alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: playbook for alert: EDR alert: possible Elevated Execution with Prompt (T1548.004)
Matching passage: Playbook for T1548.004 Elevated Execution with Prompt. 1) Validate alert telemetry against T1548.004. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: privilege escalation. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may leverage the <code>AuthorizationExecuteWithPrivileges</code> API to escalate privileges by prompting the user for credentials.(Citation: AppleDocs AuthorizationExecuteWithPrivileges) The purpose of this API is to give application developers an easy way to perform operations with root privileges, such as for application installation or updating. This API does not validate that the p
Near-miss passage: Playbook for T1548.006 TCC Manipulation. Different response path focused on privilege escalation.
Query: exploit ImageMagick 6.x before 6.9.0-5 Beta allows remote attackers to cause a denial of service (infinite loop) via a crafted MIFF file.
Matching passage: CVE-2015-8901. CWE: CWE-835. CVSS: 6.5. ImageMagick 6.x before 6.9.0-5 Beta allows remote attackers to cause a denial of service (infinite loop) via a crafted MIFF file.
Near-miss passage: CVE-2015-6815. CWE: CWE-835. CVSS: 3.5. The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to cause a denial of service (infinite loop and guest crash) via unspecified vectors.
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) p
Matching passage: CVE-2015-2144. CWE: CWE-79. CVSS: 4.800000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) project name parameter to project.php; the (2) use_js parameter to user.php; the (3) use_js parameter to group.php; the (4) Description parameter to status.php; the (5) Description parameter to severity.php; the (6) Regex parameter to os.php; or the (7) Name parameter to database.php.
Near-miss passage: CVE-2015-9354. CWE: CWE-79. CVSS: 4.800000190734863. The gigpress plugin before 2.3.11 for WordPress has XSS.
Query: Sigma rule for Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy executi
Matching passage: Sigma rule: Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy executi. Logsource: windows / process_creation. Rule: title: Uncommon Child Process Of BgInfo.EXE id: aaf46cdc-934e-4284-b329-34aa701e3771 related: - id: 811f459f-9231-45d4-959a-0266c6311987 type: similar status: test description: Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Bginfo/ - https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/ author: Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community date: 2019-10-26 modified: 2023-08-16 tags: - attack.execution - attack.stealth - attack.t1059.005 - attack.t1218 - attack.t1202 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \bginfo.exe - \bginfo64.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detect PetitPotam coerced authentication activity.. Logsource: windows / security. Rule: title: Possible PetitPotam Coerce Authentication Attempt id: 1ce8c8a3-2723-48ed-8246-906ac91061a6 status: test description: Detect PetitPotam coerced authentication activity. references: - https://github.com/topotam/PetitPotam - https://github.com/splunk/security_content/blob/0dd6de32de2118b2818550df9e65255f4109a56d/detections/endpoint/petitpotam_network_share_access_request.yml author: Mauricio Velazco, Michael Haag date: 2021-09-02 modified: 2022-08-11 tags: - attack.credential-access - attack.t1187 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Detailed File Share" must be configured for Success/Failure detection: selection: EventID: 5145 ShareName|startswith: \\\\ ShareName|endswith: \IPC$ RelativeTargetName: lsarpc SubjectUserName: ANONYMOUS LOGON condition: selection falsepositives: - Unknown. Feedback welcomed. level: high
Query: Sigma rule for In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both cre
Matching passage: Sigma rule: In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both cre. Logsource: windows / process_creation. Rule: title: PUA - Mouse Lock Execution id: c9192ad9-75e5-43eb-8647-82a0a5b493e3 status: test description: In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents. references: - https://github.com/klsecservices/Publications/blob/657deb6a6eb6e00669afd40173f425fb49682eaa/Incident-Response-Analyst-Report-2020.pdf - https://sourceforge.net/projects/mouselock/ author: Cian Heasley date: 2020-08-13 modified: 2023-02-21 tags: - attack.credential-access - attack.collection - attack.t1056.002 logsource: product: windows category: process_creation detection: selection: - Product|contains: Mouse Lock - Company|contains: Misc314 - CommandLine|contains: Mouse Lock_ condition: selection falsepositives: - Legitimate uses of Mouse Lock software level: medium
Near-miss passage: Sigma rule: Detects the execution of renamed schtasks.exe binary, which is a legitimate Windows utility used for scheduling tasks. O. Logsource: windows / process_creation. Rule: title: Renamed Schtasks Execution id: f91e51c9-f344-4b32-969b-0b6f6b8537d4 status: experimental description: 'Detects the execution of renamed schtasks.exe binary, which is a legitimate Windows utility used for scheduling tasks. One of the very common persistence techniques is schedule malicious tasks using schtasks.exe. Since, it is heavily abused, it is also heavily monitored by security products. To evade detection, threat actors may rename the schtasks.exe binary to schedule their malicious tasks. ' references: - https://x.com/JangPr0/status/1932034543026065833 - https://ss64.com/nt/schtasks.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-27 tags: - attack.execution - attack.persistence - attack.privilege-escalation - attack.stealth - attack.t1036.003 - attack.t1053.005 logsource: category: process_creation product: windows detection: selection_cmd_operation: CommandLine|contains|windash: - ' /create ' - ' /delete ' - ' /query ' - ' /change ' - ' /run ' - ' /end ' selection_cmd_flags: CommandLine|contains|windash: - ' /tn ' - ' /tr ' - ' /sc ' - ' /st ' - ' /ru ' - ' /fo ' selection_pe: OriginalFileName: schtasks.exe filter_main_cmd: CommandLine|contains: schtasks filter_main_img: Image|endswith: \schtasks.exe condition: (all of selection_cmd_* and not filter_main_cmd) or (selection_pe and not filter_main_img) falsepositives: - Unlikely level: high
Query: detection rule: Detects execution of the builtin "del"/"erase" commands in order to delete files. Adversaries may delete files left behi
Matching passage: Sigma rule: Detects execution of the builtin "del"/"erase" commands in order to delete files. Adversaries may delete files left behi. Logsource: windows / process_creation. Rule: title: File Deletion Via Del id: 379fa130-190e-4c3f-b7bc-6c8e834485f3 status: test description: 'Detects execution of the builtin "del"/"erase" commands in order to delete files. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary''s footprint. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase author: frack113 date: 2022-01-15 modified: 2024-03-05 tags: - attack.stealth - attack.t1070.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_del: CommandLine|contains: - 'del ' - 'erase ' selection_flags: CommandLine|contains|windash: - ' -f' - ' -s' - ' -q' condition: all of selection_* falsepositives: - False positives levels will differ Depending on the environment. You can use a combination of ParentImage and other keywords from the CommandLine field to filter legitimate activity level: low
Near-miss passage: Sigma rule: Detects a suspicious child process of userinit. Logsource: windows / process_creation. Rule: title: Suspicious Userinit Child Process id: b655a06a-31c0-477a-95c2-3726b83d649d status: test description: Detects a suspicious child process of userinit references: - https://twitter.com/SBousseaden/status/1139811587760562176 author: Florian Roth (Nextron Systems), Samir Bousseaden (idea) date: 2019-06-17 modified: 2025-10-17 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \userinit.exe filter_main_netlogon: CommandLine|contains: \netlogon\ filter_main_explorer: - Image|endswith: \explorer.exe - OriginalFileName: explorer.exe - CommandLine: C:\Windows\Explorer.EXE filter_main_null: Image: null condition: selection and not 1 of filter_main_* falsepositives: - Administrative scripts level: medium
Query: risk of 389 Directory Server (formerly Fedora Directory Server) before 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSocket, which allows remote attackers to h
Matching passage: CVE-2015-3230. CWE: CWE-254. CVSS: 7.5. 389 Directory Server (formerly Fedora Directory Server) before 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSocket, which allows remote attackers to have unspecified impact by requesting to use a disabled cipher.
Near-miss passage: CVE-2015-5850. CWE: CWE-254. CVSS: 2.0999999046325684. AppleKeyStore in Apple iOS before 9 allows physically proximate attackers to reset the count of incorrect passcode attempts via a device backup.
Query: CVE similar to CVE-2015-3314
Matching passage: CVE-2015-3314. CWE: CWE-89. CVSS: 8.100000381469727. SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5.
Near-miss passage: CVE-2015-10014. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability classified as critical has been found in arekk uke. This affects an unknown part of the file lib/uke/finder.rb. The manipulation leads to sql injection. The identifier of the patch is 52fd3b2d0bc16227ef57b7b98a3658bb67c1833f. It is recommended to apply a patch to fix this issue. The identifier VDB-217485 was assigned to this vulnerability.
Query: vulnerability: Multiple use-after-free vulnerabilities in sound/soc/msm/qdsp6v2/msm-lsm-client.c in the Qualcomm sound driver in Android before 2016-10-05 on Nexus 5X, Nexus 6P, and Android One d
Matching passage: CVE-2015-8951. CWE: CWE-264. CVSS: 7.800000190734863. Multiple use-after-free vulnerabilities in sound/soc/msm/qdsp6v2/msm-lsm-client.c in the Qualcomm sound driver in Android before 2016-10-05 on Nexus 5X, Nexus 6P, and Android One devices allow attackers to gain privileges via a crafted application, aka Android internal bug 30142668 and Qualcomm internal bug CR 948902.
Near-miss passage: CVE-2015-1328. CWE: CWE-264. CVSS: 7.800000190734863. The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an arbitrary mount namespace.
Query: describe CVE-2015-8453
Matching passage: CVE-2015-8453. CWE: CWE-200. CVSS: 4.300000190734863. Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to bypass the ASLR protection mechanism via JIT data, a different vulnerability than CVE-2015-8409 and CVE-2015-8440.
Near-miss passage: CVE-2015-7761. CWE: CWE-200. CVSS: 5.0. Mail in Apple OS X before 10.11 does not properly recognize user preferences, which allows attackers to obtain sensitive information via an unspecified action during the printing of an e-mail message, a different vulnerability than CVE-2015-7760.
Query: rule covering Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure functi
Matching passage: Sigma rule: Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure functi. Logsource: windows / registry_event. Rule: title: HybridConnectionManager Service Installation - Registry id: ac8866c7-ce44-46fd-8c17-b24acff96ca8 status: test description: Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function. references: - https://twitter.com/Cyb3rWard0g/status/1381642789369286662 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2021-04-12 modified: 2022-11-27 tags: - attack.resource-development - attack.t1608 logsource: category: registry_event product: windows detection: selection1: TargetObject|contains: \Services\HybridConnectionManager selection2: EventType: SetValue Details|contains: Microsoft.HybridConnectionManager.Listener.exe condition: selection1 or selection2 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution traces of the WizardUpdate malware. WizardUpdate is a macOS trojan that attempts to infiltrate mac. Logsource: macos / process_creation. Rule: title: Potential WizardUpdate Malware Infection id: f68c4a4f-19ef-4817-952c-50dce331f4b0 status: test description: Detects the execution traces of the WizardUpdate malware. WizardUpdate is a macOS trojan that attempts to infiltrate macOS machines to steal data and it is associated with other types of malicious payloads, increasing the chances of multiple infections on a device. references: - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-c68a1fcbf7a3f80c87225d7fdc031f691e9f3b6a14a36754be00762bfe6eae97 - https://malpedia.caad.fkie.fraunhofer.de/details/osx.xcsset - https://www.microsoft.com/security/blog/2022/02/02/the-evolution-of-a-mac-trojan-updateagents-progression/ author: Tim Rauch (rule), Elastic (idea) date: 2022-10-17 tags: - attack.command-and-control logsource: category: process_creation product: macos detection: selection_1: Image|endswith: /sh CommandLine|contains|all: - '=$(curl ' - eval selection_2: Image|endswith: /curl CommandLine|contains: _intermediate_agent_ condition: 1 of selection_* falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-7770
Matching passage: CVE-2015-7770. CWE: CWE-20. CVSS: 5.0. Dell SonicWall TotalSecure TZ 100 devices with firmware before 5.9.1.0-22o allow remote attackers to cause a denial of service via a crafted packet.
Near-miss passage: CVE-2015-5144. CWE: CWE-20. CVSS: 4.300000190734863. Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator.
Query: exploit Integer overflow in the ff_ivi_init_planes function in libavcodec/ivi.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 allows remote attackers to cause a denia
Matching passage: CVE-2015-8364. CWE: CWE-189. CVSS: 6.800000190734863. Integer overflow in the ff_ivi_init_planes function in libavcodec/ivi.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via crafted image dimensions in Indeo Video Interactive data.
Near-miss passage: CVE-2015-7212. CWE: CWE-189. CVSS: 7.5. Integer overflow in the mozilla::layers::BufferTextureClient::AllocateForSurface function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code by triggering a graphics operation that requires a large texture allocation.
Query: describe CVE-2015-7387
Matching passage: CVE-2015-7387. CWE: CWE-89. CVSS: 7.5. ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do, as demonstrated by "SELECT 1;INSERT INTO." Fixed in Build 11200.
Near-miss passage: CVE-2015-7390. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in TestLink before 1.9.14 allows remote attackers to execute arbitrary SQL commands via the apikey parameter to lnl.php.
Query: patch priority for CVE-2015-9369
Matching passage: CVE-2015-9369. CWE: CWE-79. CVSS: 6.099999904632568. Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Near-miss passage: CVE-2015-4310. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Cisco Finesse 10.5(1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug IDs CSCuq82322, CSCut95853, and CSCuq73975.
Query: intelligence brief on T1578
Matching passage: T1578 Modify Cloud Compute Infrastructure. Tactics: defense impairment. Description: An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots. Permissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure. Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence.(Citation: Mandiant M-Trends 2020)
Near-miss passage: T1578.003 Delete Cloud Instance. Tactics: defense impairment. Description: An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence. Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable. An adversary may also [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and later terminate the instance after achieving their objectives.(Citation: Mandiant M-Trends 2020)
Query: patch priority for CVE-2015-8026
Matching passage: CVE-2015-8026. CWE: CWE-119. CVSS: 7.800000190734863. Heap-based buffer overflow in the verify_vbr_checksum function in exfatfsck in exfat-utils before 1.2.1 allows remote attackers to cause a denial of service (infinite loop) or possibly execute arbitrary code via a crafted filesystem.
Near-miss passage: CVE-2015-2520. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: Sigma rule for Detect when a user has reset their password in Azure AD
Matching passage: Sigma rule: Detect when a user has reset their password in Azure AD. Logsource: azure / auditlogs. Rule: title: Password Reset By User Account id: 340ee172-4b67-4fb4-832f-f961bdc1f3aa status: test description: Detect when a user has reset their password in Azure AD references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts author: YochanaHenderson, '@Yochana-H' date: 2022-08-03 tags: - attack.privilege-escalation - attack.initial-access - attack.persistence - attack.credential-access - attack.stealth - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: Category: UserManagement Status: Success Initiatedby: UPN filter: Target|contains: UPN ActivityType|contains: Password reset condition: selection and filter falsepositives: - If this was approved by System Administrator or confirmed user action. level: medium
Near-miss passage: Sigma rule: This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded. Logsource: windows / system. Rule: title: DHCP Server Error Failed Loading the CallOut DLL id: 75edd3fd-7146-48e5-9848-3013d7f0282c status: test description: This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded references: - https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html - https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx - https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx author: Dimitrios Slamaris, @atc_project (fix) date: 2017-05-15 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows service: system detection: selection: EventID: - 1031 - 1032 - 1034 Provider_Name: Microsoft-Windows-DHCP-Server condition: selection falsepositives: - Unknown level: high