alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous befo
Matching passage: CVE-2015-5104. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3095, CVE-2015-5087, CVE-2015-5094, CVE-2015-5100, CVE-2015-5102, CVE-2015-5103, and CVE-2015-5115.
Near-miss passage: CVE-2015-8277. CWE: CWE-119. CVSS: 9.800000190734863. Multiple buffer overflows in (1) lmgrd and (2) Vendor Daemon in Flexera FlexNet Publisher before 11.13.1.2 Security Update 1 allow remote attackers to execute arbitrary code via a crafted packet with opcode (a) 0x107 or (b) 0x10a.
Query: SOC alert related to Asymmetric Cryptography
Matching passage: T1573.002 Asymmetric Cryptography. Tactics: command and control. Description: Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal. For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002).
Near-miss passage: T1573 Encrypted Channel. Tactics: command and control. Description: Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Query: vulnerability: IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to execute arbitrary commands with SYSTEM privi
Matching passage: CVE-2015-0160. CWE: CWE-264. CVSS: 9.0. IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to execute arbitrary commands with SYSTEM privileges via unspecified vectors.
Near-miss passage: CVE-2015-6619. CWE: CWE-264. CVSS: 9.300000190734863. The kernel in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, aka internal bug 23520714.
Query: alert when Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials
Matching passage: Sigma rule: Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials. Logsource: windows / security. Rule: title: Active Directory Replication from Non Machine Account - DcSync Indicator id: 17d619c1-e020-4347-957e-1d1207455c93 related: - id: 611eab06-a145-4dfa-a295-3ccc5c20f59a type: similar status: test description: Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials. references: - https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html - https://threathunterplaybook.com/library/windows/active_directory_replication.html - https://threathunterplaybook.com/hunts/windows/190101-ADModDirectoryReplication/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-07-26 modified: 2026-07-30 tags: - attack.credential-access - attack.t1003.006 logsource: product: windows service: security definition: 'Requirements: A SACL must be configured on the domain NC root object (e.g. DC=domain,DC=com) to generate Event 4662. Add via ADSI Edit: navigate to the domain NC root → Properties → Security → Advanced → Auditing → add an ACE for Everyone, Type: Success, Applies to: This object only, rights: DS-Replication-Get-Changes and DS-Replication-Get-Changes-All. The OS audit subcategory must also be enabled: auditpol /set /subcategory:"Directory Service Access" /success:enable ' detection: selection: EventID: 4662 Properties|contains: - 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 - 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 - 9923a32a-3607-11d2-b9be-0000f87a36b2 - 89e95b76-444d-4c62-991a-0facbeda640c filter_main_machine_accounts: SubjectUserName|endswith: $ filter_optional_subject_domain: SubjectDomainName: Window Manager filter_optional_subject_usersid: SubjectUserName|startswith: - NT AUT - MSOL_ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the use of the Dinject PowerShell cradle based on the specific flags. Logsource: windows / process_creation. Rule: title: HackTool - DInjector PowerShell Cradle Execution id: d78b5d61-187d-44b6-bf02-93486a80de5a status: test description: Detects the use of the Dinject PowerShell cradle based on the specific flags references: - https://web.archive.org/web/20211001064856/https://github.com/snovvcrash/DInjector author: Florian Roth (Nextron Systems) date: 2021-12-07 modified: 2023-02-04 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - ' /am51' - ' /password' condition: selection falsepositives: - Unlikely level: critical
Query: risk of The ArrayBufferBuilder::append function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory lo
Matching passage: CVE-2015-2739. CWE: CWE-119. CVSS: 10.0. The ArrayBufferBuilder::append function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which has unspecified impact and attack vectors.
Near-miss passage: CVE-2015-1689. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1705.
Query: write Sigma for Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "<YOUR-BUCK
Matching passage: Sigma rule: Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "<YOUR-BUCK. Logsource: aws / cloudtrail. Rule: title: AWS IAM S3Browser Templated S3 Bucket Policy Creation id: db014773-7375-4f4e-b83b-133337c0ffee status: test description: Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "<YOUR-BUCKET-NAME>". references: - https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor author: daniel.bohannon@permiso.io (@danielhbohannon) date: 2023-05-17 tags: - attack.execution - attack.stealth - attack.t1059.009 - attack.persistence - attack.initial-access - attack.privilege-escalation - attack.t1078.004 logsource: product: aws service: cloudtrail detection: selection: eventSource: iam.amazonaws.com eventName: PutUserPolicy userAgent|contains: S3 Browser requestParameters|contains|all: - '"arn:aws:s3:::<YOUR-BUCKET-NAME>/*"' - '"s3:GetObject"' - '"Allow"' condition: selection falsepositives: - Valid usage of S3 browser with accidental creation of default Inline IAM policy without changing default S3 bucket name placeholder value level: high
Near-miss passage: Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / process_creation. Rule: title: Remote Access Tool - UltraViewer Execution id: 88656cec-6c3b-487c-82c0-f73ebb805503 status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md author: frack113 date: 2022-09-25 modified: 2024-03-14 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: - Product: UltraViewer - Company: DucFabulous Co,ltd - OriginalFileName: UltraViewer_Desktop.exe condition: selection falsepositives: - Legitimate use level: medium
Query: exploit Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0 6.3.1, 6.3.2, 6.3.4, and 6.3.5 allows remote attac
Matching passage: CVE-2015-0431. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0 6.3.1, 6.3.2, 6.3.4, and 6.3.5 allows remote attackers to affect integrity via unknown vectors related to UI Infrastructure.
Near-miss passage: CVE-2015-4841. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM IP2014 and IP2015 allows remote attackers to affect confidentiality via unknown vectors related to Services.
Query: detect Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS server, cre in logs
Matching passage: Sigma rule: Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS server, cre. Logsource: windows / file_event. Rule: title: Suspicious File Created by ArcSOC.exe id: e890acee-d488-420e-8f20-d9b19b3c3d43 status: experimental description: 'Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS server, creates a file with suspicious file type, indicating that it may be an executable, script file, or otherwise unusual. ' references: - https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/ - https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm author: Micah Babinski date: 2025-11-25 tags: - attack.command-and-control - attack.persistence - attack.initial-access - attack.execution - attack.stealth - attack.t1127 - attack.t1105 - attack.t1133 logsource: category: file_event product: windows detection: selection: Image|endswith: \ArcSOC.exe TargetFilename|endswith: - .ahk - .aspx - .au3 - .bat - .cmd - .dll - .exe - .hta - .js - .ps1 - .py - .vbe - .vbs - .wsf condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects extracting of zip file from image file. Logsource: linux / auditd. Rule: title: Steganography Unzip Hidden Information From Picture File id: edd595d7-7895-4fa7-acb3-85a18a8772ca status: test description: Detects extracting of zip file from image file references: - https://zerotoroot.me/steganography-hiding-a-zip-in-a-jpeg-file/ author: Pawel Mazur date: 2021-09-09 modified: 2022-10-09 tags: - attack.stealth - attack.t1027.003 logsource: product: linux service: auditd detection: commands: type: EXECVE a0: unzip a1: a1|endswith: - .jpg - .png condition: commands and a1 falsepositives: - Unknown level: low
Query: vulnerability: MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not throttle file uploads, which allows remote authenticated users to have unspecified impact via mult
Matching passage: CVE-2015-8003. CWE: CWE-399. CVSS: 6.800000190734863. MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not throttle file uploads, which allows remote authenticated users to have unspecified impact via multiple file uploads.
Near-miss passage: CVE-2015-1740. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1735, CVE-2015-1744, CVE-2015-1745, and CVE-2015-1766.
Query: Sigma YAML for webserver
Matching passage: Sigma rule: Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the. Logsource: webserver. Rule: title: F5 BIG-IP iControl Rest API Command Execution - Webserver id: 85254a62-22be-4239-b79c-2ec17e566c37 related: - id: b59c98c6-95e8-4d65-93ee-f594dfb96b17 type: similar status: test description: Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP references: - https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash - https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029 - https://community.f5.com/t5/technical-forum/running-bash-commands-via-rest-api/td-p/272516 author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo date: 2023-11-08 tags: - attack.execution - attack.t1190 - attack.initial-access logsource: category: webserver detection: selection: cs-method: POST cs-uri-query|endswith: /mgmt/tm/util/bash condition: selection falsepositives: - Legitimate usage of the BIG IP REST API to execute command for administration purposes level: medium
Near-miss passage: Sigma rule: Identifies when a Firewall Rule Configuration is Modified or Deleted.. Logsource: azure / activitylogs. Rule: title: Azure Firewall Rule Configuration Modified or Deleted id: 2a7d64cf-81fa-4daf-ab1b-ab80b789c067 status: test description: Identifies when a Firewall Rule Configuration is Modified or Deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-08-08 modified: 2022-08-23 tags: - attack.impact logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.NETWORK/FIREWALLPOLICIES/RULECOLLECTIONGROUPS/WRITE - MICROSOFT.NETWORK/FIREWALLPOLICIES/RULECOLLECTIONGROUPS/DELETE - MICROSOFT.NETWORK/FIREWALLPOLICIES/RULEGROUPS/WRITE - MICROSOFT.NETWORK/FIREWALLPOLICIES/RULEGROUPS/DELETE condition: selection falsepositives: - Firewall Rule Configuration being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Firewall Rule Configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: what is T1610
Matching passage: T1610 Deploy Container. Tactics: execution. Description: Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment. In Kubernetes environments, an adversary may attempt to deploy a privileged or vulnerable container into a specific node in order to [Escape to Host](https://attack.mitre.org/techniques/T1611) and access other containers running on the node. (Citation: AppSecco Kubernetes Namespace Breakout 2020) Containers can be deployed by various means, such as via Docker's <code>create</code> and <code>start</code> APIs or via a web application such as the Kubernetes dashboard or Kubeflow. (Citation: Docker Container)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) In Kubernetes environments, containers may be deployed through workloads such as ReplicaSets or DaemonSets, which can allow containers to be deployed across multiple nodes.(Citation: Kubernetes Workload Management) Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts)
Near-miss passage: T1059.008 Network Device CLI. Tactics: execution. Description: Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads. The CLI is the primary means through which users and administrators interact with the device in order to view system information, modify device operations, or perform diagnostic and administrative functions. CLIs typically contain various permission levels required for different commands. Scripting interpreters automate tasks and extend functionality beyond the command set included in the network OS. The CLI and scripting interpreter are accessible through a direct console connection, or through remote means, such as telnet or [SSH](https://attack.mitre.org/techniques/T1021/004). Adversaries can use the network CLI to change how network devices behave and operate. The CLI may be used to manipulate traffic flows to intercept or manipulate data, modify startup configuration parameters to load malicious system software, or to disable security features or logging to avoid detection.(Citation: Cisco Synful Knock Evolution)
Query: describe CVE-2015-1677
Matching passage: CVE-2015-1677. CWE: CWE-200. CVSS: 2.0999999046325684. The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to bypass the ASLR protection mechanism via a crafted function call, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability," a different vulnerability than CVE-2015-1676, CVE-2015-1678, CVE-2015-1679, and CVE-2015-1680.
Near-miss passage: CVE-2015-4263. CWE: CWE-200. CVSS: 4.0. The Control and Provisioning functionality in Cisco Mobility Services Engine (MSE) 10.0(0.1) allows remote authenticated users to obtain sensitive information by reading log files, aka Bug ID CSCut36851.
