alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecifi
Matching passage: CVE-2015-1963. CWE: CWE-119. CVSS: 7.800000190734863. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1964, and CVE-2015-1965.
Near-miss passage: CVE-2015-1213. CWE: CWE-119. CVSS: 7.5. The SkBitmap::ReadRawPixels function in core/SkBitmap.cpp in the filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation.
Query: detect Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a OneNote atta in logs
Matching passage: Sigma rule: Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a OneNote atta. Logsource: windows / process_creation. Rule: title: OneNote.EXE Execution of Malicious Embedded Scripts id: 84b1706c-932a-44c4-ae28-892b28a25b94 status: test description: 'Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a OneNote attachment and then on the malicious link inside the ".one" file, it exports and executes the malicious embedded script from specific directories. ' references: - https://bazaar.abuse.ch/browse/tag/one/ author: '@kostastsale' date: 2023-02-02 tags: - attack.stealth - attack.t1218.001 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \onenote.exe Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \wscript.exe CommandLine|contains: - \exported\ - \onenoteofflinecache_files\ condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the pattern of a UAC bypass using Windows Event Viewer. Logsource: windows / file_event. Rule: title: UAC Bypass Using EventVwr id: 63e4f530-65dc-49cc-8f80-ccfa95c69d43 status: test description: Detects the pattern of a UAC bypass using Windows Event Viewer references: - https://twitter.com/orange_8361/status/1518970259868626944?s=20&t=RFXqZjtA7tWM3HxqEH78Aw - https://twitter.com/splinter_code/status/1519075134296006662?s=12&t=DLUXH86WtcmG_AZ5gY3C6g - https://lolbas-project.github.io/lolbas/Binaries/Eventvwr/#execute author: Antonio Cocomazzi (idea), Florian Roth (Nextron Systems) date: 2022-04-27 modified: 2022-11-22 tags: - attack.privilege-escalation - attack.stealth logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - \Microsoft\Event Viewer\RecentViews - \Microsoft\EventV~1\RecentViews filter: Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ condition: selection and not filter falsepositives: - Unknown level: high
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".. Logsource: windows / process_creation. Rule: title: User Added to Local Administrators Group id: ad720b90-25ad-43ff-9b5e-5c841facc8e5 related: - id: ffa28e60-bdb1-46e0-9f82-05f7a61cc06e type: similar - id: 10fb649c-3600-4d37-b1e6-56ea90bb7e09 type: similar status: test description: Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember". references: - https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-08-12 modified: 2023-03-02 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: category: process_creation product: windows detection: selection_main: - CommandLine|contains|all: - 'localgroup ' - ' /add' - CommandLine|contains|all: - 'Add-LocalGroupMember ' - ' -Group ' selection_group: CommandLine|contains: - ' administrators ' - ' administrateur' condition: all of selection_* falsepositives: - Administrative activity level: medium
Near-miss passage: Sigma rule: Adversaries may carry out malicious operations using a virtual instance to avoid detection. Logsource: windows / ps_script. Rule: title: Suspicious Hyper-V Cmdlets id: 42d36aa1-3240-4db0-8257-e0118dcdd9cd status: test description: Adversaries may carry out malicious operations using a virtual instance to avoid detection references: - https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.006/T1564.006.md#atomic-test-3---create-and-start-hyper-v-virtual-machine author: frack113 date: 2022-04-09 tags: - attack.stealth - attack.t1564.006 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - New-VM - Set-VMFirmware - Start-VM condition: selection falsepositives: - Legitimate PowerShell scripts level: medium
Query: detect Resource Forking
Matching passage: T1564.009 Resource Forking. Tactics: stealth. Description: Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.(Citation: macOS Hierarchical File System Overview) Usage of a resource fork is identifiable when displaying a file’s extended attributes, using <code>ls -l@</code> or <code>xattr -l</code> commands. Resource forks have been deprecated and replaced with the application bundle structure. Non-localized resources are placed at the top level directory of an application bundle, while localized resources are placed in the <code>/Resources</code> folder.(Citation: Resource and Data Forks)(Citation: ELC Extended Attributes) Adversaries can use resource forks to hide malicious data that may otherwise be stored directly in files. Adversaries can execute content with an attached resource fork, at a specified offset, that is moved to an executable location then invoked. Resource fork content may also be obfuscated/encrypted until execution.(Citation: sentinellabs resource named fork 2020)(Citation: tau bundlore erika noerenberg 2020)
