alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: threat report mentioning Browser Fingerprint
Matching passage: T1036.012 Browser Fingerprint. Tactics: stealth. Description: Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc. The HTTP User-Agent request header is a string that lets servers and network peers identify the application, operating system, vendor, and/or version of the requesting user agent.(Citation: Mozilla User Agent) Adversaries may gather this information through [System Information Discovery](https://attack.mitre.org/techniques/T1082) or by users navigating to adversary-controlled websites, and then use that information to craft their web traffic to evade defenses.(Citation: Gummy Browsers Targeted Browser Spoofing against State-of-the-Art Fingerprinting Techniques)
Near-miss passage: T1036.011 Overwrite Process Arguments. Tactics: stealth. Description: Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign process. On Linux, the operating system stores command-line arguments in the process’s stack and passes them to the `main()` function as the `argv` array. The first element, `argv[0]`, typically contains the process name or path - by default, the command used to actually start the process (e.g., `cat /etc/passwd`). By default, the Linux `/proc` filesystem uses this value to represent the process name. The `/proc/<PID>/cmdline` file reflects the contents of this memory, and tools like `ps` use it to display process information. Since arguments are stored in user-space memory at launch, this modification can be performed without elevated privileges. During runtime, adversaries can erase the memory used by all command-line arguments for a process, overwriting each argument string with null bytes. This removes evidence of how the process was originally launched. They can then write a spoofed string into the memory region previously occupied by `argv[0]` to mimic a benign command, such as `cat resolv.conf`. The new command-line string is reflected in `/proc/<PID>/cmdline` and displayed by tools like `ps`.(Citation: Sandfly BPFDoor 2022)(Citation: Microsoft XorDdos Linux Stealth 2022)
Query: detect Triggers on any Sysmon "FileBlockExecutable" event, which indicates a violation of the configured block policy in logs
Matching passage: Sigma rule: Triggers on any Sysmon "FileBlockExecutable" event, which indicates a violation of the configured block policy. Logsource: windows / sysmon. Rule: title: Sysmon Blocked Executable id: 23b71bc5-953e-4971-be4c-c896cda73fc2 status: test description: Triggers on any Sysmon "FileBlockExecutable" event, which indicates a violation of the configured block policy references: - https://medium.com/@olafhartong/sysmon-14-0-fileblockexecutable-13d7ba3dff3e author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-16 modified: 2023-09-16 tags: - attack.defense-impairment logsource: product: windows service: sysmon detection: selection: EventID: 27 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects usage of system utilities to discover files and directories. Logsource: macos / process_creation. Rule: title: File and Directory Discovery - MacOS id: 089dbdf6-b960-4bcc-90e3-ffc3480c20f6 status: test description: Detects usage of system utilities to discover files and directories references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2022-11-25 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: macos detection: select_file_with_asterisk: Image: /usr/bin/file CommandLine|re: (.){200,} select_recursive_ls: Image: /bin/ls CommandLine|contains: -R select_find_execution: Image: /usr/bin/find select_mdfind_execution: Image: /usr/bin/mdfind select_tree_execution|endswith: Image: /tree condition: 1 of select* falsepositives: - Legitimate activities level: informational
Query: mitigate Boot or Logon Autostart Execution
Matching passage: T1547 Boot or Logon Autostart Execution. Tactics: persistence, privilege escalation. Description: Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming) These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel. Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.
Near-miss passage: T1547.007 Re-opened Applications. Tactics: persistence, privilege escalation. Description: Adversaries may modify plist files to automatically run an application when a user logs in. When a user logs out or restarts via the macOS Graphical User Interface (GUI), a prompt is provided to the user with a checkbox to "Reopen windows when logging back in".(Citation: Re-Open windows on Mac) When selected, all applications currently open are added to a property list file named <code>com.apple.loginwindow.[UUID].plist</code> within the <code>~/Library/Preferences/ByHost</code> directory.(Citation: Methods of Mac Malware Persistence)(Citation: Wardle Persistence Chapter) Applications listed in this file are automatically reopened upon the user’s next logon. Adversaries can establish [Persistence](https://attack.mitre.org/tactics/TA0003) by adding a malicious application path to the <code>com.apple.loginwindow.[UUID].plist</code> file to execute payloads when a user logs in.
Query: risk of Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous befo
Matching passage: CVE-2015-5090. CWE: CWE-269. CVSS: 7.199999809265137. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass intended access restrictions and perform a transition from Low Integrity to Medium Integrity via unspecified vectors, a different vulnerability than CVE-2015-4446 and CVE-2015-5106.
Near-miss passage: CVE-2015-3613. CWE: CWE-269. CVSS: 9.800000190734863. A vulnerability exists in in FortiManager 5.2.1 and earlier and 5.0.10 and earlier in the WebUI FTP backup page
Query: patch priority for CVE-2015-5586
Matching passage: CVE-2015-5586. CWE: CWE-416. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-6683, CVE-2015-6684, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7615, CVE-2015-7617, and CVE-2015-7621.
Near-miss passage: CVE-2015-5095. CWE: CWE-416. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-4448, CVE-2015-5099, CVE-2015-5101, CVE-2015-5111, CVE-2015-5113, and CVE-2015-5114.
