alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects when a EFS Fileshare is modified or deleted. You can't delete a file system that is in use. If the file system h
Matching passage: Sigma rule: Detects when a EFS Fileshare is modified or deleted. You can't delete a file system that is in use. If the file system h. Logsource: aws / cloudtrail. Rule: title: AWS EFS Fileshare Modified or Deleted id: 25cb1ba1-8a19-4a23-a198-d252664c8cef status: test description: 'Detects when a EFS Fileshare is modified or deleted. You can''t delete a file system that is in use. If the file system has any mount targets, the adversary must first delete them, so deletion of a mount will occur before deletion of a fileshare. ' references: - https://docs.aws.amazon.com/efs/latest/ug/API_DeleteFileSystem.html author: Austin Songer @austinsonger date: 2021-08-15 modified: 2022-10-09 tags: - attack.impact logsource: product: aws service: cloudtrail detection: selection: eventSource: elasticfilesystem.amazonaws.com eventName: DeleteFileSystem condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).. Logsource: windows / security. Rule: title: SMB Create Remote File Admin Share id: b210394c-ba12-4f89-9117-44a2464b9511 status: test description: Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$). references: - https://github.com/OTRF/ThreatHunter-Playbook/blob/f7a58156dbfc9b019f17f638b8c62d22e557d350/playbooks/WIN-201012004336.yaml - https://securitydatasets.com/notebooks/atomic/windows/lateral_movement/SDWIN-200806015757.html?highlight=create%20file author: Jose Rodriguez (@Cyb3rPandaH), OTR (Open Threat Research) date: 2020-08-06 modified: 2025-10-17 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: security detection: selection: EventID: 5145 ShareName|endswith: C$ AccessMask: '0x2' filter_main_subjectusername: SubjectUserName|endswith: $ filter_optional_local_ip: IpAddress: ::1 condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Query: mitigate Hybrid Identity
Matching passage: T1556.007 Hybrid Identity. Tactics: defense impairment, persistence, credential access. Description: Adversaries may patch, modify, or otherwise backdoor cloud authentication processes that are tied to on-premises user identities in order to bypass typical authentication mechanisms, access credentials, and enable persistent access to accounts. Many organizations maintain hybrid user and device identities that are shared between on-premises and cloud-based environments. These can be maintained in a number of ways. For example, Microsoft Entra ID includes three options for synchronizing identities between Active Directory and Entra ID(Citation: Azure AD Hybrid Identity): * Password Hash Synchronization (PHS), in which a privileged on-premises account synchronizes user password hashes between Active Directory and Entra ID, allowing authentication to Entra ID to take place entirely in the cloud * Pass Through Authentication (PTA), in which Entra ID authentication attempts are forwarded to an on-premises PTA agent, which validates the credentials against Active Directory * Active Directory Federation Services (AD FS), in which a trust relationship is established between Active Directory and Entra ID AD FS can also be used with other SaaS and cloud platforms such as AWS and GCP, which will hand off the authentication process to AD FS and receive a token containing the hybrid users’ identity and privileges. By modifying authentication processes tied to hybrid identities, an adversary may be able to establish persistent privileged access to cloud resources. For example, adversaries who compromise an on-premises server running a PTA agent may inject a malicious DLL into the `AzureADConnectAuthenticationAgentService` process that authorizes all attempts to authenticate to Entra ID, as well as records user credentials.(Citation: Azure AD Connect for Read Teamers)(Citation: AADInternals Azure AD On-Prem to Cloud) In environments using AD FS, an adversary may edit the `Microsoft.IdentityServer.Servicehost` configuration file to load a malicious DLL that generates authentication
Near-miss passage: T1556.004 Network Device Authentication. Tactics: defense impairment, persistence, credential access. Description: Adversaries may use [Patch System Image](https://attack.mitre.org/techniques/T1601/001) to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices. [Modify System Image](https://attack.mitre.org/techniques/T1601) may include implanted code to the operating system for network devices to provide access for adversaries using a specific password. The modification includes a specific password which is implanted in the operating system image via the patch. Upon authentication attempts, the inserted code will first check to see if the user input is the password. If so, access is granted. Otherwise, the implanted code will pass the credentials on for verification of potentially valid credentials.(Citation: Mandiant - Synful Knock)
Query: secure coding against Initialization of a Resource with an Insecure Default
Matching passage: CWE-1188 Initialization of a Resource with an Insecure Default. The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
Near-miss passage: CWE-1330 Remanent Data Readable after Memory Erase. Confidential information stored in memory circuits is readable or recoverable after being cleared or erased.
