alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Search for usage of reg or Powershell by non-privileged users to modify service configuration in registry
Matching passage: Sigma rule: Search for usage of reg or Powershell by non-privileged users to modify service configuration in registry. Logsource: windows / process_creation. Rule: title: Non-privileged Usage of Reg or Powershell id: 8f02c935-effe-45b3-8fc9-ef8696a9e41d status: test description: Search for usage of reg or Powershell by non-privileged users to modify service configuration in registry references: - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-20-638.jpg author: Teymur Kheirkhabarov (idea), Ryan Plas (rule), oscd.community date: 2020-10-05 modified: 2024-12-01 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: process_creation product: windows detection: selection_cli: - CommandLine|contains|all: - 'reg ' - add - CommandLine|contains: - powershell - set-itemproperty - ' sp ' - new-itemproperty selection_data: IntegrityLevel: - Medium - S-1-16-8192 CommandLine|contains|all: - ControlSet - Services CommandLine|contains: - ImagePath - FailureCommand - ServiceDLL condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse.. Logsource: gcp / google_workspace.login. Rule: title: Google Workspace Out Of Domain Email Forwarding id: 2a0bb2dd-eb5f-4517-8cb9-404f8ba764a5 status: experimental description: Detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse. references: - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#email_forwarding_out_of_domain author: Tom kluter date: 2026-04-28 tags: - attack.t1114.003 - attack.collection logsource: product: gcp service: google_workspace.login detection: selection: protoPayload.serviceName: login.googleapis.com protoPayload.metadata.event.eventName: email_forwarding_out_of_domain condition: selection falsepositives: - Legitimate forwarding level: medium
Query: vulnerability: Cross-site scripting (XSS) vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote attackers to inject arbitrary web script or HTML via the command XML ele
Matching passage: CVE-2015-2347. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote attackers to inject arbitrary web script or HTML via the command XML element in the req parameter to flexdata.action in (1) common/, (2) monitor/, or (3) psnpm/ or the (4) module XML element in the req parameter to flexdata.action in monitor/.
Near-miss passage: CVE-2015-8353. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary web script or HTML via the object_name parameter in a rs-object_role_edit page to wp-admin/admin.php.
Query: exploit The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identificat
Matching passage: CVE-2015-1793. CWE: CWE-254. CVSS: 6.5. The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.
Near-miss passage: CVE-2015-3658. CWE: CWE-254. CVSS: 6.800000190734863. The Page Loading functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly consider redirects during decisions about sending an Origin header, which makes it easier for remote attackers to bypass CSRF protection mechanisms via a crafted web site.
Query: Suspicious Authentication Package execution detected on endpoint
Matching passage: T1547.002 Authentication Package. Tactics: persistence, privilege escalation. Description: Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system.(Citation: MSDN Authentication Packages) Adversaries can use the autostart mechanism provided by LSA authentication packages for persistence by placing a reference to a binary in the Windows Registry location <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\</code> with the key value of <code>"Authentication Packages"=&lt;target binary&gt;</code>. The binary will then be executed by the system when the authentication packages are loaded.
Near-miss passage: T1547.010 Port Monitors. Tactics: persistence, privilege escalation. Description: Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the <code>AddMonitor</code> API call to set a DLL to be loaded at startup.(Citation: AddMonitor) This DLL can be located in <code>C:\Windows\System32</code> and will be loaded and run by the print spooler service, `spoolsv.exe`, under SYSTEM level permissions on boot.(Citation: Bloxham) Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to the `Driver` value of an existing or new arbitrarily named subkey of <code>HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors</code>. The Registry key contains entries for the following: * Local Port * Standard TCP/IP Port * USB Monitor * WSD Port
Query: CVE similar to CVE-2015-1090
Matching passage: CVE-2015-1090. CWE: CWE-200. CVSS: 5.0. CFNetwork in Apple iOS before 8.3 does not delete HTTP Strict Transport Security (HSTS) state information in response to a Safari history-clearing action, which allows attackers to obtain sensitive information by reading a history file.
Near-miss passage: CVE-2015-5880. CWE: CWE-200. CVSS: 4.300000190734863. CoreAnimation in Apple iOS before 9 allows attackers to bypass intended IOSurface restrictions and obtain screen-framebuffer access via a crafted background app.
Query: how to detect Network Topology
Matching passage: T1590.004 Network Topology. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's network topology that can be used during targeting. Information about network topologies may include a variety of details, including the physical and/or logical arrangement of both external-facing and internal network environments. This information may also include specifics regarding network devices (gateways, routers, etc.) and other infrastructure. Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about network topologies may also be exposed to adversaries via online or other accessible data sets (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: DNS Dumpster) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Near-miss passage: T1590.006 Network Security Appliances. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's network security appliances that can be used during targeting. Information about network security appliances may include a variety of details, such as the existence and specifics of deployed firewalls, content filters, and proxies/bastion hosts. Adversaries may also target information about victim network-based intrusion detection systems (NIDS) or other appliances related to defensive cybersecurity operations. Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598).(Citation: Nmap Firewalls NIDS) Information about network security appliances may also be exposed to adversaries via online or other accessible data sets (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Query: common weakness: Improper Neutralization of Parameter/Argument Delimiters
Matching passage: CWE-141 Improper Neutralization of Parameter/Argument Delimiters. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.
Near-miss passage: CWE-232 Improper Handling of Undefined Values. The product does not handle or incorrectly handles when a value is not defined or supported for the associated parameter, field, or argument name.
Query: exploit The Intel Graphics Driver component in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a dif
Matching passage: CVE-2015-5830. CWE: CWE-119. CVSS: 7.199999809265137. The Intel Graphics Driver component in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5877.
Near-miss passage: CVE-2015-6609. CWE: CWE-119. CVSS: 10.0. libutils in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22953624.
Query: write Sigma for Detects the execution of Windows binaries from within a WSL instance. This could be used to masquerade parent-child rela
Matching passage: Sigma rule: Detects the execution of Windows binaries from within a WSL instance. This could be used to masquerade parent-child rela. Logsource: windows / process_creation. Rule: title: Windows Binary Executed From WSL id: ed825c86-c009-4014-b413-b76003e33d35 status: test description: 'Detects the execution of Windows binaries from within a WSL instance. This could be used to masquerade parent-child relationships ' references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-14 tags: - attack.execution - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection: Image|re: '[a-zA-Z]:\\' CurrentDirectory|contains: \\\\wsl.localhost condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects RunDLL32.exe spawning explorer.exe as child, which is very uncommon, often observes Gamarue spawning the explore. Logsource: windows / process_creation. Rule: title: RunDLL32 Spawning Explorer id: caa06de8-fdef-4c91-826a-7f9e163eef4b status: test description: Detects RunDLL32.exe spawning explorer.exe as child, which is very uncommon, often observes Gamarue spawning the explorer.exe process in an unusual way references: - https://redcanary.com/blog/intelligence-insights-november-2021/ author: elhoim, CD_ROM_ date: 2022-04-27 modified: 2022-05-25 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \rundll32.exe Image|endswith: \explorer.exe filter: ParentCommandLine|contains: \shell32.dll,Control_RunDLL condition: selection and not filter falsepositives: - Unknown level: high
Query: common weakness: Improper Authorization of Index Containing Sensitive Information
Matching passage: CWE-612 Improper Authorization of Index Containing Sensitive Information. The product creates a search index of private or sensitive documents, but it does not properly limit index access to actors who are authorized to see the original information.
Near-miss passage: CWE-1106 Insufficient Use of Symbolic Constants. The source code uses literal constants that may need to change or evolve over time, instead of using symbolic constants.
Query: describe CVE-2015-8381
Matching passage: CVE-2015-8381. CWE: CWE-119. CVSS: 7.5. The compile_regex function in pcre_compile.c in PCRE before 8.38 and pcre2_compile.c in PCRE2 before 10.2x mishandles the /(?J:(?|(:(?|(?'R')(\k'R')|((?'R')))H'Rk'Rf)|s(?'R'))))/ and /(?J:(?|(:(?|(?'R')(\z(?|(?'R')(\k'R')|((?'R')))k'R')|((?'R')))H'Ak'Rf)|s(?'R')))/ patterns, and related patterns with certain group references, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Near-miss passage: CVE-2015-8636. CWE: CWE-119. CVSS: 8.800000190734863. Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8459, CVE-2015-8460, and CVE-2015-8645.
Query: describe CVE-2015-2848
Matching passage: CVE-2015-2848. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Honeywell Tuxedo Touch before 5.2.19.0_VA allows remote attackers to hijack the authentication of arbitrary users for requests associated with home-automation commands, as demonstrated by a door-unlock command.
Near-miss passage: CVE-2015-5338. CWE: CWE-352. CVSS: 8.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the lesson module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote attackers to hijack the authentication of arbitrary users for requests to (1) mod/lesson/mediafile.php or (2) mod/lesson/view.php.
Query: CVE similar to CVE-2015-0568
Matching passage: CVE-2015-0568. CWE: CWE-416. CVSS: 7.800000190734863. Use-after-free vulnerability in the msm_set_crop function in drivers/media/video/msm/msm_camera.c in the MSM-Camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service (memory corruption) via an application that makes a crafted ioctl call.
Near-miss passage: CVE-2015-6684. CWE: CWE-416. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7615, CVE-2015-7617, and CVE-2015-7621.
Query: risk of Unspecified vulnerability in the Mobile Server component in Oracle Database Mobile/Lite Server 10.3.0.3, 11.3.0.2, and 12.1.0.0 allows remote authenticated users to affect integrit
Matching passage: CVE-2015-4894. CWE: UNKNOWN. CVSS: 4.900000095367432. Unspecified vulnerability in the Mobile Server component in Oracle Database Mobile/Lite Server 10.3.0.3, 11.3.0.2, and 12.1.0.0 allows remote authenticated users to affect integrity and availability via unknown vectors.
Near-miss passage: CVE-2015-3910. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google V8 before 4.3.61.21, as used in Google Chrome before 43.0.2357.65, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Query: common weakness: Authorization Bypass Through User-Controlled Key
Matching passage: CWE-639 Authorization Bypass Through User-Controlled Key. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Near-miss passage: CWE-1109 Use of Same Variable for Multiple Purposes. The code contains a callable, block, or other code element in which the same variable is used to control more than one unique task or store more than one instance of data.
Query: describe CVE-2015-3903
Matching passage: CVE-2015-3903. CWE: CWE-310. CVSS: 4.300000190734863. libraries/Config.class.php in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 disables X.509 certificate verification for GitHub API calls over SSL, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Near-miss passage: CVE-2015-5907. CWE: CWE-310. CVSS: 2.5999999046325684. WebKit in Apple iOS before 9 allows man-in-the-middle attackers to conduct redirection attacks by leveraging the mishandling of the resource cache of an SSL web site with an invalid X.509 certificate.
Query: vulnerability: The IPv6 snooping functionality in the first-hop security subsystem in Cisco IOS 12.2, 15.0, 15.1, 15.2, 15.3, 15.4, and 15.5 and IOS XE 3.2SE, 3.3SE, 3.3XO, 3.4SG, 3.5E, and 3.6E 
Matching passage: CVE-2015-6278. CWE: CWE-20. CVSS: 7.800000190734863. The IPv6 snooping functionality in the first-hop security subsystem in Cisco IOS 12.2, 15.0, 15.1, 15.2, 15.3, 15.4, and 15.5 and IOS XE 3.2SE, 3.3SE, 3.3XO, 3.4SG, 3.5E, and 3.6E before 3.6.3E; 3.7E before 3.7.2E; 3.9S and 3.10S before 3.10.6S; 3.11S before 3.11.4S; 3.12S and 3.13S before 3.13.3S; and 3.14S before 3.14.2S does not properly implement the Control Plane Protection (aka CPPr) feature, which allows remote attackers to cause a denial of service (device reload) via a flood of ND packets, aka Bug ID CSCus19794.
Near-miss passage: CVE-2015-8899. CWE: CWE-20. CVSS: 7.5. Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA record defined locally.
Query: vulnerability: Blind SQL Injection in filedownload v1.4 wordpress plugin
Matching passage: CVE-2015-1000003. CWE: CWE-89. CVSS: 9.800000190734863. Blind SQL Injection in filedownload v1.4 wordpress plugin
Near-miss passage: CVE-2015-4073. CWE: CWE-89. CVSS: 9.800000190734863. Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) ticket_code or (2) email parameter or (3) remote authenticated users to execute arbitrary SQL commands via the filter_order parameter.
Query: alert when Detects the deletion of tomcat WebServer logs which may indicate an attempt to destroy forensic evidence
Matching passage: Sigma rule: Detects the deletion of tomcat WebServer logs which may indicate an attempt to destroy forensic evidence. Logsource: windows / file_delete. Rule: title: Tomcat WebServer Logs Deleted id: 270185ff-5f50-4d6d-a27f-24c3b8c9fef8 status: test description: Detects the deletion of tomcat WebServer logs which may indicate an attempt to destroy forensic evidence references: - Internal Research - https://linuxhint.com/view-tomcat-logs-windows/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-16 tags: - attack.stealth - attack.t1070 logsource: category: file_delete product: windows detection: selection: TargetFilename|contains|all: - \Tomcat - \logs\ TargetFilename|contains: - catalina. - _access_log. - localhost. condition: selection falsepositives: - During uninstallation of the tomcat server - During log rotation level: medium
Near-miss passage: Sigma rule: Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image detection. Logsource: windows / process_creation. Rule: title: Use Short Name Path in Image id: a96970af-f126-420d-90e1-d37bf25e50e1 related: - id: 349d891d-fef0-4fe4-bc53-eee623a15969 type: similar status: test description: Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image detection references: - https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/ - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10) - https://twitter.com/frack113/status/1555830623633375232 author: frack113, Nasreddine Bencherchali date: 2022-08-07 modified: 2025-10-20 tags: - attack.stealth - attack.t1564.004 logsource: category: process_creation product: windows detection: selection: Image|contains: - ~1\ - ~2\ filter_main_system_process: ParentImage: - C:\Windows\System32\Dism.exe - C:\Windows\System32\cleanmgr.exe filter_main_installers: - Image|contains|all: - \AppData\ - \Temp\ - Image|endswith: - ~1\unzip.exe - ~1\7zG.exe filter_optional_webex: ParentImage|endswith: \WebEx\WebexHost.exe filter_optional_thor: ParentImage|endswith: \thor\thor64.exe filter_optional_installshield: - Product: InstallShield (R) - Description: InstallShield (R) Setup Engine - Company: InstallShield Software Corporation condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Applications could use this notation occasionally which might generate some false positives. In that case Investigate the parent and child process. level: medium