alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects usage of the 'crontab' utility to remove the current crontab. This is a common occurrence where cryptocurrency m
Matching passage: Sigma rule: Detects usage of the 'crontab' utility to remove the current crontab. This is a common occurrence where cryptocurrency m. Logsource: linux / process_creation. Rule: title: Remove Scheduled Cron Task/Job id: c2e234de-03a3-41e1-b39a-1e56dc17ba67 status: test description: 'Detects usage of the ''crontab'' utility to remove the current crontab. This is a common occurrence where cryptocurrency miners compete against each other by removing traces of other miners to hijack the maximum amount of resources possible ' references: - https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-15 tags: - attack.stealth logsource: category: process_creation product: linux detection: selection: Image|endswith: crontab CommandLine|contains: ' -r' condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering. Logsource: windows / process_creation. Rule: title: Sysinternals PsService Execution id: 3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f status: test description: Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering references: - https://learn.microsoft.com/en-us/sysinternals/downloads/psservice author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-16 modified: 2026-06-29 tags: - attack.privilege-escalation - attack.discovery - attack.persistence - attack.t1543.003 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: psservice.exe - Image|endswith: - \PsService.exe - \PsService64.exe - \PsService64a.exe condition: selection falsepositives: - Legitimate use of PsService by an administrator level: medium
Query: secure coding against Unconditional Control Flow Transfer outside of Switch Block
Matching passage: CWE-1075 Unconditional Control Flow Transfer outside of Switch Block. The product performs unconditional control transfer (such as a goto) in code outside of a branching structure such as a switch block.
Near-miss passage: CWE-579 J2EE Bad Practices: Non-serializable Object Stored in Session. The product stores a non-serializable object as an HttpSession attribute, which can hurt reliability.
Query: vulnerability: Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecifi
Matching passage: CVE-2015-1948. CWE: CWE-119. CVSS: 7.800000190734863. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965.
Near-miss passage: CVE-2015-5871. CWE: CWE-119. CVSS: 7.199999809265137. IOGraphics in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5872, CVE-2015-5873, and CVE-2015-5890.
Query: containment actions for Lateral movement indicators for Non-Standard Encoding
Matching passage: Playbook for T1132.002 Non-Standard Encoding. 1) Validate alert telemetry against T1132.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: command and control. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a non-standard data encoding system that diverges from existing protocol specifications. Non-standard data encoding schemes may be based on or related to standard data encoding schemes, such as a
Near-miss passage: Playbook for T1132 Data Encoding. Different response path focused on command and control.
Query: common weakness: Use of Object without Invoking Destructor Method
Matching passage: CWE-1091 Use of Object without Invoking Destructor Method. The product contains a method that accesses an object but does not later invoke the element's associated finalize/destructor method.
Near-miss passage: CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action. The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.
Query: write Sigma for Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors an
Matching passage: Sigma rule: Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors an. Logsource: macos / process_creation. Rule: title: System Information Discovery Using System_Profiler id: 4809c683-059b-4935-879d-36835986f8cf status: test description: 'Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information. This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes. ' references: - https://www.trendmicro.com/en_za/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html - https://www.sentinelone.com/wp-content/uploads/pdf-gen/1630910064/20-common-tools-techniques-used-by-macos-threat-actors-malware.pdf - https://ss64.com/mac/system_profiler.html - https://objective-see.org/blog/blog_0x62.html - https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/ - https://gist.github.com/nasbench/9a1ba4bc7094ea1b47bc42bf172961af author: Stephen Lincoln `@slincoln_aiq` (AttackIQ) date: 2024-01-02 tags: - attack.discovery - attack.stealth - attack.t1082 - attack.t1497.001 logsource: product: macos category: process_creation detection: selection_img: - Image|endswith: /system_profiler - CommandLine|contains: system_profiler selection_cmd: CommandLine|contains: - SPApplicationsDataType - SPHardwareDataType - SPNetworkDataType - SPUSBDataType condition: all of selection_* falsepositives: - Legitimate administrative activities level: medium
Near-miss passage: Sigma rule: Identifies the deletion of Azure Kubernetes Pods.. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes Pods Deleted id: b02f9591-12c3-4965-986a-88028629b2e1 status: test description: Identifies the deletion of Azure Kubernetes Pods. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://github.com/elastic/detection-rules/blob/065bf48a9987cd8bd826c098a30ce36e6868ee46/rules/integrations/azure/impact_kubernetes_pod_deleted.toml author: Austin Songer @austinsonger date: 2021-07-24 modified: 2022-08-23 tags: - attack.impact logsource: product: azure service: activitylogs detection: selection: operationName: MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/PODS/DELETE condition: selection falsepositives: - Pods may be deleted by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Pods deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: telemetry for T1136.002
Matching passage: T1136.002 Domain Account. Tactics: persistence. Description: Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the <code>net user /add /domain</code> command can be used to create a domain account.(Citation: Savill 1999) Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Near-miss passage: T1136 Create Account. Tactics: persistence. Description: Adversaries may create an account to maintain access to victim systems.(Citation: Symantec WastedLocker June 2020) With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system. Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.
