alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: collection using Archive Collected Data
Matching passage: T1560 Archive Collected Data. Tactics: collection. Description: An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.(Citation: DOJ GRU Indictment Jul 2018) Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender. Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.
Near-miss passage: T1560.001 Archive via Utility. Tactics: collection. Description: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport. Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as <code>tar</code> on Linux and macOS or <code>zip</code> on Windows systems. On Windows, <code>diantz</code> or <code> makecab</code> may be used to package collected files into a cabinet (.cab) file. <code>diantz</code> may also be used to download and compress files from remote locations (i.e. [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002)).(Citation: diantz.exe_lolbas) <code>xcopy</code> on Windows can copy files and directories with a variety of options. Additionally, adversaries may use [certutil](https://attack.mitre.org/software/S0160) to Base64 encode collected data before exfiltration. Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.(Citation: 7zip Homepage)(Citation: WinRAR Homepage)(Citation: WinZip Homepage)
Query: vulnerability: Cisco Identity Services Engine (ISE) before 2.0 allows remote authenticated users to bypass intended web-resource access restrictions via a direct request, aka Bug ID CSCuu45926.
Matching passage: CVE-2015-6317. CWE: CWE-284. CVSS: 6.5. Cisco Identity Services Engine (ISE) before 2.0 allows remote authenticated users to bypass intended web-resource access restrictions via a direct request, aka Bug ID CSCuu45926.
Near-miss passage: CVE-2015-0694. CWE: CWE-284. CVSS: 5.0. Cisco ASR 9000 devices with software 5.3.0.BASE do not recognize that certain ACL entries have a single-host constraint, which allows remote attackers to bypass intended network-resource access restrictions by using an address that was not supposed to have been allowed, aka Bug ID CSCur28806.
Query: alert when Detects the use of PowerShell to identify the current logged user.
Matching passage: Sigma rule: Detects the use of PowerShell to identify the current logged user.. Logsource: windows / ps_script. Rule: title: Suspicious PowerShell Get Current User id: 4096a49c-7de4-4da0-a230-c66ccd56ea5a status: test description: Detects the use of PowerShell to identify the current logged user. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md#atomic-test-4---user-discovery-with-env-vars-powershell-script - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md#atomic-test-5---getcurrent-user-with-powershell-script author: frack113 date: 2022-04-04 tags: - attack.discovery - attack.t1033 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - '[System.Environment]::UserName' - $env:UserName - '[System.Security.Principal.WindowsIdentity]::GetCurrent()' condition: selection falsepositives: - Legitimate PowerShell scripts level: low
Near-miss passage: Sigma rule: Detects the execution of Radmin which can be abused by an adversary to remotely control Windows machines. Logsource: windows / process_creation. Rule: title: PUA - Radmin Viewer Utility Execution id: 5817e76f-4804-41e6-8f1d-5fa0b3ecae2d status: test description: Detects the execution of Radmin which can be abused by an adversary to remotely control Windows machines references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1072/T1072.md - https://www.radmin.fr/ author: frack113 date: 2022-01-22 modified: 2023-12-11 tags: - attack.execution - attack.lateral-movement - attack.t1072 logsource: category: process_creation product: windows detection: selection: - Description: Radmin Viewer - Product: Radmin Viewer - OriginalFileName: Radmin.exe condition: selection falsepositives: - Unknown level: medium
Query: risk of A vulnerability, which was classified as critical, has been found in jeff-kelley opensim-utils. Affected by this issue is the function DatabaseForRegion of the file regionscrits.ph
Matching passage: CVE-2015-10016. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability, which was classified as critical, has been found in jeff-kelley opensim-utils. Affected by this issue is the function DatabaseForRegion of the file regionscrits.php. The manipulation of the argument region leads to sql injection. The patch is identified as c29e5c729a833a29dbf5b1e505a0553fe154575e. It is recommended to apply a patch to fix this issue. VDB-217550 is the identifier assigned to this vulnerability.
Near-miss passage: CVE-2015-9315. CWE: CWE-89. CVSS: 9.800000190734863. The newstatpress plugin before 1.0.1 for WordPress has SQL injection.
Query: detect Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Us in logs
Matching passage: Sigma rule: Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Us. Logsource: windows / registry_set. Rule: title: Hiding User Account Via SpecialAccounts Registry Key id: f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd related: - id: 8a58209c-7ae6-4027-afb0-307a78e4589a type: obsolete - id: 9ec9fb1b-e059-4489-9642-f270c207923d type: similar status: test description: Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen. references: - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1564.002/T1564.002.md#atomic-test-3---create-hidden-user-in-registry author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2022-07-12 modified: 2023-01-26 tags: - attack.stealth - attack.t1564.002 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_special_accounts/info.yml simulation: - type: atomic-red-team name: Create Hidden User in Registry technique: T1564.002 atomic_guid: 173126b7-afe4-45eb-8680-fa9f6400431c
Near-miss passage: Sigma rule: Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the. Logsource: windows / process_creation. Rule: title: Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths id: c74c0390-3e20-41fd-a69a-128f0275a5ea related: - id: 59b39960-5f9d-4a49-9cef-1e4d2c1d0cb9 type: derived status: test description: 'Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the "/extract" argument from potentially suspicious paths. ' references: - https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html - https://www.echotrail.io/insights/search/wusa.exe/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 modified: 2023-11-28 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_root: Image|endswith: \wusa.exe CommandLine|contains: '/extract:' selection_paths: CommandLine|contains: - :\PerfLogs\ - :\Users\Public\ - :\Windows\Temp\ - \Appdata\Local\Temp\ condition: all of selection_* falsepositives: - Unknown level: high
Query: detection rule: Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remov
Matching passage: Sigma rule: Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remov. Logsource: windows / process_creation. Rule: title: Service Registry Key Deleted Via Reg.EXE id: 05b2aa93-1210-42c8-8d9a-2fcc13b284f5 status: test description: Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remove AV software services references: - https://www.virustotal.com/gui/file/2bcd5702a7565952c44075ac6fb946c7780526640d1264f692c7664c02c68465 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-01 modified: 2023-02-04 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: reg.exe - OriginalFileName: reg.exe selection_delete: CommandLine|contains: ' delete ' selection_key: CommandLine|contains: \SYSTEM\CurrentControlSet\services\ condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the creation of files with suspicious file extensions in the temporary directory that Outlook uses when opening. Logsource: windows / file_event. Rule: title: Suspicious File Created in Outlook Temporary Directory id: fabb0e80-030c-4e3e-a104-d09676991ac3 related: - id: f748c45a-f8d3-4e6f-b617-fe176f695b8f type: obsolete status: experimental description: 'Detects the creation of files with suspicious file extensions in the temporary directory that Outlook uses when opening attachments. This can be used to detect spear-phishing campaigns that use suspicious files as attachments, which may contain malicious code. ' references: - https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/ - https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/ - https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/ author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-07-22 tags: - attack.initial-access - attack.t1566.001 logsource: product: windows category: file_event detection: selection_extension: TargetFilename|endswith: - .cpl - .hta - .iso - .rdp - .svg - .vba - .vbe - .vbs selection_location: - TargetFilename|contains: - \AppData\Local\Packages\Microsoft.Outlook_ - \AppData\Local\Microsoft\Olk\Attachments\ - TargetFilename|contains|all: - \AppData\Local\Microsoft\Windows\ - \Content.Outlook\ condition: all of selection_* falsepositives: - Opening of headers or footers in email signatures that include SVG images or legitimate SVG attachments level: high
Query: exploit Buffer overflow in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows
Matching passage: CVE-2015-1725. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Buffer Overflow Vulnerability."
Near-miss passage: CVE-2015-9053. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in the processing of certain responses from the USIM.
Query: describe CVE-2015-6400
Matching passage: CVE-2015-6400. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Cisco Emergency Responder 10.5(1a) allow remote attackers to inject arbitrary web script or HTML via unspecified fields, aka Bug ID CSCuv25547.
Near-miss passage: CVE-2015-7916. CWE: CWE-79. CVSS: 6.5. Cross-site scripting (XSS) vulnerability in Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted query.
Query: risk of In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM96
Matching passage: CVE-2015-9144. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, while processing scheduling message information, a buffer overflow can occur.
Near-miss passage: CVE-2015-5291. CWE: CWE-119. CVSS: 6.800000190734863. Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long hostname to the server name indication (SNI) extension, which is not properly handled when creating a ClientHello message. NOTE: this identifier has been SPLIT per ADT3 due to different affected version ranges. See CVE-2015-8036 for the session ticket issue that was introduced in 1.3.0.
Query: CVE similar to CVE-2015-0264
Matching passage: CVE-2015-0264. CWE: UNKNOWN. CVSS: 5.0. Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML (1) String or (2) GenericFile object in an XPath query.
Near-miss passage: CVE-2015-4241. CWE: UNKNOWN. CVSS: 6.099999904632568. Cisco Adaptive Security Appliance (ASA) Software 9.3(2) allows remote attackers to cause a denial of service (system reload) by sending crafted OSPFv2 packets on the local network, aka Bug ID CSCut52679.
Query: risk of Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, and 6.3.6 allo
Matching passage: CVE-2015-0462. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, and 6.3.6 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
Near-miss passage: CVE-2015-7464. CWE: UNKNOWN. CVSS: 7.5. Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote attackers to cause a denial of service (Report Builder server outage) via a crafted request to a Report Builder instance URL.
Query: patch priority for CVE-2015-1030
Matching passage: CVE-2015-1030. CWE: CWE-399. CVSS: 5.0. Memory leak in the rfc2553_connect_to function in jbsocket.c in Privoxy before 3.0.22 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests that are rejected because the socket limit is reached.
Near-miss passage: CVE-2015-3961. CWE: CWE-399. CVSS: 3.5. The web-server component in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches allows remote authenticated users to cause a denial of service (memory corruption and reboot) via a crafted URL.
Query: detect Detects known sensitive file extensions accessed on a network share in logs
Matching passage: Sigma rule: Detects known sensitive file extensions accessed on a network share. Logsource: windows / security. Rule: title: Suspicious Access to Sensitive File Extensions id: 91c945bc-2ad1-4799-a591-4d00198a1215 related: - id: 286b47ed-f6fe-40b3-b3a8-35129acd43bc type: similar status: test description: Detects known sensitive file extensions accessed on a network share references: - Internal Research author: Samir Bousseaden date: 2019-04-03 modified: 2025-10-17 tags: - attack.collection - attack.t1039 logsource: product: windows service: security detection: selection: EventID: 5145 RelativeTargetName|endswith: - .bak - .dmp - .edb - .kirbi - .msg - .nsf - .nst - .oab - .ost - .pst - .rdp condition: selection falsepositives: - Help Desk operator doing backup or re-imaging end user machine or backup software - Users working with these data types or exchanging message files level: medium
Near-miss passage: Sigma rule: Identifies when a user has been assigned a privilege role and are not using that role.. Logsource: azure / pim. Rule: title: Roles Are Not Being Used id: 8c6ec464-4ae4-43ac-936a-291da66ed13d status: test description: Identifies when a user has been assigned a privilege role and are not using that role. references: - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#administrators-arent-using-their-privileged-roles author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-14 tags: - attack.initial-access - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation logsource: product: azure service: pim detection: selection: riskEventType: redundantAssignmentAlertIncident condition: selection falsepositives: - Investigate if potential generic account that cannot be removed. level: high
Query: alert when Detects when a process tries to access the memory of svchost to potentially dump credentials.
Matching passage: Sigma rule: Detects when a process tries to access the memory of svchost to potentially dump credentials.. Logsource: windows / process_access. Rule: title: Credential Dumping Attempt Via Svchost id: 174afcfa-6e40-4ae9-af64-496546389294 status: test description: Detects when a process tries to access the memory of svchost to potentially dump credentials. references: - Internal Research author: Florent Labouyrie date: 2021-04-30 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548 logsource: product: windows category: process_access detection: selection: TargetImage|endswith: \svchost.exe GrantedAccess: '0x143a' filter_main_known_processes: SourceImage|endswith: - \services.exe - \msiexec.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects enabling TurnOffCheck which can be used to bypass defense of MSDT Follina vulnerability. Logsource: windows / registry_set. Rule: title: Scripted Diagnostics Turn Off Check Enabled - Registry id: 7d995e63-ec83-4aa3-89d5-8a17b5c87c86 status: test description: Detects enabling TurnOffCheck which can be used to bypass defense of MSDT Follina vulnerability references: - https://twitter.com/wdormann/status/1537075968568877057?s=20&t=0lr18OAnmAGoGpma6grLUw author: Christopher Peacock @securepeacock, SCYTHE @scythe_io date: 2022-06-15 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: \Policies\Microsoft\Windows\ScriptedDiagnostics\TurnOffCheck Details: DWORD (0x00000001) condition: selection falsepositives: - Administrator actions level: medium
Query: CVE similar to CVE-2015-0531
Matching passage: CVE-2015-0531. CWE: CWE-284. CVSS: 5.0. EMC SourceOne Email Management before 7.2 does not have a lockout mechanism for invalid login attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.
Near-miss passage: CVE-2015-1253. CWE: CWE-284. CVSS: 7.5. core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that appends a child to a SCRIPT element, related to the insert and executeReparentTask functions.
Query: exploit Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Ex
Matching passage: CVE-2015-0017. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0020, CVE-2015-0022, CVE-2015-0026, CVE-2015-0030, CVE-2015-0031, CVE-2015-0036, and CVE-2015-0041.
Near-miss passage: CVE-2015-2778. CWE: CWE-399. CVSS: 5.0. Quassel before 0.12-rc1 uses an incorrect data-type size when splitting a message, which allows remote attackers to cause a denial of service (crash) via a long CTCP query containing only multibyte characters.
Query: CVE similar to CVE-2015-3152
Matching passage: CVE-2015-3152. CWE: CWE-295. CVSS: 5.900000095367432. Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, aka a "BACKRONYM" attack.
Near-miss passage: CVE-2015-0294. CWE: CWE-295. CVSS: 7.5. GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate.