alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: adversary uses Supply Chain Compromise
Matching passage: T1195 Supply Chain Compromise. Tactics: initial access. Description: Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise can take place at any stage of the supply chain including: * Manipulation of development tools * Manipulation of a development environment * Manipulation of source code repositories (public or private) * Manipulation of source code in open-source dependencies * Manipulation of software update/distribution mechanisms * Compromised/infected system images (removable media infected at the factory)(Citation: IBM Storwize)(Citation: Schneider Electric USB Malware) * Replacement of legitimate software with modified versions * Sales of modified/counterfeit products to legitimate distributors * Shipment interdiction While supply chain compromise can impact any component of hardware or software, adversaries looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels.(Citation: Avast CCleaner3 2018)(Citation: Microsoft Dofoil 2018)(Citation: Command Five SK 2011) Adversaries may limit targeting to a desired victim set or distribute malicious software to a broad set of consumers but only follow up with specific victims.(Citation: Symantec Elderwood Sept 2012)(Citation: Avast CCleaner3 2018)(Citation: Command Five SK 2011) Popular open-source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise) In some cases, adversaries may conduct “second-order” supply chain compromises by leveraging the access gained from an initial supply chain compromise to further compromise a software component.(Citation: Krebs 3cx overview 2023) This may allow the threat actor to spread to even more victims.
Near-miss passage: T1195.003 Compromise Hardware Supply Chain. Tactics: initial access. Description: Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system. Hardware backdoors may be inserted into various devices, such as servers, workstations, network infrastructure, or peripherals.
Query: detect Detects the creation of files that look like exports of the local SAM (Security Account Manager) in logs
Matching passage: Sigma rule: Detects the creation of files that look like exports of the local SAM (Security Account Manager). Logsource: windows / file_event. Rule: title: Potential SAM Database Dump id: 4e87b8e2-2ee9-4b2a-a715-4727d297ece0 status: test description: Detects the creation of files that look like exports of the local SAM (Security Account Manager) references: - https://github.com/search?q=CVE-2021-36934 - https://web.archive.org/web/20210725081645/https://github.com/cube0x0/CVE-2021-36934 - https://www.google.com/search?q=%22reg.exe+save%22+sam - https://github.com/HuskyHacks/ShadowSteal - https://github.com/FireFart/hivenightmare author: Florian Roth (Nextron Systems) date: 2022-02-11 modified: 2023-01-05 tags: - attack.credential-access - attack.t1003.002 logsource: product: windows category: file_event detection: selection: - TargetFilename|endswith: - \Temp\sam - \sam.sav - \Intel\sam - \sam.hive - \Perflogs\sam - \ProgramData\sam - \Users\Public\sam - \AppData\Local\sam - \AppData\Roaming\sam - _ShadowSteal.zip - \Documents\SAM.export - :\sam - TargetFilename|contains: - \hive_sam_ - \sam.save - \sam.export - \~reg_sam.save - \sam_backup - \sam.bck - \sam.backup condition: selection falsepositives: - Rare cases of administrative activity level: high
Near-miss passage: Sigma rule: Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. Disabling default enc. Logsource: aws / cloudtrail. Rule: title: AWS EC2 Disable EBS Encryption id: 16124c2d-e40b-4fcc-8f2c-5ab7870a2223 status: stable description: 'Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. Disabling default encryption does not change the encryption status of your existing volumes. ' references: - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableEbsEncryptionByDefault.html author: Sittikorn S date: 2021-06-29 modified: 2021-08-20 tags: - attack.impact - attack.t1486 - attack.t1565 logsource: product: aws service: cloudtrail detection: selection: eventSource: ec2.amazonaws.com eventName: DisableEbsEncryptionByDefault condition: selection falsepositives: - System Administrator Activities - DEV, UAT, SAT environment. You should apply this rule with PROD account only. level: medium
Query: describe CVE-2015-9365
Matching passage: CVE-2015-9365. CWE: CWE-79. CVSS: 6.099999904632568. Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Near-miss passage: CVE-2015-2973. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the Welcart plugin before 1.4.18 for WordPress allow remote attackers to inject arbitrary web script or HTML via the usces_referer parameter to (1) classes/usceshop.class.php, (2) includes/edit-form-advanced.php, (3) includes/edit-form-advanced30.php, (4) includes/edit-form-advanced34.php, (5) includes/member_edit_form.php, (6) includes/order_edit_form.php, (7) includes/order_list.php, or (8) includes/usces_item_master_list.php, related to admin.php.
Query: exploit The update_dimensions function in libavcodec/vp8.c in FFmpeg through 2.8.1, as used in Google Chrome before 46.0.2490.71 and other products, relies on a coefficient-partition count
Matching passage: CVE-2015-6761. CWE: CWE-362. CVSS: 6.800000190734863. The update_dimensions function in libavcodec/vp8.c in FFmpeg through 2.8.1, as used in Google Chrome before 46.0.2490.71 and other products, relies on a coefficient-partition count during multi-threaded operation, which allows remote attackers to cause a denial of service (race condition and memory corruption) or possibly have unspecified other impact via a crafted WebM file.
Near-miss passage: CVE-2015-8556. CWE: CWE-362. CVSS: 10.0. Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1.
Query: Sigma rule for Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege
Matching passage: Sigma rule: Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege. Logsource: windows / process_creation. Rule: title: Always Install Elevated Windows Installer id: cd951fdc-4b2f-47f5-ba99-a33bf61e3770 status: test description: Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege references: - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-48-638.jpg author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community date: 2020-10-13 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: product: windows category: process_creation detection: selection_user: User|contains: - AUTHORI - AUTORI selection_image_1: Image|contains|all: - \Windows\Installer\ - msi Image|endswith: tmp selection_image_2: Image|endswith: \msiexec.exe IntegrityLevel: - System - S-1-16-16384 filter_installer: ParentImage: C:\Windows\System32\services.exe filter_repair: - CommandLine|endswith: \system32\msiexec.exe /V - ParentCommandLine|endswith: \system32\msiexec.exe /V filter_sophos: ParentImage|startswith: C:\ProgramData\Sophos\ filter_avira: ParentImage|startswith: C:\ProgramData\Avira\ filter_avast: ParentImage|startswith: - C:\Program Files\Avast Software\ - C:\Program Files (x86)\Avast Software\ filter_google_update: ParentImage|startswith: - C:\Program Files\Google\Update\ - C:\Program Files (x86)\Google\Update\ condition: 1 of selection_image_* and selection_user and not 1 of filter_* falsepositives: - System administrator usage - Anti virus products - WindowsApps located in "C:\Program Files\WindowsApps\" level: medium
Near-miss passage: Sigma rule: Detects a child process spawned by 'winrshost.exe', which suggests remote command execution through Windows Remote Shell. Logsource: windows / process_creation. Rule: title: Potential Lateral Movement via Windows Remote Shell id: 79df3f68-dccb-48e9-9171-b75cbc37c51d status: experimental description: 'Detects a child process spawned by ''winrshost.exe'', which suggests remote command execution through Windows Remote Shell (WinRs) and may indicate potential lateral movement activity. ' references: - https://cardinalops.com/blog/living-off-winrm-abusing-complexity-in-remote-management/ - https://www.ired.team/offensive-security/lateral-movement/winrs-for-lateral-movement author: Liran Ravich date: 2025-10-22 tags: - attack.lateral-movement - attack.t1021.006 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \winrshost.exe filter_main_conhost: Image: C:\Windows\System32\conhost.exe condition: selection and not 1 of filter_main_* falsepositives: - Legitimate use of WinRM within the organization level: medium
Query: exploit The Juniper SRX Series services gateways with Junos OS 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, and 12.3X48 before 12.3X48-D15 do not properly implement the "set sys
Matching passage: CVE-2015-3007. CWE: CWE-284. CVSS: 7.199999809265137. The Juniper SRX Series services gateways with Junos OS 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, and 12.3X48 before 12.3X48-D15 do not properly implement the "set system ports console insecure" feature, which allows physically proximate attackers to gain administrative privileges by leveraging access to the console port.
Near-miss passage: CVE-2015-5053. CWE: CWE-284. CVSS: 10.0. The host memory mapping path feature in the NVIDIA GPU graphics driver R346 before 346.87 and R352 before 352.41 for Linux and R352 before 352.46 for GRID vGPU and vSGA does not properly restrict access to third-party device IO memory, which allows attackers to gain privileges, cause a denial of service (resource consumption), or possibly have unspecified other impact via unknown vectors related to the follow_pfn kernel-mode API call.
Query: CVE similar to CVE-2015-6929
Matching passage: CVE-2015-6929. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Nokia Networks (formerly Nokia Solutions and Networks and Nokia Siemens Networks) @vantage Commander allow remote attackers to inject arbitrary web script or HTML via the (1) idFilter or (2) nameFilter parameter to cftraces/filter/fl_copy.jsp; the (3) flName parameter to cftraces/filter/fl_crea1.jsp; the (4) serchStatus, (5) refreshTime, or (6) serchNode parameter to cftraces/process/pr_show_process.jsp; the (7) MaxActivationTime, (8) NumberOfBytes, (9) NumberOfTracefiles, (10) SessionName, or (11) serchSessionkind parameter to cftraces/session/se_crea.jsp; the (12) serchSessionDescription parameter to cftraces/session/se_show.jsp; the (13) serchApplication or (14) serchApplicationkind parameter to cftraces/session/tr_crea_filter.jsp; the (15) columKeyUnique, (16) columParameter, (17) componentName, (18) criteria1, (19) criteria2, (20) criteria3, (21) description, (22) filter, (23) id, (24) pathName, (25) tableName, or (26) component parameter to cftraces/session/tr_create_tagg_para.jsp; or the (27) userid parameter to home/certificate_association.jsp.
Near-miss passage: CVE-2015-2329. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted order.
Query: describe CVE-2015-2778
Matching passage: CVE-2015-2778. CWE: CWE-399. CVSS: 5.0. Quassel before 0.12-rc1 uses an incorrect data-type size when splitting a message, which allows remote attackers to cause a denial of service (crash) via a long CTCP query containing only multibyte characters.
Near-miss passage: CVE-2015-1730. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Query: detection rule: Detects the execution of a renamed "jusched.exe" as seen used by the cobalt group
Matching passage: Sigma rule: Detects the execution of a renamed "jusched.exe" as seen used by the cobalt group. Logsource: windows / process_creation. Rule: title: Renamed Jusched.EXE Execution id: edd8a48c-1b9f-4ba1-83aa-490338cd1ccb status: test description: Detects the execution of a renamed "jusched.exe" as seen used by the cobalt group references: - https://www.bitdefender.com/files/News/CaseStudies/study/262/Bitdefender-WhitePaper-An-APT-Blueprint-Gaining-New-Visibility-into-Financial-Threats-interactive.pdf author: Markus Neis, Swisscom date: 2019-06-04 modified: 2023-02-03 tags: - attack.execution - attack.stealth - attack.t1036.003 logsource: category: process_creation product: windows detection: selection: Description: - Java Update Scheduler - Java(TM) Update Scheduler filter: Image|endswith: \jusched.exe condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Get-Variable is a valid PowerShell cmdlet WindowsApps is by default in the path where PowerShell is executed. So when th. Logsource: windows / file_event. Rule: title: Suspicious Get-Variable.exe Creation id: 0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b status: test description: 'Get-Variable is a valid PowerShell cmdlet WindowsApps is by default in the path where PowerShell is executed. So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet. ' references: - https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/ - https://www.joesandbox.com/analysis/465533/0/html author: frack113 date: 2022-04-23 tags: - attack.privilege-escalation - attack.persistence - attack.stealth - attack.t1546 - attack.t1027 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: Local\Microsoft\WindowsApps\Get-Variable.exe condition: selection falsepositives: - Unknown level: high
Query: write Sigma for Detects possible Java payloads in web access logs
Matching passage: Sigma rule: Detects possible Java payloads in web access logs. Logsource: webserver. Rule: title: Java Payload Strings id: 583aa0a2-30b1-4d62-8bf3-ab73689efe6c status: test description: Detects possible Java payloads in web access logs references: - https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/ - https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/ - https://github.com/httpvoid/writeups/blob/62d3751945289d088ccfdf4d0ffbf61598a2cd7d/Confluence-RCE.md - https://twitter.com/httpvoid0x2f/status/1532924261035384832 - https://medium.com/geekculture/text4shell-exploit-walkthrough-ebc02a01f035 author: frack113, Harjot Singh, "@cyb3rjy0t" (update) date: 2022-06-04 modified: 2023-01-19 tags: - cve.2022-26134 - cve.2021-26084 - attack.initial-access - attack.t1190 logsource: category: webserver detection: keywords: - '%24%7B%28%23a%3D%40' - ${(#a=@ - '%24%7B%40java' - ${@java - u0022java - '%2F%24%7B%23' - /${# - new+java. - getRuntime().exec( - getRuntime%28%29.exec%28 condition: keywords falsepositives: - Legitimate apps level: high
Near-miss passage: Sigma rule: Detects service ticket requests using RC4 encryption type. Logsource: windows / security. Rule: title: Suspicious Kerberos RC4 Ticket Encryption id: 496a0e47-0a33-4dca-b009-9e6ca3591f39 status: test description: Detects service ticket requests using RC4 encryption type references: - https://adsecurity.org/?p=3458 - https://www.trimarcsecurity.com/single-post/TrimarcResearch/Detecting-Kerberoasting-Activity author: Florian Roth (Nextron Systems) date: 2017-02-06 modified: 2022-06-19 tags: - attack.credential-access - attack.t1558.003 logsource: product: windows service: security detection: selection: EventID: 4769 TicketOptions: '0x40810000' TicketEncryptionType: '0x17' reduction: ServiceName|endswith: $ condition: selection and not reduction falsepositives: - Service accounts used on legacy systems (e.g. NetApp) - Windows Domains with DFL 2003 and legacy systems level: medium
Query: describe CVE-2015-0381
Matching passage: CVE-2015-0381. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote attackers to affect availability via unknown vectors related to Server : Replication, a different vulnerability than CVE-2015-0382.
Near-miss passage: CVE-2015-8320. CWE: UNKNOWN. CVSS: 5.0. Apache Cordova-Android before 3.7.0 improperly generates random values for BridgeSecret data, which makes it easier for attackers to conduct bridge hijacking attacks by predicting a value.
Query: CWE for Integer Overflow to Buffer Overflow
Matching passage: CWE-680 Integer Overflow to Buffer Overflow. The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.
Near-miss passage: CWE-336 Same Seed in Pseudo-Random Number Generator (PRNG). A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is initialized.
Query: CVE similar to CVE-2015-1522
Matching passage: CVE-2015-1522. CWE: CWE-119. CVSS: 7.5. analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not reject certain non-zero values of a packet length, which allows remote attackers to cause a denial of service (buffer overflow or buffer over-read) via a crafted DNP3 packet.
Near-miss passage: CVE-2015-3831. CWE: CWE-119. CVSS: 9.300000190734863. Buffer overflow in the readAt function in BpMediaHTTPConnection in media/libmedia/IMediaHTTPConnection.cpp in the mediaserver service in Android before 5.1.1 LMY48I allows attackers to execute arbitrary code via a crafted application, aka internal bug 19400722.
Query: describe CVE-2015-7879
Matching passage: CVE-2015-7879. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authenticated users with permission to create or edit a stickynote to inject arbitrary web script or HTML via note text on the admin listing page.
Near-miss passage: CVE-2015-6037. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in Microsoft Excel Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps 2010 SP2, Excel Web App 2010 SP2, Office Web Apps Server 2013 SP1, and SharePoint Foundation 2013 SP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka "Microsoft Office Web Apps XSS Spoofing Vulnerability."
Query: patch priority for CVE-2015-9300
Matching passage: CVE-2015-9300. CWE: CWE-79. CVSS: 6.099999904632568. The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.
Near-miss passage: CVE-2015-7786. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the NTT DATA Smart Sourcing JavaScript module 2003-11-26 through 2013-07-09 for Web Analytics Service allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: CVE similar to CVE-2015-3659
Matching passage: CVE-2015-3659. CWE: CWE-264. CVSS: 6.800000190734863. The SQLite authorizer in the Storage functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict access to SQL functions, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site.
Near-miss passage: CVE-2015-6384. CWE: CWE-264. CVSS: 4.300000190734863. The Cisco WebEx Meetings application before 8.5.1 for Android improperly initializes custom application permissions, which allows attackers to bypass intended access restrictions via a crafted application, aka Bug ID CSCuw86442.
Query: write Sigma for Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environ
Matching passage: Sigma rule: Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environ. Logsource: azure / signinlogs. Rule: title: Application Using Device Code Authentication Flow id: 248649b7-d64f-46f0-9fb2-a52774166fb5 status: test description: 'Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious. ' references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' date: 2022-06-01 tags: - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation - attack.initial-access logsource: product: azure service: signinlogs detection: selection: properties.message: Device Code condition: selection falsepositives: - Applications that are input constrained will need to use device code flow and are valid authentications. level: medium
Near-miss passage: Sigma rule: Detects potential network sniffing via use of network tools such as "tshark", "windump". Network sniffing refers to usin. Logsource: windows / process_creation. Rule: title: Potential Network Sniffing Activity Using Network Tools id: ba1f7802-adc7-48b4-9ecb-81e227fddfd5 status: test description: 'Detects potential network sniffing via use of network tools such as "tshark", "windump". Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1040/T1040.md author: Timur Zinniatullin, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2019-10-21 modified: 2023-02-20 tags: - attack.credential-access - attack.discovery - attack.t1040 logsource: category: process_creation product: windows detection: selection_tshark: Image|endswith: \tshark.exe CommandLine|contains: -i selection_windump: Image|endswith: \windump.exe condition: 1 of selection_* falsepositives: - Legitimate administration activity to troubleshoot network issues level: medium