alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit The decode_ihdr_chunk function in libavcodec/pngdec.c in FFmpeg before 2.7.2 does not enforce uniqueness of the IHDR (aka image header) chunk in a PNG image, which allows remote at
Matching passage: CVE-2015-6818. CWE: CWE-17. CVSS: 7.5. The decode_ihdr_chunk function in libavcodec/pngdec.c in FFmpeg before 2.7.2 does not enforce uniqueness of the IHDR (aka image header) chunk in a PNG image, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted image with two or more of these chunks.
Near-miss passage: CVE-2015-1084. CWE: CWE-17. CVSS: 5.0. The user interface in WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, does not display URLs consistently, which makes it easier for remote attackers to conduct phishing attacks via a crafted URL.
Query: common weakness: Path Equivalence: ' filename' (Leading Space)
Matching passage: CWE-47 Path Equivalence: ' filename' (Leading Space). The product accepts path input in the form of leading space (' filedir') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Near-miss passage: CWE-27 Path Traversal: 'dir/../../filename'. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal ../ sequences that can resolve to a location that is outside of that directory.
Query: detect Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as in logs
Matching passage: Sigma rule: Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as. Logsource: windows / process_creation. Rule: title: Sysinternals PsSuspend Suspicious Execution id: 4beb6ae0-f85b-41e2-8f18-8668abc8af78 related: - id: 48bbc537-b652-4b4e-bd1d-281172df448f type: similar status: test description: Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as AV or EDR to bypass defenses references: - https://learn.microsoft.com/en-us/sysinternals/downloads/pssuspend - https://twitter.com/0gtweet/status/1638069413717975046 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-23 modified: 2026-06-29 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: pssuspend.exe - Image|endswith: - \pssuspend.exe - \pssuspend64.exe - \pssuspend64a.exe selection_cli: CommandLine|contains: msmpeng.exe condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / process_creation. Rule: title: Remote Access Tool - Anydesk Execution From Suspicious Folder id: 065b00ca-5d5c-4557-ac95-64a6d0b64d86 related: - id: b52e84a3-029e-4529-b09b-71d19dd27e94 type: similar status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows - https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/ author: Florian Roth (Nextron Systems) date: 2022-05-20 modified: 2025-02-24 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \AnyDesk.exe - \AnyDeskMSI.exe - Description: AnyDesk - Product: AnyDesk - Company: AnyDesk Software GmbH filter: Image|contains: - \AppData\ - Program Files (x86)\AnyDesk - Program Files\AnyDesk condition: selection and not filter falsepositives: - Legitimate use of AnyDesk from a non-standard folder level: high
Query: explain T1102.003 One-Way Communication
Matching passage: T1102.003 One-Way Communication. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Near-miss passage: T1102 Web Service. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: Broadcom BirdyClient Microsoft Graph API 2024) Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
Query: vulnerability: PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary f
Matching passage: CVE-2015-3411. CWE: CWE-20. CVSS: 6.5. PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument load method, (2) the xmlwriter_open_uri function, (3) the finfo_file function, or (4) the hash_hmac_file function, as demonstrated by a filename\0.xml attack that bypasses an intended configuration in which client users may read only .xml files.
Near-miss passage: CVE-2015-2187. CWE: CWE-20. CVSS: 5.0. The dissect_atn_cpdlc_heur function in asn1/atn-cpdlc/packet-atn-cpdlc-template.c in the ATN-CPDLC dissector in Wireshark 1.12.x before 1.12.4 does not properly follow the TRY/ENDTRY code requirements, which allows remote attackers to cause a denial of service (stack memory corruption and application crash) via a crafted packet.
Query: alert when Detects Obfuscated use of Environment Variables to execute PowerShell
Matching passage: Sigma rule: Detects Obfuscated use of Environment Variables to execute PowerShell. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation VAR+ Launcher - PowerShell id: 0adfbc14-0ed1-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of Environment Variables to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|re: cmd.{0,5}(?:/c|/r)(?:\s|)"set\s[a-zA-Z]{3,6}.*(?:\{\d\}){1,}\\"\s+?-f(?:.*\)){1,}.*" condition: selection_4104 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation att. Logsource: nginx. Rule: title: Nginx Core Dump id: 59ec40bb-322e-40ab-808d-84fa690d7e56 status: test description: Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts. references: - https://docs.nginx.com/nginx/admin-guide/monitoring/debugging/#enabling-core-dumps - https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/ author: Florian Roth (Nextron Systems) date: 2021-05-31 modified: 2023-05-08 tags: - attack.impact - attack.t1499.004 logsource: service: nginx detection: keywords: - exited on signal 6 (core dumped) condition: keywords falsepositives: - Serious issues with a configuration or plugin level: high
Query: vulnerability: Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 store cleartext OPC User credentials in a configuratio
Matching passage: CVE-2015-0999. CWE: CWE-200. CVSS: 2.0999999046325684. Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 store cleartext OPC User credentials in a configuration file, which allows local users to obtain sensitive information by reading this file.
Near-miss passage: CVE-2015-1000007. CWE: CWE-200. CVSS: 7.5. Remote file download vulnerability in wptf-image-gallery v1.03
Query: rule covering Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)
Matching passage: Sigma rule: Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22). Logsource: windows / file_event. Rule: title: UAC Bypass Using Consent and Comctl32 - File id: 62ed5b55-f991-406a-85d9-e8e8fdf18789 status: test description: Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-23 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: C:\Windows\System32\consent.exe.@ TargetFilename|endswith: \comctl32.dll condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects processes creating temp files related to PCRE.NET package. Logsource: windows / file_event. Rule: title: PCRE.NET Package Temp Files id: 6e90ae7a-7cd3-473f-a035-4ebb72d961da status: test description: Detects processes creating temp files related to PCRE.NET package references: - https://twitter.com/rbmaslen/status/1321859647091970051 - https://twitter.com/tifkin_/status/1321916444557365248 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-29 modified: 2022-10-09 tags: - attack.execution - attack.t1059 logsource: category: file_event product: windows detection: selection: TargetFilename|contains: \AppData\Local\Temp\ba9ea7344a4a5f591d6e5dc32a13494b\ condition: selection falsepositives: - Unknown level: high
Query: exploit QEMU (aka Quick Emulator) built with the NE2000 device emulation support is vulnerable to an OOB r/w access issue. It could occur while performing 'ioport' r/w operations. A privil
Matching passage: CVE-2015-8743. CWE: CWE-125. CVSS: 7.099999904632568. QEMU (aka Quick Emulator) built with the NE2000 device emulation support is vulnerable to an OOB r/w access issue. It could occur while performing 'ioport' r/w operations. A privileged (CAP_SYS_RAWIO) user/process could use this flaw to leak or corrupt QEMU memory bytes.
Near-miss passage: CVE-2015-8984. CWE: CWE-125. CVSS: 5.900000095367432. The fnmatch function in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash) via a malformed pattern, which triggers an out-of-bounds read.
Query: risk of I-O DATA DEVICE NP-BBRM routers allow remote attackers to cause a denial of service (SSDP reflection) via UPnP requests.
Matching passage: CVE-2015-0869. CWE: CWE-264. CVSS: 7.800000190734863. I-O DATA DEVICE NP-BBRM routers allow remote attackers to cause a denial of service (SSDP reflection) via UPnP requests.
Near-miss passage: CVE-2015-3185. CWE: CWE-264. CVSS: 4.300000190734863. The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior.
Query: campaign using Network Provider DLL
Matching passage: T1556.008 Network Provider DLL. Tactics: defense impairment, persistence, credential access. Description: Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process. Network provider DLLs allow Windows to interface with specific network protocols and can also support add-on credential management functions.(Citation: Network Provider API) During the logon process, Winlogon (the interactive logon module) sends credentials to the local `mpnotify.exe` process via RPC. The `mpnotify.exe` process then shares the credentials in cleartext with registered credential managers when notifying that a logon event is happening.(Citation: NPPSPY - Huntress)(Citation: NPPSPY Video)(Citation: NPLogonNotify) Adversaries can configure a malicious network provider DLL to receive credentials from `mpnotify.exe`.(Citation: NPPSPY) Once installed as a credential manager (via the Registry), a malicious DLL can receive and save credentials each time a user logs onto a Windows workstation or domain via the `NPLogonNotify()` function.(Citation: NPLogonNotify) Adversaries may target planting malicious network provider DLLs on systems known to have increased logon activity and/or administrator logon activity, such as servers and domain controllers.(Citation: NPPSPY - Huntress)
Near-miss passage: T1556.009 Conditional Access Policies. Tactics: defense impairment, persistence, credential access. Description: Adversaries may disable or modify conditional access policies to enable persistent access to compromised accounts. Conditional access policies are additional verifications used by identity providers and identity and access management systems to determine whether a user should be granted access to a resource. For example, in Entra ID, Okta, and JumpCloud, users can be denied access to applications based on their IP address, device enrollment status, and use of multi-factor authentication.(Citation: Microsoft Conditional Access)(Citation: JumpCloud Conditional Access Policies)(Citation: Okta Conditional Access Policies) In some cases, identity providers may also support the use of risk-based metrics to deny sign-ins based on a variety of indicators. In AWS and GCP, IAM policies can contain `condition` attributes that verify arbitrary constraints such as the source IP, the date the request was made, and the nature of the resources or regions being requested.(Citation: AWS IAM Conditions)(Citation: GCP IAM Conditions) These measures help to prevent compromised credentials from resulting in unauthorized access to data or resources, as well as limit user permissions to only those required. By modifying conditional access policies, such as adding additional trusted IP ranges, removing [Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006) requirements, or allowing additional [Unused/Unsupported Cloud Regions](https://attack.mitre.org/techniques/T1535), adversaries may be able to ensure persistent access to accounts and circumvent defensive measures.
Query: describe CVE-2015-2489
Matching passage: CVE-2015-2489. CWE: CWE-264. CVSS: 4.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to gain privileges via a crafted web site, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-5645. CWE: CWE-264. CVSS: 6.5. ICZ MATCHA SNS before 1.3.7 allows remote authenticated users to obtain administrative privileges via unspecified vectors.
Query: Sigma rule for Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This te
Matching passage: Sigma rule: Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This te. Logsource: windows / registry_set. Rule: title: Potentially Suspicious Command Executed Via Run Dialog Box - Registry id: a7df0e9e-91a5-459a-a003-4cde67c2ff5d related: - id: f9d091f6-f1c7-4873-a24f-050b4a02b4dd type: derived status: test description: 'Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps. ' references: - https://medium.com/@ahmed.moh.farou2/fake-captcha-campaign-on-arabic-pirated-movie-sites-delivers-lumma-stealer-4f203f7adabf - https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71 - https://www.forensafe.com/blogs/runmrukey.html - https://redcanary.com/blog/threat-intelligence/intelligence-insights-october-2024/ author: Ahmed Farouk, Nasreddine Bencherchali date: 2024-11-01 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: registry_set detection: selection_key: TargetObject|contains: \Microsoft\Windows\CurrentVersion\Explorer\RunMRU selection_powershell_command: Details|contains: - powershell - pwsh selection_powershell_susp_keywords: Details|contains: - ' -e ' - ' -ec ' - ' -en ' - ' -enc ' - ' -enco' - ftp - Hidden - http - iex - Invoke- selection_wmic_command: Details|contains: wmic selection_wmic_susp_keywords: Details|contains: - shadowcopy - process call create condition: selection_key and (all of selection_powershell_* or all of selection_wmic_*) falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential evasion or obfuscation attempts using bogus path traversal via the commandline. Logsource: windows / process_creation. Rule: title: Potential Command Line Path Traversal Evasion Attempt id: 1327381e-6ab0-4f38-b583-4c1b8346a56b status: test description: Detects potential evasion or obfuscation attempts using bogus path traversal via the commandline references: - https://twitter.com/hexacorn/status/1448037865435320323 - https://twitter.com/Gal_B1t/status/1062971006078345217 author: Christian Burkard (Nextron Systems) date: 2021-10-26 modified: 2023-03-29 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection_1: Image|contains: \Windows\ CommandLine|contains: - \..\Windows\ - \..\System32\ - \..\..\ selection_2: CommandLine|contains: .exe\..\ filter_optional_google_drive: CommandLine|contains: \Google\Drive\googledrivesync.exe\..\ filter_optional_citrix: CommandLine|contains: \Citrix\Virtual Smart Card\Citrix.Authentication.VirtualSmartcard.Launcher.exe\..\ condition: 1 of selection_* and not 1 of filter_optional_* falsepositives: - Google Drive - Citrix level: medium
Query: CVE similar to CVE-2015-5064
Matching passage: CVE-2015-5064. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in MySql Lite Administrator (mysql-lite-administrator) beta-1 allow remote attackers to inject arbitrary web script or HTML via the table_name parameter to (1) tabella.php, (2) coloni.php, or (3) insert.php or (4) num_row parameter to coloni.php.
Near-miss passage: CVE-2015-0896. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in eXtplorer before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: alert when Detect set Notification_Suppress to 1 to disable the Windows security center notification
Matching passage: Sigma rule: Detect set Notification_Suppress to 1 to disable the Windows security center notification. Logsource: windows / registry_set. Rule: title: Activate Suppression of Windows Security Center Notifications id: 0c93308a-3f1b-40a9-b649-57ea1a1c1d63 status: test description: Detect set Notification_Suppress to 1 to disable the Windows security center notification references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md author: frack113 date: 2022-08-19 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration\Notification_Suppress Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both cre. Logsource: windows / process_creation. Rule: title: PUA - Mouse Lock Execution id: c9192ad9-75e5-43eb-8647-82a0a5b493e3 status: test description: In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents. references: - https://github.com/klsecservices/Publications/blob/657deb6a6eb6e00669afd40173f425fb49682eaa/Incident-Response-Analyst-Report-2020.pdf - https://sourceforge.net/projects/mouselock/ author: Cian Heasley date: 2020-08-13 modified: 2023-02-21 tags: - attack.credential-access - attack.collection - attack.t1056.002 logsource: product: windows category: process_creation detection: selection: - Product|contains: Mouse Lock - Company|contains: Misc314 - CommandLine|contains: Mouse Lock_ condition: selection falsepositives: - Legitimate uses of Mouse Lock software level: medium