Query: risk of The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection.
Matching passage: CVE-2015-9398. CWE: CWE-89. CVSS: 8.800000190734863. The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection.
Near-miss passage: CVE-2015-6331. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the web framework in Cisco Prime Collaboration Assurance 10.5(1) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCus39887.
Query: patch priority for CVE-2015-2092
Matching passage: CVE-2015-2092. CWE: CWE-119. CVSS: 7.5. The AnnotationX.AnnList.1 ActiveX control in Agilent Technologies Feature Extraction allows remote attackers to execute arbitrary code via a crafted object parameter in the Insert function, related to "Index Out-Of-Bounds."
Near-miss passage: CVE-2015-8088. CWE: CWE-119. CVSS: 7.800000190734863. Heap-based buffer overflow in the HIFI driver in Huawei Mate 7 phones with software MT7-UL00 before MT7-UL00C17B354, MT7-TL10 before MT7-TL10C00B354, MT7-TL00 before MT7-TL00C01B354, and MT7-CL00 before MT7-CL00C92B354 and P8 phones with software GRA-TL00 before GRA-TL00C01B220SP01, GRA-CL00 before GRA-CL00C92B220, GRA-CL10 before GRA-CL10C92B220, GRA-UL00 before GRA-UL00C00B220, and GRA-UL10 before GRA-UL10C00B220 allows attackers to cause a denial of service (reboot) or execute arbitrary code via a crafted application.
Query: CVE similar to CVE-2015-5714
Matching passage: CVE-2015-5714. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags.
Near-miss passage: CVE-2015-9319. CWE: CWE-79. CVSS: 6.099999904632568. The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.
Query: describe CVE-2015-1648
Matching passage: CVE-2015-1648. CWE: CWE-19. CVSS: 2.5999999046325684. ASP.NET in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, when the customErrors configuration is disabled, allows remote attackers to obtain sensitive configuration-file information via a crafted request, aka "ASP.NET Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-1759. CWE: CWE-19. CVSS: 9.300000190734863. Microsoft Office Compatibility Pack SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: CVE similar to CVE-2015-8667
Matching passage: CVE-2015-8667. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Reset Your Password module in Exponent CMS before 2.3.5 allows remote attackers to inject arbitrary web script or HTML via the Username/Email.
Near-miss passage: CVE-2015-3357. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Wishlist module before 6.x-2.7 and 7.x-2.x before 7.x-2.7 for Drupal allows remote authenticated users with the "access wishlists" permission to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a log message.
