alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for rpc_firewall / application
Matching passage: Sigma rule: Detects remote RPC calls to possibly abuse remote encryption service via MS-SRVS. Logsource: rpc_firewall / application. Rule: title: Remote Server Service Abuse id: b6ea3cc7-542f-43ef-bbe4-980fbed444c7 status: test description: Detects remote RPC calls to possibly abuse remote encryption service via MS-SRVS references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SRVS.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.lateral-movement logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:4b324fc8-1670-01d3-1278-5a47bf6ee188' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 4b324fc8-1670-01d3-1278-5a47bf6ee188 condition: selection falsepositives: - Legitimate remote share creation level: high
Near-miss passage: Sigma rule: Detects potential credential harvesting attempts through LSASS memory dumps using ProcDump. This rule identifies suspici. Logsource: windows / process_creation. Rule: title: Potential LSASS Process Dump Via Procdump id: 5afee48e-67dd-4e03-a783-f74259dcf998 status: stable description: 'Detects potential credential harvesting attempts through LSASS memory dumps using ProcDump. This rule identifies suspicious command-line patterns that combine memory dump flags (-ma, -mm, -mp) with LSASS-related process markers. LSASS (Local Security Authority Subsystem Service) contains sensitive authentication data including plaintext passwords, NTLM hashes, and Kerberos tickets in memory. Attackers commonly dump LSASS memory to extract credentials for lateral movement and privilege escalation. ' references: - https://learn.microsoft.com/en-us/sysinternals/downloads/procdump - https://research.splunk.com/endpoint/3742ebfe-64c2-11eb-ae93-0242ac130002 - https://x.com/wietze/status/1958302556033065292?s=12 author: Florian Roth (Nextron Systems) date: 2018-10-30 modified: 2025-10-19 tags: - attack.stealth - attack.t1036 - attack.credential-access - attack.t1003.001 - car.2013-05-009 logsource: category: process_creation product: windows detection: selection_flags: CommandLine|contains|windash: - ' -ma ' - ' -mm ' - ' -mp ' selection_process: CommandLine|contains: - ' ls' - ' keyiso' - ' samss' condition: all of selection_* falsepositives: - Unlikely, because no one should dump an lsass process memory - Another tool that uses command line flags similar to ProcDump level: high
Query: describe CVE-2015-2715
Matching passage: CVE-2015-2715. CWE: CWE-362. CVSS: 6.800000190734863. Race condition in the nsThreadManager::RegisterCurrentThread function in Mozilla Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) by leveraging improper Media Decoder Thread creation at the time of a shutdown.
Near-miss passage: CVE-2015-0654. CWE: CWE-362. CVSS: 7.099999904632568. Race condition in the TLS implementation in MainApp in the management interface in Cisco Intrusion Prevention System (IPS) Software before 7.3(3)E4 allows remote attackers to cause a denial of service (process hang) by establishing many HTTPS sessions, aka Bug ID CSCuq40652.
Query: rule covering Detects rundll32 loading a renamed comsvcs.dll to dump process memory
Matching passage: Sigma rule: Detects rundll32 loading a renamed comsvcs.dll to dump process memory. Logsource: windows / image_load. Rule: title: Suspicious Renamed Comsvcs DLL Loaded By Rundll32 id: 8cde342c-ba48-4b74-b615-172c330f2e93 status: test description: Detects rundll32 loading a renamed comsvcs.dll to dump process memory references: - https://twitter.com/sbousseaden/status/1555200155351228419 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-14 modified: 2023-02-17 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: image_load detection: selection: Image|endswith: \rundll32.exe Hashes|contains: - IMPHASH=eed93054cb555f3de70eaa9787f32ebb - IMPHASH=5e0dbdec1fce52daae251a110b4f309d - IMPHASH=eadbccbb324829acb5f2bbe87e5549a8 - IMPHASH=407ca0f7b523319d758a40d7c0193699 - IMPHASH=281d618f4e6271e527e6386ea6f748de filter: ImageLoaded|endswith: \comsvcs.dll condition: selection and not filter falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the execution "AccCheckConsole" a command-line tool for verifying the accessibility implementation of an applica. Logsource: windows / process_creation. Rule: title: Potential DLL Injection Via AccCheckConsole id: 0f6da907-5854-4be6-859a-e9958747b0aa status: test description: 'Detects the execution "AccCheckConsole" a command-line tool for verifying the accessibility implementation of an application''s UI. One of the tests that this checker can run are called "verification routine", which tests for things like Consistency, Navigation, etc. The tool allows a user to provide a DLL that can contain a custom "verification routine". An attacker can build such DLLs and pass it via the CLI, which would then be loaded in the context of the "AccCheckConsole" utility. ' references: - https://gist.github.com/bohops/2444129419c8acf837aedda5f0e7f340 - https://twitter.com/bohops/status/1477717351017680899?s=12 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/AccCheckConsole/ author: Florian Roth (Nextron Systems) date: 2022-01-06 modified: 2024-08-29 tags: - attack.execution - detection.threat-hunting logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \AccCheckConsole.exe - OriginalFileName: AccCheckConsole.exe selection_cli: CommandLine|contains: - ' -hwnd' - ' -process ' - ' -window ' condition: all of selection_* falsepositives: - Legitimate use of the UI Accessibility Checker level: medium
Query: risk of Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Ex
Matching passage: CVE-2015-6087. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6066, CVE-2015-6070, CVE-2015-6071, CVE-2015-6074, and CVE-2015-6076.
Near-miss passage: CVE-2015-8843. CWE: CWE-119. CVSS: 7.400000095367432. The Foxit Cloud Update Service (FoxitCloudUpdateService) in Foxit Reader 6.1 through 6.2.x and 7.x before 7.2.2, when an update to the Cloud plugin is available, allows local users to gain privileges by writing crafted data to a shared memory region, which triggers memory corruption.
Query: CVE similar to CVE-2015-1272
Matching passage: CVE-2015-1272. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in the GPU process implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging the continued availability of a GPUChannelHost data structure during Blink shutdown, related to content/browser/gpu/browser_gpu_channel_host_factory.cc and content/renderer/render_thread_impl.cc.
Near-miss passage: CVE-2015-4803. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4893 and CVE-2015-4911.
Query: explain T1059.004 Unix Shell
Matching passage: T1059.004 Unix Shell. Tactics: execution. Description: Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) Unix shells can control every aspect of a system, with certain commands requiring elevated privileges. Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems. Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with [SSH](https://attack.mitre.org/techniques/T1021/004). Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence. Some systems, such as embedded devices, lightweight Linux distributions, and ESXi servers, may leverage stripped-down Unix shells via Busybox, a small executable that contains a variety of tools, including a simple shell.
Near-miss passage: T1059.011 Lua. Tactics: execution. Description: Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line (through the stand-alone lua interpreter), via scripts (<code>.lua</code>), or from Lua-embedded programs (through the <code>struct lua_State</code>).(Citation: Lua main page)(Citation: Lua state) Lua scripts may be executed by adversaries for malicious purposes. Adversaries may incorporate, abuse, or replace existing Lua interpreters to allow for malicious Lua command execution at runtime.(Citation: PoetRat Lua)(Citation: Lua Proofpoint Sunseed)(Citation: Cyphort EvilBunny)(Citation: Kaspersky Lua)
Query: adversary uses Unsecured Credentials
Matching passage: T1552 Unsecured Credentials. Tactics: credential access. Description: Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Shell History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)).(Citation: Brining MimiKatz to Unix)
Near-miss passage: T1552.001 Credentials In Files. Tactics: credential access. Description: Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords. It is possible to extract passwords from backups or saved virtual machines through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003).(Citation: CG 2014) Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller.(Citation: SRD GPP) In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files.(Citation: Unit 42 Hildegard Malware) They may also be found as parameters to deployment commands in container logs.(Citation: Unit 42 Unsecured Docker Daemons) In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.(Citation: Specter Ops - Cloud Credential Storage)
Query: Sigma rule for Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been
Matching passage: Sigma rule: Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been. Logsource: linux / process_creation. Rule: title: Remote Access Tool - Team Viewer Session Started On Linux Host id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d related: - id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357 type: similar - id: f459ccb4-9805-41ea-b5b2-55e279e2424a type: similar status: test description: 'Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder. ' references: - Internal Research author: Josh Nickels, Qi Nan date: 2024-03-11 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: process_creation product: linux detection: selection: ParentImage|endswith: /TeamViewer_Service Image|endswith: /TeamViewer_Desktop CommandLine|endswith: /TeamViewer_Desktop --IPCport 5939 --Module 1 condition: selection falsepositives: - Legitimate usage of TeamViewer level: low
Near-miss passage: Sigma rule: Detects the execution of rundll32 with a command line that doesn't contain a common extension. Logsource: windows / process_creation. Rule: title: Rundll32 Execution With Uncommon DLL Extension id: c3a99af4-35a9-4668-879e-c09aeb4f2bdf status: test description: Detects the execution of rundll32 with a command line that doesn't contain a common extension references: - https://twitter.com/mrd0x/status/1481630810495139841?s=12 author: Tim Shelton, Florian Roth (Nextron Systems), Yassine Oukessou date: 2022-01-13 modified: 2024-04-04 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE filter_main_null: CommandLine: null filter_main_empty: CommandLine: '' filter_main_known_extension: - CommandLine|contains: - '.cpl ' - .cpl, - .cpl" - .cpl' - '.dll ' - .dll, - .dll" - .dll' - '.inf ' - .inf, - .inf" - .inf' - CommandLine|endswith: - .cpl - .dll - '.inf' filter_main_localserver: CommandLine|contains: ' -localserver ' filter_main_zzzzInvokeManagedCustomActionOutOfProc: ParentImage|endswith: \msiexec.exe CommandLine|contains|all: - :\Windows\Installer\ - .tmp - zzzzInvokeManagedCustomActionOutOfProc filter_optional_EdgeUpdate: ParentCommandLine|contains|all: - :\Users\ - \AppData\Local\Microsoft\EdgeUpdate\Install\{ - \EDGEMITMP_ - .tmp\setup.exe - --install-archive= - --previous-version= - --msedgewebview --verbose-logging --do-not-launch-msedge --user-level condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-9014
Matching passage: CVE-2015-9014. CWE: CWE-264. CVSS: 9.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393750.
Near-miss passage: CVE-2015-2694. CWE: CWE-264. CVSS: 5.800000190734863. The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1) zero bytes of data or (2) an arbitrary realm name, related to plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit_srv.c.
Query: exploit Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows local users to affect integrity and 
Matching passage: CVE-2015-0383. CWE: UNKNOWN. CVSS: 5.400000095367432. Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows local users to affect integrity and availability via unknown vectors related to Hotspot.
Near-miss passage: CVE-2015-7917. CWE: UNKNOWN. CVSS: 7.199999809265137. Untrusted search path vulnerability in Open Automation OPC Systems.NET 8.00.0023 and earlier allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.
Query: patch priority for CVE-2015-7717
Matching passage: CVE-2015-7717. CWE: CWE-264. CVSS: 9.300000190734863. mediaserver in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to gain privileges via a crafted application, aka internal bug 19573085, a different vulnerability than CVE-2015-6596.
Near-miss passage: CVE-2015-4103. CWE: CWE-264. CVSS: 4.900000095367432. Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field, which allows local x86 HVM guest administrators to cause a denial of service (host interrupt handling confusion) via vectors related to qemu and accessing spanning multiple fields.
Query: describe CVE-2015-1701
Matching passage: CVE-2015-1701. CWE: UNKNOWN. CVSS: 7.800000190734863. Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in April 2015, aka "Win32k Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-8437. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in the Selection object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a crafted setFocus call, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: CVE similar to CVE-2015-4787
Matching passage: CVE-2015-4787. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4789, and CVE-2015-4790.
Near-miss passage: CVE-2015-5405. CWE: UNKNOWN. CVSS: 6.5. HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote authenticated users to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors.
Query: patch priority for CVE-2015-4656
Matching passage: CVE-2015-4656. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station before 6.3-2945 allow remote attackers to inject arbitrary web script or HTML via the (1) success parameter to login.php or (2) crafted URL parameters to index.php, as demonstrated by the t parameter to photo/.
Near-miss passage: CVE-2015-4029. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the WebGUI in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the zone parameter in a del action to services_captiveportal_zones.php.
Query: describe CVE-2015-2153
Matching passage: CVE-2015-2153. CWE: CWE-119. CVSS: 5.0. The rpki_rtr_pdu_print function in print-rpki-rtr.c in the TCP printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via a crafted header length in an RPKI-RTR Protocol Data Unit (PDU).
Near-miss passage: CVE-2015-3794. CWE: CWE-119. CVSS: 6.800000190734863. The Speech UI in Apple OS X before 10.10.5, when speech alerts are enabled, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Unicode string.
Query: write Sigma for Detects command execution via ScreenConnect RMM
Matching passage: Sigma rule: Detects command execution via ScreenConnect RMM. Logsource: windows / application. Rule: title: Remote Access Tool - ScreenConnect Command Execution id: 076ebe48-cc05-4d8f-9d41-89245cd93a14 related: - id: b1f73849-6329-4069-bc8f-78a604bb8b23 type: similar status: test description: Detects command execution via ScreenConnect RMM references: - https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling - https://github.com/SigmaHQ/sigma/pull/4467 author: Ali Alwashali date: 2023-10-10 tags: - attack.execution - attack.t1059.003 logsource: service: application product: windows detection: selection: Provider_Name: ScreenConnect EventID: 200 Data|contains: Executed command of length condition: selection falsepositives: - Legitimate use of ScreenConnect level: low
Near-miss passage: Sigma rule: Detects creation of files with the ".one"/".onepkg" extension in suspicious or uncommon locations. This could be a sign. Logsource: windows / file_event. Rule: title: OneNote Attachment File Dropped In Suspicious Location id: 7fd164ba-126a-4d9c-9392-0d4f7c243df0 status: test description: Detects creation of files with the ".one"/".onepkg" extension in suspicious or uncommon locations. This could be a sign of attackers abusing OneNote attachments references: - https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/ - https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-22 modified: 2023-09-19 tags: - attack.stealth logsource: category: file_event product: windows detection: selection: TargetFilename|contains: - \AppData\Local\Temp\ - \Users\Public\ - \Windows\Temp\ - :\Temp\ TargetFilename|endswith: - .one - .onepkg filter_main_onenote: Image|contains: :\Program Files\Microsoft Office\ Image|endswith: \ONENOTE.EXE condition: selection and not 1 of filter_main_* falsepositives: - Legitimate usage of ".one" or ".onepkg" files from those locations level: medium
Query: common weakness: Improper Handling of Undefined Parameters
Matching passage: CWE-236 Improper Handling of Undefined Parameters. The product does not handle or incorrectly handles when a particular parameter, field, or argument name is not defined or supported by the product.
Near-miss passage: CWE-156 Improper Neutralization of Whitespace. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as whitespace when they are sent to a downstream component.