alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes
Matching passage: Sigma rule: Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes. Logsource: windows / process_creation. Rule: title: Sysinternals PsSuspend Execution id: 48bbc537-b652-4b4e-bd1d-281172df448f related: - id: 4beb6ae0-f85b-41e2-8f18-8668abc8af78 type: similar status: test description: Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes references: - https://learn.microsoft.com/en-us/sysinternals/downloads/pssuspend - https://twitter.com/0gtweet/status/1638069413717975046 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-23 modified: 2026-06-29 tags: - attack.privilege-escalation - attack.discovery - attack.persistence - attack.t1543.003 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: pssuspend.exe - Image|endswith: - \pssuspend.exe - \pssuspend64.exe - \pssuspend64a.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects volume shadow copy mount via Windows event log. Logsource: windows / system. Rule: title: Volume Shadow Copy Mount id: f512acbf-e662-4903-843e-97ce4652b740 status: test description: Detects volume shadow copy mount via Windows event log references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-3---esentutlexe-sam-copy author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR) date: 2020-10-20 modified: 2022-12-25 tags: - attack.credential-access - attack.t1003.002 logsource: product: windows service: system detection: selection: Provider_Name: Microsoft-Windows-Ntfs EventID: 98 DeviceName|contains: HarddiskVolumeShadowCopy condition: selection falsepositives: - Legitimate use of volume shadow copy mounts (backups maybe). level: low
Query: write Sigma for Detects the modification of an EC2 snapshot's permissions to enable access from another account
Matching passage: Sigma rule: Detects the modification of an EC2 snapshot's permissions to enable access from another account. Logsource: aws / cloudtrail. Rule: title: AWS Snapshot Backup Exfiltration id: abae8fec-57bd-4f87-aff6-6e3db989843d status: test description: Detects the modification of an EC2 snapshot's permissions to enable access from another account references: - https://www.justice.gov/file/1080281/download author: Darin Smith date: 2021-05-17 modified: 2021-08-19 tags: - attack.exfiltration - attack.t1537 logsource: product: aws service: cloudtrail detection: selection_source: eventSource: ec2.amazonaws.com eventName: ModifySnapshotAttribute condition: selection_source falsepositives: - Valid change to a snapshot's permissions level: medium
Near-miss passage: Sigma rule: Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". T. Logsource: windows / powershell-classic. Rule: title: Potential RemoteFXvGPUDisablement.EXE Abuse id: f65e22f9-819e-4f96-9c7b-498364ae7a25 related: - id: a6fc3c46-23b8-4996-9ea2-573f4c4d88c5 type: similar - id: 38a7625e-b2cb-485d-b83d-aff137d859f4 type: similar - id: cacef8fc-9d3d-41f7-956d-455c6e881bc5 type: similar status: test description: Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This could be a sign of potential abuse of the "RemoteFXvGPUDisablement.exe" binary which is known to be vulnerable to module load-order hijacking. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md - https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1 author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-07-13 modified: 2023-05-09 tags: - attack.stealth - attack.t1218 logsource: product: windows service: powershell-classic definition: fields have to be extract from event detection: selection: Data|contains: ModuleContents=function Get-VMRemoteFXPhysicalVideoAdapter { condition: selection falsepositives: - Unknown level: high
Query: alert when Detects a suspicious process spawning from an Outlook process.