Query: describe CVE-2015-2733
Matching passage: CVE-2015-2733. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote attackers to execute arbitrary code via vectors involving attachment of an XMLHttpRequest object to a dedicated worker.
Near-miss passage: CVE-2015-2619. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 7u80 and 8u45, JavaFX 2.2.80, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via unknown vectors related to 2D.
Query: Sigma rule for An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm
Matching passage: Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / process_creation. Rule: title: Remote Access Tool - Anydesk Execution From Suspicious Folder id: 065b00ca-5d5c-4557-ac95-64a6d0b64d86 related: - id: b52e84a3-029e-4529-b09b-71d19dd27e94 type: similar status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows - https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/ author: Florian Roth (Nextron Systems) date: 2022-05-20 modified: 2025-02-24 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \AnyDesk.exe - \AnyDeskMSI.exe - Description: AnyDesk - Product: AnyDesk - Company: AnyDesk Software GmbH filter: Image|contains: - \AppData\ - Program Files (x86)\AnyDesk - Program Files\AnyDesk condition: selection and not filter falsepositives: - Legitimate use of AnyDesk from a non-standard folder level: high
Near-miss passage: Sigma rule: Detect usage of the "unregmp2.exe" binary as a proxy to launch a custom version of "wmpnscfg.exe". Logsource: windows / process_creation. Rule: title: Lolbin Unregmp2.exe Use As Proxy id: 727454c0-d851-48b0-8b89-385611ab0704 status: test description: Detect usage of the "unregmp2.exe" binary as a proxy to launch a custom version of "wmpnscfg.exe" references: - https://lolbas-project.github.io/lolbas/Binaries/Unregmp2/ author: frack113 date: 2022-12-29 modified: 2024-06-04 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \unregmp2.exe - OriginalFileName: unregmp2.exe selection_cmd: CommandLine|contains|windash: ' /HideWMP' condition: all of selection_* falsepositives: - Unknown level: medium
Query: describe CVE-2015-3165
Matching passage: CVE-2015-3165. CWE: UNKNOWN. CVSS: 4.300000190734863. Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a denial of service (crash) by closing an SSL session at a time when the authentication timeout will expire during the session shutdown sequence.
Near-miss passage: CVE-2015-7078. CWE: UNKNOWN. CVSS: 7.199999809265137. Use-after-free vulnerability in Hypervisor in Apple OS X before 10.11.2 allows local users to gain privileges via vectors involving VM objects.
Query: exploit Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF19, and 
Matching passage: CVE-2015-4998. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF19, and 8.5.0 before CF08 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-4993.
Near-miss passage: CVE-2015-9319. CWE: CWE-79. CVSS: 6.099999904632568. The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.
Query: patch priority for CVE-2015-6681
Matching passage: CVE-2015-6681. CWE: CWE-119. CVSS: 10.0. Adobe Shockwave Player before 12.2.0.162 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-6680.
Near-miss passage: CVE-2015-9034. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a string can fail to be null-terminated in SIP leading to a buffer overflow.
Query: vulnerability: The web administration interface on Cisco Wireless LAN Controller (WLC) devices before 7.0.241, 7.1.x through 7.4.x before 7.4.122, and 7.5.x and 7.6.x before 7.6.120 allows remote
Matching passage: CVE-2015-0726. CWE: CWE-20. CVSS: 6.800000190734863. The web administration interface on Cisco Wireless LAN Controller (WLC) devices before 7.0.241, 7.1.x through 7.4.x before 7.4.122, and 7.5.x and 7.6.x before 7.6.120 allows remote authenticated users to cause a denial of service (device crash) via unspecified parameters, aka Bug IDs CSCum65159 and CSCum65252.
Near-miss passage: CVE-2015-8360. CWE: CWE-20. CVSS: 9.800000190734863. An unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote attackers to execute arbitrary Java code via serialized data to the JMS port.
Query: CVE similar to CVE-2015-3010
Matching passage: CVE-2015-3010. CWE: CWE-200. CVSS: 2.0999999046325684. ceph-deploy before 1.5.23 uses weak permissions (644) for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file.
Near-miss passage: CVE-2015-7731. CWE: CWE-200. CVSS: 5.5. SAP Mobile Platform 3.0 SP05 ClientHub allows attackers to obtain the keystream and other sensitive information via the DataVault, aka SAP Security Note 2094830.
Query: rule covering Detects NetSupport Manager service installation on the target system.
Matching passage: Sigma rule: Detects NetSupport Manager service installation on the target system.. Logsource: windows / system. Rule: title: NetSupport Manager Service Install id: 2d510d8d-912b-45c5-b1df-36faa3d8c3f4 status: test description: Detects NetSupport Manager service installation on the target system. references: - http://resources.netsupportsoftware.com/resources/manualpdfs/nsm_manual_uk.pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-31 tags: - attack.persistence logsource: product: windows service: system detection: selection_root: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ImagePath|contains: \NetSupport Manager\client32.exe - ServiceName: Client32 condition: all of selection_* falsepositives: - Legitimate use of the tool level: medium
Near-miss passage: Sigma rule: Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ra. Logsource: windows / process_creation. Rule: title: Fsutil Suspicious Invocation id: add64136-62e5-48ea-807e-88638d02df1e status: stable description: 'Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others). ' references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070/T1070.md - https://eqllib.readthedocs.io/en/latest/analytics/c91f422a-5214-4b17-8664-c5fcf115c0a2.html - https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md - https://blog.cluster25.duskrise.com/2023/05/22/back-in-black-blackbyte-nt author: Ecco, E.M. Anhaus, oscd.community date: 2019-09-26 modified: 2023-09-09 tags: - attack.impact - attack.stealth - attack.t1070 - attack.t1485 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \fsutil.exe - OriginalFileName: fsutil.exe selection_cli: CommandLine|contains: - deletejournal - createjournal - setZeroData condition: all of selection_* falsepositives: - Admin activity - Scripts and administrative tools used in the monitored environment level: high
Query: describe CVE-2015-1761
Matching passage: CVE-2015-1761. CWE: CWE-284. CVSS: 6.5. Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014 uses an incorrect class during casts of unspecified pointers, which allows remote authenticated users to gain privileges by leveraging certain write access, aka "SQL Server Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-4418. CWE: CWE-284. CVSS: 5.0. Zoho NetFlow Analyzer build 10250 and earlier does not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
Query: vulnerability: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MSM8909W, SD 2
Matching passage: CVE-2015-9208. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 800, and SD 810, the function tzbsp_pil_verify_sig() does not strictly check that the pointer to ELF and program headers and hash segment is within secure memory. It only checks that the address is not in non-secure memory. A given address range can overlap with both secure and non-secure regions - hence if such an address is passed in, it would not pass the non-secure range check, and would be considered valid by the function, even though that memory area could be modified by the non-secure side.
Near-miss passage: CVE-2015-0726. CWE: CWE-20. CVSS: 6.800000190734863. The web administration interface on Cisco Wireless LAN Controller (WLC) devices before 7.0.241, 7.1.x through 7.4.x before 7.4.122, and 7.5.x and 7.6.x before 7.6.120 allows remote authenticated users to cause a denial of service (device crash) via unspecified parameters, aka Bug IDs CSCum65159 and CSCum65252.
Query: describe CVE-2015-3446
Matching passage: CVE-2015-3446. CWE: CWE-94. CVSS: 9.300000190734863. The Framework Daemon in AlienVault Unified Security Management before 4.15 allows remote attackers to execute arbitrary Python code via a crafted plugin configuration file (.cfg).
Near-miss passage: CVE-2015-5243. CWE: CWE-94. CVSS: 9.800000190734863. phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.
Query: risk of Unspecified vulnerability in IBM WebSphere eXtreme Scale 8.6 through 8.6.0.8 allows remote attackers to cause a denial of service via unknown vectors.
Matching passage: CVE-2015-4936. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in IBM WebSphere eXtreme Scale 8.6 through 8.6.0.8 allows remote attackers to cause a denial of service via unknown vectors.
Near-miss passage: CVE-2015-0912. CWE: UNKNOWN. CVSS: 6.5. EasyCTF before 1.4 allows remote authenticated users to write executable content to files via unspecified vectors.
Query: vulnerability: Use-after-free vulnerability in the V8Window::namedPropertyGetterCustom function in bindings/core/v8/custom/V8WindowCustom.cpp in the V8 bindings in Blink, as used in Google Chrome
Matching passage: CVE-2015-1216. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in the V8Window::namedPropertyGetterCustom function in bindings/core/v8/custom/V8WindowCustom.cpp in the V8 bindings in Blink, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a frame detachment.
Near-miss passage: CVE-2015-3964. CWE: UNKNOWN. CVSS: 10.0. SMA Solar Sunny WebBox has hardcoded passwords, which makes it easier for remote attackers to obtain access via unspecified vectors.
Query: patch priority for CVE-2015-2181
Matching passage: CVE-2015-2181. CWE: CWE-119. CVSS: 8.800000190734863. Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username.
Near-miss passage: CVE-2015-0348. CWE: CWE-119. CVSS: 10.0. Buffer overflow in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors.