alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files are located in poten in logs
Matching passage: Sigma rule: Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files are located in poten. Logsource: windows / process_creation. Rule: title: File In Suspicious Location Encoded To Base64 Via Certutil.EXE id: 82a6714f-4899-4f16-9c1e-9a333544d4c3 related: - id: e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a type: derived status: test description: Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files are located in potentially suspicious locations references: - https://www.virustotal.com/gui/file/35c22725a92d5cb1016b09421c0a6cdbfd860fd4778b3313669b057d4a131cb7/behavior - https://www.virustotal.com/gui/file/427616528b7dbc4a6057ac89eb174a3a90f7abcf3f34e5a359b7a910d82f7a72/behavior - https://www.virustotal.com/gui/file/34de4c8beded481a4084a1fd77855c3e977e8ac643e5c5842d0f15f7f9b9086f/behavior - https://www.virustotal.com/gui/file/4abe1395a09fda06d897a9c4eb247278c1b6cddda5d126ce5b3f4f499e3b8fa2/behavior author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-15 modified: 2024-03-05 tags: - attack.stealth - attack.t1027 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certutil.exe - OriginalFileName: CertUtil.exe selection_cli: CommandLine|contains|windash: -encode selection_extension: CommandLine|contains: - \AppData\Roaming\ - \Desktop\ - \Local\Temp\ - \PerfLogs\ - \Users\Public\ - \Windows\Temp\ - $Recycle.Bin condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_location/info.yml
Near-miss passage: Sigma rule: Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired o. Logsource: linux / auditd. Rule: title: Network Sniffing - Linux id: f4d3748a-65d1-4806-bd23-e25728081d01 status: test description: 'Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1040/T1040.md author: Timur Zinniatullin, oscd.community date: 2019-10-21 modified: 2022-12-18 tags: - attack.credential-access - attack.discovery - attack.t1040 logsource: product: linux service: auditd detection: selection_1: type: execve a0: tcpdump a1: -c a3|contains: -i selection_2: type: execve a0: tshark a1: -c a3: -i condition: 1 of selection_* falsepositives: - Legitimate administrator or user uses network sniffing tool for legitimate reasons. level: low
Query: exploit The ESRI ArcGis Runtime SDK before 10.2.6-2 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly pass
Matching passage: CVE-2015-2002. CWE: CWE-118. CVSS: 9.800000190734863. The ESRI ArcGis Runtime SDK before 10.2.6-2 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
Near-miss passage: CVE-2015-2000. CWE: CWE-118. CVSS: 9.800000190734863. The Jumio SDK before 1.5.0 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
Query: detection rule: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.
Matching passage: Sigma rule: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.. Logsource: linux / auditd. Rule: title: System Shutdown/Reboot - Linux id: 4cb57c2f-1f29-41f8-893d-8bed8e1c1d2f status: test description: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md author: Igor Fits, oscd.community date: 2020-10-15 modified: 2022-11-26 tags: - attack.impact - attack.t1529 logsource: product: linux service: auditd detection: execve: type: EXECVE shutdowncmd: - shutdown - reboot - halt - poweroff init: - init - telinit initselection: - 0 - 6 condition: execve and (shutdowncmd or (init and initselection)) falsepositives: - Legitimate administrative activity level: informational
Near-miss passage: Sigma rule: Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal. Logsource: windows / process_creation. Rule: title: Suspicious Where Execution id: 725a9768-0f5e-4cb3-aec2-bc5719c6831a status: test description: 'Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1217/T1217.md author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-12-13 modified: 2022-06-29 tags: - attack.discovery - attack.t1217 logsource: category: process_creation product: windows detection: where_exe: - Image|endswith: \where.exe - OriginalFileName: where.exe where_opt: CommandLine|contains: - places.sqlite - cookies.sqlite - formhistory.sqlite - logins.json - key4.db - key3.db - sessionstore.jsonlz4 - History - Bookmarks - Cookies - Login Data condition: all of where_* falsepositives: - Unknown level: low
Query: describe CVE-2015-0515
Matching passage: CVE-2015-0515. CWE: UNKNOWN. CVSS: 6.5. Unrestricted file upload vulnerability in EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 allows remote authenticated users to execute arbitrary code by uploading and then accessing an executable file.
Near-miss passage: CVE-2015-3127. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
Query: vulnerability: Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) ticket_code or (2) e
Matching passage: CVE-2015-4073. CWE: CWE-89. CVSS: 9.800000190734863. Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) ticket_code or (2) email parameter or (3) remote authenticated users to execute arbitrary SQL commands via the filter_order parameter.
Near-miss passage: CVE-2015-7567. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary SQL commands via the "passwordreset&token" parameter.
Query: vulnerability: Microsoft Internet Explorer 8 through 11 and Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Mem
Matching passage: CVE-2015-2442. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 through 11 and Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2444.
Near-miss passage: CVE-2015-2376. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Office for Mac 2011, Excel Viewer 2007 SP3, Office Compatibility Pack SP3, Excel Services on SharePoint Server 2007 SP3, Excel Services on SharePoint Server 2010 SP2, and Excel Services on SharePoint Server 2013 SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: explain CWE-830
Matching passage: CWE-830 Inclusion of Web Functionality from an Untrusted Source. The product includes web functionality (such as a web widget) from another domain, which causes it to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source.
Near-miss passage: CWE-1325 Improperly Controlled Sequential Memory Allocation. The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.
Query: patch priority for CVE-2015-5143
Matching passage: CVE-2015-5143. CWE: CWE-399. CVSS: 7.800000190734863. The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys.
Near-miss passage: CVE-2015-7970. CWE: CWE-399. CVSS: 4.900000095367432. The p2m_pod_emergency_sweep function in arch/x86/mm/p2m-pod.c in Xen 3.4.x, 3.5.x, and 3.6.x is not preemptible, which allows local x86 HVM guest administrators to cause a denial of service (CPU consumption and possibly reboot) via crafted memory contents that triggers a "time-consuming linear scan," related to Populate-on-Demand.
Query: Sigma YAML for fortigate / event
Matching passage: Sigma rule: Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall. This behavior was observed in pair with m. Logsource: fortigate / event. Rule: title: FortiGate - New VPN SSL Web Portal Added id: 2bfb6216-0c31-4d20-8501-2629b29a3fa2 status: experimental description: 'Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall. This behavior was observed in pair with modification of VPN SSL settings. ' references: - https://www.fortiguard.com/psirt/FG-IR-24-535 - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/113121765/config-vpn-ssl-web-portal - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2025-11-01 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: product: fortigate service: event detection: selection: action: Add cfgpath: vpn.ssl.web.portal condition: selection falsepositives: - A VPN SSL Web Portal can be added for legitimate purposes. level: medium
Near-miss passage: Sigma rule: Detects events that appear when a user click on a link file with a powershell command in it. Logsource: windows / process_creation. Rule: title: Hidden Powershell in Link File Pattern id: 30e92f50-bb5a-4884-98b5-d20aa80f3d7a status: test description: Detects events that appear when a user click on a link file with a powershell command in it references: - https://www.x86matthew.com/view_post?id=embed_exe_lnk author: frack113 date: 2022-02-06 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: ParentImage: C:\Windows\explorer.exe Image: C:\Windows\System32\cmd.exe CommandLine|contains|all: - powershell - .lnk condition: selection falsepositives: - Legitimate commands in .lnk files level: medium
Query: Outbound C2 pattern associated with Masquerade Task or Service
Matching passage: T1036.004 Masquerade Task or Service. Tactics: stealth. Description: Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.(Citation: TechNet Schtasks)(Citation: Systemd Service Units) Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones. Tasks or services contain other fields, such as a description, that adversaries may attempt to make appear legitimate.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Fysbis Dr Web Analysis)
Near-miss passage: T1036.012 Browser Fingerprint. Tactics: stealth. Description: Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc. The HTTP User-Agent request header is a string that lets servers and network peers identify the application, operating system, vendor, and/or version of the requesting user agent.(Citation: Mozilla User Agent) Adversaries may gather this information through [System Information Discovery](https://attack.mitre.org/techniques/T1082) or by users navigating to adversary-controlled websites, and then use that information to craft their web traffic to evade defenses.(Citation: Gummy Browsers Targeted Browser Spoofing against State-of-the-Art Fingerprinting Techniques)
Query: write Sigma for Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool. This event must not be ignored
Matching passage: Sigma rule: Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool. This event must not be ignored. Logsource: antivirus. Rule: title: Antivirus - Hacktool Signature id: fa0c05b6-8ad3-468d-8231-c1cbccb64fba status: stable description: 'Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. ' references: - https://www.nextron-systems.com/2021/08/16/antivirus-event-analysis-cheat-sheet-v1-8-2/ - https://www.nextron-systems.com/?s=antivirus author: Florian Roth (Nextron Systems), Arnim Rupp date: 2021-08-16 modified: 2026-06-15 tags: - attack.execution - attack.t1204 logsource: category: antivirus detection: selection: - Signature|startswith: - ATK/ - Exploit.Script.CVE - HKTL - HTOOL - PWS. - PWSX - SecurityTool - Signature|contains: - Adfind - BloodH - BloodyAD - Brutel - BruteR - Cobalt - COBEACON - Cometer - DumpCreds - EDRfreeze - FastReverseProxy - Hacktool - Havoc - Impacket - Keylogger - Koadic - Mimikatz - Nighthawk - PentestPowerShell - Potato - PowerSploit - PowerSSH - PshlSpy - PSWTool - PWCrack - PWDump - Responder - Rozena - Rusthound - Sbelt - Seatbelt - SecurityTool - SharpDump - SharpHound - Shellcode - Sliver - Snaffler - SOAPHound - Splinter - Stowaway - Swrort - Trojan.Hound - TurtleLoader - Undefend - Undfnd condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects usage of the "type" command to download/upload data from WebDAV server. Logsource: windows / process_creation. Rule: title: Potential Download/Upload Activity Using Type Command id: aa0b3a82-eacc-4ec3-9150-b5a9a3e3f82f status: test description: Detects usage of the "type" command to download/upload data from WebDAV server references: - https://mr0range.com/a-new-lolbin-using-the-windows-type-command-to-upload-download-files-81d7b6179e22 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-14 tags: - attack.command-and-control - attack.t1105 logsource: product: windows category: process_creation detection: selection_upload: CommandLine|contains|all: - 'type ' - ' > \\\\' selection_download: CommandLine|contains|all: - type \\\\ - ' > ' condition: 1 of selection_* falsepositives: - Unknown level: medium
Query: risk of Buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader
Matching passage: CVE-2015-6692. CWE: CWE-120. CVSS: 5.0. Buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-20111. CWE: CWE-120. CVSS: 9.800000190734863. miniupnp before 4c90b87, as used in Bitcoin Core before 0.12 and other products, lacks checks for snprintf return values, leading to a buffer overflow and significant data leak, a different vulnerability than CVE-2019-12107. In Bitcoin Core before 0.12, remote code execution was possible in conjunction with CVE-2015-6031 exploitation.
Query: patch priority for CVE-2015-7963
Matching passage: CVE-2015-7963. CWE: CWE-264. CVSS: 7.800000190734863. SafeNet Authentication Service for AD FS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
Near-miss passage: CVE-2015-7709. CWE: CWE-264. CVSS: 10.0. The arkeiad daemon in the Arkeia Backup Agent in Western Digital Arkeia 11.0.12 and earlier allows remote attackers to bypass authentication and execute arbitrary commands via a series of crafted requests involving the ARKFS_EXEC_CMD operation.
Query: risk of MobileInstallation in Apple iOS before 8.4.1 does not ensure the uniqueness of universal provisioning profile bundle IDs, which allows attackers to replace arbitrary extensions via
Matching passage: CVE-2015-5770. CWE: CWE-264. CVSS: 5.800000190734863. MobileInstallation in Apple iOS before 8.4.1 does not ensure the uniqueness of universal provisioning profile bundle IDs, which allows attackers to replace arbitrary extensions via a crafted enterprise app.
Near-miss passage: CVE-2015-5735. CWE: CWE-264. CVSS: 7.199999809265137. The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allow local users to write to arbitrary memory locations via a 0x226108 ioctl call.
Query: patch priority for CVE-2015-8924
Matching passage: CVE-2015-8924. CWE: CWE-125. CVSS: 5.5. The archive_read_format_tar_read_header function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tar file.
Near-miss passage: CVE-2015-8915. CWE: CWE-125. CVSS: 5.5. bsdcpio in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read and crash) via crafted cpio file.
Query: risk of The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which
Matching passage: CVE-2015-5162. CWE: CWE-399. CVSS: 7.5. The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image.
Near-miss passage: CVE-2015-0043. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Query: containment actions for EDR alert: possible Acquire Infrastructure (T1583)
Matching passage: Playbook for T1583 Acquire Infrastructure. 1) Validate alert telemetry against T1583. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: resource development. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Some infrastructure providers offer free trial periods, enabling infrastructure
Near-miss passage: Playbook for T1583.001 Domains. Different response path focused on resource development.
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in DLGuard 5, 4.6, and 4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) page, (2) c, or (3) redirec
Matching passage: CVE-2015-2064. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in DLGuard 5, 4.6, and 4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) page, (2) c, or (3) redirect parameter to index.php or (4) search field (searchTerm parameter) in the main page.
Near-miss passage: CVE-2015-2349. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in defaultnewsletter.php in SuperWebMailer 5.60.0.01190 and earlier allows remote attackers to inject arbitrary web script or HTML via the HTMLForm parameter.
Query: describe CVE-2015-1898
Matching passage: CVE-2015-1898. CWE: CWE-119. CVSS: 7.199999809265137. Stack-based buffer overflow in the FastBackMount process in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.11.1 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1897.
Near-miss passage: CVE-2015-9181. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, and SD 835, in a crypto API function, a buffer over-read can occur.