alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-7340
Matching passage: CVE-2015-7340. CWE: CWE-89. CVSS: 7.199999809265137. JEvents Joomla Component before 3.4.0 RC6 has SQL Injection via evid in a Manage Events action.
Near-miss passage: CVE-2015-4043. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in ConnX ESP HR Management 4.4.0 allows remote attackers to execute arbitrary SQL commands via the ctl00$cphMainContent$txtUserName parameter to frmLogin.aspx.
Query: Persistence mechanism resembling Server Software Component
Matching passage: T1505 Server Software Component. Tactics: persistence. Description: Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.(Citation: volexity_0day_sophos_FW)
Near-miss passage: T1505.003 Web Shell. Tactics: persistence. Description: Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.(Citation: volexity_0day_sophos_FW) In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. [China Chopper](https://attack.mitre.org/software/S0020) Web shell client).(Citation: Lee 2013)
Query: exploit Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1,
Matching passage: CVE-2015-2513. CWE: CWE-20. CVSS: 9.300000190734863. Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted .jnt file, aka "Windows Journal RCE Vulnerability," a different vulnerability than CVE-2015-2514 and CVE-2015-2530.
Near-miss passage: CVE-2015-9052. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached while processing a downlink message.
Query: vulnerability: Stack-based buffer overflow in the run_init_sbus function in the KCodes NetUSB module for the Linux kernel, as used in certain NETGEAR products, TP-LINK products, and other product
Matching passage: CVE-2015-3036. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the run_init_sbus function in the KCodes NetUSB module for the Linux kernel, as used in certain NETGEAR products, TP-LINK products, and other products, allows remote attackers to execute arbitrary code by providing a long computer name in a session on TCP port 20005.
Near-miss passage: CVE-2015-3684. CWE: CWE-119. CVSS: 6.800000190734863. The HTTPAuthentication implementation in CFNetwork in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted credentials in a URL.
Query: rule covering Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands. Such behavior may be associate
Matching passage: Sigma rule: Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands. Such behavior may be associate. Logsource: linux / process_creation. Rule: title: Shell Invocation via Apt - Linux id: bb382fd5-b454-47ea-a264-1828e4c766d6 status: test description: 'Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. ' references: - https://gtfobins.github.io/gtfobins/apt/ - https://gtfobins.github.io/gtfobins/apt-get/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-28 modified: 2024-09-02 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /apt - /apt-get CommandLine|contains: APT::Update::Pre-Invoke::= condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects DLL sideloading of "dbgcore.dll". Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of DBGCORE.DLL id: 9ca2bf31-0570-44d8-a543-534c47c33ed7 status: test description: Detects DLL sideloading of "dbgcore.dll" references: - https://hijacklibs.net/ author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) date: 2022-10-25 modified: 2025-10-06 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \dbgcore.dll filter_main_generic: ImageLoaded|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SystemTemp\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_optional_steam: ImageLoaded|endswith: \Steam\bin\cef\cef.win7x64\dbgcore.dll filter_optional_opera: ImageLoaded|contains: opera\Opera Installer Temp\opera_package ImageLoaded|endswith: \assistant\dbgcore.dll condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate applications loading their own versions of the DLL mentioned in this rule level: medium
Query: detect Detects the execution of a renamed Microsoft Teams binary. in logs
Matching passage: Sigma rule: Detects the execution of a renamed Microsoft Teams binary.. Logsource: windows / process_creation. Rule: title: Renamed Microsoft Teams Execution id: 88f46b67-14d4-4f45-ac2c-d66984f22191 status: test description: Detects the execution of a renamed Microsoft Teams binary. references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2024-07-12 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: OriginalFileName: - msteams.exe - teams.exe filter_main_legit_names: Image|endswith: - \msteams.exe - \teams.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects python spawning a pretty tty. Logsource: windows / process_creation. Rule: title: Python Spawning Pretty TTY on Windows id: 480e7e51-e797-47e3-8d72-ebfce65b6d8d related: - id: 899133d5-4d7c-4a7f-94ee-27355c879d90 type: derived status: test description: Detects python spawning a pretty tty references: - https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/ author: Nextron Systems date: 2022-06-03 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: - python.exe - python3.exe - python2.exe selection_cli_1: CommandLine|contains|all: - import pty - .spawn( selection_cli_2: CommandLine|contains: from pty import spawn condition: selection_img and 1 of selection_cli_* falsepositives: - Unknown level: high
Query: vulnerability: Open Directory Client in Apple OS X before 10.10.3 sends unencrypted password-change requests in certain circumstances involving missing certificates, which allows remote attackers
Matching passage: CVE-2015-1147. CWE: CWE-200. CVSS: 5.0. Open Directory Client in Apple OS X before 10.10.3 sends unencrypted password-change requests in certain circumstances involving missing certificates, which allows remote attackers to obtain sensitive information by sniffing the network.
