alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-4487
Matching passage: CVE-2015-4487. CWE: CWE-119. CVSS: 7.5. The nsTSubstring::ReplacePrep function in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, related to an "overflow."
Near-miss passage: CVE-2015-6146. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6145.
Query: Sigma YAML for antivirus
Matching passage: Sigma rule: Detects an Antivirus alert in a highly relevant file path or with a relevant file name. This event must not be ignored j. Logsource: antivirus. Rule: title: Antivirus - Relevant File Paths Alerts Signature id: c9a88268-0047-4824-ba6e-4d81ce0b907c status: test description: 'Detects an Antivirus alert in a highly relevant file path or with a relevant file name. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. ' references: - https://www.nextron-systems.com/?s=antivirus author: Florian Roth (Nextron Systems), Arnim Rupp date: 2018-09-09 modified: 2026-06-29 tags: - attack.resource-development - attack.t1588 logsource: category: antivirus detection: selection_path: Filename|contains: - :\PerfLogs\ - :\Temp\ - :\Users\Default\ - :\Users\Public\ - :\Windows\ - /www/ - \inetpub\ - \tsclient\ - apache - nginx - tomcat - weblogic selection_ext: Filename|endswith: - .asax - .ashx - .asmx - .asp - .aspx - .bat - .cfm - .cgi - .chm - .cmd - .dat - .ear - .gif - .hta - .jpeg - .jpg - .jsp - .jspx - .lnk - .msc - .php - .pl - .png - .ps1 - .psm1 - .py - .pyc - .rb - .scf - .sct - .sh - .svg - .txt - .vbe - .vbs - .war - .wll - .wsf - .wsh - .xll - .xml condition: 1 of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22). Logsource: windows / file_event. Rule: title: UAC Bypass Using Consent and Comctl32 - File id: 62ed5b55-f991-406a-85d9-e8e8fdf18789 status: test description: Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-23 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: C:\Windows\System32\consent.exe.@ TargetFilename|endswith: \comctl32.dll condition: selection falsepositives: - Unknown level: high
Query: exploit Multiple unspecified services in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 do not require authentication, which allows remote attackers to obtain sensitive information
Matching passage: CVE-2015-8361. CWE: CWE-284. CVSS: 9.100000381469727. Multiple unspecified services in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 do not require authentication, which allows remote attackers to obtain sensitive information, modify settings, or manage build agents via unknown vectors involving the JMS port.
Near-miss passage: CVE-2015-9140. CWE: CWE-284. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile, Snapdragon Wear, and Small Cell SoC FSM9055, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 600, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, SD 810, and SDX20, unauthorized memory access possible in online memory dump feature.
Query: vulnerability: phpFileManager 0.9.8 allows remote attackers to execute arbitrary commands via a crafted URL.
Matching passage: CVE-2015-5958. CWE: CWE-78. CVSS: 8.800000190734863. phpFileManager 0.9.8 allows remote attackers to execute arbitrary commands via a crafted URL.
Near-miss passage: CVE-2015-2955. CWE: CWE-78. CVSS: 7.5. Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Query: CVE similar to CVE-2015-7555
Matching passage: CVE-2015-7555. CWE: CWE-119. CVSS: 5.5. Heap-based buffer overflow in giffix.c in giffix in giflib 5.1.1 allows attackers to cause a denial of service (program crash) via crafted image and logical screen width fields in a GIF file.
Near-miss passage: CVE-2015-1362. CWE: CWE-119. CVSS: 7.5. Buffer overflow in the Customize 35mm tab in Two Pilots Exif Pilot 4.7.2 allows remote attackers to execute arbitrary code via a long string in the maker element in an XML file.