Query: write Sigma for Detects new user account creation
Matching passage: Sigma rule: Detects new user account creation. Logsource: okta / okta. Rule: title: New Okta User Created id: b6c718dd-8f53-4b9f-98d8-93fdca966969 status: test description: Detects new user account creation author: Nasreddine Bencherchali (Nextron Systems) date: 2023-10-25 modified: 2026-04-27 references: - https://developer.okta.com/docs/reference/api/event-types/ tags: - attack.credential-access logsource: service: okta product: okta detection: selection: eventType: user.lifecycle.create condition: selection falsepositives: - Legitimate and authorized user creation level: informational
Near-miss passage: Sigma rule: Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential. Logsource: windows / ps_script. Rule: title: PowerShell Web Access Installation - PsScript id: 5f9c7f1a-7c21-4c39-b2f3-8d8006e0e51f status: test description: Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse references: - https://docs.microsoft.com/en-us/powershell/module/powershellwebaccess/install-pswawebapplication - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a - https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41 author: Michael Haag date: 2024-09-03 tags: - attack.persistence - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_install: ScriptBlockText|contains: Install-WindowsFeature WindowsPowerShellWebAccess selection_config: ScriptBlockText|contains: Install-PswaWebApplication selection_auth: ScriptBlockText|contains|all: - Add-PswaAuthorizationRule - -UserName * - -ComputerName * condition: 1 of selection_* falsepositives: - Legitimate PowerShell Web Access installations by administrators level: high
Query: exploit The file_manager component in eFront CMS before 3.6.15.5 allows remote authenticated users to bypass intended file-upload restrictions by appending a crafted parameter to the file 
Matching passage: CVE-2015-4463. CWE: CWE-434. CVSS: 6.5. The file_manager component in eFront CMS before 3.6.15.5 allows remote authenticated users to bypass intended file-upload restrictions by appending a crafted parameter to the file URL.
Near-miss passage: CVE-2015-1000000. CWE: CWE-434. CVSS: 9.800000190734863. Remote file upload vulnerability in mailcwp v1.99 wordpress plugin
Query: CWE for J2EE Misconfiguration: Data Transmission Without Encryption
Matching passage: CWE-5 J2EE Misconfiguration: Data Transmission Without Encryption. Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.
Near-miss passage: CWE-299 Improper Check for Certificate Revocation. The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.
Query: patch priority for CVE-2015-7224
Matching passage: CVE-2015-7224. CWE: CWE-287. CVSS: 9.800000190734863. puppetlabs-mysql 3.1.0 through 3.6.0 allow remote attackers to bypass authentication by leveraging creation of a database account without a password when a 'mysql_user' user parameter contains a host with a netmask.
Near-miss passage: CVE-2015-8332. CWE: CWE-287. CVSS: 8.800000190734863. Huawei Video Content Management (VCM) before V100R001C10SPC001 does not properly "authenticate online user identities and privileges," which allows remote authenticated users to gain privileges and perform a case operation as another user via a crafted message, aka "Horizontal Privilege Escalation Vulnerability."
Query: CWE for Path Traversal: '/../filedir'
Matching passage: CWE-25 Path Traversal: '/../filedir'. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize /../ sequences that can resolve to a location that is outside of that directory.
Near-miss passage: CWE-241 Improper Handling of Unexpected Data Type. The product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (A-Z).
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in Adminsystems CMS before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter to ind
Matching passage: CVE-2015-1603. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Adminsystems CMS before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter to index.php or (2) id parameter in a users_users action to asys/site/system.php.
Near-miss passage: CVE-2015-5484. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in the Plotly plugin before 1.0.3 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via a post.
Query: patch priority for CVE-2015-5555
Matching passage: CVE-2015-5555. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-5554, CVE-2015-5558, and CVE-2015-5562.
Near-miss passage: CVE-2015-8050. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in the MovieClip object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a crafted beginGradientFill call, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: CVE similar to CVE-2015-3922
Matching passage: CVE-2015-3922. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in mode.php in Coppermine Photo Gallery before 1.5.36 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referer parameter.
Near-miss passage: CVE-2015-0912. CWE: UNKNOWN. CVSS: 6.5. EasyCTF before 1.4 allows remote authenticated users to write executable content to files via unspecified vectors.
Query: containment actions for Outbound C2 pattern associated with File Transfer Protocols
Matching passage: Playbook for T1071.002 File Transfer Protocols. 1) Validate alert telemetry against T1071.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: command and control. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as SMB(Citation: US-CERT TA18-074A), FTP(Citation: ESET Machete J
Near-miss passage: Playbook for T1071.005 Publish/Subscribe Protocols. Different response path focused on command and control.
Query: vulnerability: SQL injection vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote attackers to execute arbitrary commands via unspecified parameters.
