alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: ATT&CK technique for Cloud Infrastructure Discovery
Matching passage: T1580 Cloud Infrastructure Discovery. Tactics: discovery. Description: An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services. Cloud providers offer methods such as APIs and commands issued through CLIs to serve information about infrastructure. For example, AWS provides a <code>DescribeInstances</code> API within the Amazon EC2 API that can return information about one or more instances within an account, the <code>ListBuckets</code> API that returns a list of all buckets owned by the authenticated sender of the request, the <code>HeadBucket</code> API to determine a bucket’s existence along with access permissions of the request sender, or the <code>GetPublicAccessBlock</code> API to retrieve access block configuration for a bucket.(Citation: Amazon Describe Instance)(Citation: Amazon Describe Instances API)(Citation: AWS Get Public Access Block)(Citation: AWS Head Bucket) Similarly, GCP's Cloud SDK CLI provides the <code>gcloud compute instances list</code> command to list all Google Compute Engine instances in a project (Citation: Google Compute Instances), and Azure's CLI command <code>az vm list</code> lists details of virtual machines.(Citation: Microsoft AZ CLI) In addition to API commands, adversaries can utilize open source tools to discover cloud storage infrastructure through [Wordlist Scanning](https://attack.mitre.org/techniques/T1595/003).(Citation: Malwarebytes OSINT Leaky Buckets - Hioureas) An adversary may enumerate resources using a compromised user's access keys to determine which are available to that user.(Citation: Expel IO Evil in AWS) The discovery of these available resources may help adversaries determine their next steps in the Cloud environment, such as establishing Persistence.(Citation: Mandiant M-Trends 2020)An adversary may also use this informa
Near-miss passage: T1518.002 Backup Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of backup software or configurations that are installed on a system. Adversaries may use this information to shape follow-on behaviors, such as [Data Destruction](https://attack.mitre.org/techniques/T1485), [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486). Commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), `reg query` with [Reg](https://attack.mitre.org/software/S0075), `dir` with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for, such as Veeam, Acronis, Dropbox, or Paragon.(Citation: Symantec Play Ransomware 2023)
Query: rule covering Detects wscript/cscript/mshta executions of scripts located in user directories
Matching passage: Sigma rule: Detects wscript/cscript/mshta executions of scripts located in user directories. Logsource: windows / process_creation. Rule: title: Potential Dropper Script Execution Via WScript/CScript/MSHTA id: cea72823-df4d-4567-950c-0b579eaf0846 related: - id: 1e33157c-53b1-41ad-bbcc-780b80b58288 type: similar status: test description: Detects wscript/cscript/mshta executions of scripts located in user directories references: - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/ - https://redcanary.com/blog/gootloader/ - https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/ author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems), Dave Johnson date: 2019-01-16 modified: 2026-02-17 tags: - attack.execution - attack.t1059.005 - attack.t1059.007 logsource: category: process_creation product: windows detection: selection_exec: Image|endswith: - \wscript.exe - \cscript.exe - \mshta.exe selection_paths: CommandLine|contains: - :\Perflogs\ - :\Temp\ - :\Tmp\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\Local\Temp\ - \AppData\Roaming\Temp\ - \Start Menu\Programs\Startup\ - \Temporary Internet - \Windows\Temp - '%LocalAppData%\Temp\' - '%TEMP%' - '%TMP%' selection_ext: CommandLine|contains: - .hta - .js - .jse - .vba - .vbe - .vbs - .wsf - .wsh condition: all of selection_* falsepositives: - Some installers might generate a similar behavior. An initial baseline is required level: medium
Near-miss passage: Sigma rule: Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This d. Logsource: m365 / threat_management. Rule: title: PST Export Alert Using New-ComplianceSearchAction id: 6897cd82-6664-11ed-9022-0242ac120002 related: - id: 18b88d08-d73e-4f21-bc25-4b9892a4fdd0 type: similar status: test description: Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This detection will detect PST export even if the 'eDiscovery search or exported' alert is disabled in the O365.This rule will apply to ExchangePowerShell usage and from the cloud. references: - https://learn.microsoft.com/en-us/powershell/module/exchange/new-compliancesearchaction?view=exchange-ps author: Nikita Khalimonenkov date: 2022-11-17 tags: - attack.collection - attack.t1114 logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter Payload|contains|all: - New-ComplianceSearchAction - Export - pst condition: selection falsepositives: - Exporting a PST can be done for legitimate purposes by legitimate sources, but due to the sensitive nature of PST content, it must be monitored. level: medium
Query: weakness Method Containing Access of a Member Element from Another Class
Matching passage: CWE-1090 Method Containing Access of a Member Element from Another Class. A method for a class performs an operation that directly accesses a member element from another class.
Near-miss passage: CWE-1428 Reliance on HTTP instead of HTTPS. The product provides or relies on use of HTTP communications when HTTPS is available.
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Detects usage of powershell cmdlets to disable or remove ETW trace sessions. Logsource: windows / ps_script. Rule: title: Disable of ETW Trace - Powershell id: 115fdba9-f017-42e6-84cf-d5573bf2ddf8 related: - id: a238b5d0-ce2d-4414-a676-7a531b3d13d6 type: derived status: test description: Detects usage of powershell cmdlets to disable or remove ETW trace sessions references: - https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-28 modified: 2022-11-25 tags: - attack.stealth - attack.defense-impairment - attack.t1070 - attack.t1685 - car.2016-04-002 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_pwsh_remove: ScriptBlockText|contains: 'Remove-EtwTraceProvider ' selection_pwsh_set: ScriptBlockText|contains|all: - 'Set-EtwTraceProvider ' - '0x11' condition: 1 of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects files that have extensions commonly seen while SDelete is used to wipe files.. Logsource: windows / security. Rule: title: Potential Secure Deletion with SDelete id: 39a80702-d7ca-4a83-b776-525b1f86a36d status: test description: Detects files that have extensions commonly seen while SDelete is used to wipe files. references: - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/sdelete.htm - https://www.jpcert.or.jp/english/pub/sr/ir_research.html - https://learn.microsoft.com/en-gb/sysinternals/downloads/sdelete author: Thomas Patzke date: 2017-06-14 modified: 2024-12-13 tags: - attack.impact - attack.stealth - attack.defense-impairment - attack.t1070.004 - attack.t1027.005 - attack.t1485 - attack.t1553.002 - attack.s0195 logsource: product: windows service: security detection: selection: EventID: - 4656 - 4663 - 4658 ObjectName|endswith: - .AAA - .ZZZ condition: selection falsepositives: - Legitimate usage of SDelete - Files that are interacted with that have these extensions legitimately level: medium
Query: patch priority for CVE-2015-2182
Matching passage: CVE-2015-2182. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in ZeusCart 4 allow remote attackers to inject arbitrary web script or HTML via the (1) schltr parameter in a brands action or (2) brand parameter in a viewbrands action to index.php. NOTE: The search parameter vector is already covered by CVE-2010-5322.
Near-miss passage: CVE-2015-3219. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.
Query: exploit The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not check if the parent node is an element, which allows attackers to cause a denial of service via a crafted X
Matching passage: CVE-2015-7995. CWE: UNKNOWN. CVSS: 5.0. The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not check if the parent node is an element, which allows attackers to cause a denial of service via a crafted XML file, related to a "type confusion" issue.
Near-miss passage: CVE-2015-5561. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.
Query: exploit An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384689.
Matching passage: CVE-2015-9008. CWE: CWE-264. CVSS: 9.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384689.
Near-miss passage: CVE-2015-1590. CWE: CWE-264. CVSS: 7.800000190734863. The kamcmd administrative utility and default configuration in kamailio before 4.3.0 use /tmp/kamailio_ctl.
Query: exploit SQL injection vulnerability in SAP HANA Web-based Development Workbench allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Notes 21
Matching passage: CVE-2015-4159. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in SAP HANA Web-based Development Workbench allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Notes 2153892.
Near-miss passage: CVE-2015-10037. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability, which was classified as critical, was found in ACI_Escola. This affects an unknown part. The manipulation leads to sql injection. The identifier of the patch is 34eed1f7b9295d1424912f79989d8aba5de41e9f. It is recommended to apply a patch to fix this issue. The identifier VDB-217965 was assigned to this vulnerability.
Query: explain T1059.011 Lua
Matching passage: T1059.011 Lua. Tactics: execution. Description: Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line (through the stand-alone lua interpreter), via scripts (<code>.lua</code>), or from Lua-embedded programs (through the <code>struct lua_State</code>).(Citation: Lua main page)(Citation: Lua state) Lua scripts may be executed by adversaries for malicious purposes. Adversaries may incorporate, abuse, or replace existing Lua interpreters to allow for malicious Lua command execution at runtime.(Citation: PoetRat Lua)(Citation: Lua Proofpoint Sunseed)(Citation: Cyphort EvilBunny)(Citation: Kaspersky Lua)
Near-miss passage: T1059.002 AppleScript. Tactics: execution. Description: Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.(Citation: Apple AppleScript) These AppleEvent messages can be sent independently or easily scripted with AppleScript. These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely. Scripts can be run from the command-line via <code>osascript /path/to/script</code> or <code>osascript -e "script here"</code>. Aside from the command line, scripts can be executed in numerous ways including Mail rules, Calendar.app alarms, and Automator workflows. AppleScripts can also be executed as plain text shell scripts by adding <code>#!/usr/bin/osascript</code> to the start of the script file.(Citation: SentinelOne AppleScript) AppleScripts do not need to call <code>osascript</code> to execute. However, they may be executed from within mach-O binaries by using the macOS [Native API](https://attack.mitre.org/techniques/T1106)s <code>NSAppleScript</code> or <code>OSAScript</code>, both of which execute code independent of the <code>/usr/bin/osascript</code> command line utility. Adversaries may abuse AppleScript to execute various behaviors, such as interacting with an open SSH connection, moving to remote machines, and even presenting users with fake dialog boxes. These events cannot start applications remotely (they can start them locally), but they can interact with applications if they're already running remotely. On macOS 10.10 Yosemite and higher, AppleScript has the ability to execute [Native API](https://attack.mitre.org/techniques/T1106)s, which otherwise would require compilation and execution in a mach-O binary file format.(Citation: SentinelOne macOS Red Team) Since this is a scripting language, it can be used to launch more common techniques as well such as a reverse shell via [Python](https://attack.mitre.org/techniques
Query: rule covering Detects changes to the default RDP port. Remote desktop is a common feature in operating systems. It allows a user to lo
Matching passage: Sigma rule: Detects changes to the default RDP port. Remote desktop is a common feature in operating systems. It allows a user to lo. Logsource: windows / registry_set. Rule: title: Default RDP Port Changed to Non Standard Port id: 509e84b9-a71a-40e0-834f-05470369bd1e status: test description: 'Detects changes to the default RDP port. Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS). ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md author: frack113 date: 2022-01-01 modified: 2024-03-25 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.010 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Control\Terminal Server\WinStations\RDP-Tcp\PortNumber filter_main_port: Details: DWORD (0x00000d3d) condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_change_rdp_port/info.yml simulation: - type: atomic-red-team name: Changing RDP Port to Non Standard Port via Powershell technique: T1021.001 atomic_guid: 2f840dd4-8a2e-4f44-beb3-6b2399ea3771 - type: atomic-red-team name: Changing RDP Port to Non Standard Port via Command_Prompt technique: T1021.001 atomic_guid: 74ace21e-a31c-4f7d-b540-53e4eb6d1f73
Near-miss passage: Sigma rule: Detects the creation of a remote thread from a Powershell process in an uncommon target process. Logsource: windows / create_remote_thread. Rule: title: Remote Thread Creation Via PowerShell In Uncommon Target id: 99b97608-3e21-4bfe-8217-2a127c396a0e related: - id: eeb2e3dc-c1f4-40dd-9bd5-149ee465ad50 type: similar status: test description: Detects the creation of a remote thread from a Powershell process in an uncommon target process references: - https://www.fireeye.com/blog/threat-research/2018/06/bring-your-own-land-novel-red-teaming-technique.html author: Florian Roth (Nextron Systems) date: 2018-06-25 modified: 2023-11-10 tags: - attack.execution - attack.stealth - attack.t1218.011 - attack.t1059.001 logsource: product: windows category: create_remote_thread detection: selection: SourceImage|endswith: - \powershell.exe - \pwsh.exe TargetImage|endswith: - \rundll32.exe - \regsvr32.exe condition: selection falsepositives: - Unknown level: medium
Query: exploit In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, MDM9650, MDM9655, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/
Matching passage: CVE-2015-9195. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, MDM9650, MDM9655, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 808, SD 810, and SDX20, in a QTEE syscall handler, HLOS can cause a buffer overflow to occur.
Near-miss passage: CVE-2015-1681. CWE: CWE-119. CVSS: 1.899999976158142. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to cause a denial of service via a crafted .msc file, aka "Microsoft Management Console File Format Denial of Service Vulnerability."
Query: exploit Directory traversal vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.5 Patch 6 allows remote authenticated users to read arbitrary files via a crafted URL.
Matching passage: CVE-2015-2007. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.5 Patch 6 allows remote authenticated users to read arbitrary files via a crafted URL.
Near-miss passage: CVE-2015-0911. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in TAGAWA Takao TransmitMail 1.0.11 through 1.5.8 allows remote attackers to read arbitrary files via vectors related to attachment handling.
Query: what is T1061
Matching passage: T1061 Graphical User Interface. Tactics: execution. Description: **This technique has been deprecated. Please use [Remote Services](https://attack.mitre.org/techniques/T1021) where appropriate.** The Graphical User Interfaces (GUI) is a common way to interact with an operating system. Adversaries may use a system's GUI during an operation, commonly through a remote interactive session such as [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1076), instead of through a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), to search for information and execute files via mouse double-click events, the Windows Run command (Citation: Wikipedia Run Command), or other potentially difficult to monitor interactions.
Near-miss passage: T1059.012 Hypervisor CLI. Tactics: execution. Description: Adversaries may abuse hypervisor command line interpreters (CLIs) to execute malicious commands. Hypervisor CLIs typically enable a wide variety of functionality for managing both the hypervisor itself and the guest virtual machines it hosts. For example, on ESXi systems, tools such as `esxcli` and `vim-cmd` allow administrators to configure firewall rules and log forwarding on the hypervisor, list virtual machines, start and stop virtual machines, and more.(Citation: Broadcom ESXCLI Reference)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: LOLESXi) Adversaries may be able to leverage these tools in order to support further actions, such as [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486).
Query: detect Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask. in logs
Matching passage: Sigma rule: Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask.. Logsource: windows / process_access. Rule: title: Uncommon Process Access Rights For Target Image id: a24e5861-c6ca-4fde-a93c-ba9256feddf0 status: test description: 'Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask. ' references: - https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2024-05-27 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.011 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: - \calc.exe - \calculator.exe - \mspaint.exe - \notepad.exe - \ping.exe - \wordpad.exe - \write.exe GrantedAccess: '0x1FFFFF' condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects uncommon target processes for remote thread creation. Logsource: windows / create_remote_thread. Rule: title: Remote Thread Creation In Uncommon Target Image id: a1a144b7-5c9b-4853-a559-2172be8d4a03 related: - id: f016c716-754a-467f-a39e-63c06f773987 type: obsolete status: test description: Detects uncommon target processes for remote thread creation references: - https://web.archive.org/web/20220319032520/https://blog.redbluepurple.io/offensive-research/bypassing-injection-detection author: Florian Roth (Nextron Systems) date: 2022-03-16 modified: 2025-07-04 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.003 logsource: product: windows category: create_remote_thread detection: selection: TargetImage|endswith: - \calc.exe - \calculator.exe - \mspaint.exe - \notepad.exe - \ping.exe - \sethc.exe - \spoolsv.exe - \wordpad.exe - \write.exe filter_main_csrss: SourceImage: C:\Windows\System32\csrss.exe filter_main_notepad: SourceImage: - C:\Windows\System32\explorer.exe - C:\Windows\System32\OpenWith.exe TargetImage: C:\Windows\System32\notepad.exe filter_main_sethc: SourceImage: C:\Windows\System32\AtBroker.exe TargetImage: C:\Windows\System32\Sethc.exe filter_optional_aurora_1: StartFunction: EtwpNotificationThread filter_optional_aurora_2: SourceImage|contains: unknown process filter_optional_vmtoolsd: SourceImage: C:\Program Files\VMware\VMware Tools\vmtoolsd.exe StartFunction: GetCommandLineW TargetImage: - C:\Windows\System32\notepad.exe - C:\Windows\System32\spoolsv.exe filter_optional_xerox_pjems: SourceImage: C:\Program Files\Xerox\XeroxPrintExperience\CommonFiles\XeroxPrintJobEventManagerService.exe StartFunction: LoadLibraryW TargetImage: C:\Windows\System32\spoolsv.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium