alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application cras
Matching passage: CVE-2015-5818. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-2493. CWE: CWE-119. CVSS: 9.300000190734863. The (1) VBScript and (2) JScript engines in Microsoft Internet Explorer 8 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
Query: rule covering Detects a ProcessHacker tool that elevated privileges to a very high level
Matching passage: Sigma rule: Detects a ProcessHacker tool that elevated privileges to a very high level. Logsource: windows / system. Rule: title: ProcessHacker Privilege Elevation id: c4ff1eac-84ad-44dd-a6fb-d56a92fc43a9 status: test description: Detects a ProcessHacker tool that elevated privileges to a very high level references: - https://twitter.com/1kwpeter/status/1397816101455765504 author: Florian Roth (Nextron Systems) date: 2021-05-27 modified: 2022-12-25 tags: - attack.persistence - attack.execution - attack.privilege-escalation - attack.t1543.003 - attack.t1569.002 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ServiceName|startswith: ProcessHacker AccountName: LocalSystem condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands. Such behavior may be associate. Logsource: linux / process_creation. Rule: title: Shell Invocation via Apt - Linux id: bb382fd5-b454-47ea-a264-1828e4c766d6 status: test description: 'Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. ' references: - https://gtfobins.github.io/gtfobins/apt/ - https://gtfobins.github.io/gtfobins/apt-get/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-28 modified: 2024-09-02 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /apt - /apt-get CommandLine|contains: APT::Update::Pre-Invoke::= condition: selection falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-2747
Matching passage: CVE-2015-2747. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the data loss prevention (DLP) incident Forensics Preview in Websense Triton 7.8.3 and V-Series 7.7 appliances allow remote attackers to inject arbitrary web script or HTML via a crafted (1) email or (2) HTTP request, which triggers a DLP Policy.
Near-miss passage: CVE-2015-4039. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via unspecified (1) profile fields or (2) new post content. NOTE: CVE-2015-4038 can be used to bypass the administrator confirmation step for vector 2.
Query: patch priority for CVE-2015-7050
Matching passage: CVE-2015-7050. CWE: CWE-200. CVSS: 4.300000190734863. WebKit in Apple iOS before 9.2 and Safari before 9.0.2 misparses content extensions, which allows remote attackers to obtain sensitive browsing-history information via a crafted web site.
Near-miss passage: CVE-2015-5898. CWE: CWE-200. CVSS: 2.0999999046325684. CFNetwork in Apple iOS before 9 relies on the hardware UID for its cache encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.
Query: weakness Excessive Data Query Operations in a Large Data Table
Matching passage: CWE-1049 Excessive Data Query Operations in a Large Data Table. The product performs a data query with a large number of joins and sub-queries on a large data table.
Near-miss passage: CWE-1097 Persistent Storable Data Element without Associated Comparison Control Element. The product uses a storable data element that does not have all of the associated functions or methods that are necessary to support comparison.
Query: actor TTPs: Exfiltration Over Symmetric Encrypted Non-C2 Protocol
Matching passage: T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Symmetric encryption algorithms are those that use shared or the same keys/secrets on each end of the channel. This requires an exchange or pre-arranged agreement/possession of the value used to encrypt and decrypt data. Network protocols that use asymmetric encryption often utilize symmetric encryption once keys are exchanged, but adversaries may opt to manually share keys and implement symmetric cryptographic algorithms (ex: RC4, AES) vice using mechanisms that are baked into a protocol. This may result in multiple layers of encryption (in protocols that are natively encrypted such as HTTPS) or encryption in protocols that not typically encrypted (such as HTTP or FTP).
Near-miss passage: T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Asymmetric encryption algorithms are those that use different keys on each end of the channel. Also known as public-key cryptography, this requires pairs of cryptographic keys that can encrypt/decrypt data from the corresponding key. Each end of the communication channels requires a private key (only in the procession of that entity) and the public key of the other entity. The public keys of each entity are exchanged before encrypted communications begin. Network protocols that use asymmetric encryption (such as HTTPS/TLS/SSL) often utilize symmetric encryption once keys are exchanged. Adversaries may opt to use these encrypted mechanisms that are baked into a protocol.
