\*\W\s*\)\.Name - ImagePath|re: \$VerbosePreference\.ToString\( - ImagePath|re: \String\]\s*\$VerbosePreference condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl. This activity m. Logsource: linux / process_creation. Rule: title: Kaspersky Endpoint Security Stopped Via CommandLine - Linux id: 36388120-b3f1-4ce9-b50b-280d9a7f4c04 status: experimental description: 'Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl. This activity may indicate a manual interruption of the antivirus service by an administrator, or it could be a sign of potential tampering or evasion attempts by malicious actors. ' references: - https://support.kaspersky.com/KES4Linux/12.0.0/en-US/197929.htm author: Milad Cheraghi date: 2025-10-18 tags: - attack.execution - attack.defense-impairment - attack.t1685 logsource: product: linux category: process_creation detection: selection: Image|endswith: - /systemctl - /bash - /sh CommandLine|contains|all: - stop - kesl condition: selection falsepositives: - System administrator manually stopping Kaspersky services level: high
Query: exploit The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.
Matching passage: CVE-2015-9308. CWE: CWE-352. CVSS: 8.800000190734863. The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.
Near-miss passage: CVE-2015-6966. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Nibbleblog before 4.0.5 allow remote attackers to hijack the authentication of administrators for requests that (1) create a post via a new_simple action to admin.php or (2) conduct cross-site scripting (XSS) attacks via the content parameter in a new_simple action to admin.php.
Query: vulnerability: DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or de
Matching passage: CVE-2015-2172. CWE: CWE-284. CVSS: 6.5. DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API.
Near-miss passage: CVE-2015-9337. CWE: CWE-284. CVSS: 7.5. The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.
Query: exploit eClinicalWorks Population Health (CCMR) suffers from an SQL injection vulnerability in portalUserService.jsp which allows remote authenticated users to inject arbitrary malicious d
Matching passage: CVE-2015-4592. CWE: CWE-89. CVSS: 8.800000190734863. eClinicalWorks Population Health (CCMR) suffers from an SQL injection vulnerability in portalUserService.jsp which allows remote authenticated users to inject arbitrary malicious database commands as part of user input.
Near-miss passage: CVE-2015-10048. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in bmattoso desafio_buzz_woody. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The identifier of the patch is cb8220cbae06082c969b1776fcb2fdafb3a1006b. It is recommended to apply a patch to fix this issue. The identifier VDB-218357 was assigned to this vulnerability.
Query: Sigma rule for Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. W
Matching passage: Sigma rule: Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. W. Logsource: windows / dns_query. Rule: title: DNS Query Request To OneLaunch Update Service id: df68f791-ad95-447f-a271-640a0dab9cf8 status: test description: 'Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. When the OneLaunch application is installed it will attempt to get updates from this domain. ' references: - https://www.malwarebytes.com/blog/detections/pup-optional-onelaunch-silentcf - https://www.myantispyware.com/2020/12/14/how-to-uninstall-onelaunch-browser-removal-guide/ - https://malware.guide/browser-hijacker/remove-onelaunch-virus/ author: Josh Nickels date: 2024-02-26 tags: - attack.credential-access - attack.collection - attack.t1056 logsource: category: dns_query product: windows detection: selection: QueryName: update.onelaunch.com Image|endswith: \OneLaunch.exe condition: selection falsepositives: - Unlikely level: low
Near-miss passage: Sigma rule: Detects a service installed by a client which has PID 0 or whose parent has PID 0. Logsource: windows / system. Rule: title: Service Installed By Unusual Client - System id: 71c276aa-49cd-43d2-b920-2dcd3e6962d5 related: - id: c4e92a97-a9ff-4392-9d2d-7a4c642768ca type: similar status: test description: Detects a service installed by a client which has PID 0 or whose parent has PID 0 references: - https://www.elastic.co/guide/en/security/current/windows-service-installed-via-an-unusual-client.html author: Tim Rauch (Nextron Systems), Elastic (idea) date: 2022-09-15 modified: 2023-01-04 tags: - attack.persistence - attack.privilege-escalation - attack.t1543 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ProcessId: 0 condition: selection falsepositives: - Unknown level: high
Query: risk of IBM Spectrum Scale 4.1.1.x before 4.1.1.4 and 4.2.x before 4.2.0.1, in certain LDAP File protocol configurations, allows remote attackers to discover an LDAP password via unspecifi
Matching passage: CVE-2015-7488. CWE: CWE-200. CVSS: 5.900000095367432. IBM Spectrum Scale 4.1.1.x before 4.1.1.4 and 4.2.x before 4.2.0.1, in certain LDAP File protocol configurations, allows remote attackers to discover an LDAP password via unspecified vectors.