Query: write Sigma for Detects execution of "rundll32.exe" with a parent process of Explorer.exe. This has been observed by variants of Raspber
Matching passage: Sigma rule: Detects execution of "rundll32.exe" with a parent process of Explorer.exe. This has been observed by variants of Raspber. Logsource: windows / process_creation. Rule: title: Rundll32 Spawned Via Explorer.EXE id: 1723e720-616d-4ddc-ab02-f7e3685a4713 status: test description: Detects execution of "rundll32.exe" with a parent process of Explorer.exe. This has been observed by variants of Raspberry Robin, as first reported by Red Canary. references: - https://redcanary.com/blog/raspberry-robin/ - https://thedfirreport.com/2022/09/26/bumblebee-round-two/ author: CD_ROM_ date: 2022-05-21 modified: 2023-08-31 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \explorer.exe selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE filter_main_generic: - CommandLine|contains: ' C:\Windows\System32\' - CommandLine|endswith: ' -localserver 22d8c27b-47a1-48d1-ad08-7da7abd79617' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer s. Logsource: windows / ps_script. Rule: title: Powershell Suspicious Win32_PnPEntity id: b26647de-4feb-4283-af6b-6117661283c5 status: test description: Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1120/T1120.md author: frack113 date: 2021-08-23 modified: 2022-12-25 tags: - attack.discovery - attack.t1120 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: Win32_PnPEntity condition: selection falsepositives: - Admin script level: low
Query: describe CVE-2015-5067
Matching passage: CVE-2015-5067. CWE: CWE-255. CVSS: 7.5. The (1) Cross-System Tools and (2) Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, which allows remote attackers to obtain access via unspecified vectors, aka SAP Security Notes 2059659 and 2057982.
Near-miss passage: CVE-2015-4319. CWE: CWE-255. CVSS: 5.5. The password-change feature in the administrative web interface in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.1 improperly performs authorization, which allows remote authenticated users to reset arbitrary active-user passwords via unspecified vectors, aka Bug ID CSCuv12338.
Query: telemetry for T1584.005
Matching passage: T1584.005 Botnet. Tactics: resource development. Description: Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.(Citation: Norton Botnet) Instead of purchasing/renting a botnet from a booter/stresser service, adversaries may build their own botnet by compromising numerous third-party systems.(Citation: Imperva DDoS for Hire) Adversaries may also conduct a takeover of an existing botnet, such as redirecting bots to adversary-controlled C2 servers.(Citation: Dell Dridex Oct 2015) With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale [Phishing](https://attack.mitre.org/techniques/T1566) or Distributed Denial of Service (DDoS).
Near-miss passage: T1584.008 Network Devices. Tactics: resource development. Description: Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not [Initial Access](https://attack.mitre.org/tactics/TA0001) to that environment, but rather to leverage these devices to support additional targeting. Once an adversary has control, compromised network devices can be used to launch additional operations, such as hosting payloads for [Phishing](https://attack.mitre.org/techniques/T1566) campaigns (i.e., [Link Target](https://attack.mitre.org/techniques/T1608/005)) or enabling the required access to execute [Content Injection](https://attack.mitre.org/techniques/T1659) operations. Adversaries may also be able to harvest reusable credentials (i.e., [Valid Accounts](https://attack.mitre.org/techniques/T1078)) from compromised network devices. Adversaries often target Internet-facing edge devices and related network appliances that specifically do not support robust host-based defenses.(Citation: Mandiant Fortinet Zero Day)(Citation: Wired Russia Cyberwar) Compromised network devices may be used to support subsequent [Command and Control](https://attack.mitre.org/tactics/TA0011) activity, such as [Hide Infrastructure](https://attack.mitre.org/techniques/T1665) through an established [Proxy](https://attack.mitre.org/techniques/T1090) and/or [Botnet](https://attack.mitre.org/techniques/T1584/005) network.(Citation: Justice GRU 2024)
Query: rule covering Detects the removal of a port or application rule in the Windows Firewall configuration using netsh
Matching passage: Sigma rule: Detects the removal of a port or application rule in the Windows Firewall configuration using netsh. Logsource: windows / process_creation. Rule: title: Firewall Rule Deleted Via Netsh.EXE id: 1a5fefe6-734f-452e-a07d-fc1c35bce4b2 status: test description: Detects the removal of a port or application rule in the Windows Firewall configuration using netsh references: - https://app.any.run/tasks/8bbd5b4c-b82d-4e6d-a3ea-d454594a37cc/ author: frack113 date: 2022-08-14 modified: 2025-10-07 tags: - attack.defense-impairment - attack.t1686.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: CommandLine|contains|all: - firewall - 'delete ' filter_optional_dropbox: ParentImage|endswith: \Dropbox.exe CommandLine|contains: name=Dropbox filter_optional_avast: ParentImage|endswith: \instup.exe CommandLine|contains: advfirewall firewall delete rule name="Avast Antivirus Admin Client" condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Legitimate administration activity - Software installations and removal level: medium
Near-miss passage: Sigma rule: Potential adversaries accessing the microphone and webcam in an endpoint.. Logsource: windows / security. Rule: title: Processes Accessing the Microphone and Webcam id: 8cd538a4-62d5-4e83-810b-12d41e428d6e status: test description: Potential adversaries accessing the microphone and webcam in an endpoint. references: - https://twitter.com/duzvik/status/1269671601852813320 - https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-06-07 modified: 2021-11-27 tags: - attack.collection - attack.t1123 logsource: product: windows service: security detection: selection: EventID: - 4657 - 4656 - 4663 ObjectName|contains: - \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged - \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged condition: selection falsepositives: - Unknown level: medium
Query: hunt for Virtual Private Server activity
Matching passage: T1584.003 Virtual Private Server. Tactics: resource development. Description: Adversaries may compromise third-party Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. Adversaries may compromise VPSs purchased by third-party entities. By compromising a VPS to use as infrastructure, adversaries can make it difficult to physically tie back operations to themselves.(Citation: NSA NCSC Turla OilRig) Compromising a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers as well as that added by the compromised third-party.
