alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Race condition in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Ad
Matching passage: CVE-2015-3081. CWE: CWE-362. CVSS: 4.300000190734863. Race condition in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allows attackers to bypass the Internet Explorer Protected Mode protection mechanism via unspecified vectors.
Near-miss passage: CVE-2015-3709. CWE: CWE-362. CVSS: 6.900000095367432. Race condition in kext tools in Apple OS X before 10.10.4 allows local users to bypass intended signature requirements for kernel extensions by leveraging improper pathname validation.
Query: Encoded PowerShell / command-line abuse matching Cloud Account
Matching passage: T1136.003 Cloud Account. Tactics: persistence. Description: Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.(Citation: Microsoft O365 Admin Roles)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: AWS Create IAM User)(Citation: GCP Create Cloud Identity Users)(Citation: Microsoft Azure AD Users) In addition to user accounts, cloud accounts may be associated with services. Cloud providers handle the concept of service accounts in different ways. In Azure, service accounts include service principals and managed identities, which can be linked to various resources such as OAuth applications, serverless functions, and virtual machines in order to grant those resources permissions to perform various activities in the environment.(Citation: Microsoft Entra ID Service Principals) In GCP, service accounts can also be linked to specific resources, as well as be impersonated by other accounts for [Temporary Elevated Cloud Access](https://attack.mitre.org/techniques/T1548/005).(Citation: GCP Service Accounts) While AWS has no specific concept of service accounts, resources can be directly granted permission to assume roles.(Citation: AWS Instance Profiles)(Citation: AWS Lambda Execution Role) Adversaries may create accounts that only have access to specific cloud services, which can reduce the chance of detection. Once an adversary has created a cloud account, they can then manipulate that account to ensure persistence and allow access to additional resources - for example, by adding [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) or assigning [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003).
Near-miss passage: T1136 Create Account. Tactics: persistence. Description: Adversaries may create an account to maintain access to victim systems.(Citation: Symantec WastedLocker June 2020) With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system. Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.
Query: detect Detects PowerShell scripts that utilize native PowerShell Identity modules to request Kerberos tickets. This behavior is in logs
Matching passage: Sigma rule: Detects PowerShell scripts that utilize native PowerShell Identity modules to request Kerberos tickets. This behavior is. Logsource: windows / ps_script. Rule: title: Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlock id: a861d835-af37-4930-bcd6-5b178bfb54df related: - id: caa9a802-8bd8-4b9e-a5cd-4d6221670219 type: similar status: test description: 'Detects PowerShell scripts that utilize native PowerShell Identity modules to request Kerberos tickets. This behavior is typically seen during a Kerberos or silver ticket attack. A successful execution will output the SPNs for the endpoint in question. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1558.003/T1558.003.md#atomic-test-4---request-a-single-ticket-via-powershell - https://learn.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8.1 author: frack113 date: 2021-12-28 modified: 2025-11-18 tags: - attack.credential-access - attack.t1558.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - System.IdentityModel.Tokens.KerberosRequestorSecurityToken - .GetRequest() condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a suspicious program execution in Outlook temp folder. Logsource: windows / process_creation. Rule: title: Suspicious Execution From Outlook Temporary Folder id: a018fdc3-46a3-44e5-9afb-2cd4af1d4b39 status: test description: Detects a suspicious program execution in Outlook temp folder author: Florian Roth (Nextron Systems) references: - Internal Research date: 2019-10-01 modified: 2022-10-09 tags: - attack.initial-access - attack.t1566.001 logsource: category: process_creation product: windows detection: selection: Image|contains: \Temporary Internet Files\Content.Outlook\ condition: selection falsepositives: - Unknown level: high
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects usage of curl to upload files to known file sharing domains, which may indicate data exfiltration.. Logsource: windows / process_creation. Rule: title: Curl File Upload To File Sharing Websites id: e328cc73-f92a-42fb-b3fa-7c2cffda981a related: - id: 00bca14a-df4e-4649-9054-3f2aa676bc04 type: derived - id: 7d1aaf3d-4304-425c-b7c3-162055e0b3ab type: similar status: experimental description: Detects usage of curl to upload files to known file sharing domains, which may indicate data exfiltration. author: Swachchhanda Shrawan Poudel (Nextron Systems) references: - https://unit42.paloaltonetworks.com/advanced-backdoor-squidoor/ date: 2026-03-29 tags: - attack.exfiltration - attack.t1567.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \curl.exe - OriginalFileName: curl.exe selection_cli_domain: CommandLine|contains: - 0x0.st - bashupload.com - chunk.io - file.io - filebin.net - pastebin - send.firefox.com - temp.sh - transfer.sh - ufile.io - uploadfiles.io - wetransfer.com - x0.at selection_cli_flags: - CommandLine|contains: - ' --form' - ' --upload-file' - ' --data' - ' -X POST' - ' --request POST ' - CommandLine|re: - \s-[FTd]\s - \s-sT\s condition: all of selection_* falsepositives: - Legitimate file uploads to these services by administrators or developers level: high
Near-miss passage: Sigma rule: Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse sh. Logsource: linux / process_creation. Rule: title: Potential Netcat Reverse Shell Execution id: 7f734ed0-4f47-46c0-837f-6ee62505abd9 status: test description: Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse shell setup. references: - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet - https://www.revshells.com/ - https://www.hackingtutorials.org/networking/hacking-netcat-part-2-bind-reverse-shells/ - https://www.infosecademy.com/netcat-reverse-shells/ - https://man7.org/linux/man-pages/man1/ncat.1.html author: '@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)' date: 2023-04-07 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection_nc: Image|endswith: - /nc - /ncat selection_flags: CommandLine|contains: - ' -c ' - ' -e ' selection_shell: CommandLine|contains: - ' ash' - ' bash' - ' bsh' - ' csh' - ' ksh' - ' pdksh' - ' sh' - ' tcsh' - /bin/ash - /bin/bash - /bin/bsh - /bin/csh - /bin/ksh - /bin/pdksh - /bin/sh - /bin/tcsh - /bin/zsh - $IFSash - $IFSbash - $IFSbsh - $IFScsh - $IFSksh - $IFSpdksh - $IFSsh - $IFStcsh - $IFSzsh condition: all of selection_* falsepositives: - Unlikely level: high
Query: indicators of Search Victim-Owned Websites
Matching passage: T1594 Search Victim-Owned Websites. Tactics: reconnaissance. Description: Adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: [Email Addresses](https://attack.mitre.org/techniques/T1589/002)). These sites may also have details highlighting business operations and relationships.(Citation: Comparitech Leak) Adversaries may search victim-owned websites to gather actionable information. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199) or [Phishing](https://attack.mitre.org/techniques/T1566)). In addition to manually browsing the website, adversaries may attempt to identify hidden directories or files that could contain additional sensitive information or vulnerable functionality. They may do this through automated activities such as [Wordlist Scanning](https://attack.mitre.org/techniques/T1595/003), as well as by leveraging files such as sitemap.xml and robots.txt.(Citation: Perez Sitemap XML 2023)(Citation: Register Robots TXT 2015)
Near-miss passage: T1596 Search Open Technical Databases. Tactics: reconnaissance. Description: Adversaries may search freely available technical databases for information about victims that can be used during targeting. Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans.(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS)(Citation: Medium SSL Cert)(Citation: SSLShopper Lookup)(Citation: DigitalShadows CDN)(Citation: Shodan) Adversaries may search in different open databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Query: exploit (1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly exe
Matching passage: CVE-2015-2291. CWE: CWE-20. CVSS: 7.800000190734863. (1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call.
Near-miss passage: CVE-2015-3237. CWE: CWE-20. CVSS: 6.400000095367432. The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.