Query: Sigma rule for Detects execution of the binary "wpbbin" which is used as part of the UEFI based persistence method described in the ref
Matching passage: Sigma rule: Detects execution of the binary "wpbbin" which is used as part of the UEFI based persistence method described in the ref. Logsource: windows / process_creation. Rule: title: UEFI Persistence Via Wpbbin - ProcessCreation id: 4abc0ec4-db5a-412f-9632-26659cddf145 status: test description: Detects execution of the binary "wpbbin" which is used as part of the UEFI based persistence method described in the reference section references: - https://grzegorztworek.medium.com/using-uefi-to-inject-executable-files-into-bitlocker-protected-drives-8ff4ca59c94c - https://persistence-info.github.io/Data/wpbbin.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-18 tags: - attack.persistence - attack.stealth - attack.t1542.001 logsource: product: windows category: process_creation detection: selection: Image: C:\Windows\System32\wpbbin.exe condition: selection falsepositives: - Legitimate usage of the file by hardware manufacturer such as lenovo (Thanks @0gtweet for the tip) level: high
Near-miss passage: Sigma rule: Detect usage of the "ssh.exe" binary as a proxy to launch other programs.. Logsource: windows / process_creation. Rule: title: Program Executed Using Proxy/Local Command Via SSH.EXE id: 7d6d30b8-5b91-4b90-a891-46cccaf29598 status: test description: Detect usage of the "ssh.exe" binary as a proxy to launch other programs. references: - https://lolbas-project.github.io/lolbas/Binaries/Ssh/ - https://github.com/LOLBAS-Project/LOLBAS/pull/211/files - https://gtfobins.github.io/gtfobins/ssh/ - https://man.openbsd.org/ssh_config#ProxyCommand - https://man.openbsd.org/ssh_config#LocalCommand author: frack113, Nasreddine Bencherchali date: 2022-12-29 modified: 2025-10-16 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_parent: ParentImage: C:\Windows\System32\OpenSSH\sshd.exe selection_cli_img: - Image|endswith: \ssh.exe - Product: OpenSSH for Windows - Hashes|contains: - IMPHASH=55b4964d29aad5438b9e950052dbbbc0 - IMPHASH=334d66c33503ccbf647c15b47c27eef4 - IMPHASH=27b0da080ef92afb37983d30d839141e - IMPHASH=977eb4c263d384e47daa0712d34713ab - IMPHASH=3eaadce9ae43d5a918bb082065815c3b - IMPHASH=980fe6cf0d996ab1eedf877222e722aa - IMPHASH=5f959422308ac3d721010d66647e100e - IMPHASH=a49aaa3d03d1cd9c8dc7fca60f7f480b - IMPHASH=dd335f759b6d5d6a8382b71dd9d65791 selection_cli_flags: - CommandLine|contains: ProxyCommand= - CommandLine|contains|all: - PermitLocalCommand=yes - ' LocalCommand' condition: selection_parent or all of selection_cli_* falsepositives: - Legitimate usage for administration purposes level: medium
Query: exploit SQL injection vulnerability in the PHPlist Integration Module before 6.x-1.7 for Drupal allows remote administrators to execute arbitrary SQL commands via unspecified vectors, rela
Matching passage: CVE-2015-3345. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the PHPlist Integration Module before 6.x-1.7 for Drupal allows remote administrators to execute arbitrary SQL commands via unspecified vectors, related to the "phpList database."
Near-miss passage: CVE-2015-10044. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability classified as critical was found in gophergala sqldump. This vulnerability affects unknown code. The manipulation leads to sql injection. The patch is identified as 76db54e9073b5248b8863e71a63d66a32d567d21. It is recommended to apply a patch to fix this issue. VDB-218350 is the identifier assigned to this vulnerability.
Query: describe CVE-2015-1226
Matching passage: CVE-2015-1226. CWE: CWE-264. CVSS: 5.0. The DebuggerFunction::InitAgentHost function in browser/extensions/api/debugger/debugger_api.cc in Google Chrome before 41.0.2272.76 does not properly restrict what URLs are available as debugger targets, which allows remote attackers to bypass intended access restrictions via a crafted extension.
Near-miss passage: CVE-2015-3965. CWE: CWE-264. CVSS: 8.800000190734863. Hospira Symbiq Infusion System 3.13 and earlier allows remote authenticated users to trigger "unanticipated operations" by leveraging "elevated privileges" for an unspecified call to an incorrectly exposed function.