alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects file creation events with filename patterns used by Impacket. in logs
Matching passage: Sigma rule: Detects file creation events with filename patterns used by Impacket.. Logsource: windows / file_event. Rule: title: HackTool - Impacket File Indicators id: 03f4ca17-de95-428d-a75a-4ee78b047256 related: - id: 6e2a900a-ced9-4e4a-a9c2-13e706f9518a type: similar status: experimental description: Detects file creation events with filename patterns used by Impacket. references: - https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/ - https://github.com/fortra/impacket author: The DFIR Report, IrishDeath date: 2025-05-19 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: file_event detection: selection_names_re: TargetFilename|re: \\sessionresume_[a-zA-Z]{8}$ condition: selection_names_re falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Identifies when a VPN Tunnel Modified or Deleted in Google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud VPN Tunnel Modified or Deleted id: 99980a85-3a61-43d3-ac0f-b68d6b4797b1 status: test description: Identifies when a VPN Tunnel Modified or Deleted in Google Cloud. references: - https://any-api.com/googleapis_com/compute/docs/vpnTunnels author: Austin Songer @austinsonger date: 2021-08-16 modified: 2022-10-09 tags: - attack.impact logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name: - compute.vpnTunnels.insert - compute.vpnTunnels.delete condition: selection falsepositives: - VPN Tunnel being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - VPN Tunnel modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: risk of Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the require_ssl setting is set to true, which allows remote attackers to obtain user credential
Matching passage: CVE-2015-5152. CWE: CWE-200. CVSS: 8.100000381469727. Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the require_ssl setting is set to true, which allows remote attackers to obtain user credentials via a man-in-the-middle attack.
Near-miss passage: CVE-2015-6471. CWE: CWE-200. CVSS: 5.300000190734863. Eaton Cooper Power Systems ProView 4.x and 5.x before 5.1 on Form 6 controls and Idea and IdeaPLUS relays does not properly initialize padding fields in Ethernet packets, which allows remote attackers to obtain sensitive information by reading packet data.
Query: exploit Unspecified vulnerability in Oracle Java SE 8u60 and JavaFX 2.2.85 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2015-49
Matching passage: CVE-2015-4916. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 8u60 and JavaFX 2.2.85 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2015-4906 and CVE-2015-4908.
Near-miss passage: CVE-2015-8543. CWE: UNKNOWN. CVSS: 7.0. The networking implementation in the Linux kernel through 4.3.3, as used in Android and other products, does not validate protocol identifiers for certain protocol families, which allows local users to cause a denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by leveraging CLONE_NEWUSER support to execute a crafted SOCK_RAW application.
Query: detection rule: Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. W
Matching passage: Sigma rule: Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. W. Logsource: windows / dns_query. Rule: title: DNS Query Request To OneLaunch Update Service id: df68f791-ad95-447f-a271-640a0dab9cf8 status: test description: 'Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. When the OneLaunch application is installed it will attempt to get updates from this domain. ' references: - https://www.malwarebytes.com/blog/detections/pup-optional-onelaunch-silentcf - https://www.myantispyware.com/2020/12/14/how-to-uninstall-onelaunch-browser-removal-guide/ - https://malware.guide/browser-hijacker/remove-onelaunch-virus/ author: Josh Nickels date: 2024-02-26 tags: - attack.credential-access - attack.collection - attack.t1056 logsource: category: dns_query product: windows detection: selection: QueryName: update.onelaunch.com Image|endswith: \OneLaunch.exe condition: selection falsepositives: - Unlikely level: low
Near-miss passage: Sigma rule: Detects registry modifications that disable Privacy Settings Experience. Logsource: windows / registry_set. Rule: title: Disable Privacy Settings Experience in Registry id: 0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b status: test description: Detects registry modifications that disable Privacy Settings Experience references: - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1562.001/T1562.001.md author: frack113 date: 2022-10-02 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \SOFTWARE\Policies\Microsoft\Windows\OOBE\DisablePrivacyExperience Details: DWORD (0x00000000) condition: selection falsepositives: - Legitimate admin script level: medium
Query: patch priority for CVE-2015-2898
Matching passage: CVE-2015-2898. CWE: CWE-119. CVSS: 6.800000190734863. Multiple stack-based buffer overflows in Medicomp MEDCIN Engine before 2.22.20153.226 might allow remote attackers to execute arbitrary code via a crafted packet on port 8190, related to (1) the SetGroupSequenceEx na_setgroupsequenceex function, (2) the FormatDate julptostr function, and (3) the UserFindingCodes addtocl function.