Query: detection rule: Detects shell32.dll executing a DLL in a suspicious directory
Matching passage: Sigma rule: Detects shell32.dll executing a DLL in a suspicious directory. Logsource: windows / process_creation. Rule: title: Shell32 DLL Execution in Suspicious Directory id: 32b96012-7892-429e-b26c-ac2bf46066ff status: test description: Detects shell32.dll executing a DLL in a suspicious directory references: - https://www.group-ib.com/resources/threat-research/red-curl-2.html author: Christian Burkard (Nextron Systems) date: 2021-11-24 modified: 2023-02-09 tags: - attack.execution - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|contains|all: - shell32.dll - Control_RunDLL CommandLine|contains: - '%AppData%' - '%LocalAppData%' - '%Temp%' - '%tmp%' - \AppData\ - \Temp\ - \Users\Public\ condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the setting of the "DumpType" registry value to "2" which stands for a "Full Dump". Technique such as LSASS Shti. Logsource: windows / registry_set. Rule: title: Lsass Full Dump Request Via DumpType Registry Settings id: 33efc23c-6ea2-4503-8cfe-bdf82ce8f719 status: test description: Detects the setting of the "DumpType" registry value to "2" which stands for a "Full Dump". Technique such as LSASS Shtinkering requires this value to be "2" in order to dump LSASS. references: - https://github.com/deepinstinct/Lsass-Shtinkering - https://learn.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf author: '@pbssubhash' date: 2022-12-08 modified: 2023-08-17 tags: - attack.credential-access - attack.t1003.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\DumpType - \SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\lsass.exe\DumpType Details: DWORD (0x00000002) condition: selection falsepositives: - Legitimate application that needs to do a full dump of their process level: high
Query: common weakness: Insecure Security Identifier Mechanism
Matching passage: CWE-1294 Insecure Security Identifier Mechanism. The System-on-Chip (SoC) implements a Security Identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Identifiers are not correctly implemented.
Near-miss passage: CWE-424 Improper Protection of Alternate Path. The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.
Query: vulnerability: Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Utility/Zones.
Matching passage: CVE-2015-4834. CWE: UNKNOWN. CVSS: 3.700000047683716. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Utility/Zones.
Near-miss passage: CVE-2015-7765. CWE: UNKNOWN. CVSS: 9.0. ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access by leveraging knowledge of this password.
Query: CVE similar to CVE-2015-2510
Matching passage: CVE-2015-2510. CWE: CWE-119. CVSS: 9.300000190734863. Buffer overflow in the Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 SP3, Office 2010 SP2, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "Graphics Component Buffer Overflow Vulnerability."
Near-miss passage: CVE-2015-2491. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2485 and CVE-2015-2541.
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to 
Matching passage: CVE-2015-4631. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to inject arbitrary web script or HTML via the (1) tag parameter to opac-search.pl; the (2) value parameter to authorities/authorities-home.pl; the (3) delay parameter to acqui/lateorders.pl; the (4) authtypecode or (5) tagfield to admin/auth_subfields_structure.pl; the (6) tagfield parameter to admin/marc_subfields_structure.pl; the (7) limit parameter to catalogue/search.pl; the (8) bookseller_filter, (9) callnumber_filter, (10) EAN_filter, (11) ISSN_filter, (12) publisher_filter, or (13) title_filter parameter to serials/serials-search.pl; or the (14) author, (15) collectiontitle, (16) copyrightdate, (17) isbn, (18) manageddate_from, (19) manageddate_to, (20) publishercode, (21) suggesteddate_from, or (22) suggesteddate_to parameter to suggestion/suggestion.pl; or the (23) direction, (24) display or (25) addshelf parameter to opac-shelves.pl.
Near-miss passage: CVE-2015-4699. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the Splash Portal in Cloud4Wi before 5.9.7 allows remote attackers to inject arbitrary web script or HTML via the recoveryMessage parameter to the default URI.