Matching passage: CVE-2015-3616. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote attackers to execute arbitrary commands via unspecified parameters.
Near-miss passage: CVE-2015-10039. CWE: CWE-89. CVSS: 8.0. A vulnerability was found in dobos domino. It has been rated as critical. Affected by this issue is some unknown functionality in the library src/Complex.Domino.Lib/Lib/EntityFactory.cs. The manipulation leads to sql injection. Upgrading to version 0.1.5524.38553 is able to address this issue. The name of the patch is 16f039073709a21a76526110d773a6cce0ce753a. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218024.
Query: EDR alert: possible Overwrite Process Arguments (T1036.011)
Matching passage: T1036.011 Overwrite Process Arguments. Tactics: stealth. Description: Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign process. On Linux, the operating system stores command-line arguments in the process’s stack and passes them to the `main()` function as the `argv` array. The first element, `argv[0]`, typically contains the process name or path - by default, the command used to actually start the process (e.g., `cat /etc/passwd`). By default, the Linux `/proc` filesystem uses this value to represent the process name. The `/proc/<PID>/cmdline` file reflects the contents of this memory, and tools like `ps` use it to display process information. Since arguments are stored in user-space memory at launch, this modification can be performed without elevated privileges. During runtime, adversaries can erase the memory used by all command-line arguments for a process, overwriting each argument string with null bytes. This removes evidence of how the process was originally launched. They can then write a spoofed string into the memory region previously occupied by `argv[0]` to mimic a benign command, such as `cat resolv.conf`. The new command-line string is reflected in `/proc/<PID>/cmdline` and displayed by tools like `ps`.(Citation: Sandfly BPFDoor 2022)(Citation: Microsoft XorDdos Linux Stealth 2022)
Near-miss passage: T1036 Masquerading. Tactics: stealth. Description: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site)
Query: detect Authentication Package
Matching passage: T1547.002 Authentication Package. Tactics: persistence, privilege escalation. Description: Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system.(Citation: MSDN Authentication Packages) Adversaries can use the autostart mechanism provided by LSA authentication packages for persistence by placing a reference to a binary in the Windows Registry location <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\</code> with the key value of <code>"Authentication Packages"=&lt;target binary&gt;</code>. The binary will then be executed by the system when the authentication packages are loaded.
Near-miss passage: T1547.015 Login Items. Tactics: persistence, privilege escalation. Description: Adversaries may add login items to execute upon user login to gain persistence or escalate privileges. Login items are applications, documents, folders, or server connections that are automatically launched when a user logs in.(Citation: Open Login Items Apple) Login items can be added via a shared file list or Service Management Framework.(Citation: Adding Login Items) Shared file list login items can be set using scripting languages such as [AppleScript](https://attack.mitre.org/techniques/T1059/002), whereas the Service Management Framework uses the API call <code>SMLoginItemSetEnabled</code>. Login items installed using the Service Management Framework leverage <code>launchd</code>, are not visible in the System Preferences, and can only be removed by the application that created them.(Citation: Adding Login Items)(Citation: SMLoginItemSetEnabled Schroeder 2013) Login items created using a shared file list are visible in System Preferences, can hide the application when it launches, and are executed through LaunchServices, not launchd, to open applications, documents, or URLs without using Finder.(Citation: Launch Services Apple Developer) Users and applications use login items to configure their user environment to launch commonly used services or applications, such as email, chat, and music applications. Adversaries can utilize [AppleScript](https://attack.mitre.org/techniques/T1059/002) and [Native API](https://attack.mitre.org/techniques/T1106) calls to create a login item to spawn malicious executables.(Citation: ELC Running at startup) Prior to version 10.5 on macOS, adversaries can add login items by using [AppleScript](https://attack.mitre.org/techniques/T1059/002) to send an Apple events to the “System Events” process, which has an AppleScript dictionary for manipulating login items.(Citation: Login Items AE) Adversaries can use a command such as <code>tell application “System Events” to make login item at end with properties /path/to/executable</code>.