Matching passage: Sigma rule: Detects a suspicious process spawning from an Outlook process.. Logsource: windows / process_creation. Rule: title: Suspicious Outlook Child Process id: 208748f7-881d-47ac-a29c-07ea84bf691d related: - id: 438025f9-5856-4663-83f7-52f878a70a50 type: derived - id: e212d415-0e93-435f-9e1a-f29005bb4723 type: derived status: test description: Detects a suspicious process spawning from an Outlook process. references: - https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100 - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html author: Michael Haag, Florian Roth (Nextron Systems), Markus Neis, Elastic, FPT.EagleEye Team date: 2022-02-28 modified: 2023-02-04 tags: - attack.execution - attack.t1204.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \OUTLOOK.EXE Image|endswith: - \AppVLP.exe - \bash.exe - \cmd.exe - \cscript.exe - \forfiles.exe - \hh.exe - \mftrace.exe - \msbuild.exe - \msdt.exe - \mshta.exe - \msiexec.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \schtasks.exe - \scrcons.exe - \scriptrunner.exe - \sh.exe - \svchost.exe - \wmic.exe - \wscript.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of a file by "dllhost.exe" in System32 directory part of "IDiagnosticProfileUAC" UAC bypass techniq. Logsource: windows / file_event. Rule: title: UAC Bypass Using IDiagnostic Profile - File id: 48ea844d-19b1-4642-944e-fe39c2cc1fec status: test description: Detects the creation of a file by "dllhost.exe" in System32 directory part of "IDiagnosticProfileUAC" UAC bypass technique references: - https://github.com/Wh04m1001/IDiagnosticProfileUAC author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-03 tags: - attack.execution - attack.privilege-escalation - attack.t1548.002 logsource: product: windows category: file_event detection: selection: Image|endswith: \DllHost.exe TargetFilename|startswith: C:\Windows\System32\ TargetFilename|endswith: .dll condition: selection falsepositives: - Unknown level: high
Query: vulnerability: Unspecified vulnerability in MyBB (aka MyBulletinBoard) before 1.8.4 has unknown attack vectors related to "Group join request notifications sent to wrong group leaders."
Matching passage: CVE-2015-2786. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in MyBB (aka MyBulletinBoard) before 1.8.4 has unknown attack vectors related to "Group join request notifications sent to wrong group leaders."
Near-miss passage: CVE-2015-0431. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0 6.3.1, 6.3.2, 6.3.4, and 6.3.5 allows remote attackers to affect integrity via unknown vectors related to UI Infrastructure.
Query: vulnerability: The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a
Matching passage: CVE-2015-8557. CWE: CWE-78. CVSS: 9.0. The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.
Near-miss passage: CVE-2015-4186. CWE: CWE-78. CVSS: 7.199999809265137. The diagnostics subsystem in the administrative web interface on Cisco Virtualization Experience (aka VXC) Client 6215 devices with firmware 11.2(27.4) allows local users to gain privileges for OS command execution via a crafted option value, aka Bug ID CSCug54412.
Query: exploit Multiple cross-site scripting (XSS) vulnerabilities in Request Tracker (RT) 4.x before 4.2.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to t
Matching passage: CVE-2015-5475. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Request Tracker (RT) 4.x before 4.2.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) user and (2) group rights management pages.
Near-miss passage: CVE-2015-7365. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the plugin upgrade form in Revive Adserver before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via the filename of an uploaded file containing errors.
Query: risk of Eaton Cooper Power Systems ProView 4.x and 5.x before 5.1 on Form 6 controls and Idea and IdeaPLUS relays does not properly initialize padding fields in Ethernet packets, which all
Matching passage: CVE-2015-6471. CWE: CWE-200. CVSS: 5.300000190734863. Eaton Cooper Power Systems ProView 4.x and 5.x before 5.1 on Form 6 controls and Idea and IdeaPLUS relays does not properly initialize padding fields in Ethernet packets, which allows remote attackers to obtain sensitive information by reading packet data.
Near-miss passage: CVE-2015-1314. CWE: CWE-200. CVSS: 2.0999999046325684. The USAA Mobile Banking application before 7.10.1 for Android displays the most recently-used screen before prompting the user for login, which might allow physically proximate users to obtain banking account numbers and balances.
Query: CVE similar to CVE-2015-9371
Matching passage: CVE-2015-9371. CWE: CWE-79. CVSS: 6.099999904632568. Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Near-miss passage: CVE-2015-1402. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: patch priority for CVE-2015-7621
Matching passage: CVE-2015-7621. CWE: CWE-416. CVSS: 6.800000190734863. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via a crafted U3D object, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7615, and CVE-2015-7617.
Near-miss passage: CVE-2015-5123. CWE: CWE-416. CVSS: 9.800000190734863. Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.
Query: describe CVE-2015-3215
Matching passage: CVE-2015-3215. CWE: CWE-20. CVSS: 7.5. The NetKVM Windows Virtio driver allows remote attackers to cause a denial of service (guest crash) via a crafted length value in an IP packet, as demonstrated by a value that does not account for the size of the IP options.
Near-miss passage: CVE-2015-2917. CWE: CWE-20. CVSS: 4.300000190734863. Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M unintentionally omit the X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site that contains a (1) FRAME, (2) IFRAME, or (3) OBJECT element.
Query: describe CVE-2015-3405
Matching passage: CVE-2015-3405. CWE: CWE-331. CVSS: 7.5. ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.
Near-miss passage: CVE-2015-3006. CWE: CWE-331. CVSS: 6.5. On the QFX3500 and QFX3600 platforms, the number of bytes collected from the RANDOM_INTERRUPT entropy source when the device boots up is insufficient, possibly leading to weak or duplicate SSH keys or self-signed SSL/TLS certificates. Entropy increases after the system has been up and running for some time, but immediately after boot, the entropy is very low. This issue only affects the QFX3500 and QFX3600 switches. No other Juniper Networks products or platforms are affected by this weak entropy vulnerability.
Query: patch priority for CVE-2015-0829
Matching passage: CVE-2015-0829. CWE: CWE-119. CVSS: 6.800000190734863. Buffer overflow in libstagefright in Mozilla Firefox before 36.0 allows remote attackers to execute arbitrary code via a crafted MP4 video that is improperly handled during playback.
Near-miss passage: CVE-2015-9128. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, and SD 835, lack of validation of the buffer size could lead to a buffer overread.
Query: describe CVE-2015-1879
Matching passage: CVE-2015-1879. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the profile parameter in an edit action in the gde-settings page to wp-admin/options-general.php.
Near-miss passage: CVE-2015-7191. CWE: CWE-79. CVSS: 4.300000190734863. Mozilla Firefox before 42.0 on Android improperly restricts URL strings in intents, which allows attackers to conduct cross-site scripting (XSS) attacks via vectors involving an intent: URL and fallback navigation, aka "Universal XSS (UXSS)."
Query: exploit Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Mem
Matching passage: CVE-2015-2384. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2383 and CVE-2015-2425.
Near-miss passage: CVE-2015-6993. CWE: CWE-119. CVSS: 6.800000190734863. FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-7008, CVE-2015-7009, CVE-2015-7010, and CVE-2015-7018.
Query: vulnerability: The web interface in McAfee Advanced Threat Defense (MATD) before 3.4.4.63 allows remote authenticated users to obtain sensitive configuration information via unspecified vectors.
Matching passage: CVE-2015-3030. CWE: CWE-200. CVSS: 4.0. The web interface in McAfee Advanced Threat Defense (MATD) before 3.4.4.63 allows remote authenticated users to obtain sensitive configuration information via unspecified vectors.
Near-miss passage: CVE-2015-1692. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 7 through 11 allows user-assisted remote attackers to read the clipboard contents via crafted web script, aka "Internet Explorer Clipboard Information Disclosure Vulnerability."
Query: SOC alert related to Services File Permissions Weakness
Matching passage: T1574.010 Services File Permissions Weakness. Tactics: stealth, execution. Description: Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM. Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.
Near-miss passage: T1574.004 Dylib Hijacking. Tactics: stealth, execution. Description: Adversaries may execute their own payloads by placing a malicious dynamic library (dylib) with an expected name in a path a victim application searches at runtime. The dynamic loader will try to find the dylibs based on the sequential order of the search paths. Paths to dylibs may be prefixed with <code>@rpath</code>, which allows developers to use relative paths to specify an array of search paths used at runtime based on the location of the executable. Additionally, if weak linking is used, such as the <code>LC_LOAD_WEAK_DYLIB</code> function, an application will still execute even if an expected dylib is not present. Weak linking enables developers to run an application on multiple macOS versions as new APIs are added. Adversaries may gain execution by inserting malicious dylibs with the name of the missing dylib in the identified path.(Citation: Wardle Dylib Hijack Vulnerable Apps)(Citation: Wardle Dylib Hijacking OSX 2015)(Citation: Github EmpireProject HijackScanner)(Citation: Github EmpireProject CreateHijacker Dylib) Dylibs are loaded into an application's address space allowing the malicious dylib to inherit the application's privilege level and resources. Based on the application, this could result in privilege escalation and uninhibited network access. This method may also evade detection from security products since the execution is masked under a legitimate process.(Citation: Writing Bad Malware for OSX)(Citation: wardle artofmalware volume1)(Citation: MalwareUnicorn macOS Dylib Injection MachO)
Query: actor TTPs: Domain Account
Matching passage: T1136.002 Domain Account. Tactics: persistence. Description: Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the <code>net user /add /domain</code> command can be used to create a domain account.(Citation: Savill 1999) Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Near-miss passage: T1136.001 Local Account. Tactics: persistence. Description: Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. For example, with a sufficient level of access, the Windows <code>net user /add</code> command can be used to create a local account. In Linux, the `useradd` command can be used, while on macOS systems, the <code>dscl -create</code> command can be used. Local accounts may also be added to network devices, often via common [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as <code>username</code>, to ESXi servers via `esxcli system account add`, or to Kubernetes clusters using the `kubectl` utility.(Citation: cisco_username_cmd)(Citation: Kubernetes Service Accounts Security) Adversaries may also create new local accounts on network firewall management consoles – for example, by exploiting a vulnerable firewall management system, threat actors may be able to establish super-admin accounts that could be used to modify firewall rules and gain further access to the network.(Citation: Cyber Security News) Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Query: describe CVE-2015-2233
Matching passage: CVE-2015-2233. CWE: CWE-310. CVSS: 8.300000190734863. Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 does not properly validate CA chains during signature validation, which allows man-in-the-middle attackers to upload and execute arbitrary files via a crafted certificate.
Near-miss passage: CVE-2015-4056. CWE: CWE-310. CVSS: 6.699999809265137. The System Library in VCE Vision Intelligent Operations before 2.6.5 does not properly implement cryptography, which makes it easier for local users to discover credentials by leveraging administrative access.
Query: mitigate SSH
Matching passage: T1021.004 SSH. Tactics: lateral movement. Description: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user. SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. On ESXi, SSH can be enabled either directly on the host (e.g., via `vim-cmd hostsvc/enable_ssh`) or via vCenter.(Citation: Sygnia ESXi Ransomware 2025)(Citation: TrendMicro ESXI Ransomware)(Citation: Sygnia Abyss Locker 2025) The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password. In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to login as that user (i.e., [SSH Authorized Keys](https://attack.mitre.org/techniques/T1098/004)).
Near-miss passage: T1021.007 Cloud Services. Tactics: lateral movement. Description: Adversaries may log into accessible cloud services within a compromised environment using [Valid Accounts](https://attack.mitre.org/techniques/T1078) that are synchronized with or federated to on-premises user identities. The adversary may then perform management actions or access cloud-hosted resources as the logged-on user. Many enterprises federate centrally managed user identities to cloud services, allowing users to login with their domain credentials in order to access the cloud control plane. Similarly, adversaries may connect to available cloud services through the web console or through the cloud command line interface (CLI) (e.g., [Cloud API](https://attack.mitre.org/techniques/T1059/009)), using commands such as <code>Connect-AZAccount</code> for Azure PowerShell, <code>Connect-MgGraph</code> for Microsoft Graph PowerShell, and <code>gcloud auth login</code> for the Google Cloud CLI. In some cases, adversaries may be able to authenticate to these services via [Application Access Token](https://attack.mitre.org/techniques/T1550/001) instead of a username and password.