alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects when storage bucket is enumerated in Google Cloud.
Matching passage: Sigma rule: Detects when storage bucket is enumerated in Google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud Storage Buckets Enumeration id: e2feb918-4e77-4608-9697-990a1aaf74c3 status: test description: Detects when storage bucket is enumerated in Google Cloud. references: - https://cloud.google.com/storage/docs/json_api/v1/buckets author: Austin Songer @austinsonger date: 2021-08-14 modified: 2022-10-09 tags: - attack.discovery logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name: - storage.buckets.list - storage.buckets.listChannels condition: selection falsepositives: - Storage Buckets being enumerated may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Storage Buckets enumerated from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Near-miss passage: Sigma rule: Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.. Logsource: rpc_firewall / application. Rule: title: Possible DCSync Attack id: 56fda488-113e-4ce9-8076-afc2457922c3 status: test description: Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks. references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47?redirectedfrom=MSDN - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-DRSR.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.t1033 - attack.discovery logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes, enable DRSR UUID (e3514235-4b06-11d1-ab04-00c04fc2dcd2) for "dangerous" opcodes (not 0,1 or 12) only from trusted IPs (DCs)' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: e3514235-4b06-11d1-ab04-00c04fc2dcd2 filter: OpNum: - 0 - 1 - 12 condition: selection and not filter falsepositives: - Unknown level: high
Query: secure coding against Expression is Always False
Matching passage: CWE-570 Expression is Always False. The product contains an expression that will always evaluate to false.
Near-miss passage: CWE-1176 Inefficient CPU Computation. The product performs CPU computations using algorithms that are not as efficient as they could be for the needs of the developer, i.e., the computations can be optimized further.
Query: risk of IOAcceleratorFamily in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted a
Matching passage: CVE-2015-3706. CWE: CWE-119. CVSS: 9.300000190734863. IOAcceleratorFamily in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-3705.
Near-miss passage: CVE-2015-8391. CWE: CWE-119. CVSS: 9.800000190734863. The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Query: hunt for Account Manipulation activity
Matching passage: T1098 Account Manipulation. Tactics: persistence, privilege escalation. Description: Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078).
Near-miss passage: T1098.002 Additional Email Delegate Permissions. Tactics: persistence, privilege escalation. Description: Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account. For example, the <code>Add-MailboxPermission</code> [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox.(Citation: Microsoft - Add-MailboxPermission)(Citation: FireEye APT35 2018)(Citation: Crowdstrike Hiding in Plain Sight 2018) In Google Workspace, delegation can be enabled via the Google Admin console and users can delegate accounts via their Gmail settings.(Citation: Gmail Delegation)(Citation: Google Ensuring Your Information is Safe) Adversaries may also assign mailbox folder permissions through individual folder permissions or roles. In Office 365 environments, adversaries may assign the Default or Anonymous user permissions or roles to the Top of Information Store (root), Inbox, or other mailbox folders. By assigning one or both user permissions to a folder, the adversary can utilize any other account in the tenant to maintain persistence to the target user’s mail folders.(Citation: Mandiant Defend UNC2452 White Paper) This may be used in persistent threat incidents as well as BEC (Business Email Compromise) incidents where an adversary can add [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) to the accounts they wish to compromise. This may further enable use of additional techniques for gaining access to systems. For example, compromised business accounts are often used to send messages to other accounts in the network of the target business while creating inbox rules (ex: [Internal Spearphishing](https://attack.mitre.org/techniques/T1534)), so the messages evade spam/phishing detection mechanisms.(Citation: Bienstock, D. - Defending O365 - 2019)
Query: detection rule: Detects execution of Adfind.exe utility, which can be used for reconnaissance in an Active Directory environment
Matching passage: Sigma rule: Detects execution of Adfind.exe utility, which can be used for reconnaissance in an Active Directory environment. Logsource: windows / process_creation. Rule: title: PUA - AdFind.EXE Execution id: 514e7e3e-b3b4-4a67-af60-be20f139198b related: - id: 455b9d50-15a1-4b99-853f-8d37655a4c1b type: similar status: experimental description: Detects execution of Adfind.exe utility, which can be used for reconnaissance in an Active Directory environment references: - https://www.joeware.net/freetools/tools/adfind/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.002/T1087.002.md author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-26 tags: - attack.discovery - attack.t1087.002 logsource: product: windows category: process_creation detection: selection: - Image|endswith: \AdFind.exe - OriginalFileName: AdFind.exe - Hashes|contains: - IMPHASH=d144de8117df2beceaba2201ad304764 - IMPHASH=12ce1c0f3f5837ecc18a3782408fa975 - IMPHASH=bca5675746d13a1f246e2da3c2217492 - IMPHASH=4fbf3f084fbbb2470b80b2013134df35 - IMPHASH=49b639b4acbecc49d72a01f357aa4930 - IMPHASH=53e117a96057eaf19c41380d0e87f1c2 - IMPHASH=680dad9e300346e05a85023965867201 - IMPHASH=21aa085d54992511b9f115355e468782 condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_adfind_execution/info.yml
Near-miss passage: Sigma rule: Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic. Logsource: windows / security. Rule: title: HackTool - EDRSilencer Execution - Filter Added id: 98054878-5eab-434c-85d4-72d4e5a3361b status: test description: 'Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names. ' references: - https://github.com/netero1010/EDRSilencer author: Thodoris Polyzos (@SmoothDeploy) date: 2024-01-29 modified: 2024-01-30 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: security definition: 'Requirements: Audit Filtering Platform Policy Change needs to be enabled' detection: selection: EventID: - 5441 - 5447 FilterName|contains: Custom Outbound Filter condition: selection falsepositives: - Unknown level: high
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects a commandline containing references to the Microsoft Teams database or cookies files from a process other than T. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Command Targeting Teams Sensitive Files id: d2eb17db-1d39-41dc-b57f-301f6512fa75 status: test description: 'Detects a commandline containing references to the Microsoft Teams database or cookies files from a process other than Teams. The database might contain authentication tokens and other sensitive information about the logged in accounts. ' references: - https://www.bleepingcomputer.com/news/security/microsoft-teams-stores-auth-tokens-as-cleartext-in-windows-linux-macs/ - https://www.vectra.ai/blogpost/undermining-microsoft-teams-security-by-mining-tokens author: '@SerkinValery' date: 2022-09-16 modified: 2023-12-18 tags: - attack.credential-access - attack.t1528 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - \Microsoft\Teams\Cookies - \Microsoft\Teams\Local Storage\leveldb filter_main_legit_locations: Image|endswith: \Microsoft\Teams\current\Teams.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Alert on when a user has performed an eDiscovery search or exported a PST file from the search. This PST file usually ha. Logsource: m365 / threat_management. Rule: title: PST Export Alert Using eDiscovery Alert id: 18b88d08-d73e-4f21-bc25-4b9892a4fdd0 related: - id: 6897cd82-6664-11ed-9022-0242ac120002 type: similar status: test description: Alert on when a user has performed an eDiscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content references: - https://learn.microsoft.com/en-us/microsoft-365/compliance/alert-policies?view=o365-worldwide author: Sorina Ionescu date: 2022-02-08 modified: 2022-11-17 tags: - attack.collection - attack.t1114 logsource: service: threat_management product: m365 definition: Requires the 'eDiscovery search or exported' alert to be enabled detection: selection: eventSource: SecurityComplianceCenter eventName: eDiscovery search started or exported status: success condition: selection falsepositives: - PST export can be done for legitimate purposes but due to the sensitive nature of its content it must be monitored. level: medium
Query: CVE similar to CVE-2015-0949
Matching passage: CVE-2015-0949. CWE: CWE-269. CVSS: 7.800000190734863. The System Management Mode (SMM) implementation in Dell Latitude E6430 BIOS Revision A09, HP EliteBook 850 G1 BIOS revision L71 Ver. 01.09, and possibly other BIOS implementations does not ensure that function calls operate on SMRAM memory locations, which allows local users to bypass the Secure Boot protection mechanism and gain privileges by leveraging write access to physical memory.
Near-miss passage: CVE-2015-5071. CWE: CWE-269. CVSS: 6.5. AR System Mid Tier in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users to "navigate" to arbitrary files via the __report parameter of the BIRT viewer servlet.
Query: vulnerability: The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by lib
Matching passage: CVE-2015-1547. CWE: CWE-119. CVSS: 6.5. The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff5.tif.
Near-miss passage: CVE-2015-3746. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Query: patch priority for CVE-2015-3449
Matching passage: CVE-2015-3449. CWE: CWE-254. CVSS: 7.199999809265137. The Windows client in SAP Afaria 7.0.6398.0 uses weak permissions (Everyone: read and Everyone: write) for the install folder, which allows local users to gain privileges via a Trojan horse XeService.exe file.
Near-miss passage: CVE-2015-1281. CWE: CWE-254. CVSS: 4.300000190734863. core/loader/ImageLoader.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly determine the V8 context of a microtask, which allows remote attackers to bypass Content Security Policy (CSP) restrictions by providing an image from an unintended source.
Query: describe CVE-2015-3799
Matching passage: CVE-2015-3799. CWE: CWE-255. CVSS: 9.300000190734863. The Apple ID OD plug-in in Apple OS X before 10.10.5 allows attackers to change arbitrary user passwords via a crafted app.
Near-miss passage: CVE-2015-7283. CWE: CWE-255. CVSS: 8.100000381469727. The web administration interface on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 has a default password of 1234 for the admin account, which allows remote attackers to obtain administrative privileges by leveraging a LAN session.
Query: patch priority for CVE-2015-2738
Matching passage: CVE-2015-2738. CWE: CWE-17. CVSS: 10.0. The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors.
Near-miss passage: CVE-2015-2751. CWE: CWE-17. CVSS: 7.099999904632568. Xen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows remote domains with partial management control to cause a denial of service (host lock) via unspecified domctl operations.
Query: describe CVE-2015-0524
Matching passage: CVE-2015-0524. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the Gateway Provisioning service in EMC Secure Remote Services Virtual Edition (ESRS VE) 3.02 and 3.03 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-9330. CWE: CWE-89. CVSS: 9.800000190734863. The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.
Query: vulnerability: The client detection protocol in Valve Steam allows remote attackers to cause a denial of service (process crash) via a crafted response to a broadcast packet.
Matching passage: CVE-2015-4016. CWE: CWE-20. CVSS: 5.0. The client detection protocol in Valve Steam allows remote attackers to cause a denial of service (process crash) via a crafted response to a broadcast packet.
Near-miss passage: CVE-2015-7794. CWE: CWE-20. CVSS: 5.800000190734863. Corega CG-WLNCM4G devices provide an open DNS resolver, which allows remote attackers to cause a denial of service (traffic amplification) via crafted queries.
Query: patch priority for CVE-2015-2473
Matching passage: CVE-2015-2473. CWE: UNKNOWN. CVSS: 9.300000190734863. Untrusted search path vulnerability in the client in Remote Desktop Protocol (RDP) through 8.1 in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .rdp file, aka "Remote Desktop Protocol DLL Planting Remote Code Execution Vulnerability."
Near-miss passage: CVE-2015-0314. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, and CVE-2015-0330.
Query: detection rule: Detects attempts to delete the RunMRU registry key, which stores the history of commands executed via the run dialog. In
Matching passage: Sigma rule: Detects attempts to delete the RunMRU registry key, which stores the history of commands executed via the run dialog. In. Logsource: windows / registry_delete. Rule: title: RunMRU Registry Key Deletion - Registry id: 3a9b8c1e-5b2e-4f7a-9d1c-2a7f3b6e1c55 related: - id: c11aecef-9c37-45a6-9c07-bc0782f963fd type: similar status: experimental description: 'Detects attempts to delete the RunMRU registry key, which stores the history of commands executed via the run dialog. In the clickfix techniques, the phishing lures instruct users to open a run dialog through (Win + R) and execute malicious commands. Adversaries may delete this key to cover their tracks after executing commands. ' references: - https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-09-25 tags: - attack.stealth - attack.t1070.003 logsource: category: registry_delete product: windows detection: selection: TargetObject|endswith: \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_delete/registry_delete_runmru/info.yml
Near-miss passage: Sigma rule: Detects the deletion of tomcat WebServer logs which may indicate an attempt to destroy forensic evidence. Logsource: windows / file_delete. Rule: title: Tomcat WebServer Logs Deleted id: 270185ff-5f50-4d6d-a27f-24c3b8c9fef8 status: test description: Detects the deletion of tomcat WebServer logs which may indicate an attempt to destroy forensic evidence references: - Internal Research - https://linuxhint.com/view-tomcat-logs-windows/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-16 tags: - attack.stealth - attack.t1070 logsource: category: file_delete product: windows detection: selection: TargetFilename|contains|all: - \Tomcat - \logs\ TargetFilename|contains: - catalina. - _access_log. - localhost. condition: selection falsepositives: - During uninstallation of the tomcat server - During log rotation level: medium
Query: Persistence mechanism resembling Add-ins
Matching passage: T1137.006 Add-ins. Tactics: persistence. Description: Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs. (Citation: Microsoft Office Add-ins) There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins. (Citation: MRWLabs Office Persistence Add-ins)(Citation: FireEye Mail CDS 2018) Add-ins can be used to obtain persistence because they can be set to execute code when an Office application starts.
Near-miss passage: T1137.001 Office Template Macros. Tactics: persistence. Description: Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Microsoft Office contains templates that are part of common Office applications and are used to customize styles. The base templates within the application are used each time an application starts. (Citation: Microsoft Change Normal Template) Office Visual Basic for Applications (VBA) macros (Citation: MSDN VBA in Office) can be inserted into the base template and used to execute code when the respective Office application starts in order to obtain persistence. Examples for both Word and Excel have been discovered and published. By default, Word has a Normal.dotm template created that can be modified to include a malicious macro. Excel does not have a template file created by default, but one can be added that will automatically be loaded.(Citation: enigma0x3 normal.dotm)(Citation: Hexacorn Office Template Macros) Shared templates may also be stored and pulled from remote locations.(Citation: GlobalDotName Jun 2019) Word Normal.dotm location:<br> <code>C:\Users\&lt;username&gt;\AppData\Roaming\Microsoft\Templates\Normal.dotm</code> Excel Personal.xlsb location:<br> <code>C:\Users\&lt;username&gt;\AppData\Roaming\Microsoft\Excel\XLSTART\PERSONAL.XLSB</code> Adversaries may also change the location of the base template to point to their own by hijacking the application's search order, e.g. Word 2016 will first look for Normal.dotm under <code>C:\Program Files (x86)\Microsoft Office\root\Office16\</code>, or by modifying the GlobalDotName registry key. By modifying the GlobalDotName registry key an adversary can specify an arbitrary location, file name, and file extension to use for the template that will be loaded on application startup. To abuse GlobalDotName, adversaries may first need to register the template as a trusted document or place it in a trusted location.(Citation: GlobalDotName Jun 2019) An adversary may need to enable macros to execute unrestricted depending
Query: patch priority for CVE-2015-20105
Matching passage: CVE-2015-20105. CWE: CWE-79. CVSS: 9.600000381469727. The ClickBank Affiliate Ads WordPress plugin through 1.20 does not have CSRF check when saving its settings, allowing attacker to make logged in admin change them via a CSRF attack. Furthermore, due to the lack of escaping when they are outputting, it could also lead to Stored Cross-Site Scripting issues
Near-miss passage: CVE-2015-0284. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7811.
Query: exploit Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, A
Matching passage: CVE-2015-7663. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
Near-miss passage: CVE-2015-4797. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.3 allows remote authenticated users to affect integrity via unknown vectors related to Security.