Query: detect Detects XSS attempts injected via GET requests in access logs in logs
Matching passage: Sigma rule: Detects XSS attempts injected via GET requests in access logs. Logsource: webserver. Rule: title: Cross Site Scripting Strings id: 65354b83-a2ea-4ea6-8414-3ab38be0d409 status: test description: Detects XSS attempts injected via GET requests in access logs references: - https://github.com/payloadbox/xss-payload-list - https://portswigger.net/web-security/cross-site-scripting/contexts author: Saw Win Naung, Nasreddine Bencherchali date: 2021-08-15 modified: 2022-06-14 tags: - attack.initial-access - attack.t1189 logsource: category: webserver detection: select_method: cs-method: GET keywords: - =<script> - =%3Cscript%3E - =%253Cscript%253E - '<iframe ' - '%3Ciframe ' - '<svg ' - '%3Csvg ' - document.cookie - document.domain - ' onerror=' - ' onresize=' - ' onload="' - onmouseover= - ${alert - javascript:alert - javascript%3Aalert filter: sc-status: 404 condition: select_method and keywords and not filter falsepositives: - JavaScripts,CSS Files and PNG files - User searches in search boxes of the respective website - Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as "User Agent" strings and more response codes level: high
Near-miss passage: Sigma rule: Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes. Logsource: windows / process_creation. Rule: title: Sysinternals PsSuspend Execution id: 48bbc537-b652-4b4e-bd1d-281172df448f related: - id: 4beb6ae0-f85b-41e2-8f18-8668abc8af78 type: similar status: test description: Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes references: - https://learn.microsoft.com/en-us/sysinternals/downloads/pssuspend - https://twitter.com/0gtweet/status/1638069413717975046 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-23 modified: 2026-06-29 tags: - attack.privilege-escalation - attack.discovery - attack.persistence - attack.t1543.003 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: pssuspend.exe - Image|endswith: - \pssuspend.exe - \pssuspend64.exe - \pssuspend64a.exe condition: selection falsepositives: - Unknown level: medium
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects the creation of files with scripting or executable extensions by Mysql daemon. Which could be an indicator of "U. Logsource: windows / file_event. Rule: title: Uncommon File Creation By Mysql Daemon Process id: c61daa90-3c1e-4f18-af62-8f288b5c9aaf status: test description: 'Detects the creation of files with scripting or executable extensions by Mysql daemon. Which could be an indicator of "User Defined Functions" abuse to download malware. ' references: - https://asec.ahnlab.com/en/58878/ - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-recon-mysql-malware-infection-via-user-defined-functions-udf/ author: Joseph Kamau date: 2024-05-27 tags: - attack.stealth logsource: product: windows category: file_event detection: selection: Image|endswith: - \mysqld.exe - \mysqld-nt.exe TargetFilename|endswith: - .bat - .dat - .dll - .exe - .ps1 - .psm1 - .vbe - .vbs condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of CSharp interactive console by PowerShell. Logsource: windows / process_creation. Rule: title: Suspicious Use of CSharp Interactive Console id: a9e416a8-e613-4f8b-88b8-a7d1d1af2f61 status: test description: Detects the execution of CSharp interactive console by PowerShell references: - https://redcanary.com/blog/detecting-attacks-leveraging-the-net-framework/ author: Michael R. (@nahamike01) date: 2020-03-08 modified: 2022-07-14 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection: Image|endswith: \csi.exe ParentImage|endswith: - \powershell.exe - \pwsh.exe - \powershell_ise.exe OriginalFileName: csi.exe condition: selection falsepositives: - Possible depending on environment. Pair with other factors such as net connections, command-line args, etc. level: high
Query: campaign using Mail Protocols
Matching passage: T1071.003 Mail Protocols. Tactics: command and control. Description: Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as SMTP/S, POP3/S, and IMAP that carry electronic mail may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the email messages themselves. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: FireEye APT28)
Near-miss passage: T1071.001 Web Protocols. Tactics: command and control. Description: Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as HTTP/S(Citation: CrowdStrike Putter Panda) and WebSocket(Citation: Brazking-Websockets) that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.