Near-miss passage: CVE-2015-3144. CWE: CWE-119. CVSS: 9.0. The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80."
Query: vulnerability: The Health Check tool in IBM Sterling B2B Integrator 5.2 does not properly use cookies in conjunction with HTTPS sessions, which allows man-in-the-middle attackers to obtain sensit
Matching passage: CVE-2015-7410. CWE: CWE-17. CVSS: 7.400000095367432. The Health Check tool in IBM Sterling B2B Integrator 5.2 does not properly use cookies in conjunction with HTTPS sessions, which allows man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors.
Near-miss passage: CVE-2015-1217. CWE: CWE-17. CVSS: 7.5. The V8LazyEventListener::prepareListenerObject function in bindings/core/v8/V8LazyEventListener.cpp in the V8 bindings in Blink, as used in Google Chrome before 41.0.2272.76, does not properly compile listeners, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."
Query: CVE similar to CVE-2015-4919
Matching passage: CVE-2015-4919. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Monitoring and Diagnostics SEC.
Near-miss passage: CVE-2015-7718. CWE: UNKNOWN. CVSS: 5.0. mediaserver in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to cause a denial of service (process crash) via unspecified vectors, aka internal bug 22278703, a different vulnerability than CVE-2015-6605.
Query: CWE for Path Traversal: '/dir/../filename'
Matching passage: CWE-26 Path Traversal: '/dir/../filename'. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize /dir/../filename sequences that can resolve to a location that is outside of that directory.
Near-miss passage: CWE-611 Improper Restriction of XML External Entity Reference. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Query: risk of The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 
Matching passage: CVE-2015-4216. CWE: CWE-200. CVSS: 5.0. The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 2015-06-25 uses the same default SSH root authorized key across different customers' installations, which makes it easier for remote attackers to bypass authentication by leveraging knowledge of a private key from another installation, aka Bug IDs CSCuu95988, CSCuu95994, and CSCuu96630.
Near-miss passage: CVE-2015-8601. CWE: CWE-200. CVSS: 5.0. The Chat Room module 7.x-2.x before 7.x-2.2 for Drupal does not properly check permissions when setting up a websocket for chat messages, which allows remote attackers to bypass intended access restrictions and read messages from arbitrary Chat Rooms via unspecified vectors.
Query: weakness Excessive Halstead Complexity
Matching passage: CWE-1122 Excessive Halstead Complexity. The code is structured in a way that a Halstead complexity measure exceeds a desirable maximum.
Near-miss passage: CWE-653 Improper Isolation or Compartmentalization. The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.
Query: patch priority for CVE-2015-8236
Matching passage: CVE-2015-8236. CWE: CWE-264. CVSS: 10.0. Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.1 allows remote attackers to execute arbitrary code as root by leveraging management-plane access, aka Bug 138716.
Near-miss passage: CVE-2015-9012. CWE: CWE-264. CVSS: 9.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384691.
