alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects potential DLL sideloading of "mscorsvc.dll".
Matching passage: Sigma rule: Detects potential DLL sideloading of "mscorsvc.dll".. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of MsCorSvc.DLL id: cdb15e19-c2d0-432a-928e-e49c8c60dcf2 status: test description: Detects potential DLL sideloading of "mscorsvc.dll". references: - https://hijacklibs.net/entries/microsoft/built-in/mscorsvc.html author: Wietze Beukema date: 2024-07-11 modified: 2025-02-26 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: image_load detection: selection: ImageLoaded|endswith: \mscorsvc.dll filter_main_generic: ImageLoaded|startswith: - C:\Windows\Microsoft.NET\Framework\ - C:\Windows\Microsoft.NET\Framework64\ - C:\Windows\Microsoft.NET\FrameworkArm\ - C:\Windows\Microsoft.NET\FrameworkArm64\ - C:\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Legitimate applications loading their own versions of the DLL mentioned in this rule. level: medium
Near-miss passage: Sigma rule: Detects the creation of files with an executable or script extension by an Office application.. Logsource: windows / file_event. Rule: title: File With Uncommon Extension Created By An Office Application id: c7a74c80-ba5a-486e-9974-ab9e682bc5e4 status: test description: Detects the creation of files with an executable or script extension by an Office application. references: - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems) date: 2021-08-23 modified: 2025-10-17 tags: - attack.t1204.002 - attack.execution logsource: product: windows category: file_event detection: selection1: Image|endswith: - \excel.exe - \msaccess.exe - \mspub.exe - \powerpnt.exe - \visio.exe - \winword.exe selection2: TargetFilename|endswith: - .bat - .cmd - .com - .dll - .exe - .hta - .ocx - .proj - .ps1 - .scf - .scr - .sys - .vbe - .vbs - .wsf - .wsh filter_main_localassembly: TargetFilename|contains: \AppData\Local\assembly\tmp\ TargetFilename|endswith: .dll filter_optional_webservicecache: TargetFilename|contains|all: - C:\Users\ - \AppData\Local\Microsoft\Office\ - \WebServiceCache\AllUsers TargetFilename|endswith: .com filter_optional_webex: Image|endswith: \winword.exe TargetFilename|contains: \AppData\Local\Temp\webexdelta\ TargetFilename|endswith: - .dll - .exe filter_optional_backstageinappnavcache: TargetFilename|contains|all: - C:\Users\ - \AppData\Local\Microsoft\Office\ - \BackstageInAppNavCache\ TargetFilename|endswith: .com condition: all of selection* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Query: describe CVE-2015-10013
Matching passage: CVE-2015-10013. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in WebDevStudios taxonomy-switcher Plugin up to 1.0.3 on WordPress. It has been classified as problematic. Affected is the function taxonomy_switcher_init of the file taxonomy-switcher.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.4 is able to address this issue. It is recommended to upgrade the affected component. VDB-217446 is the identifier assigned to this vulnerability.
Near-miss passage: CVE-2015-2064. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in DLGuard 5, 4.6, and 4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) page, (2) c, or (3) redirect parameter to index.php or (4) search field (searchTerm parameter) in the main page.
Query: what is T1218.007
Matching passage: T1218.007 Msiexec. Tactics: stealth. Description: Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).(Citation: Microsoft msiexec) The Msiexec.exe binary may also be digitally signed by Microsoft. Adversaries may abuse msiexec.exe to launch local or network accessible MSI files. Msiexec.exe can also execute DLLs.(Citation: LOLBAS Msiexec)(Citation: TrendMicro Msiexec Feb 2018) Since it may be signed and native on Windows systems, msiexec.exe can be used to bypass application control solutions that do not account for its potential abuse. Msiexec.exe execution may also be elevated to SYSTEM privileges if the <code>AlwaysInstallElevated</code> policy is enabled.(Citation: Microsoft AlwaysInstallElevated 2018)
Near-miss passage: T1218.012 Verclsid. Tactics: stealth. Description: Adversaries may abuse verclsid.exe to proxy execution of malicious code. Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell.(Citation: WinOSBite verclsid.exe) Adversaries may abuse verclsid.exe to execute malicious payloads. This may be achieved by running <code>verclsid.exe /S /C {CLSID}</code>, where the file is referenced by a Class ID (CLSID), a unique identification number used to identify COM objects. COM payloads executed by verclsid.exe may be able to perform various malicious actions, such as loading and executing COM scriptlets (SCT) from remote servers (similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010)). Since the binary may be signed and/or native on Windows systems, proxying execution via verclsid.exe may bypass application control solutions that do not account for its potential abuse.(Citation: LOLBAS Verclsid)(Citation: Red Canary Verclsid.exe)(Citation: BOHOPS Abusing the COM Registry)(Citation: Nick Tyrer GitHub)
Query: exploit Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office for Mac 2016, Office Compatibility Pack SP3, Word Viewer, Word
Matching passage: CVE-2015-2468. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office for Mac 2016, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Word Web Apps 2010 SP2, and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-0827. CWE: CWE-119. CVSS: 4.300000190734863. Heap-based buffer overflow in the mozilla::gfx::CopyRect function in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers to obtain sensitive information from uninitialized process memory via a malformed SVG graphic.
Query: vulnerability: The JavaServer Pages (JSP) component in Cisco Integrated Management Controller (IMC) Supervisor before 1.0.0.1 and UCS Director (formerly Cloupia Unified Infrastructure Controller)
Matching passage: CVE-2015-6259. CWE: CWE-20. CVSS: 9.399999618530273. The JavaServer Pages (JSP) component in Cisco Integrated Management Controller (IMC) Supervisor before 1.0.0.1 and UCS Director (formerly Cloupia Unified Infrastructure Controller) before 5.2.0.1 allows remote attackers to write to arbitrary files via crafted HTTP requests, aka Bug IDs CSCus36435 and CSCus62625.
Near-miss passage: CVE-2015-7993. CWE: CWE-20. CVSS: 7.5. The Extended Application Services (aka XS or XS Engine) in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to execute arbitrary code via unspecified vectors related to "HTTP Login," aka SAP Security Note 2197397.
Query: exploit Unspecified vulnerability in the Oracle Communications Convergence component in Oracle Communications Applications 2.0 and 3.0.1 allows remote attackers to affect confidentiality v
Matching passage: CVE-2015-4793. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Communications Convergence component in Oracle Communications Applications 2.0 and 3.0.1 allows remote attackers to affect confidentiality via unknown vectors related to Mail Proxy.
Near-miss passage: CVE-2015-4770. CWE: UNKNOWN. CVSS: 4.900000095367432. Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect availability via vectors related to UNIX filesystem.
Query: exploit Cross-site scripting (XSS) vulnerability in index.php in JosephErnest Void before 2015-10-02 allows remote attackers to inject arbitrary web script or HTML via a crafted URI.
Matching passage: CVE-2015-7777. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in index.php in JosephErnest Void before 2015-10-02 allows remote attackers to inject arbitrary web script or HTML via a crafted URI.
Near-miss passage: CVE-2015-5475. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Request Tracker (RT) 4.x before 4.2.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) user and (2) group rights management pages.
Query: exploit IBM Security Access Manager for Web 7.0 before 7.0.0 IF21, 8.0 before 8.0.1.3 IF4, and 9.0 before 9.0.0.1 IF1 does not have a lockout mechanism for invalid login attempts, which ma
Matching passage: CVE-2015-5010. CWE: CWE-254. CVSS: 7.5. IBM Security Access Manager for Web 7.0 before 7.0.0 IF21, 8.0 before 8.0.1.3 IF4, and 9.0 before 9.0.0.1 IF1 does not have a lockout mechanism for invalid login attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.
Near-miss passage: CVE-2015-5850. CWE: CWE-254. CVSS: 2.0999999046325684. AppleKeyStore in Apple iOS before 9 allows physically proximate attackers to reset the count of incorrect passcode attempts via a device backup.
Query: Sigma rule for Detects the setting of the REGISTERAPPRESTART compatibility layer on an application. This compatibility layer allows an
Matching passage: Sigma rule: Detects the setting of the REGISTERAPPRESTART compatibility layer on an application. This compatibility layer allows an. Logsource: windows / registry_set. Rule: title: Potential Persistence Via AppCompat RegisterAppRestart Layer id: b86852fb-4c77-48f9-8519-eb1b2c308b59 status: test description: 'Detects the setting of the REGISTERAPPRESTART compatibility layer on an application. This compatibility layer allows an application to register for restart using the "RegisterApplicationRestart" API. This can be potentially abused as a persistence mechanism. ' references: - https://github.com/nasbench/Misc-Research/blob/d114d6a5e0a437d3818e492ef9864367152543e7/Other/Persistence-Via-RegisterAppRestart-Shim.md author: Nasreddine Bencherchali (Nextron Systems) date: 2024-01-01 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.011 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\ Details|contains: REGISTERAPPRESTART condition: selection falsepositives: - Legitimate applications making use of this feature for compatibility reasons level: medium
Near-miss passage: Sigma rule: Detects the creation of the LiveKD driver by a process image other than "livekd.exe".. Logsource: windows / file_event. Rule: title: LiveKD Driver Creation By Uncommon Process id: 059c5af9-5131-4d8d-92b2-de4ad6146712 related: - id: 16fe46bb-4f64-46aa-817d-ff7bec4a2352 type: similar status: test description: Detects the creation of the LiveKD driver by a process image other than "livekd.exe". references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-16 tags: - attack.privilege-escalation - attack.stealth logsource: product: windows category: file_event detection: selection: TargetFilename: C:\Windows\System32\drivers\LiveKdD.SYS filter_main_legit_name: Image|endswith: - \livekd.exe - \livek64.exe condition: selection and not 1 of filter_main_* falsepositives: - Administrators might rename LiveKD before its usage which could trigger this. Add additional names you use to the filter level: high
Query: describe CVE-2015-6757
Matching passage: CVE-2015-6757. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in content/browser/service_worker/embedded_worker_instance.cc in the ServiceWorker implementation in Google Chrome before 46.0.2490.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging object destruction in a callback.
Near-miss passage: CVE-2015-3959. CWE: UNKNOWN. CVSS: 7.199999809265137. The firmware in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches has a hardcoded serial-console password for a privileged account, which might allow physically proximate attackers to obtain access by establishing a console session to a nonstandard installation on which this account is enabled, and leveraging knowledge of this password.
Query: rule covering Detects remote thread creation from CACTUSTORCH as described in references.
Matching passage: Sigma rule: Detects remote thread creation from CACTUSTORCH as described in references.. Logsource: windows / create_remote_thread. Rule: title: HackTool - CACTUSTORCH Remote Thread Creation id: 2e4e488a-6164-4811-9ea1-f960c7359c40 status: test description: Detects remote thread creation from CACTUSTORCH as described in references. references: - https://twitter.com/SBousseaden/status/1090588499517079552 - https://github.com/mdsecactivebreach/CACTUSTORCH author: '@SBousseaden (detection), Thomas Patzke (rule)' date: 2019-02-01 modified: 2023-05-05 tags: - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1055.012 - attack.t1059.005 - attack.t1059.007 - attack.t1218.005 logsource: product: windows category: create_remote_thread detection: selection: SourceImage|endswith: - \System32\cscript.exe - \System32\wscript.exe - \System32\mshta.exe - \winword.exe - \excel.exe TargetImage|contains: \SysWOW64\ StartModule: null condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the spec. Logsource: aws / cloudtrail. Rule: title: AWS EC2 Startup Shell Script Change id: 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df status: test description: Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up. references: - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/ec2__startup_shell_script/main.py#L9 author: faloker date: 2020-02-12 modified: 2022-06-07 tags: - attack.execution - attack.t1059.001 - attack.t1059.003 - attack.t1059.004 logsource: product: aws service: cloudtrail detection: selection_source: eventSource: ec2.amazonaws.com requestParameters.attribute: userData eventName: ModifyInstanceAttribute condition: selection_source falsepositives: - Valid changes to the startup script level: high
Query: vulnerability: Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to write to arbitrary files via a .. (dot dot) in the component par
Matching passage: CVE-2015-5149. CWE: CWE-22. CVSS: 5.5. Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to write to arbitrary files via a .. (dot dot) in the component parameter in the Request component to workorder/Attachment.jsp.
Near-miss passage: CVE-2015-4703. CWE: CWE-22. CVSS: 5.300000190734863. Absolute path traversal vulnerability in mysqldump_download.php in the WordPress Rename plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the dumpfname parameter.
Query: patch priority for CVE-2015-5943
Matching passage: CVE-2015-5943. CWE: CWE-254. CVSS: 4.300000190734863. SecurityAgent in Apple OS X before 10.11.1 does not prevent synthetic clicks from reaching keychain windows, which allows attackers to bypass intended access restrictions via a crafted app.
Near-miss passage: CVE-2015-8615. CWE: CWE-254. CVSS: 5.0. The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ).
Query: weakness Uncaught Exception in Servlet
Matching passage: CWE-600 Uncaught Exception in Servlet. The Servlet does not catch all exceptions, which may reveal sensitive debugging information.
Near-miss passage: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop'). The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Query: describe CVE-2015-8306
Matching passage: CVE-2015-8306. CWE: CWE-119. CVSS: 7.800000190734863. Buffer overflow in the HIFI driver in Huawei P8 phones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230 allows attackers to cause a denial of service (system crash) or execute arbitrary code via an unspecified parameter.
Near-miss passage: CVE-2015-4482. CWE: CWE-119. CVSS: 4.599999904632568. mar_read.c in the Updater in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows local users to gain privileges or cause a denial of service (out-of-bounds write) via a crafted name of a Mozilla Archive (aka MAR) file.
Query: describe CVE-2015-9036
Matching passage: CVE-2015-9036. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, an incorrect length is used to clear a memory buffer resulting in adjacent memory getting corrupted.
Near-miss passage: CVE-2015-0564. CWE: CWE-119. CVSS: 5.0. Buffer underflow in the ssl_decrypt_record function in epan/dissectors/packet-ssl-utils.c in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 allows remote attackers to cause a denial of service (application crash) via a crafted packet that is improperly handled during decryption of an SSL session.
Query: describe CVE-2015-4834
Matching passage: CVE-2015-4834. CWE: UNKNOWN. CVSS: 3.700000047683716. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Utility/Zones.
Near-miss passage: CVE-2015-7765. CWE: UNKNOWN. CVSS: 9.0. ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access by leveraging knowledge of this password.
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in X2Engine X2CRM before 5.0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) version parameter in pr
Matching passage: CVE-2015-5076. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in X2Engine X2CRM before 5.0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) version parameter in protected/views/admin/formEditor.php; the (2) importId parameter in protected/views/admin/rollbackImport.php; the (3) bc, (4) fg, (5) bgc, or (6) font parameter in protected/views/site/listener.php; the (7) Services[*] parameter in protected/components/views/webForm.php; the (8) file parameter in protected/components/TranslationManager.php; the (9) x2_key parameter in protected/tests/webscripts/x2WebTrackingTestPages/customWebLeadCaptureScriptTest.php; the (10) id parameter in protected/modules/contacts/controllers/ContactsController.php; or the (11) lastEventId parameter to index.php/profile/getEvents.
Near-miss passage: CVE-2015-8006. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the PageTriage toolbar in the PageTriage extension for MediWiki allows remote attackers to inject arbitrary web script or HTML via the page title.
Query: SOC runbook when seeing Persistence mechanism resembling Data from Network Shared Drive
Matching passage: Playbook for T1039 Data from Network Shared Drive. 1) Validate alert telemetry against T1039. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: collection. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org
Near-miss passage: Playbook for T1056.002 GUI Input Capture. Different response path focused on collection, credential access.
Query: detection rule: Modifications to a config that will serve an adversary's impacts or persistence
Matching passage: Sigma rule: Modifications to a config that will serve an adversary's impacts or persistence. Logsource: cisco / aaa. Rule: title: Cisco Modify Configuration id: 671ffc77-50a7-464f-9e3d-9ea2b493b26b status: test description: Modifications to a config that will serve an adversary's impacts or persistence author: Austin Clark date: 2019-08-12 modified: 2025-04-28 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.impact - attack.t1490 - attack.t1505 - attack.t1565.002 - attack.t1053 logsource: product: cisco service: aaa detection: keywords: - ip http server - ip https server - kron policy-list - kron occurrence - policy-list - access-list - ip access-group - archive maximum - ntp server condition: keywords falsepositives: - Legitimate administrators may run these commands level: medium
Near-miss passage: Sigma rule: Detects the execution of a renamed ProcDump executable. This often done by attackers or malware in order to evade defens. Logsource: windows / process_creation. Rule: title: Renamed ProcDump Execution id: 4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67 related: - id: 03795938-1387-481b-9f4c-3f6241e604fe type: obsolete status: test description: 'Detects the execution of a renamed ProcDump executable. This often done by attackers or malware in order to evade defensive mechanisms. ' references: - https://learn.microsoft.com/en-us/sysinternals/downloads/procdump author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2019-11-18 modified: 2026-06-29 tags: - attack.stealth - attack.t1036.003 logsource: product: windows category: process_creation detection: selection_ofn: OriginalFileName: procdump selection_cli_dump_flag: CommandLine|contains|windash: - ' -ma ' - ' -mp ' selection_cli_eula_flag: CommandLine|contains|windash: ' /accepteula' filter_main_known_names: Image|endswith: - \procdump.exe - \procdump64.exe - \procdump64a.exe condition: (selection_ofn or all of selection_cli_*) and not 1 of filter_main_* falsepositives: - Procdump illegally bundled with legitimate software. - Administrators who rename binaries (should be investigated). level: high