Query: detect Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScr in logs
Matching passage: Sigma rule: Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScr. Logsource: windows / process_creation. Rule: title: HackTool - SharpMove Tool Execution id: 055fb54c-a8f4-4aee-bd44-f74cf30a0d9d status: test description: 'Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options. ' references: - https://github.com/0xthirteen/SharpMove/ - https://pentestlab.blog/tag/sharpmove/ author: Luca Di Bartolomeo (CrimpSec) date: 2024-01-29 tags: - attack.lateral-movement - attack.t1021.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \SharpMove.exe - OriginalFileName: SharpMove.exe selection_cli_computer: CommandLine|contains: computername= selection_cli_actions: CommandLine|contains: - action=create - action=dcom - action=executevbs - action=hijackdcom - action=modschtask - action=modsvc - action=query - action=scm - action=startservice - action=taskscheduler condition: selection_img or all of selection_cli_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions all. Logsource: windows / process_creation. Rule: title: Suspicious Rundll32 Setupapi.dll Activity id: 285b85b1-a555-4095-8652-a8a4106af63f status: test description: setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions allowing to create values in the registry, modify files and install drivers. This technique could be used to obtain persistence via modifying one of Run or RunOnce registry keys, run process or use other DLLs chain calls (see references) InstallHinfSection function in setupapi.dll calls runonce.exe executable regardless of actual content of INF file. references: - https://lolbas-project.github.io/lolbas/Libraries/Setupapi/ - https://gist.githubusercontent.com/bohops/0cc6586f205f3691e04a1ebf1806aabd/raw/baf7b29891bb91e76198e30889fbf7d6642e8974/calc_exe.inf - https://raw.githubusercontent.com/huntresslabs/evading-autoruns/master/shady.inf - https://twitter.com/Z3Jpa29z/status/1313742350292746241?s=20 author: Konstantin Grishchenko, oscd.community date: 2020-10-07 modified: 2021-11-27 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection: Image|endswith: \runonce.exe ParentImage|endswith: \rundll32.exe ParentCommandLine|contains|all: - setupapi.dll - InstallHinfSection condition: selection falsepositives: - Scripts and administrative tools that use INF files for driver installation with setupapi.dll level: medium
Query: risk of Use-after-free vulnerability in the TextField object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.
Matching passage: CVE-2015-8049. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in the TextField object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a crafted autoSize property value, a different vulnerability than CVE-2015-8048, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-0133. CWE: UNKNOWN. CVSS: 5.0. IBM WebSphere Commerce 7.0 Feature Pack 4 through 8 allows remote attackers to read arbitrary files and possibly obtain administrative privileges via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Query: alert when Detects the deletion of S3 buckets in AWS CloudTrail logs. Monitoring the deletion of S3 buckets is critical for securit
Matching passage: Sigma rule: Detects the deletion of S3 buckets in AWS CloudTrail logs. Monitoring the deletion of S3 buckets is critical for securit. Logsource: aws / cloudtrail. Rule: title: AWS Bucket Deleted id: 39c9f26d-6e3b-4dbb-9c7a-4154b0281112 status: experimental description: 'Detects the deletion of S3 buckets in AWS CloudTrail logs. Monitoring the deletion of S3 buckets is critical for security and data integrity, as it may indicate potential data loss or unauthorized access attempts. ' references: - https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/delete-bucket.html author: Ivan Saakov, Nasreddine Bencherchali date: 2025-10-19 tags: - attack.stealth logsource: product: aws service: cloudtrail detection: selection_event_name: eventName: DeleteBucket selection_status_success: errorCode: Success selection_status_null: errorCode: null condition: selection_event_name and 1 of selection_status_* falsepositives: - During maintenance operations or testing, authorized administrators may delete S3 buckets as part of routine data management or cleanup activities. level: medium
