alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.
Matching passage: Sigma rule: Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.. Logsource: windows / process_creation. Rule: title: Scheduled Task Creation Via Schtasks.EXE id: 92626ddd-662c-49e3-ac59-f6535f12d189 status: test description: Detects the creation of scheduled tasks by user accounts via the "schtasks" utility. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create author: Florian Roth (Nextron Systems) date: 2019-01-16 modified: 2025-10-22 tags: - attack.execution - attack.persistence - attack.privilege-escalation - attack.t1053.005 - attack.s0111 - car.2013-08-001 - stp.1u logsource: category: process_creation product: windows detection: selection: Image|endswith: \schtasks.exe CommandLine|contains: ' /create ' filter_main_system_user: User|contains: - AUTHORI - AUTORI filter_optional_msoffice: ParentImage: - C:\Program Files\Microsoft Office\root\integration\integrator.exe - C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe Image: - C:\Windows\System32\schtasks.exe - C:\Windows\SysWOW64\schtasks.exe CommandLine|contains: Microsoft\Office\Office Performance Monitor condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Administrative activity - Software installation level: low
Near-miss passage: Sigma rule: Detects when a request has been made to transfer a Route 53 domain to another AWS account.. Logsource: aws / cloudtrail. Rule: title: AWS Route 53 Domain Transferred to Another Account id: b056de1a-6e6e-4e40-a67e-97c9808cf41b status: test description: Detects when a request has been made to transfer a Route 53 domain to another AWS account. references: - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/integrations/aws/persistence_route_53_domain_transferred_to_another_account.toml author: Elastic, Austin Songer @austinsonger date: 2021-07-22 modified: 2022-10-09 tags: - attack.persistence - attack.credential-access - attack.privilege-escalation - attack.t1098 logsource: product: aws service: cloudtrail detection: selection: eventSource: route53.amazonaws.com eventName: TransferDomainToAnotherAwsAccount condition: selection falsepositives: - A domain may be transferred to another AWS account by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Domain transfers from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Query: Suspicious Botnet execution detected on endpoint
Matching passage: T1583.005 Botnet. Tactics: resource development. Description: Adversaries may buy, lease, or rent a network of compromised systems that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.(Citation: Norton Botnet) Adversaries may purchase a subscription to use an existing botnet from a booter/stresser service. Internet-facing edge devices and related network appliances that are end-of-life (EOL) and unsupported by their manufacturers are commonly acquired for botnet activities. Adversaries may lease operational relay box (ORB) networks – consisting of virtual private servers (VPS), small office/home office (SOHO) routers, or Internet of Things (IoT) devices – to serve as a botnet.(Citation: ORB Mandiant) With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale [Phishing](https://attack.mitre.org/techniques/T1566) or Distributed Denial of Service (DDoS).(Citation: Imperva DDoS for Hire)(Citation: Krebs-Anna)(Citation: Krebs-Bazaar)(Citation: Krebs-Booter) Acquired botnets may also be used to support Command and Control activity, such as [Hide Infrastructure](https://attack.mitre.org/techniques/T1665) through an established [Proxy](https://attack.mitre.org/techniques/T1090) network.
Near-miss passage: T1583.006 Web Services. Tactics: resource development. Description: Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)), [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567), or [Phishing](https://attack.mitre.org/techniques/T1566). Using common services, such as those offered by Google, GitHub, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: FireEye APT29)(Citation: Hacker News GitHub Abuse 2024) By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.
Query: patch priority for CVE-2015-7239
Matching passage: CVE-2015-7239. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the BP_FIND_JOBS_WITH_PROGRAM function module in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-1441. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Piwigo before 2.5.6, 2.6.x before 2.6.5, and 2.7.x before 2.7.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Query: exploit HP Virtual Connect Enterprise Manager (VCEM) SDK before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote attackers to obtain sensiti
Matching passage: CVE-2015-5432. CWE: UNKNOWN. CVSS: 7.5. HP Virtual Connect Enterprise Manager (VCEM) SDK before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote attackers to obtain sensitive information or modify data via unspecified vectors.
Near-miss passage: CVE-2015-2264. CWE: UNKNOWN. CVSS: 6.900000095367432. Multiple untrusted search path vulnerabilities in (1) EQATEC.Analytics.Monitor.Win32_vc100.dll and (2) EQATEC.Analytics.Monitor.Win32_vc100-x64.dll in Telerik Analytics Monitor Library before 3.2.125 allow local users to gain privileges via a Trojan horse (a) csunsapi.dll, (b) swift.dll, (c) nfhwcrhk.dll, or (d) surewarehook.dll file in an unspecified directory.
Query: risk of The Intel Graphics Driver component in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vecto
Matching passage: CVE-2015-7076. CWE: UNKNOWN. CVSS: 7.199999809265137. The Intel Graphics Driver component in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.
Near-miss passage: CVE-2015-5200. CWE: UNKNOWN. CVSS: 6.300000190734863. The trace functionality in libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to write to arbitrary files via unspecified vectors.
Query: patch priority for CVE-2015-5014
Matching passage: CVE-2015-5014. CWE: CWE-20. CVSS: 9.300000190734863. IBM Cognos Disclosure Management (CDM) 10.1.x and 10.2.x before 10.2.4 IF10 allows man-in-the-middle attackers to obtain access by spoofing an executable file during a client upload operation.
Near-miss passage: CVE-2015-8844. CWE: CWE-20. CVSS: 5.5. The signal implementation in the Linux kernel before 4.3.5 on powerpc platforms does not check for an MSR with both the S and T bits set, which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application.
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system pe. Logsource: windows / ps_script. Rule: title: Suspicious Get Local Groups Information - PowerShell id: fa6a5a45-3ee2-4529-aa14-ee5edc9e29cb related: - id: cef24b90-dddc-4ae1-a09a-8764872f69fc type: similar status: test description: 'Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.001/T1069.001.md author: frack113 date: 2021-12-12 modified: 2025-08-22 tags: - attack.discovery - attack.t1069.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_localgroup: ScriptBlockText|contains: - 'get-localgroup ' - 'get-localgroupmember ' selection_wmi_module: ScriptBlockText|contains: - 'get-wmiobject ' - 'gwmi ' - 'get-ciminstance ' - 'gcim ' selection_wmi_class: ScriptBlockText|contains: win32_group condition: selection_localgroup or all of selection_wmi_* falsepositives: - Inventory scripts or admin tasks level: low
Near-miss passage: Sigma rule: Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall.. Logsource: fortigate / event. Rule: title: FortiGate - New Firewall Policy Added id: f24ab7a8-f09a-4319-82c1-915586aa642b status: experimental description: Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall. references: - https://www.fortiguard.com/psirt/FG-IR-24-535 - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/333889629/config-firewall-policy - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2025-11-01 modified: 2026-05-04 tags: - attack.defense-impairment - attack.t1686.002 logsource: product: fortigate service: event detection: selection: action: Add cfgpath: firewall.policy condition: selection falsepositives: - A firewall policy can be added for legitimate purposes. level: medium
Query: risk of Integer truncation issue in coders/pict.c in ImageMagick before 7.0.5-0 allows remote attackers to cause a denial of service (application crash) via a crafted .pict file.
Matching passage: CVE-2015-8896. CWE: UNKNOWN. CVSS: 6.5. Integer truncation issue in coders/pict.c in ImageMagick before 7.0.5-0 allows remote attackers to cause a denial of service (application crash) via a crafted .pict file.
Near-miss passage: CVE-2015-0326. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2015-0325 and CVE-2015-0328.
Query: patch priority for CVE-2015-3831
Matching passage: CVE-2015-3831. CWE: CWE-119. CVSS: 9.300000190734863. Buffer overflow in the readAt function in BpMediaHTTPConnection in media/libmedia/IMediaHTTPConnection.cpp in the mediaserver service in Android before 5.1.1 LMY48I allows attackers to execute arbitrary code via a crafted application, aka internal bug 19400722.
Near-miss passage: CVE-2015-9202. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, while processing the content headers in the Playready module, a buffer overread may occur if the header count exceeds the expected value.
Query: exploit Directory traversal vulnerability in the management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticated users to read arbitr
Matching passage: CVE-2015-1490. CWE: CWE-22. CVSS: 5.5. Directory traversal vulnerability in the management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticated users to read arbitrary files via a relative pathname in a client installation package.
Near-miss passage: CVE-2015-4988. CWE: CWE-22. CVSS: 8.600000381469727. Directory traversal vulnerability in the replay server in IBM Tealeaf Customer Experience before 8.7.1.8818, 8.8 before 8.8.0.9026, 9.0.0, 9.0.0A, 9.0.1 before 9.0.1.1083, 9.0.1A before 9.0.1.5073, 9.0.2 before 9.0.2.1095, and 9.0.2A before 9.0.2.5144 allows remote attackers to read arbitrary files via unspecified vectors.
Query: patch priority for CVE-2015-0065
Matching passage: CVE-2015-0065. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Word 2007 SP3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "OneTableDocumentStream Remote Code Execution Vulnerability."
Near-miss passage: CVE-2015-1744. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1735, CVE-2015-1740, CVE-2015-1745, and CVE-2015-1766.
Query: describe CVE-2015-7045
Matching passage: CVE-2015-7045. CWE: CWE-17. CVSS: 5.0. Keychain Access in Apple OS X before 10.11.2 and tvOS before 9.1 improperly interacts with Keychain Agent, which allows attackers to spoof the Keychain Server via unspecified vectors.
Near-miss passage: CVE-2015-2019. CWE: CWE-17. CVSS: 2.0999999046325684. IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 does not prevent caching of documents retrieved in SSL sessions, which allows physically proximate attackers to obtain sensitive information by leveraging an unattended workstation.
Query: Multiple failed authentications followed by Virtual Machine Discovery
Matching passage: T1673 Virtual Machine Discovery. Tactics: discovery. Description: An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host or hypervisor. For example, adversaries may enumerate a list of VMs on an ESXi hypervisor using a [Hypervisor CLI](https://attack.mitre.org/techniques/T1059/012) such as `esxcli` or `vim-cmd` (e.g. `esxcli vm process list or vim-cmd vmsvc/getallvms`).(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: TrendMicro Play) Adversaries may also directly leverage a graphical user interface, such as VMware vCenter, in order to view virtual machines on a host. Adversaries may use the information from [Virtual Machine Discovery](https://attack.mitre.org/techniques/T1673) during discovery to shape follow-on behaviors. Subsequently discovered VMs may be leveraged for follow-on activities such as [Service Stop](https://attack.mitre.org/techniques/T1489) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486).(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)
Near-miss passage: T1614 System Location Discovery. Tactics: discovery. Description: Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from [System Location Discovery](https://attack.mitre.org/techniques/T1614) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.(Citation: FBI Ragnar Locker 2020)(Citation: Sophos Geolocation 2016)(Citation: Bleepingcomputer RAT malware 2020) Windows API functions such as <code>GetLocaleInfoW</code> can also be used to determine the locale of the host.(Citation: FBI Ragnar Locker 2020) In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.(Citation: AWS Instance Identity Documents)(Citation: Microsoft Azure Instance Metadata 2021) Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.(Citation: Securelist Trasparent Tribe 2020)(Citation: Sophos Geolocation 2016)
Query: describe CVE-2015-5630
Matching passage: CVE-2015-5630. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the NTT Broadband Platform Japan Connected-free Wi-Fi application 1.6.0 and earlier for Android and 1.0.2 and earlier for iOS allows remote attackers to inject arbitrary web script or HTML via a crafted SSID.
Near-miss passage: CVE-2015-3440. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type.
Query: vulnerability: The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files.
Matching passage: CVE-2015-9338. CWE: CWE-434. CVSS: 7.5. The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files.
Near-miss passage: CVE-2015-9228. CWE: CWE-434. CVSS: 8.800000190734863. In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php.
Query: Multiple failed authentications followed by Malicious Copy and Paste
Matching passage: T1204.004 Malicious Copy and Paste. Tactics: execution. Description: An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). One such strategy is "ClickFix," in which adversaries present users with seemingly helpful solutions—such as prompts to fix errors or complete CAPTCHAs—that instead instruct the user to copy and paste malicious code. Malicious websites, such as those used in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), may present fake error messages or CAPTCHA prompts that instruct users to open a terminal or the Windows Run Dialog box and execute an arbitrary command. These commands may be obfuscated using encoding or other techniques to conceal malicious intent. Once executed, the adversary will typically be able to establish a foothold on the victim's machine.(Citation: CloudSEK Lumma Stealer 2024)(Citation: Sekoia ClickFake 2025)(Citation: Reliaquest CAPTCHA 2024)(Citation: AhnLab LummaC2 2025) Adversaries may also leverage phishing emails for this purpose. When a user attempts to open an attachment, they may be presented with a fake error and offered a malicious command to paste as a solution, consistent with the "ClickFix" strategy.(Citation: Proofpoint ClickFix 2024)(Citation: AhnLab Malicioys Copy Paste 2024) Tricking a user into executing a command themselves may help to bypass email filtering, browser sandboxing, or other mitigations designed to protect users against malicious downloaded files.
Near-miss passage: T1204.001 Malicious Link. Tactics: execution. Description: An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002). Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203). Links may also lead users to download files that require execution via [Malicious File](https://attack.mitre.org/techniques/T1204/002).
Query: detection rule: Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply
Matching passage: Sigma rule: Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply. Logsource: windows / file_event. Rule: title: Potential Persistence Via Microsoft Office Add-In id: 8e1cb247-6cf6-42fa-b440-3f27d57e9936 status: test description: Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel). references: - Internal Research - https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence - https://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md author: NVISO date: 2020-05-11 modified: 2023-02-08 tags: - attack.persistence - attack.t1137.006 logsource: category: file_event product: windows detection: selection_wlldropped: TargetFilename|contains: \Microsoft\Word\Startup\ TargetFilename|endswith: .wll selection_xlldropped: TargetFilename|contains: \Microsoft\Excel\Startup\ TargetFilename|endswith: .xll selection_xladropped: TargetFilename|contains: Microsoft\Excel\XLSTART\ TargetFilename|endswith: .xlam selection_generic: TargetFilename|contains: \Microsoft\Addins\ TargetFilename|endswith: - .xlam - .xla - .ppam condition: 1 of selection_* falsepositives: - Legitimate add-ins level: high
Near-miss passage: Sigma rule: Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.. Logsource: windows / process_creation. Rule: title: Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell id: 692f0bec-83ba-4d04-af7e-e884a96059b6 related: - id: 8a582fe2-0882-4b89-a82a-da6b2dc32937 type: similar - id: d21374ff-f574-44a7-9998-4a8c8bf33d7d type: similar status: stable description: Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI. references: - https://any.run/report/68bc255f9b0db6a0d30a8f2dadfbee3256acfe12497bf93943bc1eab0735e45e/a2385d6f-34f7-403c-90d3-b1f9d2a90a5e author: Markus Neis @Karneades date: 2019-04-03 modified: 2023-03-29 tags: - attack.execution - attack.t1047 - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \WmiPrvSE.exe selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll condition: all of selection_* falsepositives: - AppvClient - CCM - WinRM level: medium
Query: explain CWE-118
Matching passage: CWE-118 Incorrect Access of Indexable Resource ('Range Error'). The product does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.
Near-miss passage: CWE-1419 Incorrect Initialization of Resource. The product attempts to initialize a resource but does not correctly do so, which might leave the resource in an unexpected, incorrect, or insecure state when it is accessed.