alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary 
Matching passage: CVE-2015-7450. CWE: CWE-502. CVSS: 9.800000190734863. Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.
Near-miss passage: CVE-2015-4852. CWE: CWE-502. CVSS: 9.800000190734863. The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.
Query: campaign using Overwrite Process Arguments
Matching passage: T1036.011 Overwrite Process Arguments. Tactics: stealth. Description: Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign process. On Linux, the operating system stores command-line arguments in the process’s stack and passes them to the `main()` function as the `argv` array. The first element, `argv[0]`, typically contains the process name or path - by default, the command used to actually start the process (e.g., `cat /etc/passwd`). By default, the Linux `/proc` filesystem uses this value to represent the process name. The `/proc/<PID>/cmdline` file reflects the contents of this memory, and tools like `ps` use it to display process information. Since arguments are stored in user-space memory at launch, this modification can be performed without elevated privileges. During runtime, adversaries can erase the memory used by all command-line arguments for a process, overwriting each argument string with null bytes. This removes evidence of how the process was originally launched. They can then write a spoofed string into the memory region previously occupied by `argv[0]` to mimic a benign command, such as `cat resolv.conf`. The new command-line string is reflected in `/proc/<PID>/cmdline` and displayed by tools like `ps`.(Citation: Sandfly BPFDoor 2022)(Citation: Microsoft XorDdos Linux Stealth 2022)
Near-miss passage: T1036.001 Invalid Code Signature. Tactics: stealth. Description: Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program. Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may improperly handle these files.(Citation: Threatexpress MetaTwin 2017) Unlike [Code Signing](https://attack.mitre.org/techniques/T1553/002), this activity will not result in a valid signature.
Query: patch priority for CVE-2015-0480
Matching passage: CVE-2015-0480. CWE: UNKNOWN. CVSS: 5.800000190734863. Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity and availability via unknown vectors related to Tools.
Near-miss passage: CVE-2015-0400. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Libraries.
Query: describe CVE-2015-4786
Matching passage: CVE-2015-4786. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790.
Near-miss passage: CVE-2015-6710. CWE: UNKNOWN. CVSS: 6.800000190734863. The CBBBRInit method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Query: alert when Detects instances where an RDP service on an OpenCanary node has had a connection attempt.
Matching passage: Sigma rule: Detects instances where an RDP service on an OpenCanary node has had a connection attempt.. Logsource: opencanary / application. Rule: title: OpenCanary - RDP New Connection Attempt id: 598290cf-5932-45cd-9123-be1e05ab4f2e status: experimental description: Detects instances where an RDP service on an OpenCanary node has had a connection attempt. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Marco Pedrinazzi (@pedrinazziM) date: 2026-01-06 tags: - attack.initial-access - attack.lateral-movement - attack.persistence - attack.t1133 - attack.t1021.001 logsource: category: application product: opencanary detection: selection: logtype: 14001 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the addition of the 'MiniNt' key to the registry. Upon a reboot, Windows Event Log service will stop writing eve. Logsource: windows / registry_set. Rule: title: Security Event Logging Disabled via MiniNt Registry Key - Registry Set id: 8839e550-52d7-4958-9f2f-e13c1e736838 related: - id: 1a4bd6af-99ac-4466-b5b2-7b72b4a05462 type: similar status: experimental description: 'Detects the addition of the ''MiniNt'' key to the registry. Upon a reboot, Windows Event Log service will stop writing events. Windows Event Log is a service that collects and stores event logs from the operating system and applications. It is an important component of Windows security and auditing. Adversary may want to disable this service to disable logging of security events which could be used to detect their activities. ' references: - https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-04-09 tags: - attack.persistence - attack.defense-impairment - attack.t1685.001 - attack.t1112 - car.2022-03-001 logsource: category: registry_set product: windows detection: selection: TargetObject: HKLM\System\CurrentControlSet\Control\MiniNt\(Default) condition: selection falsepositives: - Highly Unlikely level: high
Query: Sigma rule for Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or fir
Matching passage: Sigma rule: Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or fir. Logsource: windows / process_creation. Rule: title: PUA - Fast Reverse Proxy (FRP) Execution id: 32410e29-5f94-4568-b6a3-d91a8adad863 status: test description: Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet. references: - https://asec.ahnlab.com/en/38156/ - https://github.com/fatedier/frp author: frack113, Florian Roth date: 2022-09-02 modified: 2024-11-23 tags: - attack.command-and-control - attack.t1090 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: - \frpc.exe - \frps.exe selection_cli: CommandLine|contains: \frpc.ini selection_hashes: Hashes|contains: - MD5=7D9C233B8C9E3F0EA290D2B84593C842 - SHA1=06DDC9280E1F1810677935A2477012960905942F - SHA256=57B0936B8D336D8E981C169466A15A5FD21A7D5A2C7DAF62D5E142EE860E387C condition: 1 of selection_* falsepositives: - Legitimate use level: high
Near-miss passage: Sigma rule: Detects potential persistence activity via outlook today page. An attacker can set a custom page to execute arbitrary co. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Outlook Today Page id: 487bb375-12ef-41f6-baae-c6a1572b4dd1 related: - id: ddd171b5-2cc6-4975-9e78-f0eccd08cc76 type: similar status: test description: 'Detects potential persistence activity via outlook today page. An attacker can set a custom page to execute arbitrary code and link to it via the registry values "URL" and "UserDefinedUrl". ' references: - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=74 - https://trustedsec.com/blog/specula-turning-outlook-into-a-c2-with-one-registry-change author: Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand date: 2021-06-10 modified: 2024-08-07 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection_main: TargetObject|contains|all: - Software\Microsoft\Office\ - \Outlook\Today\ selection_value_stamp: TargetObject|endswith: \Stamp Details: DWORD (0x00000001) selection_value_url: TargetObject|endswith: - \URL - \UserDefinedUrl filter_main_office: Image|startswith: - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\ Image|endswith: \OfficeClickToRun.exe condition: selection_main and 1 of selection_value_* and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Detects usage of the "Write-EventLog" cmdlet with 'RawData' flag. The cmdlet can be levreage to write malicious payloads. Logsource: windows / ps_script. Rule: title: PowerShell Write-EventLog Usage id: 35f41cd7-c98e-469f-8a02-ec4ba0cc7a7e status: test description: Detects usage of the "Write-EventLog" cmdlet with 'RawData' flag. The cmdlet can be levreage to write malicious payloads to the EventLog and then retrieve them later for later use references: - https://www.blackhillsinfosec.com/windows-event-logs-for-red-teams/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-16 tags: - attack.defense-impairment logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Write-EventLog - '-RawData ' condition: selection falsepositives: - Legitimate applications writing events via this cmdlet. Investigate alerts to determine if the action is benign level: medium
Near-miss passage: Sigma rule: Detects LOLBINs executing from an abnormal or uncommon drive such as a mounted ISO.. Logsource: windows / process_creation. Rule: title: LOLBIN Execution From Abnormal Drive id: d4ca7c59-e9e4-42d8-bf57-91a776efcb87 related: - id: 5b80cf53-3a46-4adc-960b-05ec19348d74 type: similar status: test description: Detects LOLBINs executing from an abnormal or uncommon drive such as a mounted ISO. references: - https://thedfirreport.com/2021/12/13/diavol-ransomware/ - https://www.scythe.io/library/threat-emulation-qakbot - https://sec-consult.com/blog/detail/bumblebee-hunting-with-a-velociraptor/ author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Angelo Violetti - SEC Consult '@angelo_violetti', Aaron Herman date: 2022-01-25 modified: 2023-08-29 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \calc.exe - \certutil.exe - \cmstp.exe - \cscript.exe - \installutil.exe - \mshta.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - OriginalFileName: - CALC.EXE - CertUtil.exe - CMSTP.EXE - cscript.exe - installutil.exe - MSHTA.EXE - REGSVR32.EXE - RUNDLL32.EXE - wscript.exe filter_main_currentdirectory: CurrentDirectory|contains: C:\ filter_main_empty: CurrentDirectory: '' filter_main_null: CurrentDirectory: null condition: selection and not 1 of filter_main_* falsepositives: - Rare false positives could occur on servers with multiple drives. level: medium
Query: risk of The process-management implementation in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to gain privileges by terminating a firestarter.py
Matching passage: CVE-2015-4325. CWE: CWE-264. CVSS: 6.900000095367432. The process-management implementation in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to gain privileges by terminating a firestarter.py supervised process and then triggering the restart of a process by the root account, aka Bug ID CSCuv12272.
Near-miss passage: CVE-2015-3188. CWE: CWE-264. CVSS: 9.800000190734863. The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors.
Query: vulnerability: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Mem
Matching passage: CVE-2015-1659. CWE: UNKNOWN. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1662 and CVE-2015-1665.
Near-miss passage: CVE-2015-0406. CWE: UNKNOWN. CVSS: 5.800000190734863. Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality and availability via unknown vectors related to Deployment.
Query: Sigma rule for Detects when an a role privilege is deleted in Google Workspace.
Matching passage: Sigma rule: Detects when an a role privilege is deleted in Google Workspace.. Logsource: gcp / google_workspace.admin. Rule: title: Google Workspace Role Privilege Deleted id: bf638ef7-4d2d-44bb-a1dc-a238252e6267 status: test description: Detects when an a role privilege is deleted in Google Workspace. references: - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3 - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings author: Austin Songer date: 2021-08-24 modified: 2023-10-11 tags: - attack.impact logsource: product: gcp service: google_workspace.admin detection: selection: eventService: admin.googleapis.com eventName: REMOVE_PRIVILEGE condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application.. Logsource: windows / process_creation. Rule: title: REGISTER_APP.VBS Proxy Execution id: 1c8774a0-44d4-4db0-91f8-e792359c70bd status: test description: Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application. references: - https://twitter.com/sblmsrsn/status/1456613494783160325?s=20 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - \register_app.vbs - -register condition: selection falsepositives: - Legitimate usage of the script. Always investigate what's being registered to confirm if it's benign level: medium
Query: rule covering Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files wr
Matching passage: Sigma rule: Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files wr. Logsource: windows / process_creation. Rule: title: Malicious Windows Script Components File Execution by TAEF Detection id: 634b00d5-ccc3-4a06-ae3b-0ec8444dd51b status: test description: 'Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files written on different languages (C, C#, Microsoft COM Scripting interfaces Adversaries may execute malicious code (such as WSC file with VBScript, dll and so on) directly by running te.exe ' references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Te/ - https://twitter.com/pabraeken/status/993298228840992768 - https://learn.microsoft.com/en-us/windows-hardware/drivers/taef/ author: Agro (@agro_sev) oscd.community date: 2020-10-13 modified: 2021-11-27 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \te.exe - ParentImage|endswith: \te.exe - OriginalFileName: \te.exe condition: selection falsepositives: - It's not an uncommon to use te.exe directly to execute legal TAEF tests level: low
Near-miss passage: Sigma rule: Detects email exfiltration via powershell cmdlets. Logsource: windows / process_creation. Rule: title: Email Exifiltration Via Powershell id: 312d0384-401c-4b8b-abdf-685ffba9a332 status: test description: Detects email exfiltration via powershell cmdlets references: - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/ - https://github.com/Azure/Azure-Sentinel/blob/7e6aa438e254d468feec061618a7877aa528ee9f/Hunting%20Queries/Microsoft%20365%20Defender/Ransomware/DEV-0270/Email%20data%20exfiltration%20via%20PowerShell.yaml author: Nasreddine Bencherchali (Nextron Systems), Azure-Sentinel (idea) date: 2022-09-09 tags: - attack.exfiltration logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains|all: - Add-PSSnapin - Get-Recipient - -ExpandProperty - EmailAddresses - SmtpAddress - -hidetableheaders condition: selection falsepositives: - Unknown level: high
Query: Outbound C2 pattern associated with Credentials In Files
Matching passage: T1552.001 Credentials In Files. Tactics: credential access. Description: Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords. It is possible to extract passwords from backups or saved virtual machines through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003).(Citation: CG 2014) Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller.(Citation: SRD GPP) In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files.(Citation: Unit 42 Hildegard Malware) They may also be found as parameters to deployment commands in container logs.(Citation: Unit 42 Unsecured Docker Daemons) In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.(Citation: Specter Ops - Cloud Credential Storage)
Near-miss passage: T1552.003 Shell History. Tactics: credential access. Description: Adversaries may search the command history on compromised systems for insecurely stored credentials. On Linux and macOS systems, shells such as Bash and Zsh keep track of the commands users type on the command-line with the "history" utility. Once a user logs out, the history is flushed to the user's history file. For each user, this file resides at the same location: for example, `~/.bash_history` or `~/.zsh_history`. Typically, these files keeps track of the user's last 1000 commands. On Windows, PowerShell has both a command history that is wiped after the session ends, and one that contains commands used in all sessions and is persistent. The default location for persistent history can be found in `%userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt`, but command history can also be accessed with `Get-History`. Command Prompt (CMD) on Windows does not have persistent history.(Citation: Microsoft about_History)(Citation: Medium) Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out. Adversaries can abuse this by looking through the file for potential credentials.(Citation: External to DA, the OS X Way)
Query: describe CVE-2015-6617
Matching passage: CVE-2015-6617. CWE: CWE-119. CVSS: 9.300000190734863. Skia, as used in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23648740.
Near-miss passage: CVE-2015-3868. CWE: CWE-119. CVSS: 10.0. libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23270724.
Query: vulnerability: The page-loading implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, does not properly handle the rel attribute in an A element,
Matching passage: CVE-2015-1156. CWE: CWE-264. CVSS: 4.300000190734863. The page-loading implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, does not properly handle the rel attribute in an A element, which allows remote attackers to bypass the Same Origin Policy for a link's target, and spoof the user interface, via a crafted web site.
Near-miss passage: CVE-2015-8955. CWE: CWE-264. CVSS: 7.300000190734863. arch/arm64/kernel/perf_event.c in the Linux kernel before 4.1 on arm64 platforms allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via vectors involving events that are mishandled during a span of multiple HW PMUs.
Query: risk of The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to bypass the Same Origin Policy and rea
Matching passage: CVE-2015-1155. CWE: CWE-264. CVSS: 4.300000190734863. The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to bypass the Same Origin Policy and read arbitrary files via a crafted web site.
Near-miss passage: CVE-2015-8951. CWE: CWE-264. CVSS: 7.800000190734863. Multiple use-after-free vulnerabilities in sound/soc/msm/qdsp6v2/msm-lsm-client.c in the Qualcomm sound driver in Android before 2016-10-05 on Nexus 5X, Nexus 6P, and Android One devices allow attackers to gain privileges via a crafted application, aka Android internal bug 30142668 and Qualcomm internal bug CR 948902.
Query: secure coding against Improper Handling of Hardware Behavior in Exceptionally Cold Environments
Matching passage: CWE-1351 Improper Handling of Hardware Behavior in Exceptionally Cold Environments. A hardware device, or the firmware running on it, is missing or has incorrect protection features to maintain goals of security primitives when the device is cooled below standard operating temperatures.
Near-miss passage: CWE-506 Embedded Malicious Code. The product contains code that appears to be malicious in nature.