alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects file and folder permission changes.
Matching passage: Sigma rule: Detects file and folder permission changes.. Logsource: linux / auditd. Rule: title: File or Folder Permissions Change id: 74c01ace-0152-4094-8ae2-6fd776dd43e5 status: test description: Detects file and folder permission changes. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.002/T1222.002.md author: Jakob Weinzettl, oscd.community date: 2019-09-23 modified: 2021-11-27 tags: - attack.defense-impairment - attack.t1222.002 logsource: product: linux service: auditd detection: selection: type: EXECVE a0|contains: - chmod - chown condition: selection falsepositives: - User interacting with files permissions (normal/daily behaviour). level: low
Near-miss passage: Sigma rule: Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privile. Logsource: linux / auditd. Rule: title: Potential Abuse of Linux Magic System Request Key id: ea61bb82-a5e0-42e6-8537-91d29500f1b9 status: experimental description: 'Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf. ' references: - https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel - https://www.splunk.com/en_us/blog/security/threat-update-awfulshred-script-wiper.html author: Milad Cheraghi date: 2025-05-23 tags: - attack.execution - attack.t1059.004 - attack.impact - attack.t1529 - attack.t1489 - attack.t1499 logsource: product: linux service: auditd definition: 'Required auditd configuration: -w /proc/sysrq-trigger -p wa -k sysrq -w /proc/sys/kernel/sysrq -p wa -k sysrq ' detection: selection: type: PATH name|endswith: - /sysrq - /sysctl.conf - /sysrq-trigger condition: selection falsepositives: - Legitimate administrative activity level: medium
Query: actor TTPs: Email Forwarding Rule
Matching passage: T1114.003 Email Forwarding Rule. Tactics: collection. Description: Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.(Citation: Pfammatter - Hidden Inbox Rules) Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient. These rules may be created through a local email application, a web interface, or by command-line interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2)(Citation: Mac Forwarding Rules) Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more. Adversaries may also hide the rule by making use of the Microsoft Messaging API (MAPI) to modify the rule properties, making it hidden and not visible from Outlook, OWA or most Exchange Administration tools.(Citation: Pfammatter - Hidden Inbox Rules) In some environments, administrators may be able to enable email forwarding rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.(Citation: Microsof
Near-miss passage: T1114.002 Remote Email Collection. Tactics: collection. Description: Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords.
Query: describe CVE-2015-8840
Matching passage: CVE-2015-8840. CWE: CWE-862. CVSS: 8.800000190734863. The XML Data Archiving Service (XML DAS) in SAP NetWeaver AS Java does not check authorization, which allows remote authenticated users to obtain sensitive information, gain privileges, or possibly have unspecified other impact via requests to (1) webcontent/cas/cas_enter.jsp, (2) webcontent/cas/cas_validate.jsp, or (3) webcontent/aas/aas_store.jsp, aka SAP Security Note 1945215.
Near-miss passage: CVE-2015-0571. CWE: CWE-862. CVSS: 7.800000190734863. The WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not verify authorization for private SET IOCTL calls, which allows attackers to gain privileges via a crafted application, related to wlan_hdd_hostapd.c and wlan_hdd_wext.c.
Query: CVE similar to CVE-2015-8411
Matching passage: CVE-2015-8411. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-0508. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB, a different vulnerability than CVE-2015-0506.
Query: exploit Microsoft .NET Framework 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to cause a denial of service to an ASP.NET web site via crafted requests, aka "MVC Denial of Service Vul
Matching passage: CVE-2015-2526. CWE: CWE-17. CVSS: 5.0. Microsoft .NET Framework 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to cause a denial of service to an ASP.NET web site via crafted requests, aka "MVC Denial of Service Vulnerability."
Near-miss passage: CVE-2015-4620. CWE: CWE-17. CVSS: 7.800000190734863. name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DNSSEC validation, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) by constructing crafted zone data and then making a query for a name in that zone.
Query: describe CVE-2015-1402
Matching passage: CVE-2015-1402. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-8797. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/plugins.js in the stats page in the Admin UI in Apache Solr before 5.3.1 allows remote attackers to inject arbitrary web script or HTML via the entry parameter to a plugins/cache URI.
Query: describe CVE-2015-1443
Matching passage: CVE-2015-1443. CWE: CWE-20. CVSS: 8.800000190734863. The httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allows remote attackers to execute arbitrary code.
Near-miss passage: CVE-2015-5014. CWE: CWE-20. CVSS: 9.300000190734863. IBM Cognos Disclosure Management (CDM) 10.1.x and 10.2.x before 10.2.4 IF10 allows man-in-the-middle attackers to obtain access by spoofing an executable file during a client upload operation.
Query: detection rule: Detects a suspicious child process of Script Event Consumer (scrcons.exe).
Matching passage: Sigma rule: Detects a suspicious child process of Script Event Consumer (scrcons.exe).. Logsource: windows / process_creation. Rule: title: Script Event Consumer Spawning Process id: f6d1dd2f-b8ce-40ca-bc23-062efb686b34 status: test description: Detects a suspicious child process of Script Event Consumer (scrcons.exe). references: - https://redcanary.com/blog/child-processes/ - https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-analytics-alert-reference/cortex-xdr-analytics-alert-reference/scrcons-exe-rare-child-process.html author: Sittikorn S date: 2021-06-21 modified: 2022-07-14 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \scrcons.exe Image|endswith: - \svchost.exe - \dllhost.exe - \powershell.exe - \pwsh.exe - \wscript.exe - \cscript.exe - \schtasks.exe - \regsvr32.exe - \mshta.exe - \rundll32.exe - \msiexec.exe - \msbuild.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects attackers attempting to disable Windows Defender using Powershell. Logsource: windows / process_creation. Rule: title: Disable Windows Defender AV Security Monitoring id: a7ee1722-c3c5-aeff-3212-c777e4733217 status: test description: Detects attackers attempting to disable Windows Defender using Powershell references: - https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/ - https://rvsec0n.wordpress.com/2020/01/24/malwares-that-bypass-windows-defender/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md author: ok @securonix invrep-de, oscd.community, frack113 date: 2020-10-12 modified: 2022-11-18 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_pwsh_binary: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_pwsh_cli: CommandLine|contains: - -DisableBehaviorMonitoring $true - -DisableRuntimeMonitoring $true selection_sc_binary: - Image|endswith: \sc.exe - OriginalFileName: sc.exe selection_sc_tamper_cmd_stop: CommandLine|contains|all: - stop - WinDefend selection_sc_tamper_cmd_delete: CommandLine|contains|all: - delete - WinDefend selection_sc_tamper_cmd_disabled: CommandLine|contains|all: - config - WinDefend - start=disabled condition: all of selection_pwsh_* or (selection_sc_binary and 1 of selection_sc_tamper_*) falsepositives: - Minimal, for some older versions of dev tools, such as pycharm, developers were known to sometimes disable Windows Defender to improve performance, but this generally is not considered a good security practice. level: high
Query: mitigate Internal Proxy
Matching passage: T1090.001 Internal Proxy. Tactics: command and control. Description: Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment. By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.
Near-miss passage: T1090 Proxy. Tactics: command and control. Description: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.
Query: risk of The ff_mpv_common_init function in libavcodec/mpegvideo.c in FFmpeg before 2.7.2 does not properly maintain the encoding context, which allows remote attackers to cause a denial of
Matching passage: CVE-2015-6821. CWE: CWE-20. CVSS: 7.5. The ff_mpv_common_init function in libavcodec/mpegvideo.c in FFmpeg before 2.7.2 does not properly maintain the encoding context, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted MPEG data.
Near-miss passage: CVE-2015-9052. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached while processing a downlink message.
Query: risk of SecurityAgent in Apple OS X before 10.11.1 does not prevent synthetic clicks from reaching keychain windows, which allows attackers to bypass intended access restrictions via a cra
Matching passage: CVE-2015-5943. CWE: CWE-254. CVSS: 4.300000190734863. SecurityAgent in Apple OS X before 10.11.1 does not prevent synthetic clicks from reaching keychain windows, which allows attackers to bypass intended access restrictions via a crafted app.
Near-miss passage: CVE-2015-8615. CWE: CWE-254. CVSS: 5.0. The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ).
Query: alert when Detects suspicious file writes to the root directory of web applications, particularly Apache web servers or Tomcat serv
Matching passage: Sigma rule: Detects suspicious file writes to the root directory of web applications, particularly Apache web servers or Tomcat serv. Logsource: windows / file_event. Rule: title: Suspicious File Write to Webapps Root Directory id: 89c42960-f244-4dad-9151-ae9b1a3287a2 status: experimental description: 'Detects suspicious file writes to the root directory of web applications, particularly Apache web servers or Tomcat servers. This may indicate an attempt to deploy malicious files such as web shells or other unauthorized scripts. ' references: - https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-10-20 tags: - attack.persistence - attack.t1505.003 - attack.initial-access - attack.t1190 logsource: product: windows category: file_event detection: selection_susp_img: Image|endswith: - \dotnet.exe - \w3wp.exe - \java.exe selection_servers: TargetFilename|contains: - \apache - \tomcat selection_path: TargetFilename|contains: \webapps\ROOT\ selection_susp_extensions: TargetFilename|endswith: .jsp condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious access to the "svchost" process such as that used by Invoke-Phantom to kill the thread of the Windows. Logsource: windows / process_access. Rule: title: Suspicious Svchost Process Access id: 166e9c50-8cd9-44af-815d-d1f0c0e90dde status: test description: Detects suspicious access to the "svchost" process such as that used by Invoke-Phantom to kill the thread of the Windows event logging service. references: - https://github.com/hlldz/Invoke-Phant0m - https://twitter.com/timbmsft/status/900724491076214784 author: Tim Burrell date: 2020-01-02 modified: 2023-01-30 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: :\Windows\System32\svchost.exe GrantedAccess: '0x1F3FFF' CallTrace|contains: UNKNOWN filter_main_msbuild: SourceImage|contains: :\Program Files\Microsoft Visual Studio\ SourceImage|endswith: \MSBuild\Current\Bin\MSBuild.exe CallTrace|contains: - Microsoft.Build.ni.dll - System.ni.dll condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: weakness Improper Handling of Highly Compressed Data (Data Amplification)
Matching passage: CWE-409 Improper Handling of Highly Compressed Data (Data Amplification). The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
Near-miss passage: CWE-234 Failure to Handle Missing Parameter. If too few arguments are sent to a function, the function will still pop the expected number of arguments from the stack. Potentially, a variable number of arguments could be exhausted in a function as well.
Query: patch priority for CVE-2015-7449
Matching passage: CVE-2015-7449. CWE: CWE-200. CVSS: 3.299999952316284. IBM Rational Collaborative Lifecycle Management (CLM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Quality Manager (RQM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Team Concert (RTC) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Requirements Composer (RRC) 4.0.x before 4.0.7 iFix10; Rational DOORS Next Generation (RDNG) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Engineering Lifecycle Manager (RELM) 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7 before iFix1, 5.0.x before 5.0.2 iFix1, and 6.0.x before 6.0.2; Rational Rhapsody Design Manager (Rhapsody DM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Software Architect Design Manager (RSA DM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2 allow local users to obtain sensitive information by leveraging weak encryption. IBM X-Force ID: 108221.
Near-miss passage: CVE-2015-1357. CWE: CWE-200. CVSS: 5.0. Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware before SS4.4.4624.35, WIN70xx devices with firmware before BS4.4.4621.32, and WIN72xx devices with firmware before BS4.4.4621.32 allow context-dependent attackers to discover password hashes by reading (1) files or (2) security logs.
Query: risk of The document.cookie API implementation in the CFNetwork Cookies subsystem in WebKit in Apple iOS before 9 allows remote attackers to bypass an intended single-cookie restriction vi
Matching passage: CVE-2015-3801. CWE: CWE-264. CVSS: 5.0. The document.cookie API implementation in the CFNetwork Cookies subsystem in WebKit in Apple iOS before 9 allows remote attackers to bypass an intended single-cookie restriction via unspecified vectors.
Near-miss passage: CVE-2015-6607. CWE: CWE-264. CVSS: 6.800000190734863. SQLite before 3.8.9, as used in Android before 5.1.1 LMY48T, allows attackers to gain privileges via a crafted application, aka internal bug 20099586.
Query: risk of ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote authenticated users to bypass intended access restrictions via a modified request, as demonstrated by lever
Matching passage: CVE-2015-7249. CWE: CWE-264. CVSS: 4.900000095367432. ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote authenticated users to bypass intended access restrictions via a modified request, as demonstrated by leveraging the support account to change a password via a cgi-bin/webproc accountpsd action.
Near-miss passage: CVE-2015-1702. CWE: CWE-264. CVSS: 6.900000095367432. The Service Control Manager (SCM) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Service Control Manager Elevation of Privilege Vulnerability."