alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the use of 3proxy, a tiny free proxy server. Logsource: windows / process_creation. Rule: title: PUA - 3Proxy Execution id: f38a82d2-fba3-4781-b549-525efbec8506 status: test description: Detects the use of 3proxy, a tiny free proxy server references: - https://github.com/3proxy/3proxy - https://blog.talosintelligence.com/2022/09/lazarus-three-rats.html author: Florian Roth (Nextron Systems) date: 2022-09-13 modified: 2023-02-21 tags: - attack.command-and-control - attack.t1572 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \3proxy.exe selection_pe: Description: 3proxy - tiny proxy server selection_params: CommandLine|contains: .exe -i127.0.0.1 -p condition: 1 of selection_* falsepositives: - Administrative activity level: high
Near-miss passage: Sigma rule: Detects Commandlet names and arguments from the Nishang exploitation framework. Logsource: windows / ps_script. Rule: title: Malicious Nishang PowerShell Commandlets id: f772cee9-b7c2-4cb2-8f07-49870adc02e0 status: test description: Detects Commandlet names and arguments from the Nishang exploitation framework references: - https://github.com/samratashok/nishang author: Alec Costello date: 2019-05-16 modified: 2023-01-16 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Add-ConstrainedDelegationBackdoor - Copy-VSS - Create-MultipleSessions - DataToEncode - DNS_TXT_Pwnage - Do-Exfiltration-Dns - Download_Execute - Download-Execute-PS - DownloadAndExtractFromRemoteRegistry - DumpCerts - DumpCreds - DumpHashes - Enable-DuplicateToken - Enable-Duplication - Execute-Command-MSSQL - Execute-DNSTXT-Code - Execute-OnTime - ExetoText - exfill - ExfilOption - FakeDC - FireBuster - FireListener - 'Get-Information ' - Get-PassHints - Get-Web-Credentials - Get-WebCredentials - Get-WLAN-Keys - HTTP-Backdoor - Invoke-AmsiBypass - Invoke-BruteForce - Invoke-CredentialsPhish - Invoke-Decode - Invoke-Encode - Invoke-Interceptor - Invoke-JSRatRegsvr - Invoke-JSRatRundll - Invoke-MimikatzWDigestDowngrade - Invoke-NetworkRelay - Invoke-PowerShellIcmp - Invoke-PowerShellUdp - Invoke-Prasadhak - Invoke-PSGcat - Invoke-PsGcatAgent - Invoke-SessionGopher - Invoke-SSIDExfil - LoggedKeys - Nishang - NotAllNameSpaces - Out-CHM - OUT-DNSTXT - Out-HTA - Out-RundllCommand - Out-SCF - Out-SCT - Out-Shortcut - Out-WebQuery - Out-Word - Parse_Keys - Password-List - Powerpreter - Remove-Persistence - Remove-PoshRat - Remove-Update - Run-EXEonRemote - Set-DCShadowPermissions - Set-RemotePSRemoting - Set-RemoteWMI - Shellcode32 - Shellcode64 - StringtoBase64 - TexttoExe condition: selection falsepositives: - Unknown level: high
Query: exploit ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command.
Matching passage: CVE-2015-7977. CWE: CWE-476. CVSS: 5.900000095367432. ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command.
Near-miss passage: CVE-2015-8926. CWE: CWE-476. CVSS: 5.5. The archive_read_format_rar_read_data function in archive_read_support_format_rar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted rar archive.
Query: describe CVE-2015-2764
Matching passage: CVE-2015-2764. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Websense TRITON AP-DATA before 8.0.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the DSS (1) Mobile or (2) DLP report catalog.
Near-miss passage: CVE-2015-2223. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the web-based console management interface in Palo Alto Networks Traps (formerly Cyvera Endpoint Protection) 3.1.2.1546 allow remote attackers to inject arbitrary web script or HTML via the (1) Arguments, (2) FileName, or (3) URL parameter in a SOAP request.
Query: CWE for Exposure of Core Dump File to an Unauthorized Control Sphere
Matching passage: CWE-528 Exposure of Core Dump File to an Unauthorized Control Sphere. The product generates a core dump file in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.
Near-miss passage: CWE-1100 Insufficient Isolation of System-Dependent Functions. The product or code does not isolate system-dependent functionality into separate standalone modules.
Query: exploit Apache Tika server (aka tika-server) in Apache Tika 1.9 might allow remote attackers to read arbitrary files via the HTTP fileUrl header.
Matching passage: CVE-2015-3271. CWE: CWE-200. CVSS: 5.300000190734863. Apache Tika server (aka tika-server) in Apache Tika 1.9 might allow remote attackers to read arbitrary files via the HTTP fileUrl header.
Near-miss passage: CVE-2015-1857. CWE: CWE-200. CVSS: 5.300000190734863. The odl-mdsal-apidocs feature in OpenDaylight Helium allow remote attackers to obtain sensitive information by leveraging missing AAA restrictions.
Query: Sigma YAML for linux
Matching passage: Sigma rule: Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd. Logsource: linux. Rule: title: Symlink Etc Passwd id: c67fc22a-0be5-4b4f-aad5-2b32c4b69523 status: test description: Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd references: - https://www.qualys.com/2021/05/04/21nails/21nails.txt author: Florian Roth (Nextron Systems) date: 2019-04-05 modified: 2021-11-27 tags: - attack.t1204.001 - attack.execution logsource: product: linux detection: keywords: - ln -s -f /etc/passwd - ln -s /etc/passwd condition: keywords falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspici. Logsource: windows / process_creation. Rule: title: Suspicious Git Clone id: aef9d1f1-7396-4e92-a927-4567c7a495c1 status: test description: Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious references: - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-03 modified: 2023-01-10 tags: - attack.reconnaissance - attack.t1593.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \git.exe - \git-remote-https.exe - OriginalFileName: git.exe selection_cli: CommandLine|contains: - ' clone ' - 'git-remote-https ' selection_keyword: CommandLine|contains: - exploit - Vulns - vulnerability - RemoteCodeExecution - Invoke- - CVE- - poc- - ProofOfConcept - proxyshell - log4shell - eternalblue - eternal-blue - MS17- condition: all of selection_* falsepositives: - Unknown level: medium
Query: exploit The built-in web server in Huawei VP9660 multi-point control unit with software before V200R001C30SPC700 allows remote administrators to obtain sensitive information or cause a den
Matching passage: CVE-2015-8227. CWE: CWE-20. CVSS: 8.5. The built-in web server in Huawei VP9660 multi-point control unit with software before V200R001C30SPC700 allows remote administrators to obtain sensitive information or cause a denial of service via a crafted message.
Near-miss passage: CVE-2015-3204. CWE: CWE-20. CVSS: 5.0. libreswan 3.9 through 3.12 allows remote attackers to cause a denial of service (daemon restart) via an IKEv1 packet with (1) unassigned bits set in the IPSEC DOI value or (2) the next payload value set to ISAKMP_NEXT_SAK.
Query: common weakness: J2EE Misconfiguration: Weak Access Permissions for EJB Methods
Matching passage: CWE-9 J2EE Misconfiguration: Weak Access Permissions for EJB Methods. If elevated access rights are assigned to EJB methods, then an attacker can take advantage of the permissions to exploit the product.
Near-miss passage: CWE-653 Improper Isolation or Compartmentalization. The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.
Query: risk of The PRNG implementation in the DNS resolver in Mozilla Firefox (aka Fennec) before 37.0 on Android does not properly generate random numbers for query ID values and UDP source port
Matching passage: CVE-2015-0800. CWE: CWE-200. CVSS: 5.0. The PRNG implementation in the DNS resolver in Mozilla Firefox (aka Fennec) before 37.0 on Android does not properly generate random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a related issue to CVE-2012-2808.
Near-miss passage: CVE-2015-6557. CWE: CWE-200. CVSS: 2.0999999046325684. IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 5.5 before 5.5.6.1, 6.3 before 6.3.1.5, 6.4 before 6.4.1.7, and 7.1 before 7.1.2; Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 5.5 before 5.5.1.1, 6.1 before 6.1.3.7, 6.3 before 6.3.1.5, 6.4 before 6.4.1.7, and 7.1 before 7.1.2; and Tivoli Storage FlashCopy Manager 3.1 before 3.1.1.5, 3.2 before 3.2.1.7, and 4.1 before 4.1.2, when application tracing is used, place cleartext passwords in exception messages, which allows physically proximate attackers to obtain sensitive information by reading trace output, a different vulnerability than CVE-2015-4949.
Query: patch priority for CVE-2015-1113
Matching passage: CVE-2015-1113. CWE: CWE-200. CVSS: 1.899999976158142. The Sandbox Profiles component in Apple iOS before 8.3 allows attackers to read the (1) telephone number or (2) e-mail address of a recent contact via a crafted app.
Near-miss passage: CVE-2015-7433. CWE: CWE-200. CVSS: 7.800000190734863. IBM Capacity Management Analytics 2.1.0.0 allows local users to discover cleartext usernames and passwords by leveraging access to the CMA install machine. IBM X-Force ID: 107862.
Query: exfiltration using Scheduled Transfer
Matching passage: T1029 Scheduled Transfer. Tactics: exfiltration. Description: Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability. When scheduled exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) or [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).
Near-miss passage: T1567.003 Exfiltration to Text Storage Sites. Tactics: exfiltration. Description: Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as <code>pastebin[.]com</code>, are commonly used by developers to share code and other information. Text storage sites are often used to host malicious code for C2 communication (e.g., [Stage Capabilities](https://attack.mitre.org/techniques/T1608)), but adversaries may also use these sites to exfiltrate collected data. Furthermore, paid features and encryption options may allow adversaries to conceal and store data more securely.(Citation: Pastebin EchoSec) **Note:** This is distinct from [Exfiltration to Code Repository](https://attack.mitre.org/techniques/T1567/001), which highlight access to code repositories via APIs.
Query: mitigate Compromise Infrastructure
Matching passage: T1584 Compromise Infrastructure. Tactics: resource development. Description: Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage. Use of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) to further blend in and support staged information gathering and/or [Phishing](https://attack.mitre.org/techniques/T1566) campaigns.(Citation: FireEye DNS Hijack 2019) Adversaries may also compromise numerous machines to support [Proxy](https://attack.mitre.org/techniques/T1090) and/or proxyware services or to form a botnet.(Citation: amnesty_nso_pegasus)(Citation: Sysdig Proxyjacking) Additionally, adversaries may compromise infrastructure residing in close proximity to a target in order to gain [Initial Access](https://attack.mitre.org/tactics/TA0001) via [Wi-Fi Networks](https://attack.mitre.org/techniques/T1669).(Citation: Nearest Neighbor Volexity) By using compromised infrastructure, adversaries may enable follow-on malicious operations. Prior to targeting, adversaries may also compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig)
Near-miss passage: T1584.003 Virtual Private Server. Tactics: resource development. Description: Adversaries may compromise third-party Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. Adversaries may compromise VPSs purchased by third-party entities. By compromising a VPS to use as infrastructure, adversaries can make it difficult to physically tie back operations to themselves.(Citation: NSA NCSC Turla OilRig) Compromising a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers as well as that added by the compromised third-party.
Query: actor TTPs: Disable Crypto Hardware
Matching passage: T1600.002 Disable Crypto Hardware. Tactics: defense impairment. Description: Adversaries disable a network device’s dedicated hardware encryption, which may enable them to leverage weaknesses in software encryption in order to reduce the effort involved in collecting, manipulating, and exfiltrating transmitted data. Many network devices such as routers, switches, and firewalls, perform encryption on network traffic to secure transmission across networks. Often, these devices are equipped with special, dedicated encryption hardware to greatly increase the speed of the encryption process as well as to prevent malicious tampering. When an adversary takes control of such a device, they may disable the dedicated hardware, for example, through use of [Modify System Image](https://attack.mitre.org/techniques/T1601), forcing the use of software to perform encryption on general processors. This is typically used in conjunction with attacks to weaken the strength of the cipher in software (e.g., [Reduce Key Space](https://attack.mitre.org/techniques/T1600/001)). (Citation: Cisco Blog Legacy Device Attacks)
Near-miss passage: T1600 Weaken Encryption. Tactics: defense impairment. Description: Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications.(Citation: Cisco Synful Knock Evolution) Encryption can be used to protect transmitted network traffic to maintain its confidentiality (protect against unauthorized disclosure) and integrity (protect against unauthorized changes). Encryption ciphers are used to convert a plaintext message to ciphertext and can be computationally intensive to decipher without the associated decryption key. Typically, longer keys increase the cost of cryptanalysis, or decryption without the key. Adversaries can compromise and manipulate devices that perform encryption of network traffic. For example, through behaviors such as [Modify System Image](https://attack.mitre.org/techniques/T1601), [Reduce Key Space](https://attack.mitre.org/techniques/T1600/001), and [Disable Crypto Hardware](https://attack.mitre.org/techniques/T1600/002), an adversary can negatively effect and/or eliminate a device’s ability to securely encrypt network traffic. This poses a greater risk of unauthorized disclosure and may help facilitate data manipulation, Credential Access, or Collection efforts.(Citation: Cisco Blog Legacy Device Attacks)
Query: exploit Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X a
Matching passage: CVE-2015-0305. CWE: UNKNOWN. CVSS: 9.300000190734863. Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion."
Near-miss passage: CVE-2015-1346. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google V8 before 3.30.33.15, as used in Google Chrome before 40.0.2214.91, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Query: exploit Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," a differen
Matching passage: CVE-2015-1704. CWE: CWE-264. CVSS: 6.800000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-1703.
Near-miss passage: CVE-2015-1496. CWE: CWE-264. CVSS: 7.199999809265137. Motorola Scanner SDK uses weak permissions for (1) CoreScanner.exe, (2) rsmdriverproviderservice.exe, and (3) ScannerService.exe, which allows local users to gain privileges via unspecified vectors.
Query: rule covering Detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe. ArcSOC.exe is the
Matching passage: Sigma rule: Detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe. ArcSOC.exe is the. Logsource: windows / process_creation. Rule: title: Suspicious ArcSOC.exe Child Process id: 8e95e73e-ba02-4a87-b4d7-0929b8053038 status: experimental description: 'Detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe. ArcSOC.exe is the process name which hosts ArcGIS Server REST services. If an attacker compromises an ArcGIS Server system and uploads a malicious Server Object Extension (SOE), they can send crafted requests to the corresponding service endpoint and remotely execute code from the ArcSOC.exe process. ' references: - https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/ - https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm author: Micah Babinski date: 2025-11-25 tags: - attack.execution - attack.t1059 - attack.t1203 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \ArcSOC.exe Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wmic.exe - \wscript.exe filter_main_cmd: Image|endswith: \cmd.exe CommandLine: cmd.exe /c "ver" condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in com. Logsource: windows / image_load. Rule: title: DLL Sideloading Of ShellChromeAPI.DLL id: ee4c5d06-3abc-48cc-8885-77f1c20f4451 related: - id: e173ad47-4388-4012-ae62-bd13f71c18a8 type: similar status: test description: 'Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter ' references: - https://mobile.twitter.com/0gtweet/status/1564131230941122561 - https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-01 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \ShellChromeAPI.dll condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-2965
Matching passage: CVE-2015-2965. CWE: CWE-22. CVSS: 4.0. Directory traversal vulnerability in osCommerce Japanese 2.2ms1j-R8 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors.
Near-miss passage: CVE-2015-1195. CWE: CWE-22. CVSS: 6.5. The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.
Query: CVE similar to CVE-2015-0934
Matching passage: CVE-2015-0934. CWE: CWE-77. CVSS: 6.5. Common LaTeX Service Interface (CLSI) before 0.1.3, as used in ShareLaTeX before 0.1.3, allows remote authenticated users to execute arbitrary code via ` (backtick) characters in a filename.
Near-miss passage: CVE-2015-2210. CWE: CWE-77. CVSS: 7.800000190734863. The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into the window source to create a button that spawns a command shell.
Query: risk of mt-phpincgi.php in Hajime Fujimoto mt-phpincgi before 2015-05-15 does not properly restrict URLs, which allows remote attackers to conduct PHP object injection attacks and execute 
Matching passage: CVE-2015-2945. CWE: CWE-94. CVSS: 7.5. mt-phpincgi.php in Hajime Fujimoto mt-phpincgi before 2015-05-15 does not properly restrict URLs, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted request, as exploited in the wild in May 2015.
Near-miss passage: CVE-2015-5721. CWE: CWE-94. CVSS: 9.800000190734863. Malware Information Sharing Platform (MISP) before 2.3.90 allows remote attackers to conduct PHP object injection attacks via crafted serialized data, related to TemplatesController.php and populate_event_from_template_attributes.ctp.
Query: common weakness: Insecure Storage of Sensitive Information
Matching passage: CWE-922 Insecure Storage of Sensitive Information. The product stores sensitive information without properly limiting read or write access by unauthorized actors.
Near-miss passage: CWE-1119 Excessive Use of Unconditional Branching. The code uses too many unconditional branches (such as goto).