Near-miss passage: CVE-2015-8487. CWE: CWE-200. CVSS: 4.300000190734863. Cybozu Office 9.0.0 through 10.3 allows remote attackers to discover CSRF tokens via unspecified vectors, a different vulnerability than CVE-2015-8488.
Query: telemetry for T1204.005
Matching passage: T1204.005 Malicious Library. Tactics: execution. Description: Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may [Upload Malware](https://attack.mitre.org/techniques/T1608/001) to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that establishes persistence, steals data, or mines cryptocurrency.(Citation: Datadog Security Labs Malicious PyPi Packages 2024)(Citation: Fortinet Malicious NPM Packages 2023) In some cases, threat actors may compromise and backdoor existing popular libraries (i.e., [Compromise Software Dependencies and Development Tools](https://attack.mitre.org/techniques/T1195/001)). Alternatively, they may create entirely new packages and leverage behaviors such as typosquatting to encourage users to install them.
Near-miss passage: T1204.004 Malicious Copy and Paste. Tactics: execution. Description: An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). One such strategy is "ClickFix," in which adversaries present users with seemingly helpful solutions—such as prompts to fix errors or complete CAPTCHAs—that instead instruct the user to copy and paste malicious code. Malicious websites, such as those used in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), may present fake error messages or CAPTCHA prompts that instruct users to open a terminal or the Windows Run Dialog box and execute an arbitrary command. These commands may be obfuscated using encoding or other techniques to conceal malicious intent. Once executed, the adversary will typically be able to establish a foothold on the victim's machine.(Citation: CloudSEK Lumma Stealer 2024)(Citation: Sekoia ClickFake 2025)(Citation: Reliaquest CAPTCHA 2024)(Citation: AhnLab LummaC2 2025) Adversaries may also leverage phishing emails for this purpose. When a user attempts to open an attachment, they may be presented with a fake error and offered a malicious command to paste as a solution, consistent with the "ClickFix" strategy.(Citation: Proofpoint ClickFix 2024)(Citation: AhnLab Malicioys Copy Paste 2024) Tricking a user into executing a command themselves may help to bypass email filtering, browser sandboxing, or other mitigations designed to protect users against malicious downloaded files.
Query: weakness Use of Default Password
Matching passage: CWE-1393 Use of Default Password. The product uses default passwords for potentially critical functionality.
Near-miss passage: CWE-439 Behavioral Change in New Version or Environment. A's behavior or functionality changes with a new version of A, or a new environment, which is not known (or manageable) by B.
Query: risk of The FireWire driver in IOFireWireFamily in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer d
Matching passage: CVE-2015-3707. CWE: UNKNOWN. CVSS: 9.300000190734863. The FireWire driver in IOFireWireFamily in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.
Near-miss passage: CVE-2015-6184. CWE: UNKNOWN. CVSS: 8.100000381469727. The CAttrArray object implementation in Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and memory corruption) via a malformed Cascading Style Sheets (CSS) token sequence in conjunction with modifications to HTML elements, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6048 and CVE-2015-6049.
Query: risk of The Apple iWork application before 2.6 for iOS, Apple Keynote before 6.6, Apple Pages before 5.6, and Apple Numbers before 3.6 allow remote attackers to obtain sensitive informatio
Matching passage: CVE-2015-7032. CWE: CWE-200. CVSS: 4.300000190734863. The Apple iWork application before 2.6 for iOS, Apple Keynote before 6.6, Apple Pages before 5.6, and Apple Numbers before 3.6 allow remote attackers to obtain sensitive information via a crafted document.
Near-miss passage: CVE-2015-5016. CWE: CWE-200. CVSS: 4.300000190734863. IBM Maximo Asset Management 7.1, 7.5, and 7.6; Maximo Asset Management Essentials 7.1 and 7.5; Control Desk 7.5 and 7.6; Tivoli Asset Management for IT 7.1 and 7.2; and certain other IBM products allow remote authenticated users to bypass intended access restrictions and read arbitrary ticket worklog entries via unspecified vectors. IBM X-Force ID: 106460.
Query: rule covering Detects user data export activity.
Matching passage: Sigma rule: Detects user data export activity.. Logsource: bitbucket / audit. Rule: title: Bitbucket User Details Export Attempt Detected id: 5259cbf2-0a75-48bf-b57a-c54d6fabaef3 status: test description: Detects user data export activity. references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html - https://support.atlassian.com/security-and-access-policies/docs/export-user-accounts author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.collection - attack.reconnaissance - attack.discovery - attack.t1213 - attack.t1082 - attack.t1591.004 logsource: product: bitbucket service: audit definition: 'Requirements: "Advance" log level is required to receive these audit events.' detection: selection: auditType.category: Users and groups auditType.action: - User permissions export failed - User permissions export started - User permissions exported condition: selection falsepositives: - Legitimate user activity. level: medium
Near-miss passage: Sigma rule: Detects enabling of the "AllowAnonymousCallback" registry value, which allows a remote connection between computers that. Logsource: windows / registry_set. Rule: title: Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback id: 4d431012-2ab5-4db7-a84e-b29809da2172 status: test description: Detects enabling of the "AllowAnonymousCallback" registry value, which allows a remote connection between computers that do not have a trust relationship. references: - https://learn.microsoft.com/en-us/windows/win32/wmisdk/connecting-to-wmi-remotely-starting-with-vista author: X__Junior (Nextron Systems) date: 2023-11-03 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_set detection: selection: TargetObject|contains: \Microsoft\WBEM\CIMOM\AllowAnonymousCallback Details: DWORD (0x00000001) condition: selection falsepositives: - Administrative activity level: medium
Query: vulnerability: libstagefright in Android 5.x before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka i
Matching passage: CVE-2015-7716. CWE: CWE-119. CVSS: 10.0. libstagefright in Android 5.x before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 20721050, a different vulnerability than CVE-2015-3873.
Near-miss passage: CVE-2015-7085. CWE: CWE-119. CVSS: 6.599999904632568. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
Query: risk of SQL injection vulnerability in the Spider Contacts module for Drupal allows remote authenticated users with the "access Spider Contacts category administration" permission to execu
Matching passage: CVE-2015-4348. CWE: CWE-89. CVSS: 6.0. SQL injection vulnerability in the Spider Contacts module for Drupal allows remote authenticated users with the "access Spider Contacts category administration" permission to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-5504. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the Novalnet Payment Module Ubercart module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Query: alert when Detects file creation events with filename patterns used by CrackMapExec.
Matching passage: Sigma rule: Detects file creation events with filename patterns used by CrackMapExec.. Logsource: windows / file_event. Rule: title: HackTool - CrackMapExec File Indicators id: 736ffa74-5f6f-44ca-94ef-1c0df4f51d2a related: - id: 9433ff9c-5d3f-4269-99f8-95fc826ea489 type: obsolete status: test description: Detects file creation events with filename patterns used by CrackMapExec. references: - https://github.com/byt3bl33d3r/CrackMapExec/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-03-11 modified: 2024-06-27 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: file_event detection: selection_path: TargetFilename|startswith: C:\Windows\Temp\ selection_names_str: TargetFilename|endswith: - \temp.ps1 - \msol.ps1 selection_names_re: - TargetFilename|re: \\[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.txt$ - TargetFilename|re: \\[a-zA-Z]{8}\.tmp$ condition: selection_path and 1 of selection_names_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detection of unusual child processes by different system processes. Logsource: windows / process_creation. Rule: title: Abused Debug Privilege by Arbitrary Parent Processes id: d522eca2-2973-4391-a3e0-ef0374321dae status: test description: Detection of unusual child processes by different system processes references: - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-74-638.jpg author: Semanur Guneysu @semanurtg, oscd.community date: 2020-10-28 modified: 2022-11-11 tags: - attack.privilege-escalation - attack.t1548 logsource: product: windows category: process_creation detection: selection_parent: ParentImage|endswith: - \winlogon.exe - \services.exe - \lsass.exe - \csrss.exe - \smss.exe - \wininit.exe - \spoolsv.exe - \searchindexer.exe User|contains: - AUTHORI - AUTORI selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \cmd.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll - Cmd.Exe filter: CommandLine|contains|all: - ' route ' - ' ADD ' condition: all of selection_* and not filter falsepositives: - Unknown level: high