alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection engineering for Steal Application Access Token
Matching passage: T1528 Steal Application Access Token. Tactics: credential access. Description: Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS).(Citation: Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019) Adversaries who steal account API tokens in cloud and containerized environments may be able to access data and perform actions with the permissions of these accounts, which can lead to privilege escalation and further compromise of the environment. For example, in Kubernetes environments, processes running inside a container may communicate with the Kubernetes API server using service account tokens. If a container is compromised, an adversary may be able to steal the container’s token and thereby gain access to Kubernetes API commands.(Citation: Kubernetes Service Accounts) Similarly, instances within continuous-development / continuous-integration (CI/CD) pipelines will often use API tokens to authenticate to other services for testing and deployment.(Citation: Cider Security Top 10 CICD Security Risks) If these pipelines are compromised, adversaries may be able to steal these tokens and leverage their privileges. In Azure, an adversary who compromises a resource with an attached Managed Identity, such as an Azure VM, can request short-lived tokens through the Azure Instance Metadata Service (IMDS). These tokens can then facilitate unauthorized actions or further access to other Azure services, bypassing typical credential-based authentication.(Citation: Entra Managed Identities 2025)(Citation: SpecterOps Managed Identity 2022) Token theft can also occur through social engineering, in which case user action may be required to grant access. OAuth is one commonly implemented framework that issues tokens to users for access to systems. An ap
Near-miss passage: T1558.002 Silver Ticket. Tactics: credential access. Description: Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets.(Citation: ADSecurity Silver Tickets) Silver tickets are more limited in scope in than golden tickets in that they only enable adversaries to access a particular resource (e.g. MSSQL) and the system that hosts the resource; however, unlike golden tickets, adversaries with the ability to forge silver tickets are able to create TGS tickets without interacting with the Key Distribution Center (KDC), potentially making detection more difficult.(Citation: ADSecurity Detecting Forged Tickets) Password hashes for target services may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).
Query: write Sigma for Monitor and alert on group membership additions of groups that have CA policy modification access
Matching passage: Sigma rule: Monitor and alert on group membership additions of groups that have CA policy modification access. Logsource: azure / auditlogs. Rule: title: User Added To Group With CA Policy Modification Access id: 91c95675-1f27-46d0-bead-d1ae96b97cd3 status: test description: Monitor and alert on group membership additions of groups that have CA policy modification access references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner' date: 2022-08-04 tags: - attack.privilege-escalation - attack.credential-access - attack.persistence - attack.defense-impairment - attack.t1548 - attack.t1556 logsource: product: azure service: auditlogs detection: selection: properties.message: Add member from group condition: selection falsepositives: - User removed from the group is approved level: medium
Near-miss passage: Sigma rule: Detects when an internet hosted webdav share is mounted using the "net.exe" utility. Logsource: windows / process_creation. Rule: title: Windows Internet Hosted WebDav Share Mount Via Net.EXE id: 7e6237fe-3ddb-438f-9381-9bf9de5af8d0 status: test description: Detects when an internet hosted webdav share is mounted using the "net.exe" utility references: - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-21 modified: 2023-07-25 tags: - attack.lateral-movement - attack.t1021.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: CommandLine|contains|all: - ' use ' - ' http' condition: all of selection_* falsepositives: - Unknown level: high
Query: rule covering Detects potential DLL side-loading of jli.dll. JLI.dll has been observed being side-loaded by Java processes by various
Matching passage: Sigma rule: Detects potential DLL side-loading of jli.dll. JLI.dll has been observed being side-loaded by Java processes by various. Logsource: windows / image_load. Rule: title: Potential JLI.dll Side-Loading id: 7a3b6d1f-4a2b-4f8c-9d7e-e9f8cbf21a35 status: experimental description: 'Detects potential DLL side-loading of jli.dll. JLI.dll has been observed being side-loaded by Java processes by various threat actors, including APT41, XWorm, and others in order to load malicious payloads in context of legitimate Java processes. ' references: - https://securelist.com/apt41-in-africa/116986/ - https://lab52.io/blog/snake-keylogger-in-geopolitical-affairs-abuse-of-trusted-java-utilities-in-cybercrime-operations/ - https://hijacklibs.net/entries/3rd_party/oracle/jli.html - https://www.proofpoint.com/us/blog/threat-insight/phish-china-aligned-espionage-actors-ramp-up-taiwan-semiconductor-targeting author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-07-25 modified: 2025-10-06 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \jli.dll filter_main_legitimate_install_paths: ImageLoaded|startswith: - C:\Program Files\ - C:\Program Files (x86)\ Description: OpenJDK Platform binary OriginalFileName: jli.dll Product|startswith: OpenJDK Platform Signed: 'true' filter_optional_eclipse: ImageLoaded|startswith: C:\eclipse\plugins\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of AppleScript of the macOS scripting language AppleScript.. Logsource: macos / process_creation. Rule: title: MacOS Scripting Interpreter AppleScript id: 1bc2e6c5-0885-472b-bed6-be5ea8eace55 status: test description: Detects execution of AppleScript of the macOS scripting language AppleScript. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.002/T1059.002.md - https://redcanary.com/blog/applescript/ author: Alejandro Ortuno, oscd.community date: 2020-10-21 modified: 2026-05-21 tags: - attack.execution - attack.t1059.002 logsource: category: process_creation product: macos detection: selection: Image|endswith: /osascript CommandLine|contains: - ' -e ' - .scpt - .js filter_optional_opencode: ParentImage|endswith: opencode CommandLine|contains|all: - osascript - ' -e ' - set imageData to the clipboard - set fileRef condition: selection and not 1 of filter_optional_* falsepositives: - Application installers might contain scripts as part of the installation process. level: medium
Query: CVE similar to CVE-2015-6168
Matching passage: CVE-2015-6168. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6153.
Near-miss passage: CVE-2015-7626. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7625, CVE-2015-7627, CVE-2015-7630, CVE-2015-7633, and CVE-2015-7634.
Query: patch priority for CVE-2015-2770
Matching passage: CVE-2015-2770. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the command line page in Websense TRITON V-Series appliances before 8.0.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Near-miss passage: CVE-2015-4255. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence IP Gateway devices with software 2.0(3.34) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu90734.
Query: secure coding against Placement of User into Incorrect Group
Matching passage: CWE-842 Placement of User into Incorrect Group. The product or the administrator places a user into an incorrect group.
Near-miss passage: CWE-34 Path Traversal: '....//'. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '....//' (doubled dot dot slash) sequences that can resolve to a location that is outside of that directory.
Query: risk of Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availabil
Matching passage: CVE-2015-0443. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality based on Trillium, a different vulnerability than CVE-2015-0444, CVE-2015-0445, CVE-2015-0446, CVE-2015-2634, CVE-2015-2635, CVE-2015-2636, CVE-2015-4758, and CVE-2015-4759.
Near-miss passage: CVE-2015-0453. CWE: UNKNOWN. CVSS: 3.299999952316284. Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote attackers to affect confidentiality via vectors related to PORTAL.
Query: adversary uses Network Share Discovery
Matching passage: T1135 Network Share Discovery. Tactics: discovery. Description: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. File sharing over a Windows network occurs over the SMB protocol. (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder) [Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the <code>net view \\\\remotesystem</code> command. It can also be used to query shared drives on the local system using <code>net share</code>. For macOS, the <code>sharing -l</code> command lists all shared points used for smb services.
Near-miss passage: T1614 System Location Discovery. Tactics: discovery. Description: Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from [System Location Discovery](https://attack.mitre.org/techniques/T1614) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.(Citation: FBI Ragnar Locker 2020)(Citation: Sophos Geolocation 2016)(Citation: Bleepingcomputer RAT malware 2020) Windows API functions such as <code>GetLocaleInfoW</code> can also be used to determine the locale of the host.(Citation: FBI Ragnar Locker 2020) In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.(Citation: AWS Instance Identity Documents)(Citation: Microsoft Azure Instance Metadata 2021) Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.(Citation: Securelist Trasparent Tribe 2020)(Citation: Sophos Geolocation 2016)
Query: CVE similar to CVE-2015-6991
Matching passage: CVE-2015-6991. CWE: CWE-119. CVSS: 6.800000190734863. FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, CVE-2015-7010, and CVE-2015-7018.
Near-miss passage: CVE-2015-6676. CWE: CWE-119. CVSS: 10.0. Buffer overflow in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-6678.
Query: risk of Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of 
Matching passage: CVE-2015-8983. CWE: CWE-190. CVSS: 8.100000381469727. Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to computing a size in bytes, which triggers a heap-based buffer overflow.
Near-miss passage: CVE-2015-2519. CWE: CWE-190. CVSS: 9.300000190734863. Integer overflow in Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted .jnt file, aka "Windows Journal Integer Overflow RCE Vulnerability."
Query: rule covering Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for e
Matching passage: Sigma rule: Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for e. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Execution Of PDQDeployRunner id: 12b8e9f5-96b2-41e1-9a42-8c6779a5c184 related: - id: d679950c-abb7-43a6-80fb-2a480c4fc450 type: similar status: test description: Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on a remote machines references: - https://twitter.com/malmoeb/status/1550483085472432128 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-22 modified: 2024-05-02 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_parent: ParentImage|contains: \PDQDeployRunner- selection_child: - Image|endswith: - \bash.exe - \certutil.exe - \cmd.exe - \csc.exe - \cscript.exe - \dllhost.exe - \mshta.exe - \msiexec.exe - \regsvr32.exe - \rundll32.exe - \scriptrunner.exe - \wmic.exe - \wscript.exe - \wsl.exe - Image|contains: - :\ProgramData\ - :\Users\Public\ - :\Windows\TEMP\ - \AppData\Local\Temp - CommandLine|contains: - ' -decode ' - ' -enc ' - ' -encodedcommand ' - ' -w hidden' - DownloadString - FromBase64String - http - 'iex ' - Invoke- condition: all of selection_* falsepositives: - Legitimate use of the PDQDeploy tool to execute these commands level: medium
Near-miss passage: Sigma rule: Detects the creation of a new PowerShell module in the first folder of the module directory structure "\WindowsPowerShel. Logsource: windows / file_event. Rule: title: Potential Suspicious PowerShell Module File Created id: e8a52bbd-bced-459f-bd93-64db45ce7657 status: test description: Detects the creation of a new PowerShell module in the first folder of the module directory structure "\WindowsPowerShell\Modules\malware\malware.psm1". This is somewhat an uncommon practice as legitimate modules often includes a version folder. references: - Internal Research - https://learn.microsoft.com/en-us/powershell/scripting/developer/module/understanding-a-windows-powershell-module?view=powershell-7.3 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-09 tags: - attack.persistence logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - \\WindowsPowerShell\\Modules\\*\.ps - \\WindowsPowerShell\\Modules\\*\.dll condition: selection falsepositives: - False positive rate will vary depending on the environments. Additional filters might be required to make this logic usable in production. level: medium
Query: exploit XML External Entity (XXE) vulnerability in Milton Webdav before 2.7.0.3.
Matching passage: CVE-2015-7326. CWE: CWE-611. CVSS: 9.800000190734863. XML External Entity (XXE) vulnerability in Milton Webdav before 2.7.0.3.
Near-miss passage: CVE-2015-8549. CWE: CWE-611. CVSS: 7.099999904632568. XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action Message Format (AMF) payload.
Query: vulnerability: Unrestricted file upload vulnerability in h5ai before 0.25.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it v
Matching passage: CVE-2015-3203. CWE: UNKNOWN. CVSS: 7.5. Unrestricted file upload vulnerability in h5ai before 0.25.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the directory specified by the href parameter.
Near-miss passage: CVE-2015-2369. CWE: UNKNOWN. CVSS: 6.900000095367432. Untrusted search path vulnerability in Windows Media Device Manager in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .rtf file, aka "DLL Planting Remote Code Execution Vulnerability."
Query: how to detect Abuse Elevation Control Mechanism
Matching passage: T1548 Abuse Elevation Control Mechanism. Tactics: privilege escalation. Description: Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.(Citation: TechNet How UAC Works)(Citation: sudo man page 2018) An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.(Citation: OSX Keydnap malware)(Citation: Fortinet Fareit)
Near-miss passage: T1548.003 Sudo and Sudo Caching. Tactics: privilege escalation. Description: Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges. Within Linux and MacOS systems, sudo (sometimes referred to as "superuser do") allows users to perform commands from terminals with elevated privileges and to control who can perform these commands on the system. The <code>sudo</code> command "allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments."(Citation: sudo man page 2018) Since sudo was made for the system administrator, it has some useful configuration features such as a <code>timestamp_timeout</code>, which is the amount of time in minutes between instances of <code>sudo</code> before it will re-prompt for a password. This is because <code>sudo</code> has the ability to cache credentials for a period of time. Sudo creates (or touches) a file at <code>/var/db/sudo</code> with a timestamp of when sudo was last run to determine this timeout. Additionally, there is a <code>tty_tickets</code> variable that treats each new tty (terminal session) in isolation. This means that, for example, the sudo timeout of one tty will not affect another tty (you will have to type the password again). The sudoers file, <code>/etc/sudoers</code>, describes which users can run which commands and from which terminals. This also describes which commands users can run as other users or groups. This provides the principle of least privilege such that users are running in their lowest possible permissions for most of the time and only elevate to other users or permissions as needed, typically by prompting for a password. However, the sudoers file can also specify when to not prompt users for passwords with a line like <code>user1 ALL=(ALL) NOPASSWD: ALL</code>.(Citation: OSX.Dok
Query: risk of Apache CloudStack before 4.5.2 does not properly preserve VNC passwords when migrating KVM virtual machines, which allows remote attackers to gain access by connecting to the VNC s
Matching passage: CVE-2015-3252. CWE: CWE-255. CVSS: 9.800000190734863. Apache CloudStack before 4.5.2 does not properly preserve VNC passwords when migrating KVM virtual machines, which allows remote attackers to gain access by connecting to the VNC server.
Near-miss passage: CVE-2015-8675. CWE: CWE-255. CVSS: 6.199999809265137. Huawei S5300 Campus Series switches with software before V200R005SPH008 do not mask the password when uploading files, which allows physically proximate attackers to obtain sensitive password information by reading the display.
Query: patch priority for CVE-2015-7232
Matching passage: CVE-2015-7232. CWE: CWE-79. CVSS: 2.5999999046325684. Cross-site scripting (XSS) vulnerability in unspecified administration pages in the OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology module is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-7676. CWE: CWE-79. CVSS: 5.400000095367432. Ipswitch MOVEit File Transfer (formerly DMZ) 8.1 and earlier, when configured to support file view on download, allows remote authenticated users to conduct cross-site scripting (XSS) attacks by uploading HTML files.