Query: explain T1580 Cloud Infrastructure Discovery
Matching passage: T1580 Cloud Infrastructure Discovery. Tactics: discovery. Description: An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services. Cloud providers offer methods such as APIs and commands issued through CLIs to serve information about infrastructure. For example, AWS provides a <code>DescribeInstances</code> API within the Amazon EC2 API that can return information about one or more instances within an account, the <code>ListBuckets</code> API that returns a list of all buckets owned by the authenticated sender of the request, the <code>HeadBucket</code> API to determine a bucket’s existence along with access permissions of the request sender, or the <code>GetPublicAccessBlock</code> API to retrieve access block configuration for a bucket.(Citation: Amazon Describe Instance)(Citation: Amazon Describe Instances API)(Citation: AWS Get Public Access Block)(Citation: AWS Head Bucket) Similarly, GCP's Cloud SDK CLI provides the <code>gcloud compute instances list</code> command to list all Google Compute Engine instances in a project (Citation: Google Compute Instances), and Azure's CLI command <code>az vm list</code> lists details of virtual machines.(Citation: Microsoft AZ CLI) In addition to API commands, adversaries can utilize open source tools to discover cloud storage infrastructure through [Wordlist Scanning](https://attack.mitre.org/techniques/T1595/003).(Citation: Malwarebytes OSINT Leaky Buckets - Hioureas) An adversary may enumerate resources using a compromised user's access keys to determine which are available to that user.(Citation: Expel IO Evil in AWS) The discovery of these available resources may help adversaries determine their next steps in the Cloud environment, such as establishing Persistence.(Citation: Mandiant M-Trends 2020)An adversary may also use this informa
Near-miss passage: T1518.002 Backup Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of backup software or configurations that are installed on a system. Adversaries may use this information to shape follow-on behaviors, such as [Data Destruction](https://attack.mitre.org/techniques/T1485), [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486). Commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), `reg query` with [Reg](https://attack.mitre.org/software/S0075), `dir` with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for, such as Veeam, Acronis, Dropbox, or Paragon.(Citation: Symantec Play Ransomware 2023)
Query: rule covering Detects when an instance identity has taken an action that isn't inside SSM. This can indicate that a compromised EC2 in
Matching passage: Sigma rule: Detects when an instance identity has taken an action that isn't inside SSM. This can indicate that a compromised EC2 in. Logsource: aws / cloudtrail. Rule: title: Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure id: 352a918a-34d8-4882-8470-44830c507aa3 status: test description: 'Detects when an instance identity has taken an action that isn''t inside SSM. This can indicate that a compromised EC2 instance is being used as a pivot point. ' references: - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-identity-roles.html - https://ermetic.com/blog/aws/aws-ec2-imds-what-you-need-to-know/ - https://www.packetmischief.ca/2023/07/31/amazon-ec2-credential-exfiltration-how-it-happens-and-how-to-mitigate-it/#lifting-credentials-from-imds-this-is-why-we-cant-have-nice-things author: jamesc-grafana date: 2024-07-11 tags: - attack.privilege-escalation - attack.initial-access - attack.persistence - attack.stealth - attack.t1078 - attack.t1078.002 logsource: product: aws service: cloudtrail detection: selection: userIdentity.arn|re: .+:assumed-role/aws:.+ filter_main_generic: - eventSource: ssm.amazonaws.com - eventName: RegisterManagedInstance - sourceIPAddress: AWS Internal condition: selection and not 1 of filter_main_* falsepositives: - A team has configured an EC2 instance to use instance profiles that grant the option for the EC2 instance to talk to other AWS Services level: high
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "SolidPDFCreator.dll". Logsource: windows / image_load. Rule: title: Potential SolidPDFCreator.DLL Sideloading id: a2edbce1-95c8-4291-8676-0d45146862b3 status: test description: Detects potential DLL sideloading of "SolidPDFCreator.dll" references: - https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/ author: X__Junior (Nextron Systems) date: 2023-05-07 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \SolidPDFCreator.dll filter_main_path: Image|endswith: \SolidPDFCreator.exe ImageLoaded|startswith: - C:\Program Files (x86)\SolidDocuments\SolidPDFCreator\ - C:\Program Files\SolidDocuments\SolidPDFCreator\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium