alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects changes to the bitbucket audit log configuration.
Matching passage: Sigma rule: Detects changes to the bitbucket audit log configuration.. Logsource: bitbucket / audit. Rule: title: Bitbucket Audit Log Configuration Updated id: 6aa12161-235a-4dfb-9c74-fe08df8d8da1 status: test description: Detects changes to the bitbucket audit log configuration. references: - https://confluence.atlassian.com/bitbucketserver/view-and-configure-the-audit-log-776640417.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.defense-impairment - attack.t1685 logsource: product: bitbucket service: audit definition: 'Requirements: "Basic" log level is required to receive these audit events.' detection: selection: auditType.category: Auditing auditType.action: Audit log configuration updated condition: selection falsepositives: - Legitimate user activity. level: medium
Near-miss passage: Sigma rule: Detects usage of a PowerShell command to dump the live memory of a Windows machine. Logsource: windows / ps_script. Rule: title: Live Memory Dump Using Powershell id: cd185561-4760-45d6-a63e-a51325112cae status: test description: Detects usage of a PowerShell command to dump the live memory of a Windows machine references: - https://learn.microsoft.com/en-us/powershell/module/storage/get-storagediagnosticinfo?view=windowsserver2022-ps author: Max Altgelt (Nextron Systems) date: 2021-09-21 modified: 2022-12-25 tags: - attack.credential-access - attack.t1003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Get-StorageDiagnosticInfo - -IncludeLiveDump condition: selection falsepositives: - Diagnostics level: high
Query: vulnerability: The DecodeImage function in coders/gif.c in GraphicsMagick 1.3.18 allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted GIF file.
Matching passage: CVE-2015-8808. CWE: CWE-119. CVSS: 5.5. The DecodeImage function in coders/gif.c in GraphicsMagick 1.3.18 allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted GIF file.
Near-miss passage: CVE-2015-8417. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, and CVE-2015-8455.
Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects java process spawning suspicious children. Logsource: linux / process_creation. Rule: title: Suspicious Java Children Processes id: d292e0af-9a18-420c-9525-ec0ac3936892 status: test description: Detects java process spawning suspicious children references: - https://www.tecmint.com/different-types-of-linux-shells/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-03 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection: ParentImage|endswith: /java CommandLine|contains: - /bin/sh - bash - dash - ksh - zsh - csh - fish - curl - wget - python condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a certain command line flag combination used by "devinit.exe", which can be abused as a LOLBIN to download arbit. Logsource: windows / process_creation. Rule: title: Arbitrary MSI Download Via Devinit.EXE id: 90d50722-0483-4065-8e35-57efaadd354d status: test description: Detects a certain command line flag combination used by "devinit.exe", which can be abused as a LOLBIN to download arbitrary MSI packages on a Windows system references: - https://twitter.com/mrd0x/status/1460815932402679809 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Devinit/ author: Florian Roth (Nextron Systems) date: 2022-01-11 modified: 2023-04-06 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - ' -t msi-install ' - ' -i http' condition: selection falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-3337
Matching passage: CVE-2015-3337. CWE: CWE-22. CVSS: 4.300000190734863. Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.
Near-miss passage: CVE-2015-4085. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1.
Query: CVE similar to CVE-2015-1514
Matching passage: CVE-2015-1514. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in FancyFon FAMOC before 3.17.4 allow (1) remote attackers to execute arbitrary SQL commands via the device ID REST parameter (PATH_INFO) to /ajax.php or (2) remote authenticated users to execute arbitrary SQL commands via the order parameter to index.php.
Near-miss passage: CVE-2015-9315. CWE: CWE-89. CVSS: 9.800000190734863. The newstatpress plugin before 1.0.1 for WordPress has SQL injection.
Query: CVE similar to CVE-2015-2512
Matching passage: CVE-2015-2512. CWE: CWE-264. CVSS: 7.199999809265137. The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Font Driver Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2507.
Near-miss passage: CVE-2015-5217. CWE: CWE-264. CVSS: 4.0. providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly check permissions to update the SAML2 Service Provider (SP) owner, which allows remote authenticated users to cause a denial of service via a duplicate SP name.
Query: telemetry for T1685.003
Matching passage: T1685.003 Modify or Spoof Tool UI. Tactics: defense impairment. Description: Adversaries may spoof or manipulate security tool user interfaces (UIs) to falsely indicate tools are functioning normally and delay detection and response. Adversaries may present misleading or falsified security tool interfaces (UIs) that display normal or healthy status indicators, even when underlying security tools have been disabled, degraded, or otherwise tampered with. Security tools typically provide visibility into system health, alerting, and operational status; by misrepresenting this information, adversaries can undermine defender trust in these signals and obscure the true security posture of the system. This behavior is often used in conjunction with efforts to disable or modify tools, where adversaries first impair the functionality of defenses (e.g., EDR, logging agents) and then replace or mimic their interfaces to conceal the loss of visibility. By maintaining the appearance of normal operations, such as showing active protection, successful updates, or absence of threats, adversaries can delay investigation and response, enabling continued malicious activity. For example, adversaries may display a fake Windows Security interface or system tray icon indicating a “protected” or “healthy” state after disabling Windows Defender or related services.(Citation: BlackBasta)
Near-miss passage: T1685.004 Disable or Modify Linux Audit System Log. Tactics: defense impairment. Description: Adversaries may disable or modify the Linux Audit system to hide malicious activity and avoid detection. Linux admins use the Linux Audit system to track security-relevant information on a system. The Linux Audit system operates at the kernel-level and maintains event logs on application and system activity such as process, network, file, and login events based on pre-configured rules. Often referred to as `auditd`, this is the name of the daemon used to write events to disk and is governed by the parameters set in the `audit.conf` configuration file. Two primary ways to configure the log generation rules are through the command line `auditctl` utility and the file `/etc/audit/audit.rules`, containing a sequence of `auditctl` commands loaded at boot time.(Citation: IzyKnows auditd threat detection 2022)(Citation: Red Hat Linux Disable or Mod) With root privileges, adversaries may be able to ensure their activity is not logged through disabling the Audit system service, editing the configuration/rule files, or by hooking the Audit system library functions. Using the command line, adversaries can disable the Audit system service through killing processes associated with `auditd` daemon or use `systemctl` to stop the Audit service. Adversaries can also hook Audit system functions to disable logging or modify the rules contained in the `/etc/audit/audit.rules` or `audit.conf` files to ignore malicious activity.(Citation: ESET Ebury Feb 2014)
Query: CVE similar to CVE-2015-5344
Matching passage: CVE-2015-5344. CWE: CWE-19. CVSS: 9.800000190734863. The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
Near-miss passage: CVE-2015-8339. CWE: CWE-19. CVSS: 4.699999809265137. The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly hand back pages to a domain, which might allow guest OS administrators to cause a denial of service (host crash) via unspecified vectors related to domain teardown.
Query: risk of admin_messages.php in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrar
Matching passage: CVE-2015-5692. CWE: CWE-264. CVSS: 7.900000095367432. admin_messages.php in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary code by uploading a file with a safe extension and content type, and then leveraging an improper Sudo configuration to make this a setuid-root file.
Near-miss passage: CVE-2015-3379. CWE: CWE-264. CVSS: 4.0. The Views module before 6.x-2.18, 6.x-3.x before 6.x-3.2, and 7.x-3.x before 7.x-3.10 for Drupal does not properly restrict access to the default views configurations, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
Query: CVE similar to CVE-2015-0548
Matching passage: CVE-2015-0548. CWE: CWE-20. CVSS: 4.0. The D2DownloadService.getDownloadUrls service method in EMC Documentum D2 4.1 and 4.2 before 4.2 P16 and 4.5 before P03 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and bypass intended read-access restrictions via unspecified vectors.
Near-miss passage: CVE-2015-2459. CWE: CWE-20. CVSS: 9.300000190734863. ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability," a different vulnerability than CVE-2015-2458 and CVE-2015-2461.
Query: intelligence brief on T1593.001
Matching passage: T1593.001 Social Media. Tactics: reconnaissance. Description: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. [Spearphishing Service](https://attack.mitre.org/techniques/T1598/001)).(Citation: Cyware Social Media) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).
Near-miss passage: T1593 Search Open Websites/Domains. Tactics: reconnaissance. Description: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.(Citation: Cyware Social Media)(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking) Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Phishing](https://attack.mitre.org/techniques/T1566)).
Query: describe CVE-2015-2491
Matching passage: CVE-2015-2491. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2485 and CVE-2015-2541.
Near-miss passage: CVE-2015-4409. CWE: CWE-119. CVSS: 6.5. Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service (service interruption) via a crafted HTTP request, aka the SDK issue.
Query: alert when Detects user agent and URI paths used by empire agents
Matching passage: Sigma rule: Detects user agent and URI paths used by empire agents. Logsource: proxy. Rule: title: HackTool - Empire UserAgent URI Combo id: b923f7d6-ac89-4a50-a71a-89fb846b4aa8 status: test description: Detects user agent and URI paths used by empire agents references: - https://github.com/BC-SECURITY/Empire author: Florian Roth (Nextron Systems) date: 2020-07-13 modified: 2024-02-26 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko cs-uri: - /admin/get.php - /news.php - /login/process.php cs-method: POST condition: selection falsepositives: - Valid requests with this exact user agent to server scripts of the defined names level: high
Near-miss passage: Sigma rule: Detects a suspicious WinRAR execution in a folder which is not the default installation folder. Logsource: windows / process_creation. Rule: title: WinRAR Execution in Non-Standard Folder id: 4ede543c-e098-43d9-a28f-dd784a13132f status: test description: Detects a suspicious WinRAR execution in a folder which is not the default installation folder references: - https://twitter.com/cyb3rops/status/1460978167628406785 author: Florian Roth (Nextron Systems), Tigzy date: 2021-11-17 modified: 2025-07-16 tags: - attack.collection - attack.t1560.001 logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \rar.exe - \winrar.exe - Description: - Command line RAR - WinRAR filter_main_unrar: Image|endswith: \UnRAR.exe filter_main_path: Image|contains: - :\Program Files (x86)\WinRAR\ - :\Program Files\WinRAR\ filter_optional_temp: Image|contains: :\Windows\Temp\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate use of WinRAR in a folder of a software that bundles WinRAR level: medium
Query: describe CVE-2015-8832
Matching passage: CVE-2015-8832. CWE: CWE-284. CVSS: 8.800000190734863. Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own media items" and "manage their own entries and comments" permissions to execute arbitrary PHP code by uploading a file with a (1) .pht, (2) .phps, or (3) .phtml extension.
Near-miss passage: CVE-2015-2107. CWE: CWE-284. CVSS: 6.800000190734863. HP Operations Manager i Management Pack 1.x before 1.01 for SAP allows local users to execute OS commands by leveraging SAP administrative privileges.
Query: detection rule: Detects a suspicious process pattern which could be a sign of an exploited Serv-U service
Matching passage: Sigma rule: Detects a suspicious process pattern which could be a sign of an exploited Serv-U service. Logsource: windows / process_creation. Rule: title: Suspicious Serv-U Process Pattern id: 58f4ea09-0fc2-4520-ba18-b85c540b0eaf status: test description: Detects a suspicious process pattern which could be a sign of an exploited Serv-U service references: - https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/ author: Florian Roth (Nextron Systems) date: 2021-07-14 modified: 2022-07-14 tags: - attack.credential-access - attack.t1555 - cve.2021-35211 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \Serv-U.exe Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - \wscript.exe - \cscript.exe - \sh.exe - \bash.exe - \schtasks.exe - \regsvr32.exe - \wmic.exe - \mshta.exe - \rundll32.exe - \msiexec.exe - \forfiles.exe - \scriptrunner.exe condition: selection falsepositives: - Legitimate uses in which users or programs use the SSH service of Serv-U for remote command execution level: high
Near-miss passage: Sigma rule: Detects the addition of the 'MiniNt' key to the registry. Upon a reboot, Windows Event Log service will stop writing eve. Logsource: windows / registry_set. Rule: title: Security Event Logging Disabled via MiniNt Registry Key - Registry Set id: 8839e550-52d7-4958-9f2f-e13c1e736838 related: - id: 1a4bd6af-99ac-4466-b5b2-7b72b4a05462 type: similar status: experimental description: 'Detects the addition of the ''MiniNt'' key to the registry. Upon a reboot, Windows Event Log service will stop writing events. Windows Event Log is a service that collects and stores event logs from the operating system and applications. It is an important component of Windows security and auditing. Adversary may want to disable this service to disable logging of security events which could be used to detect their activities. ' references: - https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-04-09 tags: - attack.persistence - attack.defense-impairment - attack.t1685.001 - attack.t1112 - car.2022-03-001 logsource: category: registry_set product: windows detection: selection: TargetObject: HKLM\System\CurrentControlSet\Control\MiniNt\(Default) condition: selection falsepositives: - Highly Unlikely level: high
Query: patch priority for CVE-2015-8083
Matching passage: CVE-2015-8083. CWE: CWE-119. CVSS: 7.800000190734863. An unspecified module in Huawei eSpace U1910, U1911, U1930, U1960, U1980, and U1981 unified gateways with software before V200R003C00SPC300 does not properly initialize memory when processing timeout messages, which allows remote attackers to cause a denial of service (out-of-bounds memory access and device restart) via unknown vectors.
Near-miss passage: CVE-2015-8507. CWE: CWE-119. CVSS: 9.300000190734863. mediaserver in Android 6.0 before 2015-12-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 24157524, a different vulnerability than CVE-2015-6616, CVE-2015-8505, and CVE-2015-8506.
Query: Sigma YAML for fortigate / event
Matching passage: Sigma rule: Detects the modification of VPN SSL Settings (for example, the modification of authentication rules). This behavior was. Logsource: fortigate / event. Rule: title: FortiGate - VPN SSL Settings Modified id: 8b5dacf2-aeb7-459d-b133-678eb696d410 status: experimental description: 'Detects the modification of VPN SSL Settings (for example, the modification of authentication rules). This behavior was observed in pair with the addition of a VPN SSL Web Portal. ' references: - https://www.fortiguard.com/psirt/FG-IR-24-535 - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/114404382/config-vpn-ssl-settings - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44546/44546-logid-event-config-attr author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2025-11-01 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: product: fortigate service: event detection: selection: action: Edit cfgpath: vpn.ssl.settings condition: selection falsepositives: - VPN SSL settings can be changed for legitimate purposes. level: medium
Near-miss passage: Sigma rule: Detects when a user downloads a file by using CertOC.exe. Logsource: windows / process_creation. Rule: title: File Download via CertOC.EXE id: 70ad0861-d1fe-491c-a45f-fa48148a300d related: - id: b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a type: similar status: test description: Detects when a user downloads a file by using CertOC.exe references: - https://lolbas-project.github.io/lolbas/Binaries/Certoc/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-05-16 modified: 2023-10-18 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certoc.exe - OriginalFileName: CertOC.exe selection_cli: CommandLine|contains|all: - -GetCACAPS - http condition: all of selection* falsepositives: - Unknown level: medium
Query: vulnerability: Multiple SQL injection vulnerabilities in xlinkerz ecommerceMajor allow remote attackers to execute arbitrary SQL commands via the (1) productbycat parameter to product.php, or (2)
Matching passage: CVE-2015-1476. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in xlinkerz ecommerceMajor allow remote attackers to execute arbitrary SQL commands via the (1) productbycat parameter to product.php, or (2) username or (3) password parameter to __admin/index.php.
Near-miss passage: CVE-2015-1055. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the Photo Gallery plugin 1.2.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the order_by parameter in a GalleryBox action to wp-admin/admin-ajax.php.
Query: patch priority for CVE-2015-0497
Matching passage: CVE-2015-0497. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the PeopleSoft Enterprise Portal Interaction Hub component in Oracle PeopleSoft Products 9.1.00 allows remote attackers to affect integrity via unknown vectors related to Enterprise Portal.
Near-miss passage: CVE-2015-4838. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.4.0, 12.1.2.0.0, and 12.1.3.0.0 allows remote authenticated users to affect confidentiality via vectors related to ADF Faces.