Near-miss passage: T1564.005 Hidden File System. Tactics: stealth. Description: Adversaries may use a hidden file system to conceal malicious activity from users and security tools. File systems provide a structure to store and access data from physical storage. Typically, a user engages with a file system through applications that allow them to access files and directories, which are an abstraction from their physical location (ex: disk sector). Standard file systems include FAT, NTFS, ext4, and APFS. File systems can also contain other structures, such as the Volume Boot Record (VBR) and Master File Table (MFT) in NTFS.(Citation: MalwareTech VFS Nov 2014) Adversaries may use their own abstracted file system, separate from the standard file system present on the infected system. In doing so, adversaries can hide the presence of malicious components and file input/output from security tools. Hidden file systems, sometimes referred to as virtual file systems, can be implemented in numerous ways. One implementation would be to store a file system in reserved disk space unused by disk structures or standard file system partitions.(Citation: MalwareTech VFS Nov 2014)(Citation: FireEye Bootkits) Another implementation could be for an adversary to drop their own portable partition image as a file on top of the standard file system.(Citation: ESET ComRAT May 2020) Adversaries may also fragment files across the existing file system structure in non-standard ways.(Citation: Kaspersky Equation QA)
Query: exploit The Wireless Intrusion Detection (aka WIDS) functionality on Cisco Wireless LAN Controller (WLC) devices allows remote attackers to cause a denial of service (device outage) via cr
Matching passage: CVE-2015-0622. CWE: CWE-20. CVSS: 7.099999904632568. The Wireless Intrusion Detection (aka WIDS) functionality on Cisco Wireless LAN Controller (WLC) devices allows remote attackers to cause a denial of service (device outage) via crafted packets that are improperly handled during rendering of the Signature Events Summary page, aka Bug ID CSCus46861.
Near-miss passage: CVE-2015-1103. CWE: CWE-20. CVSS: 7.5. The kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 makes routing changes in response to ICMP_REDIRECT messages, which allows remote attackers to cause a denial of service (network outage) or obtain sensitive packet-content information via a crafted ICMP packet.
Query: secure coding against Improper Neutralization of Special Elements used in a Command ('Command Injection')
Matching passage: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection'). The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Near-miss passage: CWE-50 Path Equivalence: '//multiple/leading/slash'. The product accepts path input in the form of multiple leading slash ('//multiple/leading/slash') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Query: rule covering Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to b
Matching passage: Sigma rule: Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to b. Logsource: linux / auditd. Rule: title: Modify System Firewall id: 323ff3f5-0013-4847-bbd4-250b5edb62cc related: - id: 53059bc0-1472-438b-956a-7508a94a91f0 type: similar status: test description: 'Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access. Detection rules that match only on the disabling of firewalls will miss this. ' references: - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html - https://blog.aquasec.com/container-security-tnt-container-attack - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/getting-started-with-nftables_configuring-and-managing-networking author: IAI date: 2023-03-06 modified: 2025-10-12 tags: - attack.defense-impairment - attack.t1686 logsource: product: linux service: auditd detection: selection1: type: EXECVE a0: iptables a1|contains: DROP selection2: type: EXECVE a0: firewall-cmd a1|contains: remove selection3: type: EXECVE a0: ufw a1|contains: delete selection4: type: EXECVE a0: nft a1|contains: - delete - flush condition: 1 of selection* falsepositives: - Legitimate admin activity level: medium
Near-miss passage: Sigma rule: Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility. Logsource: windows / process_creation. Rule: title: Potential Suspicious Registry File Imported Via Reg.EXE id: 62e0298b-e994-4189-bc87-bc699aa62d97 related: - id: 73bba97f-a82d-42ce-b315-9182e76c57b1 type: derived status: test description: Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/reg-import author: frack113, Nasreddine Bencherchali date: 2022-08-01 modified: 2023-02-05 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_cli: CommandLine|contains: ' import ' selection_paths: CommandLine|contains: - C:\Users\ - '%temp%' - '%tmp%' - '%appdata%' - \AppData\Local\Temp\ - C:\Windows\Temp\ - C:\ProgramData\ condition: all of selection_* falsepositives: - Legitimate import of keys level: medium
Query: patch priority for CVE-2015-2751
Matching passage: CVE-2015-2751. CWE: CWE-17. CVSS: 7.099999904632568. Xen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows remote domains with partial management control to cause a denial of service (host lock) via unspecified domctl operations.
Near-miss passage: CVE-2015-1465. CWE: CWE-17. CVSS: 7.800000190734863. The IPv4 implementation in the Linux kernel before 3.18.8 does not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allows remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets.
Query: risk of Multiple insecure Temporary File vulnerabilities in 389 Administration Server before 1.1.38.
Matching passage: CVE-2015-0233. CWE: CWE-254. CVSS: 4.199999809265137. Multiple insecure Temporary File vulnerabilities in 389 Administration Server before 1.1.38.
Near-miss passage: CVE-2015-6498. CWE: CWE-254. CVSS: 7.5. Alcatel-Lucent Home Device Manager before 4.1.10, 4.2.x before 4.2.2 allows remote attackers to spoof and make calls as target devices.
Query: patch priority for CVE-2015-1761
Matching passage: CVE-2015-1761. CWE: CWE-284. CVSS: 6.5. Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014 uses an incorrect class during casts of unspecified pointers, which allows remote authenticated users to gain privileges by leveraging certain write access, aka "SQL Server Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-4418. CWE: CWE-284. CVSS: 5.0. Zoho NetFlow Analyzer build 10250 and earlier does not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
Query: risk of Mozilla Firefox before 37.0 on OS X does not ensure that the cursor is visible, which allows remote attackers to conduct clickjacking attacks via a Flash object in conjunction with
Matching passage: CVE-2015-0810. CWE: CWE-20. CVSS: 4.300000190734863. Mozilla Firefox before 37.0 on OS X does not ensure that the cursor is visible, which allows remote attackers to conduct clickjacking attacks via a Flash object in conjunction with DIV elements associated with layered presentation, and crafted JavaScript code that interacts with an IMG element.
Near-miss passage: CVE-2015-4266. CWE: CWE-20. CVSS: 4.300000190734863. The web interface in Cisco Identity Services Engine (ISE) 1.1(4.1), 1.3(106.146), and 1.3(120.135) does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCut04556.
Query: actor TTPs: LC_MAIN Hijacking
Matching passage: T1149 LC_MAIN Hijacking. Tactics: stealth. Description: **This technique has been deprecated and should no longer be used.** As of OS X 10.8, mach-O binaries introduced a new header called LC_MAIN that points to the binary’s entry point for execution. Previously, there were two headers to achieve this same effect: LC_THREAD and LC_UNIXTHREAD (Citation: Prolific OSX Malware History). The entry point for a binary can be hijacked so that initial execution flows to a malicious addition (either another section or a code cave) and then goes back to the initial entry point so that the victim doesn’t know anything was different (Citation: Methods of Mac Malware Persistence). By modifying a binary in this way, application whitelisting can be bypassed because the file name or application path is still the same.
Near-miss passage: T1027.014 Polymorphic Code. Tactics: stealth. Description: Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection. Polymorphic code is a type of software capable of changing its runtime footprint during code execution.(Citation: polymorphic-blackberry) With each execution of the software, the code is mutated into a different version of itself that achieves the same purpose or objective as the original. This functionality enables the malware to evade traditional signature-based defenses, such as antivirus and antimalware tools.(Citation: polymorphic-sentinelone) Other obfuscation techniques can be used in conjunction with polymorphic code to accomplish the intended effects, including using mutation engines to conduct actions such as [Software Packing](https://attack.mitre.org/techniques/T1027/002), [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010), or [Encrypted/Encoded File](https://attack.mitre.org/techniques/T1027/013).(Citation: polymorphic-linkedin)(Citation: polymorphic-medium)
Query: vulnerability: Multiple PHP remote file inclusion vulnerabilities in install.php in Web Reference Database (aka refbase) through 0.9.6 allow remote attackers to execute arbitrary PHP code via the
Matching passage: CVE-2015-7381. CWE: CWE-94. CVSS: 7.5. Multiple PHP remote file inclusion vulnerabilities in install.php in Web Reference Database (aka refbase) through 0.9.6 allow remote attackers to execute arbitrary PHP code via the (1) pathToMYSQL or (2) databaseStructureFile parameter, a different issue than CVE-2015-6008.
Near-miss passage: CVE-2015-1697. CWE: CWE-94. CVSS: 9.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1675, CVE-2015-1695, CVE-2015-1696, CVE-2015-1698, and CVE-2015-1699.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious acti. Logsource: windows / process_creation. Rule: title: Wscript Shell Run In CommandLine id: 2c28c248-7f50-417a-9186-a85b223010ee status: test description: Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious activity references: - https://web.archive.org/web/20220830122045/http://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html - https://blog.talosintelligence.com/modernloader-delivers-multiple-stealers-cryptominers-and-rats/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-31 modified: 2023-05-15 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - Wscript. - .Shell - .Run condition: selection falsepositives: - Inline scripting can be used by some rare third party applications or administrators. Investigate and apply additional filters accordingly level: medium
Near-miss passage: Sigma rule: Detects potential persistence behavior using the windows telemetry registry key. Windows telemetry makes use of the bina. Logsource: windows / registry_set. Rule: title: Potential Registry Persistence Attempt Via Windows Telemetry id: 73a883d0-0348-4be4-a8d8-51031c2564f8 related: - id: 4e8d5fd3-c959-441f-a941-f73d0cdcdca5 type: obsolete status: test description: 'Detects potential persistence behavior using the windows telemetry registry key. Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections. This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run. The problem is, it will run any arbitrary command without restriction of location or type. ' references: - https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/ author: Lednyov Alexey, oscd.community, Sreeman date: 2020-10-16 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.005 logsource: category: registry_set product: windows definition: 'Requirements: Sysmon config that monitors \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController subkey of the HKLM hives' detection: selection: TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\ TargetObject|endswith: \Command Details|contains: - .bat - .bin - .cmd - .dat - .dll - .exe - .hta - .jar - .js - .msi - .ps - .sh - .vb filter_main_generic: Details|contains: - \system32\CompatTelRunner.exe - \system32\DeviceCensus.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-0162
Matching passage: CVE-2015-0162. CWE: CWE-264. CVSS: 7.0. IBM Security SiteProtector System 3.0, 3.1, and 3.1.1 allows local users to gain privileges.
Near-miss passage: CVE-2015-6620. CWE: CWE-264. CVSS: 9.300000190734863. libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bugs 24123723 and 24445127.
Query: threat report mentioning Shortcut Modification
Matching passage: T1547.009 Shortcut Modification. Tactics: persistence, privilege escalation. Description: Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process. Adversaries may abuse shortcuts in the startup folder to execute their tools and achieve persistence.(Citation: Shortcut for Persistence ) Although often used as payloads in an infection chain (e.g. [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001)), adversaries may also create a new shortcut as a means of indirection, while also abusing [Masquerading](https://attack.mitre.org/techniques/T1036) to make the malicious shortcut appear as a legitimate program. Adversaries can also edit the target path or entirely replace an existing shortcut so their malware will be executed instead of the intended legitimate program. Shortcuts can also be abused to establish persistence by implementing other methods. For example, LNK browser extensions may be modified (e.g. [Browser Extensions](https://attack.mitre.org/techniques/T1176/001)) to persistently launch malware.
Near-miss passage: T1547.008 LSASS Driver. Tactics: persistence, privilege escalation. Description: Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.(Citation: Microsoft Security Subsystem) Adversaries may target LSASS drivers to obtain persistence. By either replacing or adding illegitimate drivers (e.g., [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574)), an adversary can use LSA operations to continuously execute malicious payloads.