Near-miss passage: CVE-2015-6626. CWE: CWE-200. CVSS: 5.0. libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24310423.
Query: detect Detects using SettingSyncHost.exe to run hijacked binary in logs
Matching passage: Sigma rule: Detects using SettingSyncHost.exe to run hijacked binary. Logsource: windows / process_creation. Rule: title: Using SettingSyncHost.exe as LOLBin id: b2ddd389-f676-4ac4-845a-e00781a48e5f status: test description: Detects using SettingSyncHost.exe to run hijacked binary references: - https://www.hexacorn.com/blog/2020/02/02/settingsynchost-exe-as-a-lolbin author: Anton Kutepov, oscd.community date: 2020-02-05 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.008 logsource: category: process_creation product: windows detection: system_utility: Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ parent_is_settingsynchost: ParentCommandLine|contains|all: - cmd.exe /c - RoamDiag.cmd - -outputpath condition: not system_utility and parent_is_settingsynchost falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Processes accessing the camera and microphone from suspicious folder. Logsource: windows / registry_event. Rule: title: Suspicious Camera and Microphone Access id: 62120148-6b7a-42be-8b91-271c04e281a3 status: test description: Detects Processes accessing the camera and microphone from suspicious folder references: - https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072 author: Den Iuzvyk date: 2020-06-07 modified: 2022-10-09 tags: - attack.collection - attack.t1125 - attack.t1123 logsource: category: registry_event product: windows detection: selection_1: TargetObject|contains|all: - \Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\ - \NonPackaged selection_2: TargetObject|contains: - microphone - webcam selection_3: TargetObject|contains: - :#Windows#Temp# - :#$Recycle.bin# - :#Temp# - :#Users#Public# - :#Users#Default# - :#Users#Desktop# condition: all of selection_* falsepositives: - Unlikely, there could be conferencing software running from a Temp folder accessing the devices level: high
Query: write Sigma for Detects usage of the 'crontab' utility to remove the current crontab. This is a common occurrence where cryptocurrency m
Matching passage: Sigma rule: Detects usage of the 'crontab' utility to remove the current crontab. This is a common occurrence where cryptocurrency m. Logsource: linux / process_creation. Rule: title: Remove Scheduled Cron Task/Job id: c2e234de-03a3-41e1-b39a-1e56dc17ba67 status: test description: 'Detects usage of the ''crontab'' utility to remove the current crontab. This is a common occurrence where cryptocurrency miners compete against each other by removing traces of other miners to hijack the maximum amount of resources possible ' references: - https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-15 tags: - attack.stealth logsource: category: process_creation product: linux detection: selection: Image|endswith: crontab CommandLine|contains: ' -r' condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects attempts to disable security event logging by adding the `MiniNt` registry key. This key is used to disable the. Logsource: windows / process_creation. Rule: title: Security Event Logging Disabled via MiniNt Registry Key - Process id: 1a4bd6af-99ac-4466-b5b2-7b72b4a05462 related: - id: 8839e550-52d7-4958-9f2f-e13c1e736838 type: similar status: experimental description: 'Detects attempts to disable security event logging by adding the `MiniNt` registry key. This key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications. Adversaries may want to disable this service to prevent logging of security events that could be used to detect their activities. ' references: - https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-04-09 tags: - attack.persistence - attack.defense-impairment - attack.t1685.001 - attack.t1112 - car.2022-03-001 logsource: category: process_creation product: windows detection: selection_reg_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_reg_cmd: CommandLine|contains|all: - ' add ' - \SYSTEM\CurrentControlSet\Control\MiniNt selection_powershell_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \powershell_ise.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_powershell_cmd1: CommandLine|contains: - 'New-Item ' - 'ni ' selection_powershell_cmd2: CommandLine|contains: \SYSTEM\CurrentControlSet\Control\MiniNt condition: all of selection_reg_* or all of selection_powershell_* falsepositives: - Highly Unlikely level: high
Query: Sigma rule for Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used
Matching passage: Sigma rule: Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used. Logsource: windows / ps_script. Rule: title: Code Executed Via Office Add-in XLL File id: 36fbec91-fa1b-4d5d-8df1-8d8edcb632ad status: test description: 'Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1137.006/T1137.006.md author: frack113 date: 2021-12-28 tags: - attack.persistence - attack.t1137.006 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'new-object ' - '-ComObject ' - .application - .RegisterXLL condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects instances where an HTTP service on an OpenCanary node has had login attempt via Form POST.. Logsource: opencanary / application. Rule: title: OpenCanary - HTTP POST Login Attempt id: af1ac430-df6b-4b38-b976-0b52f07a0252 status: test description: 'Detects instances where an HTTP service on an OpenCanary node has had login attempt via Form POST. ' references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.initial-access - attack.t1190 logsource: category: application product: opencanary detection: selection: logtype: 3001 condition: selection falsepositives: - Unlikely level: high
Query: detection rule: Detects rundll32 execution where the DLL is located on a remote location (share). Threat actors can abuse the rundll32.e
Matching passage: Sigma rule: Detects rundll32 execution where the DLL is located on a remote location (share). Threat actors can abuse the rundll32.e. Logsource: windows / process_creation. Rule: title: Rundll32 UNC Path Execution id: 5cdb711b-5740-4fb2-ba88-f7945027afac status: test description: 'Detects rundll32 execution where the DLL is located on a remote location (share). Threat actors can abuse the rundll32.exe binary to execute remote DLLs from a UNC pathh. ' references: - https://www.cybereason.com/blog/rundll32-the-infamous-proxy-for-executing-malicious-code - https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-10 modified: 2026-07-20 tags: - attack.execution - attack.lateral-movement - attack.stealth - attack.t1021.002 - attack.t1218.011 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE - CommandLine|contains: rundll32 selection_cli: CommandLine|contains: - ' \\\\' - ' ''\\\\' - ' "\\\\' filter_main_cli_pipe: CommandLine|contains: \\\\.\\pipe condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_rundll32_unc_path/info.yml
Near-miss passage: Sigma rule: Detects the use of Windows Defender MpCmdRun.EXE to download files. Logsource: windows / process_creation. Rule: title: File Download Via Windows Defender MpCmpRun.EXE id: 46123129-1024-423e-9fae-43af4a0fa9a5 status: test description: Detects the use of Windows Defender MpCmdRun.EXE to download files references: - https://web.archive.org/web/20200903194959/https://twitter.com/djmtshepana/status/1301608169496612866 - https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/ author: Matthew Matchen date: 2020-09-04 modified: 2023-11-09 tags: - attack.stealth - attack.t1218 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: MpCmdRun.exe - Image|endswith: \MpCmdRun.exe - CommandLine|contains: MpCmdRun.exe - Description: Microsoft Malware Protection Command Line Utility selection_cli: CommandLine|contains|all: - DownloadFile - url condition: all of selection_* falsepositives: - Unknown level: high
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) proxypass parameter to system_
Matching passage: CVE-2015-6509. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) proxypass parameter to system_advanced_misc.php; (2) adaptiveend, (3) adaptivestart, (4) maximumstates, (5) maximumtableentries, or (6) aliasesresolveinterval parameter to system_advanced_firewall.php; (7) proxyurl, (8) proxyuser, or (9) proxyport parameter to system_advanced_misc.php; or (10) name, (11) notification_name, (12) ipaddress, (13) password, (14) smtpipaddress, (15) smtpport, (16) smtpfromaddress, (17) smtpnotifyemailaddress, (18) smtpusername, or (19) smtppassword parameter to system_advanced_notifications.php.
Near-miss passage: CVE-2015-3942. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the web-server component in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: patch priority for CVE-2015-7644
Matching passage: CVE-2015-7644. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, and CVE-2015-7643.
Near-miss passage: CVE-2015-4782. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790.
Query: Outbound C2 pattern associated with Botnet
Matching passage: T1584.005 Botnet. Tactics: resource development. Description: Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.(Citation: Norton Botnet) Instead of purchasing/renting a botnet from a booter/stresser service, adversaries may build their own botnet by compromising numerous third-party systems.(Citation: Imperva DDoS for Hire) Adversaries may also conduct a takeover of an existing botnet, such as redirecting bots to adversary-controlled C2 servers.(Citation: Dell Dridex Oct 2015) With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale [Phishing](https://attack.mitre.org/techniques/T1566) or Distributed Denial of Service (DDoS).
Near-miss passage: T1584.001 Domains. Tactics: resource development. Description: Adversaries may hijack domains and/or subdomains that can be used during targeting. Domain registration hijacking is the act of changing the registration of a domain name without the permission of the original registrant.(Citation: ICANNDomainNameHijacking) Adversaries may gain access to an email account for the person listed as the owner of the domain. The adversary can then claim that they forgot their password in order to make changes to the domain registration. Other possibilities include social engineering a domain registration help desk to gain access to an account, taking advantage of renewal process gaps, or compromising a cloud service that enables managing domains (e.g., AWS Route53).(Citation: Krebs DNS Hijack 2019) Subdomain hijacking can occur when organizations have DNS entries that point to non-existent or deprovisioned resources. In such cases, an adversary may take control of a subdomain to conduct operations with the benefit of the trust associated with that domain.(Citation: Microsoft Sub Takeover 2020) Adversaries who compromise a domain may also engage in domain shadowing by creating malicious subdomains under their control while keeping any existing DNS records. As service will not be disrupted, the malicious subdomains may go unnoticed for long periods of time.(Citation: Palo Alto Unit 42 Domain Shadowing 2022)
Query: patch priority for CVE-2015-1120
Matching passage: CVE-2015-1120. CWE: UNKNOWN. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE-SA-2015-04-08-4.
Near-miss passage: CVE-2015-5346. CWE: UNKNOWN. CVSS: 8.100000381469727. Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.