Near-miss passage: T1584.008 Network Devices. Tactics: resource development. Description: Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not [Initial Access](https://attack.mitre.org/tactics/TA0001) to that environment, but rather to leverage these devices to support additional targeting. Once an adversary has control, compromised network devices can be used to launch additional operations, such as hosting payloads for [Phishing](https://attack.mitre.org/techniques/T1566) campaigns (i.e., [Link Target](https://attack.mitre.org/techniques/T1608/005)) or enabling the required access to execute [Content Injection](https://attack.mitre.org/techniques/T1659) operations. Adversaries may also be able to harvest reusable credentials (i.e., [Valid Accounts](https://attack.mitre.org/techniques/T1078)) from compromised network devices. Adversaries often target Internet-facing edge devices and related network appliances that specifically do not support robust host-based defenses.(Citation: Mandiant Fortinet Zero Day)(Citation: Wired Russia Cyberwar) Compromised network devices may be used to support subsequent [Command and Control](https://attack.mitre.org/tactics/TA0011) activity, such as [Hide Infrastructure](https://attack.mitre.org/techniques/T1665) through an established [Proxy](https://attack.mitre.org/techniques/T1090) and/or [Botnet](https://attack.mitre.org/techniques/T1584/005) network.(Citation: Justice GRU 2024)
Query: detection rule: Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any in
Matching passage: Sigma rule: Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any in. Logsource: windows / ps_script. Rule: title: Suspicious SSL Connection id: 195626f3-5f1b-4403-93b7-e6cfd4d6a078 status: test description: Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1573/T1573.md#atomic-test-1---openssl-c2 - https://medium.com/walmartglobaltech/openssl-server-reverse-shell-from-windows-client-aee2dbfa0926 author: frack113 date: 2022-01-23 tags: - attack.command-and-control - attack.t1573 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - System.Net.Security.SslStream - Net.Security.RemoteCertificateValidationCallback - .AuthenticateAsClient condition: selection falsepositives: - Legitimate administrative script level: low
Near-miss passage: Sigma rule: Detects the modification of an EC2 snapshot's permissions to enable access from another account. Logsource: aws / cloudtrail. Rule: title: AWS Snapshot Backup Exfiltration id: abae8fec-57bd-4f87-aff6-6e3db989843d status: test description: Detects the modification of an EC2 snapshot's permissions to enable access from another account references: - https://www.justice.gov/file/1080281/download author: Darin Smith date: 2021-05-17 modified: 2021-08-19 tags: - attack.exfiltration - attack.t1537 logsource: product: aws service: cloudtrail detection: selection_source: eventSource: ec2.amazonaws.com eventName: ModifySnapshotAttribute condition: selection_source falsepositives: - Valid change to a snapshot's permissions level: medium
Query: secure coding against Missing Synchronization
Matching passage: CWE-820 Missing Synchronization. The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.
Near-miss passage: CWE-795 Only Filtering Special Elements at a Specified Location. The product receives data from an upstream component, but only accounts for special elements at a specified location, thereby missing remaining special elements that may exist before sending it to a downstream component.
