alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Unrestricted file upload vulnerability in Berta CMS allows remote attackers to execute arbitrary code by uploading a crafted image file with an executable extension, then accessing
Matching passage: CVE-2015-2780. CWE: CWE-434. CVSS: 9.800000190734863. Unrestricted file upload vulnerability in Berta CMS allows remote attackers to execute arbitrary code by uploading a crafted image file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.
Near-miss passage: CVE-2015-7571. CWE: CWE-434. CVSS: 7.800000190734863. Unrestricted file upload vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
Query: risk of The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remot
Matching passage: CVE-2015-2808. CWE: CWE-327. CVSS: 3.700000047683716. The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.
Near-miss passage: CVE-2015-0226. CWE: CWE-327. CVSS: 7.5. Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487.
Query: rule covering Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes
Matching passage: Sigma rule: Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes. Logsource: windows / dns_query. Rule: title: DNS Query for Anonfiles.com Domain - Sysmon id: 065cceea-77ec-4030-9052-fc0affea7110 related: - id: 29f171d7-aa47-42c7-9c7b-3c87938164d9 type: similar status: test description: Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes references: - https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte author: pH-T (Nextron Systems) date: 2022-07-15 modified: 2023-01-16 tags: - attack.exfiltration - attack.t1567.002 logsource: product: windows category: dns_query detection: selection: QueryName|contains: .anonfiles.com condition: selection falsepositives: - Rare legitimate access to anonfiles.com level: high
Near-miss passage: Sigma rule: Detects the creation of a new office macro files on the system via an application (browser, mail client). This can help. Logsource: windows / file_event. Rule: title: Office Macro File Download id: 0e29e3a7-1ad8-40aa-b691-9f82ecd33d66 related: - id: 91174a41-dc8f-401b-be89-7bfc140612a0 type: similar status: test description: 'Detects the creation of a new office macro files on the system via an application (browser, mail client). This can help identify potential malicious activity, such as the download of macro-enabled documents that could be used for exploitation. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference author: Nasreddine Bencherchali (Nextron Systems) date: 2022-01-23 modified: 2025-10-29 tags: - attack.initial-access - attack.t1566.001 logsource: category: file_event product: windows detection: selection_processes: Image|endswith: - \RuntimeBroker.exe - \outlook.exe - \thunderbird.exe - \brave.exe - \chrome.exe - \firefox.exe - \iexplore.exe - \maxthon.exe - \MicrosoftEdge.exe - \msedge.exe - \msedgewebview2.exe - \opera.exe - \safari.exe - \seamonkey.exe - \vivaldi.exe - \whale.exe selection_ext: - TargetFilename|endswith: - .docm - .dotm - .xlsm - .xltm - .potm - .pptm - TargetFilename|contains: - .docm:Zone - .dotm:Zone - .xlsm:Zone - .xltm:Zone - .potm:Zone - .pptm:Zone condition: all of selection_* falsepositives: - Legitimate macro files downloaded from the internet - Legitimate macro files sent as attachments via emails level: low
Query: exploit Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explore
Matching passage: CVE-2015-6147. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6149.
Near-miss passage: CVE-2015-5785. CWE: CWE-119. CVSS: 6.800000190734863. Apple QuickTime before 7.7.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-5786.
Query: rule covering Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes. Tools like ProcessHacker an
Matching passage: Sigma rule: Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes. Tools like ProcessHacker an. Logsource: windows / image_load. Rule: title: Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded id: bdc64095-d59a-42a2-8588-71fd9c9d9abc related: - id: 0e277796-5f23-4e49-a490-483131d4f6e1 type: similar status: test description: 'Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes. Tools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll. As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker''s machine. ' references: - https://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump - https://www.pinvoke.net/default.aspx/dbghelp/MiniDumpWriteDump.html - https://medium.com/@fsx30/bypass-edrs-memory-protection-introduction-to-hooking-2efb21acffd6 author: Perez Diego (@darkquassar), oscd.community, Ecco date: 2019-10-27 modified: 2022-12-09 tags: - attack.credential-access - attack.t1003.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: - \dbghelp.dll - \dbgcore.dll Signed: 'false' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of system utilities to discover files and directories. Logsource: macos / process_creation. Rule: title: File and Directory Discovery - MacOS id: 089dbdf6-b960-4bcc-90e3-ffc3480c20f6 status: test description: Detects usage of system utilities to discover files and directories references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2022-11-25 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: macos detection: select_file_with_asterisk: Image: /usr/bin/file CommandLine|re: (.){200,} select_recursive_ls: Image: /bin/ls CommandLine|contains: -R select_find_execution: Image: /usr/bin/find select_mdfind_execution: Image: /usr/bin/mdfind select_tree_execution|endswith: Image: /tree condition: 1 of select* falsepositives: - Legitimate activities level: informational
Query: risk of Buffer overflow in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe
Matching passage: CVE-2015-8415. CWE: CWE-119. CVSS: 10.0. Buffer overflow in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-3743. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Query: actor TTPs: Time Providers
Matching passage: T1547.003 Time Providers. Tactics: persistence, privilege escalation. Description: Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.(Citation: Microsoft W32Time Feb 2018) W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients.(Citation: Microsoft TimeProvider) Time providers are implemented as dynamic-link libraries (DLLs) that are registered in the subkeys of `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders\`.(Citation: Microsoft TimeProvider) The time provider manager, directed by the service control manager, loads and starts time providers listed and enabled under this key at system startup and/or whenever parameters are changed.(Citation: Microsoft TimeProvider) Adversaries may abuse this architecture to establish persistence, specifically by creating a new arbitrarily named subkey pointing to a malicious DLL in the `DllName` value. Administrator privileges are required for time provider registration, though execution will run in context of the Local Service account.(Citation: Github W32Time Oct 2017)
Near-miss passage: T1547.012 Print Processors. Tactics: persistence, privilege escalation. Description: Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation. Print processors are DLLs that are loaded by the print spooler service, `spoolsv.exe`, during boot.(Citation: Microsoft Intro Print Processors) Adversaries may abuse the print spooler service by adding print processors that load malicious DLLs at startup. A print processor can be installed through the <code>AddPrintProcessor</code> API call with an account that has <code>SeLoadDriverPrivilege</code> enabled. Alternatively, a print processor can be registered to the print spooler service by adding the <code>HKLM\SYSTEM\\[CurrentControlSet or ControlSet001]\Control\Print\Environments\\[Windows architecture: e.g., Windows x64]\Print Processors\\[user defined]\Driver</code> Registry key that points to the DLL. For the malicious print processor to be correctly installed, the payload must be located in the dedicated system print-processor directory, that can be found with the <code>GetPrintProcessorDirectory</code> API call, or referenced via a relative path from this directory.(Citation: Microsoft AddPrintProcessor May 2018) After the print processors are installed, the print spooler service, which starts during boot, must be restarted in order for them to run.(Citation: ESET PipeMon May 2020) The print spooler service runs under SYSTEM level permissions, therefore print processors installed by an adversary may run under elevated privileges.
Query: alert when Detects the mount of an ISO image on an endpoint
Matching passage: Sigma rule: Detects the mount of an ISO image on an endpoint. Logsource: windows / security. Rule: title: ISO Image Mounted id: 0248a7bc-8a9a-4cd8-a57e-3ae8e073a073 status: test description: Detects the mount of an ISO image on an endpoint references: - https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/malicious-spam-campaign-uses-iso-image-files-to-deliver-lokibot-and-nanocore - https://www.proofpoint.com/us/blog/threat-insight/threat-actor-profile-ta2719-uses-colorful-lures-deliver-rats-local-languages - https://twitter.com/MsftSecIntel/status/1257324139515269121 - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image author: Syed Hasan (@syedhasan009) date: 2021-05-29 modified: 2023-11-09 tags: - attack.initial-access - attack.t1566.001 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Audit Removable Storage" must be configured for Success/Failure detection: selection: EventID: 4663 ObjectServer: Security ObjectType: File ObjectName|startswith: \Device\CdRom filter_main_generic: ObjectName: - \Device\CdRom0\autorun.ico - \Device\CdRom0\setup.exe - \Device\CdRom0\setup64.exe condition: selection and not 1 of filter_main_* falsepositives: - Software installation ISO files level: medium
Near-miss passage: Sigma rule: Detects when a new credential is added to an existing application. Any additional credentials added outside of expected. Logsource: azure / auditlogs. Rule: title: Added Credentials to Existing Application id: cbb67ecc-fb70-4467-9350-c910bdf7c628 status: test description: Detects when a new credential is added to an existing application. Any additional credentials added outside of expected processes could be a malicious actor using those credentials. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-credentials author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' date: 2022-05-26 modified: 2025-07-18 tags: - attack.privilege-escalation - attack.t1098.001 - attack.persistence logsource: product: azure service: auditlogs detection: selection: properties.message: - Update application – Certificates and secrets management - Update Service principal/Update Application condition: selection falsepositives: - When credentials are added/removed as part of the normal working hours/workflows level: high
Query: risk of The liveforms plugin before 3.2.0 for WordPress has SQL injection.
Matching passage: CVE-2015-9301. CWE: CWE-89. CVSS: 9.800000190734863. The liveforms plugin before 3.2.0 for WordPress has SQL injection.
Near-miss passage: CVE-2015-1442. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in views/zero_transact_user.php in the administrative backend in ZeroCMS 1.3.3, 1.3.2, and earlier allows remote authenticated users to execute arbitrary SQL commands via the user_id parameter in a Modify Account action. NOTE: The article_id parameter to zero_view_article.php vector is already covered by CVE-2014-4034.
Query: patch priority for CVE-2015-8466
Matching passage: CVE-2015-8466. CWE: CWE-20. CVSS: 7.400000095367432. Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request that lacks a Date header.
Near-miss passage: CVE-2015-7691. CWE: CWE-20. CVSS: 7.5. The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted packets containing particular autokey operations. NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.
Query: indicators of Archive via Library
Matching passage: T1560.002 Archive via Library. Tactics: collection. Description: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including [Python](https://attack.mitre.org/techniques/T1059/006) rarfile (Citation: PyPI RAR), libzip (Citation: libzip), and zlib (Citation: Zlib Github). Most libraries include functionality to encrypt and/or compress data. Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. Note that the libraries are different from the utilities. The libraries can be linked against when compiling, while the utilities require spawning a subshell, or a similar execution mechanism.
Near-miss passage: T1560 Archive Collected Data. Tactics: collection. Description: An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.(Citation: DOJ GRU Indictment Jul 2018) Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender. Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.
Query: vulnerability: The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via a quiz name.
Matching passage: CVE-2015-9389. CWE: CWE-79. CVSS: 5.400000095367432. The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via a quiz name.
Near-miss passage: CVE-2015-2046. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in MantisBT 1.2.13 and later before 1.2.20.
Query: Sigma YAML for windows / application
Matching passage: Sigma rule: Detects command execution via ScreenConnect RMM. Logsource: windows / application. Rule: title: Remote Access Tool - ScreenConnect Command Execution id: 076ebe48-cc05-4d8f-9d41-89245cd93a14 related: - id: b1f73849-6329-4069-bc8f-78a604bb8b23 type: similar status: test description: Detects command execution via ScreenConnect RMM references: - https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling - https://github.com/SigmaHQ/sigma/pull/4467 author: Ali Alwashali date: 2023-10-10 tags: - attack.execution - attack.t1059.003 logsource: service: application product: windows detection: selection: Provider_Name: ScreenConnect EventID: 200 Data|contains: Executed command of length condition: selection falsepositives: - Legitimate use of ScreenConnect level: low
Near-miss passage: Sigma rule: Detects potential malicious modification of the property value of IsCredGuardEnabled from HKLM:\SYSTEM\CurrentControlSet. Logsource: windows / registry_event. Rule: title: Wdigest CredGuard Registry Modification id: 1a2d6c47-75b0-45bd-b133-2c0be75349fd status: test description: 'Detects potential malicious modification of the property value of IsCredGuardEnabled from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to disable Cred Guard on a system. This is usually used with UseLogonCredential to manipulate the caching credentials. ' references: - https://teamhydra.blog/2020/08/25/bypassing-credential-guard/ author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2019-08-25 modified: 2021-11-27 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: \IsCredGuardEnabled condition: selection falsepositives: - Unknown level: high
Query: alert when Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePo
Matching passage: Sigma rule: Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePo. Logsource: linux / process_creation. Rule: title: PUA - TruffleHog Execution - Linux id: d7a650c4-226c-451e-948f-cc490db506aa related: - id: 44030449-b0df-4c94-aae1-502359ab28ee type: similar status: experimental description: 'Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously. While it is a legitimate tool, intended for use in CI pipelines and security assessments, It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information. ' references: - https://github.com/trufflesecurity/trufflehog - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-09-24 tags: - attack.discovery - attack.credential-access - attack.t1083 - attack.t1552.001 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /trufflehog selection_cli_platform: CommandLine|contains: - ' docker --image ' - ' Git ' - ' GitHub ' - ' Jira ' - ' Slack ' - ' Confluence ' - ' SharePoint ' - ' s3 ' - ' gcs ' selection_cli_verified: CommandLine|contains: ' --results=verified' condition: selection_img or all of selection_cli_* falsepositives: - Legitimate use of TruffleHog by security teams or developers. level: medium
Near-miss passage: Sigma rule: Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are prog. Logsource: windows / file_event. Rule: title: Suspicious Screensaver Binary File Creation id: 97aa2e88-555c-450d-85a6-229bcd87efb8 status: test description: 'Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.002/T1546.002.md author: frack113 date: 2021-12-29 modified: 2022-11-08 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.002 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: .scr filter_generic: Image|endswith: - \Kindle.exe - \Bin\ccSvcHst.exe filter_tiworker: Image|endswith: \TiWorker.exe TargetFilename|endswith: \uwfservicingscr.scr condition: selection and not 1 of filter_* falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-4432
Matching passage: CVE-2015-4432. CWE: CWE-119. CVSS: 10.0. Heap-based buffer overflow in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3135 and CVE-2015-5118.
Near-miss passage: CVE-2015-5867. CWE: CWE-119. CVSS: 9.300000190734863. IOHIDFamily in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.