alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for aws / cloudtrail
Matching passage: Sigma rule: Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauth. Logsource: aws / cloudtrail. Rule: title: Modification or Deletion of an AWS RDS Cluster id: 457cc9ac-d8e6-4d1d-8c0e-251d0f11a74c status: experimental description: Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information. references: - https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBCluster.html - https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBCluster.html - https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc#rds-modifydbinstance author: Ivan Saakov date: 2024-12-06 tags: - attack.exfiltration - attack.t1020 logsource: product: aws service: cloudtrail detection: selection: eventSource: rds.amazonaws.com eventName: - ModifyDBCluster - DeleteDBCluster condition: selection falsepositives: - Verify if the modification or deletion was performed by an authorized administrator. - Confirm if the modification or deletion was part of a planned change or maintenance activity. level: high
Near-miss passage: Sigma rule: Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.. Logsource: windows / openssh. Rule: title: OpenSSH Server Listening On Socket id: 3ce8e9a4-bc61-4c9b-8e69-d7e2492a8781 status: test description: Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket. references: - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.004-Remote%20Service%20SSH - https://winaero.com/enable-openssh-server-windows-10/ - https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse - https://virtualizationreview.com/articles/2020/05/21/ssh-server-on-windows-10.aspx - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16 author: mdecrevoisier date: 2022-10-25 tags: - attack.lateral-movement - attack.t1021.004 logsource: product: windows service: openssh detection: selection: EventID: 4 process: sshd payload|startswith: 'Server listening on ' condition: selection falsepositives: - Legitimate administrator activity level: medium
Query: patch priority for CVE-2015-3158
Matching passage: CVE-2015-3158. CWE: CWE-264. CVSS: 4.0. The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a (1) direct request or (2) request through an SP initiated flow.
Near-miss passage: CVE-2015-1643. CWE: CWE-264. CVSS: 7.199999809265137. Microsoft Windows Server 2003 R2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "NtCreateTransactionManager Type Confusion Vulnerability."
Query: patch priority for CVE-2015-6629
Matching passage: CVE-2015-6629. CWE: CWE-200. CVSS: 5.0. Wi-Fi in Android 5.x before 5.1.1 LMY48Z allows attackers to obtain sensitive information via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 22667667.
Near-miss passage: CVE-2015-6858. CWE: CWE-200. CVSS: 3.700000047683716. HP Insight Control server provisioning before 7.5.0 RabbitMQ allows remote attackers to obtain sensitive information via unspecified vectors.
Query: exploit The Email Security Gateway in Websense TRITON AP-EMAIL before 8.0.0 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
Matching passage: CVE-2015-2765. CWE: CWE-20. CVSS: 4.300000190734863. The Email Security Gateway in Websense TRITON AP-EMAIL before 8.0.0 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
Near-miss passage: CVE-2015-0726. CWE: CWE-20. CVSS: 6.800000190734863. The web administration interface on Cisco Wireless LAN Controller (WLC) devices before 7.0.241, 7.1.x through 7.4.x before 7.4.122, and 7.5.x and 7.6.x before 7.6.120 allows remote authenticated users to cause a denial of service (device crash) via unspecified parameters, aka Bug IDs CSCum65159 and CSCum65252.
Query: vulnerability: SystemUI in Android 5.x before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or Signa
Matching passage: CVE-2015-6621. CWE: CWE-264. CVSS: 9.300000190734863. SystemUI in Android 5.x before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23909438.
Near-miss passage: CVE-2015-6620. CWE: CWE-264. CVSS: 9.300000190734863. libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bugs 24123723 and 24445127.
Query: what is T1053.004
Matching passage: T1053.004 Launchd. Tactics: execution, persistence, privilege escalation. Description: This technique is deprecated due to the inaccurate usage. The report cited did not provide technical detail as to how the malware interacted directly with launchd rather than going through known services. Other system services are used to interact with launchd rather than launchd being used by itself. Adversaries may abuse the <code>Launchd</code> daemon to perform task scheduling for initial or recurring execution of malicious code. The <code>launchd</code> daemon, native to macOS, is responsible for loading and maintaining services within the operating system. This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in <code>/System/Library/LaunchDaemons</code> and <code>/Library/LaunchDaemons</code> (Citation: AppleDocs Launch Agent Daemons). These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence). An adversary may use the <code>launchd</code> daemon in macOS environments to schedule new executables to run at system startup or on a scheduled basis for persistence. <code>launchd</code> can also be abused to run a process under the context of a specified account. Daemons, such as <code>launchd</code>, run with the permissions of the root user account, and will operate regardless of which user account is logged in.
Near-miss passage: T1053 Scheduled Task/Job. Tactics: execution, persistence, privilege escalation. Description: Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.(Citation: TechNet Task Scheduler Security) Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges). Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.(Citation: ProofPoint Serpent)
Query: CVE similar to CVE-2015-2167
Matching passage: CVE-2015-2167. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the 3PI Manager in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5, and 6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter to jsp/start-3pi-manager.jsp.
Near-miss passage: CVE-2015-8320. CWE: UNKNOWN. CVSS: 5.0. Apache Cordova-Android before 3.7.0 improperly generates random values for BridgeSecret data, which makes it easier for attackers to conduct bridge hijacking attacks by predicting a value.
Query: vulnerability: Multiple SQL injection vulnerabilities in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allow remote authenticated users to execute arbitrary 
Matching passage: CVE-2015-7727. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors in the (1) trace configuration page or (2) getSqlTraceConfiguration function, aka SAP Security Note 2153898.
Near-miss passage: CVE-2015-10023. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability classified as critical has been found in Fumon trello-octometric. This affects the function main of the file metrics-ui/server/srv.go. The manipulation of the argument num leads to sql injection. The patch is named a1f1754933fbf21e2221fbc671c81a47de6a04ef. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217611.
Query: detect Detects the restoration of files from the defender quarantine in logs
Matching passage: Sigma rule: Detects the restoration of files from the defender quarantine. Logsource: windows / windefend. Rule: title: Win Defender Restored Quarantine File id: bc92ca75-cd42-4d61-9a37-9d5aa259c88b status: test description: Detects the restoration of files from the defender quarantine references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-06 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: 1009 condition: selection falsepositives: - Legitimate administrator activity restoring a file level: high
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via use MSHTA in Scripts. Logsource: windows / process_creation. Rule: title: Invoke-Obfuscation Via Use MSHTA id: ac20ae82-8758-4f38-958e-b44a3140ca88 status: test description: Detects Obfuscated Powershell via use MSHTA in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-08 modified: 2022-03-08 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - set - '&&' - mshta - vbscript:createobject - .run - (window.close) condition: selection falsepositives: - Unknown level: high
Query: risk of CRLF injection vulnerability in export.cfg in the web-based administrative console for Sierra Wireless AirCard 760S, 762S, and 763S allows remote attackers to inject arbitrary head
Matching passage: CVE-2015-2054. CWE: UNKNOWN. CVSS: 4.300000190734863. CRLF injection vulnerability in export.cfg in the web-based administrative console for Sierra Wireless AirCard 760S, 762S, and 763S allows remote attackers to inject arbitrary headers via CRLF sequences in the save parameter.
Near-miss passage: CVE-2015-2813. CWE: UNKNOWN. CVSS: 5.0. XML external entity (XXE) vulnerability in SAP Mobile Platform allows remote attackers to send requests to intranet servers via crafted XML, aka SAP Security Note 2125358.
Query: patch priority for CVE-2015-1333
Matching passage: CVE-2015-1333. CWE: CWE-119. CVSS: 4.900000095367432. Memory leak in the __key_link_end function in security/keys/keyring.c in the Linux kernel before 4.1.4 allows local users to cause a denial of service (memory consumption) via many add_key system calls that refer to existing keys.
Near-miss passage: CVE-2015-1930. CWE: CWE-119. CVSS: 7.800000190734863. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965.
Query: describe CVE-2015-1800
Matching passage: CVE-2015-1800. CWE: CWE-200. CVSS: 7.5. The samsung_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to potentially obtain sensitive information.
Near-miss passage: CVE-2015-4138. CWE: CWE-200. CVSS: 4.300000190734863. The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not include the HTTPOnly flag in a Set-Cookie header for the administrator's cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, a different vulnerability than CVE-2015-2855.
Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl. This activity m. Logsource: linux / process_creation. Rule: title: Kaspersky Endpoint Security Stopped Via CommandLine - Linux id: 36388120-b3f1-4ce9-b50b-280d9a7f4c04 status: experimental description: 'Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl. This activity may indicate a manual interruption of the antivirus service by an administrator, or it could be a sign of potential tampering or evasion attempts by malicious actors. ' references: - https://support.kaspersky.com/KES4Linux/12.0.0/en-US/197929.htm author: Milad Cheraghi date: 2025-10-18 tags: - attack.execution - attack.defense-impairment - attack.t1685 logsource: product: linux category: process_creation detection: selection: Image|endswith: - /systemctl - /bash - /sh CommandLine|contains|all: - stop - kesl condition: selection falsepositives: - System administrator manually stopping Kaspersky services level: high
Near-miss passage: Sigma rule: Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Via ClassicExplorer32.dll id: caa02837-f659-466f-bca6-48bde2826ab4 status: test description: Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software references: - https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets - https://app.any.run/tasks/6d8cabb0-dcda-44b6-8050-28d6ce281687/ author: frack113 date: 2022-12-13 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection_classicexplorer: ImageLoaded|endswith: \ClassicExplorer32.dll filter_classicexplorer: ImageLoaded|startswith: C:\Program Files\Classic Shell\ condition: selection_classicexplorer and not filter_classicexplorer falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-1854
Matching passage: CVE-2015-1854. CWE: CWE-284. CVSS: 7.5. 389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call.