Near-miss passage: Sigma rule: Detects when a user tampers with S3 data management in Amazon Web Services.. Logsource: aws / cloudtrail. Rule: title: AWS S3 Data Management Tampering id: 78b3756a-7804-4ef7-8555-7b9024a02e2d status: test description: Detects when a user tampers with S3 data management in Amazon Web Services. references: - https://github.com/elastic/detection-rules/pull/1145/files - https://docs.aws.amazon.com/AmazonS3/latest/API/API_Operations.html - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLogging.html - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketWebsite.html - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html - https://docs.aws.amazon.com/AmazonS3/latest/userguide/setting-repl-config-perm-overview.html - https://docs.aws.amazon.com/AmazonS3/latest/API/API_RestoreObject.html author: Austin Songer @austinsonger date: 2021-07-24 modified: 2022-10-09 tags: - attack.exfiltration - attack.t1537 logsource: product: aws service: cloudtrail detection: selection: eventSource: s3.amazonaws.com eventName: - PutBucketLogging - PutBucketWebsite - PutEncryptionConfiguration - PutLifecycleConfiguration - PutReplicationConfiguration - ReplicateObject - RestoreObject condition: selection falsepositives: - A S3 configuration change may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. S3 configuration change from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Query: Sigma rule for Detects usage of bitsadmin downloading a file with a suspicious extension
Matching passage: Sigma rule: Detects usage of bitsadmin downloading a file with a suspicious extension. Logsource: windows / process_creation. Rule: title: File With Suspicious Extension Downloaded Via Bitsadmin id: 5b80a791-ad9b-4b75-bcc1-ad4e1e89c200 status: test description: Detects usage of bitsadmin downloading a file with a suspicious extension references: - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin - https://isc.sans.edu/diary/22264 - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-06-28 modified: 2023-05-30 tags: - attack.persistence - attack.execution - attack.stealth - attack.t1197 - attack.s0190 - attack.t1036.003 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \bitsadmin.exe - OriginalFileName: bitsadmin.exe selection_flags: CommandLine|contains: - ' /transfer ' - ' /create ' - ' /addfile ' selection_extension: CommandLine|contains: - .7z - .asax - .ashx - .asmx - .asp - .aspx - .bat - .cfm - .cgi - .chm - .cmd - .dll - .gif - .jpeg - .jpg - .jsp - .jspx - .log - .png - .ps1 - .psm1 - .rar - .scf - .sct - .txt - .vbe - .vbs - .war - .wsf - .wsh - .xll - .zip condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_extensions/info.yml simulation: - type: atomic-red-team name: Windows - BITSAdmin BITS Download technique: T1105 atomic_guid: a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b
Near-miss passage: Sigma rule: Detects suspicious network connections made by a well-known Windows binary run with no command line parameters. Logsource: windows / network_connection. Rule: title: Suspicious Network Connection Binary No CommandLine id: 20384606-a124-4fec-acbb-8bd373728613 status: test description: Detects suspicious network connections made by a well-known Windows binary run with no command line parameters references: - https://redcanary.com/blog/raspberry-robin/ author: Florian Roth (Nextron Systems) date: 2022-07-03 tags: - attack.stealth logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: - \regsvr32.exe - \rundll32.exe - \dllhost.exe CommandLine|endswith: - \regsvr32.exe - \rundll32.exe - \dllhost.exe filter_no_cmdline: CommandLine: '' filter_null: CommandLine: null condition: selection and not 1 of filter* falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-0796
Matching passage: CVE-2015-0796. CWE: CWE-434. CVSS: 7.800000190734863. In open buildservice 2.6 before 2.6.3, 2.5 before 2.5.7 and 2.4 before 2.4.8 the source service patch application could generate non-standard files like symlinks or device nodes, which could allow buildservice users to break of confinement or cause denial of service attacks on the source service.
Near-miss passage: CVE-2015-1785. CWE: CWE-434. CVSS: 6.5. In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The vulnerabilities lie in how the application validates user uploaded files and lack of security measures preventing unwanted HTTP requests.