alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects the execution of a Chromium based browser process with the "headless" flag and a URL pointing to the mockbin.org
Matching passage: Sigma rule: Detects the execution of a Chromium based browser process with the "headless" flag and a URL pointing to the mockbin.org. Logsource: windows / process_creation. Rule: title: Chromium Browser Headless Execution To Mockbin Like Site id: 1c526788-0abe-4713-862f-b520da5e5316 status: test description: Detects the execution of a Chromium based browser process with the "headless" flag and a URL pointing to the mockbin.org service (which can be used to exfiltrate data). references: - https://www.zscaler.com/blogs/security-research/steal-it-campaign author: X__Junior (Nextron Systems) date: 2023-09-11 tags: - attack.execution logsource: product: windows category: process_creation detection: selection_img: Image|endswith: - \brave.exe - \chrome.exe - \msedge.exe - \opera.exe - \vivaldi.exe selection_headless: CommandLine|contains: --headless selection_url: CommandLine|contains: - ://run.mocky - ://mockbin condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_mockbin_abuse/info.yml
Near-miss passage: Sigma rule: Detect set DisallowRun to 1 to prevent user running specific computer program. Logsource: windows / registry_set. Rule: title: Add DisallowRun Execution to Registry id: 275641a5-a492-45e2-a817-7c81e9d9d3e9 status: test description: Detect set DisallowRun to 1 to prevent user running specific computer program references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md author: frack113 date: 2022-08-19 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: medium
Query: exploit Cross-site scripting (XSS) vulnerability in style-underground/search in Plain Black WebGUI 7.10.29 and earlier allows remote attackers to inject arbitrary web script or HTML via th
Matching passage: CVE-2015-1564. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in style-underground/search in Plain Black WebGUI 7.10.29 and earlier allows remote attackers to inject arbitrary web script or HTML via the Search field.
Near-miss passage: CVE-2015-3620. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1 and FortiManager 5.0.3 through 5.0.10 and 5.2.0 through 5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: alert when Detects potential DLL sideloading of an unsigned dbghelp.dll by the Sysinternals VMMap.
Matching passage: Sigma rule: Detects potential DLL sideloading of an unsigned dbghelp.dll by the Sysinternals VMMap.. Logsource: windows / image_load. Rule: title: VMMap Unsigned Dbghelp.DLL Potential Sideloading id: 273a8dd8-3742-4302-bcc7-7df5a80fe425 related: - id: 98ffaed4-aec2-4e04-9b07-31492fe68b3d type: similar status: test description: Detects potential DLL sideloading of an unsigned dbghelp.dll by the Sysinternals VMMap. references: - https://techcommunity.microsoft.com/t5/sysinternals-blog/zoomit-v7-1-procdump-2-0-for-linux-process-explorer-v17-05/ba-p/3884766 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-07-28 modified: 2023-09-05 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|contains: C:\Debuggers\dbghelp.dll Image|endswith: - \vmmap.exe - \vmmap64.exe filter_main_signed: Signed: 'true' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout. Logsource: windows / registry_set. Rule: title: Suspicious Keyboard Layout Load id: 34aa0252-6039-40ff-951f-939fd6ce47d8 status: test description: Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only references: - https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index - https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files author: Florian Roth (Nextron Systems) date: 2019-10-12 modified: 2023-08-17 tags: - attack.resource-development - attack.t1588.002 logsource: category: registry_set product: windows definition: 'Requirements: Sysmon config that monitors \Keyboard Layout\Preload subkey of the HKLU hives - see https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files' detection: selection_registry: TargetObject|contains: - \Keyboard Layout\Preload\ - \Keyboard Layout\Substitutes\ Details|contains: - 00000429 - 00050429 - 0000042a condition: selection_registry falsepositives: - Administrators or users that actually use the selected keyboard layouts (heavily depends on the organisation's user base) level: medium
Query: vulnerability: jcc.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (abort) via a crafted chunk-encoded body.
Matching passage: CVE-2015-1380. CWE: CWE-20. CVSS: 5.0. jcc.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (abort) via a crafted chunk-encoded body.
Near-miss passage: CVE-2015-3805. CWE: CWE-20. CVSS: 7.199999809265137. Apple iOS before 8.4.1 and OS X before 10.10.5 allow local users to bypass a code-signing protection mechanism via a crafted Mach-O file, a different vulnerability than CVE-2015-3802.
Query: patch priority for CVE-2015-9146
Matching passage: CVE-2015-9146. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, MDM9645, MDM9650, MDM9655, SD 400, SD 800, SD 835, SD 845, SD 850, and SDX20, when QDI read, write, or ioctl are called, the passed-in pointer is not properly validated before accessing it for the delayed response.
Near-miss passage: CVE-2015-0679. CWE: CWE-20. CVSS: 6.099999904632568. The web-authentication functionality on Cisco Wireless LAN Controller (WLC) devices 7.3(103.8) and 7.4(110.0) allows remote attackers to cause a denial of service (device reload) via a malformed password, aka Bug ID CSCui57980.
Query: CVE similar to CVE-2015-5755
Matching passage: CVE-2015-5755. CWE: CWE-119. CVSS: 6.800000190734863. CoreText in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted font file, a different vulnerability than CVE-2015-5761.
Near-miss passage: CVE-2015-8088. CWE: CWE-119. CVSS: 7.800000190734863. Heap-based buffer overflow in the HIFI driver in Huawei Mate 7 phones with software MT7-UL00 before MT7-UL00C17B354, MT7-TL10 before MT7-TL10C00B354, MT7-TL00 before MT7-TL00C01B354, and MT7-CL00 before MT7-CL00C92B354 and P8 phones with software GRA-TL00 before GRA-TL00C01B220SP01, GRA-CL00 before GRA-CL00C92B220, GRA-CL10 before GRA-CL10C92B220, GRA-UL00 before GRA-UL00C00B220, and GRA-UL10 before GRA-UL10C00B220 allows attackers to cause a denial of service (reboot) or execute arbitrary code via a crafted application.
Query: rule covering Detects the use of SFTP.exe to execute commands indirectly via ProxyCommand parameter. Threat actors were seen leveragin
Matching passage: Sigma rule: Detects the use of SFTP.exe to execute commands indirectly via ProxyCommand parameter. Threat actors were seen leveragin. Logsource: windows / process_creation. Rule: title: Indirect Command Execution via SFTP ProxyCommand id: 762bb580-79b4-40f4-8b9e-9349ce1710f4 status: experimental description: 'Detects the use of SFTP.exe to execute commands indirectly via ProxyCommand parameter. Threat actors were seen leveraging this legitimate Windows binary to bypass security controls and execute arbitrary commands while evading detection. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Sftp/ - https://news.sophos.com/en-us/2025/05/09/lumma-stealer-coming-and-going/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-04-27 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection: Image|endswith: \sftp.exe CommandLine|contains: ProxyCommand= condition: selection falsepositives: - Legitimate use of SFTP with proxy commands for administration or networking tasks level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_lolbin_sftp_indirect_cmd_execution/info.yml
Near-miss passage: Sigma rule: Detects logon events that specify new credentials. Logsource: windows / security. Rule: title: Outgoing Logon with New Credentials id: def8b624-e08f-4ae1-8612-1ba21190da6b status: test description: Detects logon events that specify new credentials references: - https://go.recordedfuture.com/hubfs/reports/mtp-2021-0914.pdf author: Max Altgelt (Nextron Systems) date: 2022-04-06 tags: - attack.lateral-movement - attack.t1550 logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 9 condition: selection falsepositives: - Legitimate remote administration activity level: low
Query: risk of The administrative web interface in Cisco WebEx Meetings Server 1.0 through 1.5 allows remote authenticated users to execute arbitrary OS commands with root privileges via unspecif
Matching passage: CVE-2015-0589. CWE: CWE-20. CVSS: 9.0. The administrative web interface in Cisco WebEx Meetings Server 1.0 through 1.5 allows remote authenticated users to execute arbitrary OS commands with root privileges via unspecified fields, aka Bug ID CSCuj40460.
Near-miss passage: CVE-2015-3758. CWE: CWE-20. CVSS: 4.300000190734863. UIKit WebView in Apple iOS before 8.4.1 allows attackers to bypass an intended user-confirmation requirement and initiate arbitrary FaceTime calls via an app that provides a crafted URL.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the Users module in Orchard 1.7.3 through 1.8.2 and 1.9.x before 1.9.1 allows remote attackers to inject arbitrary web script or HTML vi
Matching passage: CVE-2015-5520. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Users module in Orchard 1.7.3 through 1.8.2 and 1.9.x before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the username when creating a new user account, which is not properly handled when deleting an account.
Near-miss passage: CVE-2015-7417. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server 7.0 before 7.0.0.41, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.9 allows remote authenticated users to inject arbitrary web script or HTML via crafted data from an OAuth provider.
Query: CVE similar to CVE-2015-10104
Matching passage: CVE-2015-10104. CWE: CWE-601. CVSS: 6.099999904632568. A vulnerability, which was classified as problematic, has been found in Icons for Features Plugin 1.0.0 on WordPress. Affected by this issue is some unknown functionality of the file classes/class-icons-for-features-admin.php. The manipulation of the argument redirect_url leads to open redirect. The attack may be launched remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is 63124c021ae24b68e56872530df26eb4268ad633. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227756.
Near-miss passage: CVE-2015-5354. CWE: CWE-601. CVSS: 5.800000190734863. Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to admin/nos/login.
Query: exploit libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXML
Matching passage: CVE-2015-0236. CWE: CWE-200. CVSS: 3.5. libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.
Near-miss passage: CVE-2015-7945. CWE: CWE-200. CVSS: 7.5. The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2 allows remote attackers to obtain the DRBD secret via instance information job results.
Query: execution using Shared Modules
Matching passage: T1129 Shared Modules. Tactics: execution. Description: Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., [Native API](https://attack.mitre.org/techniques/T1106)). Adversaries may use this functionality as a way to execute arbitrary payloads on a victim system. For example, adversaries can modularize functionality of their malware into shared objects that perform various functions such as managing C2 network communications or execution of specific actions on objective. The Linux & macOS module loader can load and execute shared objects from arbitrary local paths. This functionality resides in `dlfcn.h` in functions such as `dlopen` and `dlsym`. Although macOS can execute `.so` files, common practice uses `.dylib` files.(Citation: Apple Dev Dynamic Libraries)(Citation: Linux Shared Libraries)(Citation: RotaJakiro 2021 netlab360 analysis)(Citation: Unit42 OceanLotus 2017) The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in `NTDLL.dll` and is part of the Windows [Native API](https://attack.mitre.org/techniques/T1106) which is called from functions like `LoadLibrary` at run time.(Citation: Microsoft DLL)
Near-miss passage: T1204.003 Malicious Image. Tactics: execution. Description: Adversaries may rely on a user running a malicious image to facilitate execution. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored. Backdoored images may be uploaded to a public repository via [Upload Malware](https://attack.mitre.org/techniques/T1608/001), and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container.(Citation: Summit Route Malicious AMIs) Adversaries may also name images a certain way to increase the chance of users mistakenly deploying an instance or container from the image (ex: [Match Legitimate Resource Name or Location](https://attack.mitre.org/techniques/T1036/005)).(Citation: Aqua Security Cloud Native Threat Report June 2021)
Query: exploit drivers/char/diag/diagchar_core.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5, 6, and 7 (2013) devices mishandles a socket process, which allows attackers to
Matching passage: CVE-2015-8937. CWE: CWE-19. CVSS: 7.800000190734863. drivers/char/diag/diagchar_core.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5, 6, and 7 (2013) devices mishandles a socket process, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28803962 and Qualcomm internal bug CR770548.
Near-miss passage: CVE-2015-1760. CWE: CWE-19. CVSS: 9.300000190734863. Microsoft Office Compatibility Pack SP3, Office 2010 SP2, Office 2013 SP1, and Office 2013 RT SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: alert when Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".
Matching passage: Sigma rule: Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".. Logsource: windows / process_creation. Rule: title: User Added to Remote Desktop Users Group id: ffa28e60-bdb1-46e0-9f82-05f7a61cc06e related: - id: ad720b90-25ad-43ff-9b5e-5c841facc8e5 type: similar - id: 10fb649c-3600-4d37-b1e6-56ea90bb7e09 type: similar status: test description: Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember". references: - https://www.microsoft.com/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021/ author: Florian Roth (Nextron Systems) date: 2021-12-06 modified: 2022-09-09 tags: - attack.initial-access - attack.persistence - attack.lateral-movement - attack.t1133 - attack.t1136.001 - attack.t1021.001 logsource: category: process_creation product: windows detection: selection_main: - CommandLine|contains|all: - 'localgroup ' - ' /add' - CommandLine|contains|all: - 'Add-LocalGroupMember ' - ' -Group ' selection_group: CommandLine|contains: - Remote Desktop Users - Utilisateurs du Bureau à distance - Usuarios de escritorio remoto condition: all of selection_* falsepositives: - Administrative activity level: high
Near-miss passage: Sigma rule: Detects the execution of SecurityXploded Tools. Logsource: windows / process_creation. Rule: title: HackTool - SecurityXploded Execution id: 7679d464-4f74-45e2-9e01-ac66c5eb041a status: stable description: Detects the execution of SecurityXploded Tools references: - https://securityxploded.com/ - https://web.archive.org/web/20200601000524/https://cyberx-labs.com/blog/gangnam-industrial-style-apt-campaign-targets-korean-industrial-companies/ author: Florian Roth (Nextron Systems) date: 2018-12-19 modified: 2023-02-04 tags: - attack.credential-access - attack.t1555 logsource: category: process_creation product: windows detection: selection: - Company: SecurityXploded - Image|endswith: PasswordDump.exe - OriginalFileName|endswith: PasswordDump.exe condition: selection falsepositives: - Unlikely level: critical
Query: how to detect Cloud Firewall
Matching passage: T1686.001 Cloud Firewall. Tactics: defense impairment. Description: Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols. An adversary with appropriate permissions may introduce new firewall rules or policies to allow access into a victim cloud environment and/or move laterally from the cloud control plane to the data plane. For example, an adversary may use a script or utility that creates new ingress rules in existing security groups (or creates new security groups entirely) to allow any TCP/IP connectivity to a cloud-hosted instance. They may also remove networking limitations to support traffic associated with malicious activity (such as cryptomining).(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022)(Citation: Expel AWS)
Near-miss passage: T1686.002 Network Device Firewall. Tactics: defense impairment. Description: Adversaries may disable network device-based firewall mechanisms entirely or add, delete, or modify particular rules in order to bypass controls limiting network usage. Adversaries may obtain access to devices such as routers, switches, or other perimeter/network devices and change access control lists (ACLs), security zones, or policy rules to permit otherwise blocked traffic. For example, adversaries may add new network firewall rules to allow access to all internal network subnets without restrictions. Allowing access to internal network subsets may enable unrestricted inbound/outbound connectivity or open paths for command and control and lateral movement. Adversaries may obtain access to network device management interfaces via [Valid Accounts](https://attack.mitre.org/techniques/T1078) or by exploiting vulnerabilities. In some cases, threat actors may target firewalls and other network infrastructure that are exposed to the internet by leveraging weaknesses in public-facing applications ([Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).(Citation: CVE-2024-55591 Detail) Adversaries may also modify host networking configurations that indirectly manipulate system firewalls, such as adjusting interface bandwidth or network connection request thresholds.
Query: describe CVE-2015-8005
Matching passage: CVE-2015-8005. CWE: CWE-200. CVSS: 5.0. MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 uses the thumbnail ImageMagick command line argument, which allows remote attackers to obtain the installation path by reading the metadata of a PNG thumbnail file.
Near-miss passage: CVE-2015-0673. CWE: CWE-200. CVSS: 4.0. Cisco Mobility Services Engine (MSE) 8.0(110.0) allows remote authenticated users to discover the passwords of arbitrary users by (1) reading log files or (2) using an unspecified GUI feature, aka Bug ID CSCut24792.