Near-miss passage: CVE-2015-1763. CWE: CWE-284. CVSS: 8.5. Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014 does not prevent use of uninitialized memory in certain attempts to execute virtual functions, which allows remote authenticated users to execute arbitrary code via a crafted query, aka "SQL Server Remote Code Execution Vulnerability."
Query: weakness Improperly Controlled Sequential Memory Allocation
Matching passage: CWE-1325 Improperly Controlled Sequential Memory Allocation. The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.
Near-miss passage: CWE-1244 Internal Asset Exposed to Unsafe Debug Access Level or State. The product uses physical debug or test interfaces with support for multiple access levels, but it assigns the wrong debug access level to an internal asset, providing unintended access to the asset from untrusted debug agents.
Query: write Sigma for Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect u
Matching passage: Sigma rule: Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect u. Logsource: linux / auditd. Rule: title: Binary Padding - Linux id: c52a914f-3d8b-4b2a-bb75-b3991e75f8ba status: test description: 'Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.001/T1027.001.md author: Igor Fits, oscd.community date: 2020-10-13 modified: 2023-05-03 tags: - attack.stealth - attack.t1027.001 logsource: product: linux service: auditd detection: selection_execve: type: EXECVE keywords_truncate: '|all': - truncate - -s keywords_dd: '|all': - dd - if= keywords_filter: - of= condition: selection_execve and (keywords_truncate or (keywords_dd and not keywords_filter)) falsepositives: - Unknown level: high simulation: - type: atomic-red-team name: Pad Binary to Change Hash - Linux/macOS dd technique: T1027.001 atomic_guid: ffe2346c-abd5-4b45-a713-bf5f1ebd573a
Near-miss passage: Sigma rule: Identifies when a VPN connection is modified or deleted.. Logsource: azure / activitylogs. Rule: title: Azure VPN Connection Modified or Deleted id: 61171ffc-d79c-4ae5-8e10-9323dba19cd3 status: test description: Identifies when a VPN connection is modified or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-08-08 modified: 2022-08-23 tags: - attack.impact logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.NETWORK/VPNGATEWAYS/VPNCONNECTIONS/WRITE - MICROSOFT.NETWORK/VPNGATEWAYS/VPNCONNECTIONS/DELETE condition: selection falsepositives: - VPN Connection being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - VPN Connection modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: CVE similar to CVE-2015-0408
Matching passage: CVE-2015-0408. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI.
Near-miss passage: CVE-2015-4363. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the finder_form_goto function in the Finder module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Query: write Sigma for Detect enable rdp feature to allow specific user to rdp connect on the targeted machine
Matching passage: Sigma rule: Detect enable rdp feature to allow specific user to rdp connect on the targeted machine. Logsource: windows / registry_set. Rule: title: Allow RDP Remote Assistance Feature id: 37b437cf-3fc5-4c8e-9c94-1d7c9aff842b status: test description: Detect enable rdp feature to allow specific user to rdp connect on the targeted machine references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md author: frack113 date: 2022-08-19 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: System\CurrentControlSet\Control\Terminal Server\fAllowToGetHelp Details: DWORD (0x00000001) condition: selection falsepositives: - Legitimate use of the feature (alerts should be investigated either way) level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_allow_rdp_remote_assistance_feature/info.yml simulation: - type: atomic-red-team name: Allow RDP Remote Assistance Feature technique: T1112 atomic_guid: 86677d0e-0b5e-4a2b-b302-454175f9aa9e
Near-miss passage: Sigma rule: Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.. Logsource: aws / cloudtrail. Rule: title: AWS STS AssumeRole Misuse id: 905d389b-b853-46d0-9d3d-dea0d3a3cd49 status: test description: Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges. references: - https://github.com/elastic/detection-rules/pull/1214 - https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html author: Austin Songer @austinsonger date: 2021-07-24 modified: 2022-10-09 tags: - attack.lateral-movement - attack.privilege-escalation - attack.t1548 - attack.t1550 - attack.t1550.001 logsource: product: aws service: cloudtrail detection: selection: userIdentity.type: AssumedRole userIdentity.sessionContext.sessionIssuer.type: Role condition: selection falsepositives: - AssumeRole may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - AssumeRole from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. - Automated processes that uses Terraform may lead to false positives. level: low