alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.
Matching passage: Sigma rule: A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.. Logsource: windows / file_event. Rule: title: Startup Folder File Write id: 2aa0a6b4-a865-495b-ab51-c28249537b75 related: - id: 28208707-fe31-437f-9a7f-4b1108b94d2e type: similar status: test description: A General detection for files being created in the Windows startup directory. This could be an indicator of persistence. references: - https://github.com/OTRF/detection-hackathon-apt29/issues/12 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/5.B.1_611FCA99-97D0-4873-9E51-1C1BA2DBB40D.md author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2025-12-03 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \Microsoft\Windows\Start Menu\Programs\StartUp filter_main_update: - Image: - C:\Windows\System32\wuauclt.exe - C:\Windows\uus\ARM64\wuaucltcore.exe - TargetFilename|startswith: - C:\$WINDOWS.~BT\NewOS\ - C:\$WinREAgent\Scratch\Mount\ filter_optional_onenote: Image|endswith: \ONENOTE.EXE TargetFilename|endswith: \Send to OneNote.lnk condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - FP could be caused by legitimate application writing shortcuts for example. This folder should always be inspected to make sure that all the files in there are legitimate level: medium
Near-miss passage: Sigma rule: Detects the removal or uninstallation of an application via "Wmic.EXE".. Logsource: windows / process_creation. Rule: title: Application Removed Via Wmic.EXE id: b53317a0-8acf-4fd1-8de8-a5401e776b96 related: - id: 847d5ff3-8a31-4737-a970-aeae8fe21765 type: derived status: test description: Detects the removal or uninstallation of an application via "Wmic.EXE". references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md#atomic-test-10---application-uninstall-using-wmic author: frack113 date: 2022-01-28 modified: 2024-07-02 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WMIC.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains|all: - call - uninstall condition: all of selection_* falsepositives: - Unknown level: medium simulation: - type: atomic-red-team name: Application uninstall using WMIC technique: T1047 atomic_guid: c510d25b-1667-467d-8331-a56d3e9bc4ff regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_uninstall_application/info.yml
Query: exploit Buffer overflow in CREAR AL-Mail32 before 1.13d allows remote attackers to execute arbitrary code via a long filename of an attachment.
Matching passage: CVE-2015-0880. CWE: CWE-119. CVSS: 6.800000190734863. Buffer overflow in CREAR AL-Mail32 before 1.13d allows remote attackers to execute arbitrary code via a long filename of an attachment.
Near-miss passage: CVE-2015-8999. CWE: CWE-119. CVSS: 7.800000190734863. In TrustZone a buffer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel while loading an ELF file.
Query: weakness Unchecked Input for Loop Condition
Matching passage: CWE-606 Unchecked Input for Loop Condition. The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
Near-miss passage: CWE-228 Improper Handling of Syntactically Invalid Structure. The product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the associated specification.
Query: explain CWE-1276
Matching passage: CWE-1276 Hardware Child Block Incorrectly Connected to Parent System. Signals between a hardware IP and the parent system design are incorrectly connected causing security risks.
Near-miss passage: CWE-619 Dangling Database Cursor ('Cursor Injection'). If a database cursor is not closed properly, then it could become accessible to other users while retaining the same privileges that were originally assigned, leaving the cursor dangling.
Query: describe CVE-2015-10100
Matching passage: CVE-2015-10100. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability, which was classified as critical, has been found in Dynamic Widgets Plugin up to 1.5.10 on WordPress. This issue affects some unknown processing of the file classes/dynwid_class.php. The manipulation leads to sql injection. The attack may be initiated remotely. Upgrading to version 1.5.11 is able to address this issue. The identifier of the patch is d0a19c6efcdc86d7093b369bc9e29a0629e57795. It is recommended to upgrade the affected component. The identifier VDB-225353 was assigned to this vulnerability.
Near-miss passage: CVE-2015-3980. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2097534.
Query: describe CVE-2015-7686
Matching passage: CVE-2015-7686. CWE: CWE-20. CVSS: 7.800000190734863. Algorithmic complexity vulnerability in Address.pm in the Email-Address module 1.908 and earlier for Perl allows remote attackers to cause a denial of service (CPU consumption) via a crafted string containing a list of e-mail addresses in conjunction with parenthesis characters that can be associated with nested comments. NOTE: the default configuration in 1.908 mitigates this vulnerability but misparses certain realistic comments.
Near-miss passage: CVE-2015-1049. CWE: CWE-20. CVSS: 6.800000190734863. The web server on Siemens SCALANCE X-200IRT switches with firmware before 5.2.0 allows remote attackers to hijack sessions via unspecified vectors.
Query: exploit Multiple stack-based buffer overflows in Moxa VPort ActiveX SDK Plus before 2.8 allow remote attackers to insert assembly-code lines via vectors involving a regkey (1) set or (2) g
Matching passage: CVE-2015-0986. CWE: CWE-119. CVSS: 7.5. Multiple stack-based buffer overflows in Moxa VPort ActiveX SDK Plus before 2.8 allow remote attackers to insert assembly-code lines via vectors involving a regkey (1) set or (2) get command.
Near-miss passage: CVE-2015-8319. CWE: CWE-119. CVSS: 7.800000190734863. Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application, a different vulnerability than CVE-2015-8318.
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed). Logsource: windows / file_event. Rule: title: AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File id: d353dac0-1b41-46c2-820c-d7d2561fc6ed related: - id: 074e0ded-6ced-4ebd-8b4d-53f55908119d type: derived status: test description: Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed) references: - https://posts.specterops.io/application-whitelisting-bypass-and-arbitrary-unsigned-code-execution-technique-in-winrm-vbs-c8c24fb40404 author: Julia Fomina, oscd.community date: 2020-10-06 modified: 2022-11-28 tags: - attack.stealth - attack.t1216 logsource: product: windows category: file_event detection: system_files: TargetFilename|endswith: - WsmPty.xsl - WsmTxt.xsl in_system_folder: TargetFilename|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ condition: system_files and not in_system_folder falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Detect changes of syslog daemons configuration files. Logsource: linux / auditd. Rule: title: Logging Configuration Changes on Linux Host id: c830f15d-6f6e-430f-8074-6f73d6807841 status: test description: Detect changes of syslog daemons configuration files references: - self experience author: Mikhail Larin, oscd.community date: 2019-10-25 modified: 2021-11-27 tags: - attack.defense-impairment - attack.t1685 logsource: product: linux service: auditd detection: selection: type: PATH name: - /etc/syslog.conf - /etc/rsyslog.conf - /etc/syslog-ng/syslog-ng.conf condition: selection falsepositives: - Legitimate administrative activity level: high
Query: vulnerability: Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest OS users to cause a denial of se
Matching passage: CVE-2015-2150. CWE: CWE-264. CVSS: 4.900000095367432. Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest OS users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response.
Near-miss passage: CVE-2015-7861. CWE: CWE-264. CVSS: 10.0. Persistent Accelerite Radia Client Automation (formerly HP Client Automation), possibly before 9.1, allows remote attackers to execute arbitrary code by sending unspecified commands in an environment that lacks relationship-based firewalling.
Query: risk of WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application cras
Matching passage: CVE-2015-5792. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-1280. CWE: CWE-119. CVSS: 7.5. SkPictureShader.cpp in Skia, as used in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging access to a renderer process and providing crafted serialized data.
Query: rule covering Detects changes to the registry values related to outlook security settings
Matching passage: Sigma rule: Detects changes to the registry values related to outlook security settings. Logsource: windows / registry_set. Rule: title: Outlook Security Settings Updated - Registry id: c3cefdf4-6703-4e1c-bad8-bf422fc5015a related: - id: 6763c6c8-bd01-4687-bc8d-4fa52cf8ba08 type: similar status: test description: Detects changes to the registry values related to outlook security settings references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1137/T1137.md - https://learn.microsoft.com/en-us/outlook/troubleshoot/security/information-about-email-security-settings author: frack113 date: 2021-12-28 modified: 2026-01-09 tags: - attack.persistence - attack.t1137 logsource: category: registry_set product: windows detection: selection: TargetObject|contains|all: - \SOFTWARE\Microsoft\Office\ - \Outlook\Security\ filter_main_outlook: Image|startswith: - C:\Program Files\Microsoft Office\ - C:\Program Files (x86)\Microsoft Office\ Image|endswith: \OUTLOOK.EXE condition: selection and not 1 of filter_main_* falsepositives: - Administrative activity level: medium
Near-miss passage: Sigma rule: Detects suspicious sub processes of web server processes. Logsource: linux / process_creation. Rule: title: Linux Webshell Indicators id: 818f7b24-0fba-4c49-a073-8b755573b9c7 status: test description: Detects suspicious sub processes of web server processes references: - https://www.acunetix.com/blog/articles/web-shells-101-using-php-introduction-web-shells-part-2/ - https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-10-15 modified: 2022-12-28 tags: - attack.persistence - attack.t1505.003 logsource: product: linux category: process_creation detection: selection_general: ParentImage|endswith: - /httpd - /lighttpd - /nginx - /apache2 - /node - /caddy selection_tomcat: ParentCommandLine|contains|all: - /bin/java - tomcat selection_websphere: ParentCommandLine|contains|all: - /bin/java - websphere sub_processes: Image|endswith: - /whoami - /ifconfig - /ip - /bin/uname - /bin/cat - /bin/crontab - /hostname - /iptables - /netstat - /pwd - /route condition: 1 of selection_* and sub_processes falsepositives: - Web applications that invoke Linux command line tools level: high
Query: weakness Insecure Default Variable Initialization
Matching passage: CWE-453 Insecure Default Variable Initialization. The product, by default, initializes an internal variable with an insecure or less secure value than is possible.
Near-miss passage: CWE-1232 Improper Lock Behavior After Power State Transition. Register lock bit protection disables changes to system configuration once the bit is set. Some of the protected registers or lock bits become programmable after power state transitions (e.g., Entry and wake from low power sleep modes) causing the system configuration to be changeable.
Query: vulnerability: EMC Documentum Content Server before 7.1P20 and 7.2.x before 7.2P04 does not properly verify authorization for dm_job object access, which allows remote authenticated users to obta
Matching passage: CVE-2015-4544. CWE: CWE-264. CVSS: 9.0. EMC Documentum Content Server before 7.1P20 and 7.2.x before 7.2P04 does not properly verify authorization for dm_job object access, which allows remote authenticated users to obtain superuser privileges via crafted object operations. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4626.
Near-miss passage: CVE-2015-1496. CWE: CWE-264. CVSS: 7.199999809265137. Motorola Scanner SDK uses weak permissions for (1) CoreScanner.exe, (2) rsmdriverproviderservice.exe, and (3) ScannerService.exe, which allows local users to gain privileges via unspecified vectors.
Query: exploit In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, SD 400, and SD 800, userspace-provided pointer arguments are not valid
Matching passage: CVE-2015-9151. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, SD 400, and SD 800, userspace-provided pointer arguments are not validated.
Near-miss passage: CVE-2015-5235. CWE: CWE-20. CVSS: 4.300000190734863. IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page.
Query: vulnerability: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0
Matching passage: CVE-2015-8057. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-4860. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4883.
Query: SIEM correlation: discovery activity consistent with Virtual Machine Discovery
Matching passage: T1673 Virtual Machine Discovery. Tactics: discovery. Description: An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host or hypervisor. For example, adversaries may enumerate a list of VMs on an ESXi hypervisor using a [Hypervisor CLI](https://attack.mitre.org/techniques/T1059/012) such as `esxcli` or `vim-cmd` (e.g. `esxcli vm process list or vim-cmd vmsvc/getallvms`).(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: TrendMicro Play) Adversaries may also directly leverage a graphical user interface, such as VMware vCenter, in order to view virtual machines on a host. Adversaries may use the information from [Virtual Machine Discovery](https://attack.mitre.org/techniques/T1673) during discovery to shape follow-on behaviors. Subsequently discovered VMs may be leveraged for follow-on activities such as [Service Stop](https://attack.mitre.org/techniques/T1489) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486).(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)
Near-miss passage: T1007 System Service Discovery. Tactics: discovery. Description: Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as <code>sc query</code>, <code>tasklist /svc</code>, <code>systemctl --type=service</code>, and <code>net start</code>. Adversaries may also gather information about schedule tasks via commands such as `schtasks` on Windows or `crontab -l` on Linux and macOS.(Citation: Elastic Security Labs GOSAR 2024)(Citation: SentinelLabs macOS Malware 2021)(Citation: Splunk Linux Gormir 2024)(Citation: Aquasec Kinsing 2020) Adversaries may use the information from [System Service Discovery](https://attack.mitre.org/techniques/T1007) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Query: patch priority for CVE-2015-8751
Matching passage: CVE-2015-8751. CWE: CWE-190. CVSS: 8.800000190734863. Integer overflow in the jas_matrix_create function in JasPer allows context-dependent attackers to have unspecified impact via a crafted JPEG 2000 image, related to integer multiplication for memory allocation.
Near-miss passage: CVE-2015-9201. CWE: CWE-190. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, and SDX20, integer overflow in tzbsp can lead to privilege escalation.
Query: indicators of Dylib Hijacking
Matching passage: T1574.004 Dylib Hijacking. Tactics: stealth, execution. Description: Adversaries may execute their own payloads by placing a malicious dynamic library (dylib) with an expected name in a path a victim application searches at runtime. The dynamic loader will try to find the dylibs based on the sequential order of the search paths. Paths to dylibs may be prefixed with <code>@rpath</code>, which allows developers to use relative paths to specify an array of search paths used at runtime based on the location of the executable. Additionally, if weak linking is used, such as the <code>LC_LOAD_WEAK_DYLIB</code> function, an application will still execute even if an expected dylib is not present. Weak linking enables developers to run an application on multiple macOS versions as new APIs are added. Adversaries may gain execution by inserting malicious dylibs with the name of the missing dylib in the identified path.(Citation: Wardle Dylib Hijack Vulnerable Apps)(Citation: Wardle Dylib Hijacking OSX 2015)(Citation: Github EmpireProject HijackScanner)(Citation: Github EmpireProject CreateHijacker Dylib) Dylibs are loaded into an application's address space allowing the malicious dylib to inherit the application's privilege level and resources. Based on the application, this could result in privilege escalation and uninhibited network access. This method may also evade detection from security products since the execution is masked under a legitimate process.(Citation: Writing Bad Malware for OSX)(Citation: wardle artofmalware volume1)(Citation: MalwareUnicorn macOS Dylib Injection MachO)
Near-miss passage: T1574.014 AppDomainManager. Tactics: stealth, execution. Description: Adversaries may execute their own malicious payloads by hijacking how the .NET `AppDomainManager` loads assemblies. The .NET framework uses the `AppDomainManager` class to create and manage one or more isolated runtime environments (called application domains) inside a process to host the execution of .NET applications. Assemblies (`.exe` or `.dll` binaries compiled to run as .NET code) may be loaded into an application domain as executable code.(Citation: Microsoft App Domains) Known as "AppDomainManager injection," adversaries may execute arbitrary code by hijacking how .NET applications load assemblies. For example, malware may create a custom application domain inside a target process to load and execute an arbitrary assembly. Alternatively, configuration files (`.config`) or process environment variables that define .NET runtime settings may be tampered with to instruct otherwise benign .NET applications to load a malicious assembly (identified by name) into the target process.(Citation: PenTestLabs AppDomainManagerInject)(Citation: PwC Yellow Liderc)(Citation: Rapid7 AppDomain Manager Injection)
Query: patch priority for CVE-2015-2048
Matching passage: CVE-2015-2048. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Near-miss passage: CVE-2015-6007. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Web Reference Database (aka refbase) through 0.9.6 allows remote attackers to hijack the authentication of arbitrary users.