alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Aversaries may use to interact with a remote network share using Server Message Block (SMB). This technique is used by p
Matching passage: Sigma rule: Aversaries may use to interact with a remote network share using Server Message Block (SMB). This technique is used by p. Logsource: windows / file_event. Rule: title: Writing Local Admin Share id: 4aafb0fa-bff5-4b9d-b99e-8093e659c65f status: test description: 'Aversaries may use to interact with a remote network share using Server Message Block (SMB). This technique is used by post-exploitation frameworks. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.002/T1021.002.md#atomic-test-4---execute-command-writing-output-to-local-admin-share author: frack113 date: 2022-01-01 modified: 2022-08-13 tags: - attack.privilege-escalation - attack.persistence - attack.lateral-movement - attack.t1546.002 logsource: product: windows category: file_event detection: selection: TargetFilename|contains|all: - \\\\127.0.0 - \ADMIN$\ condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: The "VSIISExeLauncher.exe" binary part of the Visual Studio/VS Code can be used to execute arbitrary binaries. Logsource: windows / process_creation. Rule: title: Use of VSIISExeLauncher.exe id: 18749301-f1c5-4efc-a4c3-276ff1f5b6f8 status: test description: The "VSIISExeLauncher.exe" binary part of the Visual Studio/VS Code can be used to execute arbitrary binaries references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/VSIISExeLauncher/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-09 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \VSIISExeLauncher.exe - OriginalFileName: VSIISExeLauncher.exe selection_cli: CommandLine|contains: - ' -p ' - ' -a ' condition: all of selection* falsepositives: - Unknown level: medium
Query: CWE for Exposed IOCTL with Insufficient Access Control
Matching passage: CWE-782 Exposed IOCTL with Insufficient Access Control. The product implements an IOCTL with functionality that should be restricted, but it does not properly enforce access control for the IOCTL.
Near-miss passage: CWE-248 Uncaught Exception. An exception is thrown from a function, but it is not caught.
Query: risk of An unspecified action handler in the management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticated users to read arbitrary 
Matching passage: CVE-2015-1488. CWE: CWE-200. CVSS: 4.0. An unspecified action handler in the management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticated users to read arbitrary files via unknown vectors.
Near-miss passage: CVE-2015-0170. CWE: CWE-200. CVSS: 2.0999999046325684. IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows local users to obtain sensitive information by reading cached data.
Query: risk of HP ArcSight Logger 6.0.0.7307.1, ArcSight Command Center 6.8.0.1896.0, and ArcSight Connector Appliance 6.4.0.6881.3 use the root account to execute files owned by the arcsight use
Matching passage: CVE-2015-6030. CWE: CWE-264. CVSS: 7.199999809265137. HP ArcSight Logger 6.0.0.7307.1, ArcSight Command Center 6.8.0.1896.0, and ArcSight Connector Appliance 6.4.0.6881.3 use the root account to execute files owned by the arcsight user, which might allow local users to gain privileges by leveraging arcsight account access.
Near-miss passage: CVE-2015-0223. CWE: CWE-264. CVSS: 5.0. Unspecified vulnerability in Apache Qpid 0.30 and earlier allows remote attackers to bypass access restrictions on qpidd via unknown vectors, related to 0-10 connection handling.
Query: risk of Cross-site request forgery (CSRF) vulnerability in the SOAP API endpoints of the web-services directory in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to hijack the
Matching passage: CVE-2015-0705. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the SOAP API endpoints of the web-services directory in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts, aka Bug ID CSCus97494.
Near-miss passage: CVE-2015-4349. CWE: CWE-352. CVSS: 5.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Spider Contacts module for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete contact categories via unspecified vectors.
Query: vulnerability: The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit parameter.
Matching passage: CVE-2015-9437. CWE: CWE-352. CVSS: 6.5. The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit parameter.
Near-miss passage: CVE-2015-5534. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Oxwall before 1.8 allow remote attackers to hijack the authentication of administrators for requests that (1) put the website under maintenance via the maintenance_enable parameter or (2) conduct cross-site scripting (XSS) attacks via the maintenance_text parameter to admin/pages/maintenance.
Query: detect Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "Remo in logs
Matching passage: Sigma rule: Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "Remo. Logsource: windows / process_creation. Rule: title: RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses id: a6fc3c46-23b8-4996-9ea2-573f4c4d88c5 related: - id: f65e22f9-819e-4f96-9c7b-498364ae7a25 type: similar - id: 38a7625e-b2cb-485d-b83d-aff137d859f4 type: similar - id: cacef8fc-9d3d-41f7-956d-455c6e881bc5 type: similar status: test description: Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "RemoteFXvGPUDisablement.exe" binary to run custom PowerShell code via module load-order hijacking. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md - https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1 author: frack113 date: 2021-07-13 modified: 2023-05-09 tags: - attack.stealth - attack.t1218 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - Invoke-ATHRemoteFXvGPUDisablementCommand - Invoke-ATHRemoteFXvGPUDisableme condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a suspicious child process of Script Event Consumer (scrcons.exe).. Logsource: windows / process_creation. Rule: title: Script Event Consumer Spawning Process id: f6d1dd2f-b8ce-40ca-bc23-062efb686b34 status: test description: Detects a suspicious child process of Script Event Consumer (scrcons.exe). references: - https://redcanary.com/blog/child-processes/ - https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-analytics-alert-reference/cortex-xdr-analytics-alert-reference/scrcons-exe-rare-child-process.html author: Sittikorn S date: 2021-06-21 modified: 2022-07-14 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \scrcons.exe Image|endswith: - \svchost.exe - \dllhost.exe - \powershell.exe - \pwsh.exe - \wscript.exe - \cscript.exe - \schtasks.exe - \regsvr32.exe - \mshta.exe - \rundll32.exe - \msiexec.exe - \msbuild.exe condition: selection falsepositives: - Unknown level: high
Query: write Sigma for Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool
Matching passage: Sigma rule: Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool. Logsource: windows / process_creation. Rule: title: HackTool - Inveigh Execution id: b99a1518-1ad5-4f65-bc95-1ffff97a8fd0 status: test description: Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool references: - https://github.com/Kevin-Robertson/Inveigh - https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-24 modified: 2023-02-04 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \Inveigh.exe - OriginalFileName: - \Inveigh.exe - \Inveigh.dll - Description: Inveigh - CommandLine|contains: - ' -SpooferIP' - ' -ReplyToIPs ' - ' -ReplyToDomains ' - ' -ReplyToMACs ' - ' -SnifferIP' condition: selection falsepositives: - Very unlikely level: critical
Near-miss passage: Sigma rule: Detects a copy command or a copy utility execution to or from an Admin share or remote. Logsource: windows / process_creation. Rule: title: Copy From Or To Admin Share Or Sysvol Folder id: 855bc8b5-2ae8-402e-a9ed-b889e6df1900 status: test description: Detects a copy command or a copy utility execution to or from an Admin share or remote references: - https://twitter.com/SBousseaden/status/1211636381086339073 - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view - https://www.elastic.co/guide/en/security/current/remote-file-copy-to-a-hidden-share.html - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/ author: Florian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali date: 2019-12-30 modified: 2025-10-22 tags: - attack.lateral-movement - attack.collection - attack.exfiltration - attack.t1039 - attack.t1048 - attack.t1021.002 logsource: category: process_creation product: windows detection: selection_target: CommandLine|contains: - \\\\*\\*$ - \Sysvol\ selection_other_tools: - Image|endswith: - \robocopy.exe - \xcopy.exe - OriginalFileName: - robocopy.exe - XCOPY.EXE selection_cmd_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cmd_cli: CommandLine|contains: copy selection_pwsh_img: - Image|contains: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - powershell_ise.exe - PowerShell.EXE - pwsh.dll selection_pwsh_cli: CommandLine|contains: - copy-item - 'copy ' - 'cpi ' - ' cp ' - 'move ' - ' move-item' - ' mi ' - ' mv ' condition: selection_target and (selection_other_tools or all of selection_cmd_* or all of selection_pwsh_*) falsepositives: - Administrative scripts level: medium
Query: alert when Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems sin
Matching passage: Sigma rule: Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems sin. Logsource: windows / process_creation. Rule: title: Suspicious Kernel Dump Using Dtrace id: 7124aebe-4cd7-4ccb-8df0-6d6b93c96795 status: test description: Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1 references: - https://twitter.com/0gtweet/status/1474899714290208777?s=12 - https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/dtrace author: Florian Roth (Nextron Systems) date: 2021-12-28 tags: - attack.discovery - attack.t1082 logsource: product: windows category: process_creation detection: selection_plain: Image|endswith: \dtrace.exe CommandLine|contains: lkd(0) selection_obfuscated: CommandLine|contains|all: - syscall:::return - lkd( condition: 1 of selection* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_dtrace_kernel_dump/info.yml
Near-miss passage: Sigma rule: Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. It was seen used by BlackCat. Logsource: windows / process_creation. Rule: title: DirLister Execution id: b4dc61f5-6cce-468e-a608-b48b469feaa2 status: test description: Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. It was seen used by BlackCat ransomware to create a list of accessible directories and files. references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1083/T1083.md - https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/ author: frack113 date: 2022-08-20 modified: 2023-02-04 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: DirLister.exe - Image|endswith: \DirLister.exe condition: selection falsepositives: - Legitimate use by users level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_dirlister_execution/info.yml simulation: - type: atomic-red-team name: Launch DirLister Executable technique: T1083 atomic_guid: c5bec457-43c9-4a18-9a24-fe151d8971b7
Query: CWE for J2EE Misconfiguration: Missing Custom Error Page
Matching passage: CWE-7 J2EE Misconfiguration: Missing Custom Error Page. The default error page of a web application should not display sensitive information about the product.
Near-miss passage: CWE-1095 Loop Condition Value Update within the Loop. The product uses a loop with a control flow condition based on a value that is updated within the body of the loop.
Query: exploit FortiOS 5.0.x before 5.0.12 and 5.2.x before 5.2.4 supports anonymous, export, RC4, and possibly other weak ciphers when using TLS to connect to FortiGuard servers, which allows ma
Matching passage: CVE-2015-2323. CWE: CWE-310. CVSS: 6.400000095367432. FortiOS 5.0.x before 5.0.12 and 5.2.x before 5.2.4 supports anonymous, export, RC4, and possibly other weak ciphers when using TLS to connect to FortiGuard servers, which allows man-in-the-middle attackers to spoof TLS content by modifying packets.
Near-miss passage: CVE-2015-2078. CWE: CWE-310. CVSS: 5.0. The SDK for Komodia Redirector with SSL Digestor, as used in Lavasoft Ad-Aware Web Companion 1.1.885.1766 and Ad-Aware AdBlocker (alpha) 1.3.69.1, Qustodio for Windows, Atom Security, Inc. StaffCop 5.8, and other products, does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers, a different vulnerability than CVE-2015-2077.
Query: playbook for alert: Suspicious Space after Filename execution detected on endpoint
Matching passage: Playbook for T1036.006 Space after Filename. 1) Validate alert telemetry against T1036.006. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system. For example, if there is a Mach-O executable file called <code>evil.bin</code>, when it is double clicked by a user, it will launc
Near-miss passage: Playbook for T1036.008 Masquerade File Type. Different response path focused on stealth.
Query: patch priority for CVE-2015-6602
Matching passage: CVE-2015-6602. CWE: CWE-20. CVSS: 9.300000190734863. libutils in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file, as demonstrated by an attack against use of libutils by libstagefright in Android 5.x.
Near-miss passage: CVE-2015-0980. CWE: CWE-20. CVSS: 9.0. Format string vulnerability in BACnOPCServer.exe in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via format string specifiers in a request.
Query: patch priority for CVE-2015-8817
Matching passage: CVE-2015-8817. CWE: CWE-125. CVSS: 5.5. QEMU (aka Quick Emulator) built to use 'address_space_translate' to map an address to a MemoryRegionSection is vulnerable to an OOB r/w access issue. It could occur while doing pci_dma_read/write calls. Affects QEMU versions >= 1.6.0 and <= 2.3.1. A privileged user inside guest could use this flaw to crash the guest instance resulting in DoS.
Near-miss passage: CVE-2015-8897. CWE: CWE-125. CVSS: 5.5. The SpliceImage function in MagickCore/transform.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (application crash) via a crafted png file.
Query: resource development using Generate Content
Matching passage: T1683 Generate Content. Tactics: resource development. Description: Adversaries may create or generate content to support targeting and operations. This content may be used to establish personas, impersonate known individuals or organizations, and support [Social Engineering](https://attack.mitre.org/techniques/T1684), fraud, or influence activities. Written materials, audio, images, video, or other media may be developed and tailored to the target and objective.(Citation: IBM AI-Generated Content) Content development may occur prior to or during an operation. Adversaries may develop or generate content in-house, source it through third parties, or produce it using AI-assisted tools. Adversaries may use AI to research targets, develop pretexts, and better understand the organizations and individuals they intend to target or deceive prior to generating content (i.e., [Query Public AI Services](https://attack.mitre.org/techniques/T1682)); for obtaining access to AI tools used in content generation, see [Artificial Intelligence](https://attack.mitre.org/techniques/T1588/007). Content may be leveraged in support of techniques such as [Phishing](https://attack.mitre.org/techniques/T1566), [Phishing for Information](https://attack.mitre.org/techniques/T1598), [Social Engineering](https://attack.mitre.org/techniques/T1684), [Financial Theft](https://attack.mitre.org/techniques/T1657), or [Establish Accounts](https://attack.mitre.org/techniques/T1585). Generated or developed content does not include malicious code or scripts (i.e., [Develop Capabilities](https://attack.mitre.org/techniques/T1587) and [Artificial Intelligence](https://attack.mitre.org/techniques/T1588/007)).
Near-miss passage: T1683.002 Audio-Visual Content. Tactics: resource development. Description: Adversaries may create or manipulate audio, image, and video content to support targeting and malicious operations. Adversaries may also use synthetic voice recordings, real-time altered audio or video during live interactions, fabricated profile photos and identity documents, or video content depicting fabricated or impersonated individuals.(Citation: Nov AI Threat Tracker) Content may be produced manually through editing tools, generated using AI-assisted tools, or produced using third-party synthetic services.(Citation: FBI 2025 AI Generate Content)(Citation: Europol Deepfakes) AI-assisted tools have enabled adversaries to produce synthetic media at scale and generate content that is more difficult to identify as inauthentic. Audio-visual content produced through these methods may be used in support of other techniques, such as [Phishing](https://attack.mitre.org/techniques/T1660), [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003), [Phishing for Information](https://attack.mitre.org/techniques/T1598), [Internal Spearphishing](https://attack.mitre.org/techniques/T1534), [Social Engineering](https://attack.mitre.org/techniques/T1684), [Financial Theft](https://attack.mitre.org/techniques/T1657), or [Establish Accounts](https://attack.mitre.org/techniques/T1585).
Query: detect Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions) in logs
Matching passage: Sigma rule: Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions). Logsource: windows / process_creation. Rule: title: Suspicious SysAidServer Child id: 60bfeac3-0d35-4302-8efb-1dd16f715bc6 status: test description: Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions) references: - https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/ author: Florian Roth (Nextron Systems) date: 2022-08-26 tags: - attack.lateral-movement - attack.t1210 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \java.exe - \javaw.exe ParentCommandLine|contains: SysAidServer condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detect scenarios where a potentially unauthorized application or user is modifying the system time.. Logsource: windows / security. Rule: title: Unauthorized System Time Modification id: faa031b5-21ed-4e02-8881-2591f98d82ed status: test description: Detect scenarios where a potentially unauthorized application or user is modifying the system time. references: - Private Cuckoo Sandbox (from many years ago, no longer have hash, NDA as well) - Live environment caused by malware - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4616 author: '@neu5ron' date: 2019-02-05 modified: 2025-12-03 tags: - attack.stealth - attack.t1070.006 logsource: product: windows service: security definition: 'Requirements: Audit Policy : System > Audit Security State Change, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\System\Audit Security State Change' detection: selection: EventID: 4616 filter_main_svchost: ProcessName: C:\Windows\System32\svchost.exe SubjectUserSid: S-1-5-19 filter_optional_vmtools: ProcessName: - C:\Program Files\VMware\VMware Tools\vmtoolsd.exe - C:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exe - C:\Windows\System32\VBoxService.exe - C:\Windows\System32\oobe\msoobe.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - HyperV or other virtualization technologies with binary not listed in filter portion of detection level: low