Query: write Sigma for Detects execution of powershell scripts via Runscripthelper.exe
Matching passage: Sigma rule: Detects execution of powershell scripts via Runscripthelper.exe. Logsource: windows / process_creation. Rule: title: Suspicious Runscripthelper.exe id: eca49c87-8a75-4f13-9c73-a5a29e845f03 status: test description: Detects execution of powershell scripts via Runscripthelper.exe references: - https://lolbas-project.github.io/lolbas/Binaries/Runscripthelper/ author: Victor Sergeev, oscd.community date: 2020-10-09 modified: 2022-07-11 tags: - attack.execution - attack.stealth - attack.t1059 - attack.t1202 logsource: category: process_creation product: windows detection: selection: Image|endswith: \Runscripthelper.exe CommandLine|contains: surfacecheck condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects PsExec service installation and execution events. Logsource: windows / system. Rule: title: PsExec Service Installation id: 42c575ea-e41e-41f1-b248-8093c3e82a28 status: test description: Detects PsExec service installation and execution events references: - https://www.jpcert.or.jp/english/pub/sr/ir_research.html - https://jpcertcc.github.io/ToolAnalysisResultSheet author: Thomas Patzke date: 2017-06-12 modified: 2023-08-04 tags: - attack.execution - attack.t1569.002 - attack.s0029 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ServiceName: PSEXESVC - ImagePath|endswith: \PSEXESVC.exe condition: all of selection_* falsepositives: - Unknown level: medium
Query: detection rule: Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "Remo
Matching passage: Sigma rule: Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "Remo. Logsource: windows / process_creation. Rule: title: RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses id: a6fc3c46-23b8-4996-9ea2-573f4c4d88c5 related: - id: f65e22f9-819e-4f96-9c7b-498364ae7a25 type: similar - id: 38a7625e-b2cb-485d-b83d-aff137d859f4 type: similar - id: cacef8fc-9d3d-41f7-956d-455c6e881bc5 type: similar status: test description: Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "RemoteFXvGPUDisablement.exe" binary to run custom PowerShell code via module load-order hijacking. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md - https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1 author: frack113 date: 2021-07-13 modified: 2023-05-09 tags: - attack.stealth - attack.t1218 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - Invoke-ATHRemoteFXvGPUDisablementCommand - Invoke-ATHRemoteFXvGPUDisableme condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious Speech Runtime Binary Execution by monitoring its child processes. Child processes spawned by SpeechR. Logsource: windows / process_creation. Rule: title: Suspicious Speech Runtime Binary Child Process id: 78f10490-f2f4-4d19-a75b-4e0683bf3b8d status: experimental description: 'Detects suspicious Speech Runtime Binary Execution by monitoring its child processes. Child processes spawned by SpeechRuntime.exe could indicate an attempt for lateral movement via COM & DCOM hijacking. ' references: - https://github.com/rtecCyberSec/SpeechRuntimeMove author: andrewdanis date: 2025-10-23 logsource: category: process_creation product: windows tags: - attack.lateral-movement - attack.stealth - attack.t1021.003 - attack.t1218 detection: selection: ParentImage|endswith: \SpeechRuntime.exe condition: selection falsepositives: - Unlikely. level: high
Query: alert when Identifies when a service account is disabled or deleted in Google Cloud.
Matching passage: Sigma rule: Identifies when a service account is disabled or deleted in Google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud Service Account Disabled or Deleted id: 13f81a90-a69c-4fab-8f07-b5bb55416a9f status: test description: Identifies when a service account is disabled or deleted in Google Cloud. references: - https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts author: Austin Songer @austinsonger date: 2021-08-14 modified: 2022-10-09 tags: - attack.impact - attack.t1531 logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name|endswith: - .serviceAccounts.disable - .serviceAccounts.delete condition: selection falsepositives: - Service Account being disabled or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Service Account disabled or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects applications trying to modify the registry in order to disable any write-protect property for storage devices. T. Logsource: windows / process_creation. Rule: title: Write Protect For Storage Disabled id: 75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13 status: test description: 'Detects applications trying to modify the registry in order to disable any write-protect property for storage devices. This could be a precursor to a ransomware attack and has been an observed technique used by cypherpunk group. ' references: - https://www.manageengine.com/products/desktop-central/os-imaging-deployment/media-is-write-protected.html author: Sreeman date: 2021-06-11 modified: 2024-01-18 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: process_creation detection: selection: CommandLine|contains|all: - \System\CurrentControlSet\Control - Write Protection - '0' - storage condition: selection falsepositives: - Unknown level: medium