Query: Sigma YAML for firewall
Matching passage: Sigma rule: Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channel. Logsource: firewall. Rule: title: Cleartext Protocol Usage id: d7fb8f0e-bd5f-45c2-b467-19571c490d7e status: stable description: 'Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels. Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access. ' references: - https://www.cisecurity.org/controls/cis-controls-list/ - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf author: Alexandr Yampolskyi, SOC Prime, Tim Shelton date: 2019-03-26 modified: 2022-10-10 tags: - attack.credential-access logsource: category: firewall detection: selection: dst_port: - 8080 - 21 - 80 - 23 - 50000 - 1521 - 27017 - 3306 - 1433 - 11211 - 15672 - 5900 - 5901 - 5902 - 5903 - 5904 selection_allow1: action: - forward - accept - 2 selection_allow2: blocked: 'false' condition: selection and 1 of selection_allow* falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects the execution of whoami that has been renamed to a different name to avoid detection. Logsource: windows / process_creation. Rule: title: Renamed Whoami Execution id: f1086bf7-a0c4-4a37-9102-01e573caf4a0 status: test description: Detects the execution of whoami that has been renamed to a different name to avoid detection references: - https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/ - https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/ author: Florian Roth (Nextron Systems) date: 2021-08-12 modified: 2022-10-09 tags: - attack.discovery - attack.t1033 - car.2016-03-001 logsource: category: process_creation product: windows detection: selection: OriginalFileName: whoami.exe filter: Image|endswith: \whoami.exe condition: selection and not filter falsepositives: - Unknown level: critical
Query: describe CVE-2015-8702
Matching passage: CVE-2015-8702. CWE: CWE-20. CVSS: 8.600000381469727. The DNS::GetResult function in dns.cpp in InspIRCd before 2.0.19 allows remote DNS servers to cause a denial of service (netsplit) via an invalid character in a PTR response, as demonstrated by a "\032" (whitespace) character in a hostname.
Near-miss passage: CVE-2015-7855. CWE: CWE-20. CVSS: 6.5. The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode 7 packet containing a long data value.
Query: detect Detects potential RDP connection via Mstsc using a local ".rdp" file in logs
Matching passage: Sigma rule: Detects potential RDP connection via Mstsc using a local ".rdp" file. Logsource: windows / process_creation. Rule: title: Mstsc.EXE Execution With Local RDP File id: 5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af status: test description: Detects potential RDP connection via Mstsc using a local ".rdp" file references: - https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/ - https://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/ author: Nasreddine Bencherchali (Nextron Systems), Christopher Peacock @securepeacock date: 2023-04-18 modified: 2023-04-30 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mstsc.exe - OriginalFileName: mstsc.exe selection_cli: CommandLine|endswith: - .rdp - .rdp" filter_optional_wsl: ParentImage: C:\Windows\System32\lxss\wslhost.exe CommandLine|contains: C:\ProgramData\Microsoft\WSL\wslg.rdp condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Likely with legitimate usage of ".rdp" files level: low
Near-miss passage: Sigma rule: Detects a Get-Process command on lsass process, which is in almost all cases a sign of malicious activity. Logsource: windows / ps_script. Rule: title: PowerShell Get-Process LSASS in ScriptBlock id: 84c174ab-d3ef-481f-9c86-a50d0b8e3edb status: test description: Detects a Get-Process command on lsass process, which is in almost all cases a sign of malicious activity references: - https://web.archive.org/web/20220205033028/https://twitter.com/PythonResponder/status/1385064506049630211 author: Florian Roth (Nextron Systems) date: 2021-04-23 modified: 2022-12-25 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: Get-Process lsass condition: selection falsepositives: - Legitimate certificate exports invoked by administrators or users (depends on processes in the environment - filter if unusable) level: high
Query: vulnerability: Integer overflow in the strxfrm function in the GNU C Library (aka glibc or libc6) before 2.21 allows context-dependent attackers to cause a denial of service (crash) or possibly e
Matching passage: CVE-2015-8982. CWE: CWE-190. CVSS: 8.100000381469727. Integer overflow in the strxfrm function in the GNU C Library (aka glibc or libc6) before 2.21 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow.
Near-miss passage: CVE-2015-7599. CWE: CWE-190. CVSS: 8.100000381469727. Integer overflow in the _authenticate function in svc_auth.c in Wind River VxWorks 5.5 through 6.9.4.1, when the Remote Procedure Call (RPC) protocol is enabled, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a username and password.
Query: detection rule: Detects PowerShell scripts that have capabilities to read files, loop through them and resolve DNS host entries.
Matching passage: Sigma rule: Detects PowerShell scripts that have capabilities to read files, loop through them and resolve DNS host entries.. Logsource: windows / ps_script. Rule: title: PowerShell Script With File Hostname Resolving Capabilities id: fbc5e92f-3044-4e73-a5c6-1c4359b539de status: test description: Detects PowerShell scripts that have capabilities to read files, loop through them and resolve DNS host entries. references: - https://www.fortypoundhead.com/showcontent.asp?artid=24022 - https://labs.withsecure.com/publications/fin7-target-veeam-servers author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-05 tags: - attack.exfiltration - attack.t1020 logsource: product: windows category: ps_script definition: bade5735-5ab0-4aa7-a642-a11be0e40872 detection: selection: ScriptBlockText|contains|all: - 'Get-content ' - foreach - '[System.Net.Dns]::GetHostEntry' - Out-File condition: selection falsepositives: - The same functionality can be implemented by admin scripts, correlate with name and creator level: medium
Near-miss passage: Sigma rule: Detect a system being shutdown or put into different boot mode. Logsource: cisco / aaa. Rule: title: Cisco Denial of Service id: d94a35f0-7a29-45f6-90a0-80df6159967c status: test description: Detect a system being shutdown or put into different boot mode author: Austin Clark date: 2019-08-15 modified: 2023-01-04 tags: - attack.impact - attack.t1495 - attack.t1529 - attack.t1565.001 logsource: product: cisco service: aaa detection: keywords: - shutdown - config-register 0x2100 - config-register 0x2142 condition: keywords falsepositives: - Legitimate administrators may run these commands, though rarely. level: medium
Query: Outbound C2 pattern associated with VNC
Matching passage: T1021.005 VNC. Tactics: lateral movement. Description: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely control machines using Virtual Network Computing (VNC). VNC is a platform-independent desktop sharing system that uses the RFB (“remote framebuffer”) protocol to enable users to remotely control another computer’s display by relaying the screen, mouse, and keyboard inputs over the network.(Citation: The Remote Framebuffer Protocol) VNC differs from [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) as VNC is screen-sharing software rather than resource-sharing software. By default, VNC uses the system's authentication, but it can be configured to use credentials specific to VNC.(Citation: MacOS VNC software for Remote Desktop)(Citation: VNC Authentication) Adversaries may abuse VNC to perform malicious actions as the logged-on user such as opening documents, downloading files, and running arbitrary commands. An adversary could use VNC to remotely control and monitor a system to collect data and information to pivot to other systems within the network. Specific VNC libraries/implementations have also been susceptible to brute force attacks and memory usage exploitation.(Citation: Hijacking VNC)(Citation: macOS root VNC login without authentication)(Citation: VNC Vulnerabilities)(Citation: Offensive Security VNC Authentication Check)(Citation: Attacking VNC Servers PentestLab)(Citation: Havana authentication bug)
Near-miss passage: T1021.001 Remote Desktop Protocol. Tactics: lateral movement. Description: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services) Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. Adversaries may also use RDP in conjunction with the [Accessibility Features](https://attack.mitre.org/techniques/T1546/008) or [Terminal Services DLL](https://attack.mitre.org/techniques/T1505/005) for Persistence.(Citation: Alperovitch Malware)
Query: SOC runbook when seeing SIEM correlation: collection activity consistent with Data from Cloud Storage
Matching passage: Playbook for T1530 Data from Cloud Storage. 1) Validate alert telemetry against T1530. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: collection. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may access data from cloud storage. Many IaaS providers offer solutions for online data object storage such as Amazon S3, Azure Storage, and Google Cloud Storage. Similarly, SaaS enterprise platforms such as Office 365 and Google Workspace provide cloud-based document storage to users through services such as OneDrive and Google Drive, while SaaS application providers such as Slack, Co
Near-miss passage: Playbook for T1557.001 Name Resolution Poisoning and SMB Relay. Different response path focused on credential access, collection.