alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects creation of new ".dll" files inside the plugins directory of a notepad++ installation by a process other than "g
Matching passage: Sigma rule: Detects creation of new ".dll" files inside the plugins directory of a notepad++ installation by a process other than "g. Logsource: windows / file_event. Rule: title: Potential Persistence Via Notepad++ Plugins id: 54127bd4-f541-4ac3-afdb-ea073f63f692 status: test description: Detects creation of new ".dll" files inside the plugins directory of a notepad++ installation by a process other than "gup.exe". Which could indicates possible persistence references: - https://pentestlab.blog/2022/02/14/persistence-notepad-plugins/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-10 modified: 2025-09-01 tags: - attack.persistence logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \Notepad++\plugins\ TargetFilename|endswith: .dll filter_gup: Image|endswith: \Notepad++\updater\gup.exe filter_install: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Temp\ Image|endswith: - \target.exe - Installer.x64.exe filter_main_installer: Image|contains: \npp. Image|endswith: .exe TargetFilename: - C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll - C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll - C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll - C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll condition: selection and not 1 of filter_* falsepositives: - Possible FPs during first installation of Notepad++ - Legitimate use of custom plugins by users in order to enhance notepad++ functionalities level: medium
Near-miss passage: Sigma rule: Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.. Logsource: azure / riskdetection. Rule: title: Anonymous IP Address id: 53acd925-2003-440d-a1f3-71a5253fe237 status: test description: Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN. references: - https://learn.microsoft.com/en-us/graph/api/resources/riskdetection?view=graph-rest-1.0 - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#anonymous-ip-address author: Gloria Lee, '@gleeiamglo' date: 2023-08-22 tags: - attack.t1528 - attack.credential-access logsource: product: azure service: riskdetection detection: selection: riskEventType: anonymizedIPAddress condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins level: high
Query: risk of Multiple stack-based buffer overflows in Medicomp MEDCIN Engine before 2.22.20153.226 might allow remote attackers to execute arbitrary code via a crafted packet on port 8190, rela
Matching passage: CVE-2015-2898. CWE: CWE-119. CVSS: 6.800000190734863. Multiple stack-based buffer overflows in Medicomp MEDCIN Engine before 2.22.20153.226 might allow remote attackers to execute arbitrary code via a crafted packet on port 8190, related to (1) the SetGroupSequenceEx na_setgroupsequenceex function, (2) the FormatDate julptostr function, and (3) the UserFindingCodes addtocl function.
Near-miss passage: CVE-2015-3144. CWE: CWE-119. CVSS: 9.0. The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80."
Query: detect Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in in logs
Matching passage: Sigma rule: Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in. Logsource: windows / process_creation. Rule: title: Capture Credentials with Rpcping.exe id: 93671f99-04eb-4ab4-a161-70d446a84003 status: test description: Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process. references: - https://lolbas-project.github.io/lolbas/Binaries/Rpcping/ - https://twitter.com/vysecurity/status/974806438316072960 - https://twitter.com/vysecurity/status/873181705024266241 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh875578(v=ws.11) author: Julia Fomina, oscd.community date: 2020-10-09 modified: 2025-10-31 tags: - attack.credential-access - attack.t1003 logsource: category: process_creation product: windows detection: selection_main_img: - Image|endswith: \RpcPing.exe - OriginalFileName: \RpcPing.exe selection_main_flag: CommandLine|contains|windash: -s selection_cli_ntlm: CommandLine|contains|windash: -u CommandLine|contains: NTLM selection_cli_ncacn: CommandLine|contains|windash: -t CommandLine|contains: ncacn_np condition: all of selection_main_* and 1 of selection_cli_* falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Detect built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool. Simila. Logsource: windows / ps_script. Rule: title: Disable-WindowsOptionalFeature Command PowerShell id: 99c4658d-2c5e-4d87-828d-7c066ca537c3 status: test description: 'Detect built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images ' references: - https://github.com/redcanaryco/atomic-red-team/blob/5b67c9b141fa3918017f8fa44f2f88f0b1ecb9e1/atomics/T1562.001/T1562.001.md - https://learn.microsoft.com/en-us/powershell/module/dism/disable-windowsoptionalfeature?view=windowsserver2022-ps author: frack113 date: 2022-09-10 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmd: ScriptBlockText|contains|all: - Disable-WindowsOptionalFeature - -Online - -FeatureName selection_feature: ScriptBlockText|contains: - Windows-Defender-Gui - Windows-Defender-Features - Windows-Defender - Windows-Defender-ApplicationGuard condition: all of selection* falsepositives: - Unknown level: high
Query: detection engineering for Bootkit
Matching passage: T1542.003 Bootkit. Tactics: stealth, persistence. Description: Adversaries may use bootkits to persist on systems. A bootkit is a malware variant that modifies the boot sectors of a hard drive, allowing malicious code to execute before a computer's operating system has loaded. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly. In BIOS systems, a bootkit may modify the Master Boot Record (MBR) and/or Volume Boot Record (VBR).(Citation: Mandiant M Trends 2016) The MBR is the section of disk that is first loaded after completing hardware initialization by the BIOS. It is the location of the boot loader. An adversary who has raw access to the boot drive may overwrite this area, diverting execution during startup from the normal boot loader to adversary code.(Citation: Lau 2011) The MBR passes control of the boot process to the VBR. Similar to the case of MBR, an adversary who has raw access to the boot drive may overwrite the VBR to divert execution during startup to adversary code. In UEFI (Unified Extensible Firmware Interface) systems, a bootkit may instead create or modify files in the EFI system partition (ESP). The ESP is a partition on data storage used by devices containing UEFI that allows the system to boot the OS and other utilities used by the system. An adversary can use the newly created or patched files in the ESP to run malicious kernel code.(Citation: Microsoft Security)(Citation: welivesecurity)
Near-miss passage: T1542.004 ROMMONkit. Tactics: stealth, persistence. Description: Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect. (Citation: Cisco Synful Knock Evolution)(Citation: Cisco Blog Legacy Device Attacks) ROMMON is a Cisco network device firmware that functions as a boot loader, boot image, or boot helper to initialize hardware and software when the platform is powered on or reset. Similar to [TFTP Boot](https://attack.mitre.org/techniques/T1542/005), an adversary may upgrade the ROMMON image locally or remotely (for example, through TFTP) with adversary code and restart the device in order to overwrite the existing ROMMON image. This provides adversaries with the means to update the ROMMON to gain persistence on a system in a way that may be difficult to detect.
Query: Encoded PowerShell / command-line abuse matching Exfiltration to Code Repository
Matching passage: T1567.001 Exfiltration to Code Repository. Tactics: exfiltration. Description: Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection. Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network.
Near-miss passage: T1567.004 Exfiltration Over Webhook. Tactics: exfiltration. Description: Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server.(Citation: RedHat Webhooks) Many public and commercial services, such as Discord, Slack, and `webhook.site`, support the creation of webhook endpoints that can be used by other services, such as Github, Jira, or Trello.(Citation: Discord Intro to Webhooks) When changes happen in the linked services (such as pushing a repository update or modifying a ticket), these services will automatically post the data to the webhook endpoint for use by the consuming application. Adversaries may link an adversary-owned environment to a victim-owned SaaS service to achieve repeated [Automated Exfiltration](https://attack.mitre.org/techniques/T1020) of emails, chat messages, and other data.(Citation: Push Security SaaS Attacks Repository Webhooks) Alternatively, instead of linking the webhook endpoint to a service, an adversary can manually post staged data directly to the URL in order to exfiltrate it.(Citation: Microsoft SQL Server) Access to webhook endpoints is often over HTTPS, which gives the adversary an additional level of protection. Exfiltration leveraging webhooks can also blend in with normal network traffic if the webhook endpoint points to a commonly used SaaS application or collaboration service.(Citation: CyberArk Labs Discord)(Citation: Talos Discord Webhook Abuse)(Citation: Checkmarx Webhooks)
Query: patch priority for CVE-2015-3668
Matching passage: CVE-2015-3668. CWE: CWE-119. CVSS: 6.800000190734863. QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3661, CVE-2015-3662, CVE-2015-3663, CVE-2015-3666, and CVE-2015-3667.
Near-miss passage: CVE-2015-0530. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in an unspecified function in nsr_render_log in EMC NetWorker before 8.0.4.3, 8.1.x before 8.1.2.6, and 8.2.x before 8.2.1.2 allows local users to gain privileges via unknown vectors.
Query: exploit Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, A
Matching passage: CVE-2015-7660. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted setMask arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
Near-miss passage: CVE-2015-5370. CWE: UNKNOWN. CVSS: 5.900000095367432. Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not properly implement the DCE-RPC layer, which allows remote attackers to perform protocol-downgrade attacks, cause a denial of service (application crash or CPU consumption), or possibly execute arbitrary code on a client system via unspecified vectors.
Query: describe CVE-2015-5344
Matching passage: CVE-2015-5344. CWE: CWE-19. CVSS: 9.800000190734863. The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
Near-miss passage: CVE-2015-8339. CWE: CWE-19. CVSS: 4.699999809265137. The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly hand back pages to a domain, which might allow guest OS administrators to cause a denial of service (host crash) via unspecified vectors related to domain teardown.
Query: risk of WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corrupt
Matching passage: CVE-2015-1072. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Near-miss passage: CVE-2015-5727. CWE: CWE-399. CVSS: 7.5. The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, related to a length field.
Query: risk of Larry Wall's patch; patch in FreeBSD 10.2-RC1 before 10.2-RC1-p1, 10.2 before 10.2-BETA2-p2, and 10.1 before 10.1-RELEASE-p16; Bitrig; GNU patch before 2.2.5; and possibly other pa
Matching passage: CVE-2015-1416. CWE: CWE-264. CVSS: 7.800000190734863. Larry Wall's patch; patch in FreeBSD 10.2-RC1 before 10.2-RC1-p1, 10.2 before 10.2-BETA2-p2, and 10.1 before 10.1-RELEASE-p16; Bitrig; GNU patch before 2.2.5; and possibly other patch variants allow remote attackers to execute arbitrary shell commands via a crafted patch file.
Near-miss passage: CVE-2015-1481. CWE: CWE-264. CVSS: 6.5. Ansible Tower (aka Ansible UI) before 2.0.5 allows remote organization administrators to gain privileges by creating a superuser account.
Query: risk of message/index.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/site:readallmessages capability before access
Matching passage: CVE-2015-2266. CWE: CWE-200. CVSS: 4.0. message/index.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/site:readallmessages capability before accessing arbitrary conversations, which allows remote authenticated users to obtain sensitive personal-contact and unread-message-count information via a modified URL.
Near-miss passage: CVE-2015-5320. CWE: CWE-200. CVSS: 5.0. Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attackers to connect as slaves and obtain sensitive information or possibly gain administrative access by leveraging knowledge of the name of a slave.
Query: risk of The TLS stack in Mono before 3.12.1 allows remote attackers to have unspecified impact via vectors related to client-side SSLv2 fallback.
Matching passage: CVE-2015-2320. CWE: CWE-295. CVSS: 9.800000190734863. The TLS stack in Mono before 3.12.1 allows remote attackers to have unspecified impact via vectors related to client-side SSLv2 fallback.
Near-miss passage: CVE-2015-7826. CWE: CWE-295. CVSS: 9.800000190734863. botan 1.11.x before 1.11.22 improperly handles wildcard matching against hostnames, which might allow remote attackers to have unspecified impact via a valid X.509 certificate, as demonstrated by accepting *.example.com as a match for bar.foo.example.com.
Query: detect Obtain Capabilities
Matching passage: T1588 Obtain Capabilities. Tactics: resource development. Description: Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle. In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals.(Citation: NationsBuying)(Citation: PegasusCitizenLab) In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.(Citation: DiginotarCompromise)
Near-miss passage: T1588.006 Vulnerabilities. Tactics: resource development. Description: Adversaries may acquire information about vulnerabilities that can be used during targeting. A vulnerability is a weakness in computer hardware or software that can, potentially, be exploited by an adversary to cause unintended or unanticipated behavior to occur. Adversaries may find vulnerability information by searching open databases or gaining access to closed vulnerability databases.(Citation: National Vulnerability Database) An adversary may monitor vulnerability disclosures/databases to understand the state of existing, as well as newly discovered, vulnerabilities. There is usually a delay between when a vulnerability is discovered and when it is made public. An adversary may target the systems of those known to conduct vulnerability research (including commercial vendors). Knowledge of a vulnerability may cause an adversary to search for an existing exploit (i.e. [Exploits](https://attack.mitre.org/techniques/T1588/005)) or to attempt to develop one themselves (i.e. [Exploits](https://attack.mitre.org/techniques/T1587/004)).
Query: patch priority for CVE-2015-0545
Matching passage: CVE-2015-0545. CWE: UNKNOWN. CVSS: 10.0. EMC Unisphere for VMAX 8.x before 8.0.3.4 sets up the Java Debugging Wire Protocol (JDWP) service, which allows remote attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-4116. CWE: UNKNOWN. CVSS: 9.800000190734863. Use-after-free vulnerability in the spl_ptr_heap_insert function in ext/spl/spl_heap.c in PHP before 5.5.27 and 5.6.x before 5.6.11 allows remote attackers to execute arbitrary code by triggering a failed SplMinHeap::compare operation.
Query: patch priority for CVE-2015-0498
Matching passage: CVE-2015-0498. CWE: UNKNOWN. CVSS: 1.7000000476837158. Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Replication.
Near-miss passage: CVE-2015-6605. CWE: UNKNOWN. CVSS: 5.0. mediaserver in Android before 5.1.1 LMY48T allows attackers to cause a denial of service (process crash) via unspecified vectors, aka internal bugs 20915134 and 23142203, a different vulnerability than CVE-2015-7718.
Query: detection rule: Sysmon registry detection of a local hidden user account.
Matching passage: Sigma rule: Sysmon registry detection of a local hidden user account.. Logsource: windows / registry_event. Rule: title: Creation of a Local Hidden User Account by Registry id: 460479f3-80b7-42da-9c43-2cc1d54dbccd status: test description: Sysmon registry detection of a local hidden user account. references: - https://twitter.com/SBousseaden/status/1387530414185664538 author: Christian Burkard (Nextron Systems) date: 2021-05-03 modified: 2025-10-31 tags: - attack.persistence - attack.t1136.001 logsource: product: windows category: registry_event detection: selection: TargetObject|contains: \SAM\SAM\Domains\Account\Users\Names\ TargetObject|endswith: $\(Default) Image|endswith: \lsass.exe condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_event/registry_event_add_local_hidden_user/info.yml simulation: - type: atomic-red-team name: Create Hidden User in Registry technique: T1564.002 atomic_guid: 173126b7-afe4-45eb-8680-fa9f6400431c
Near-miss passage: Sigma rule: Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this actio. Logsource: aws / cloudtrail. Rule: title: AWS Route 53 Domain Transfer Lock Disabled id: 3940b5f1-3f46-44aa-b746-ebe615b879e0 status: test description: Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar. references: - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/integrations/aws/persistence_route_53_domain_transfer_lock_disabled.toml - https://docs.aws.amazon.com/Route53/latest/APIReference/API_Operations_Amazon_Route_53.html - https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_DisableDomainTransferLock.html author: Elastic, Austin Songer @austinsonger date: 2021-07-22 modified: 2022-10-09 tags: - attack.persistence - attack.privilege-escalation - attack.credential-access - attack.t1098 logsource: product: aws service: cloudtrail detection: selection: eventSource: route53.amazonaws.com eventName: DisableDomainTransferLock condition: selection falsepositives: - A domain transfer lock may be disabled by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Activity from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Query: risk of IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to execute arbitrary commands with SYSTEM privi
Matching passage: CVE-2015-0160. CWE: CWE-264. CVSS: 9.0. IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to execute arbitrary commands with SYSTEM privileges via unspecified vectors.
Near-miss passage: CVE-2015-6619. CWE: CWE-264. CVSS: 9.300000190734863. The kernel in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, aka internal bug 23520714.
Query: exploit Directory traversal vulnerability in Spiffy before 5.4.
Matching passage: CVE-2015-8235. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in Spiffy before 5.4.
Near-miss passage: CVE-2015-7270. CWE: CWE-22. CVSS: 7.800000190734863. Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows directory traversal.