Query: detection rule: Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or unde
Matching passage: Sigma rule: Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or unde. Logsource: windows / process_creation. Rule: title: Suspicious Double Extension File Execution id: 1cdd9a09-06c9-4769-99ff-626e2b3991b8 related: - id: 5e6a80c8-2d45-4633-9ef4-fa2671a39c5c type: similar status: stable description: Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns references: - https://blu3-team.blogspot.com/2019/06/misleading-extensions-xlsexe-docexe.html - https://twitter.com/blackorbird/status/1140519090961825792 - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems) date: 2019-06-26 modified: 2025-05-30 tags: - attack.initial-access - attack.t1566.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - ' .exe' - ______.exe - .doc.exe - .doc.js - .docx.exe - .docx.js - .gif.exe - .jpeg.exe - .jpg.exe - .mkv.exe - .mov.exe - .mp3.exe - .mp4.exe - .pdf.exe - .pdf.js - .png.exe - .ppt.exe - .ppt.js - .pptx.exe - .pptx.js - .rtf.exe - .rtf.js - .svg.exe - .txt.exe - .txt.js - .xls.exe - .xls.js - .xlsx.exe - .xlsx.js - ⠀⠀⠀⠀⠀⠀.exe CommandLine|contains: - ' .exe' - ______.exe - .doc.exe - .doc.js - .docx.exe - .docx.js - .gif.exe - .jpeg.exe - .jpg.exe - .mkv.exe - .mov.exe - .mp3.exe - .mp4.exe - .pdf.exe - .pdf.js - .png.exe - .ppt.exe - .ppt.js - .pptx.exe - .pptx.js - .rtf.exe - .rtf.js - .svg.exe - .txt.exe - .txt.js - .xls.exe - .xls.js - .xlsx.exe - .xlsx.js - ⠀⠀⠀⠀⠀⠀.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL). Attackers may use Kali Linux. Logsource: windows / process_creation. Rule: title: Installation of WSL Kali-Linux id: eca8ae39-5c3c-4321-b538-9e64fe25822e status: experimental description: 'Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL). Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes. ' references: - https://medium.com/@redfanatic7/running-kali-linux-on-windows-51ad95166e6e - https://learn.microsoft.com/en-us/windows/wsl/install author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-10-10 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_wsl_img: - Image|endswith: \wsl.exe - OriginalFileName: wsl selection_wsl_install: CommandLine|contains: - ' --install ' - ' -i ' selection_wsl_kali: CommandLine|contains: kali condition: all of selection_wsl_* falsepositives: - Legitimate installation or usage of Kali Linux WSL by administrators or security teams level: high
Query: CVE similar to CVE-2015-4089
Matching passage: CVE-2015-4089. CWE: CWE-352. CVSS: 8.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPress allow remote attackers to hijack the authentication of unspecified victims for requests that call the (1) saveOption, (2) deleteCache, (3) deleteCssAndJsCache, or (4) addCacheTimeout method via the wpFastestCachePage parameter in the WpFastestCacheOptions/ page.
Near-miss passage: CVE-2015-7936. CWE: CWE-352. CVSS: 7.5. Cross-site request forgery (CSRF) vulnerability in Motorola Solutions MOSCAD IP Gateway allows remote attackers to hijack the authentication of administrators for requests that modify a password.
Query: patch priority for CVE-2015-9161
Matching passage: CVE-2015-9161. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, and SD 810, TOCTOU condition could lead to a buffer overflow in function playready_reader_bind().
Near-miss passage: CVE-2015-5871. CWE: CWE-119. CVSS: 7.199999809265137. IOGraphics in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5872, CVE-2015-5873, and CVE-2015-5890.
Query: exploit HP ArcSight Logger 6.0.0.7307.1, ArcSight Command Center 6.8.0.1896.0, and ArcSight Connector Appliance 6.4.0.6881.3 use the root account to execute files owned by the arcsight use
Matching passage: CVE-2015-6030. CWE: CWE-264. CVSS: 7.199999809265137. HP ArcSight Logger 6.0.0.7307.1, ArcSight Command Center 6.8.0.1896.0, and ArcSight Connector Appliance 6.4.0.6881.3 use the root account to execute files owned by the arcsight user, which might allow local users to gain privileges by leveraging arcsight account access.
Near-miss passage: CVE-2015-0223. CWE: CWE-264. CVSS: 5.0. Unspecified vulnerability in Apache Qpid 0.30 and earlier allows remote attackers to bypass access restrictions on qpidd via unknown vectors, related to 0-10 connection handling.
Query: explain CWE-1294
Matching passage: CWE-1294 Insecure Security Identifier Mechanism. The System-on-Chip (SoC) implements a Security Identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Identifiers are not correctly implemented.
Near-miss passage: CWE-492 Use of Inner Class Containing Sensitive Data. Inner classes are translated into classes that are accessible at package scope and may expose code that the programmer intended to keep private to attackers.
Query: exploit In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, SD 400, and SD 800, userspace-provided pointer arguments are not valid
Matching passage: CVE-2015-9147. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, SD 400, and SD 800, userspace-provided pointer arguments are not validated.
Near-miss passage: CVE-2015-7234. CWE: CWE-20. CVSS: 4.0. The OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology and OSF Import modules are enabled, allows user-assisted remote attackers to delete arbitrary files via unspecified vectors.
Query: Sigma rule for Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service
Matching passage: Sigma rule: Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service. Logsource: windows / process_creation. Rule: title: Suspicious Child Process Of Manage Engine ServiceDesk id: cea2b7ea-792b-405f-95a1-b903ea06458f status: test description: Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service references: - https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/ - https://github.com/horizon3ai/CVE-2022-47966/blob/3a51c6b72ebbd87392babd955a8fbeaee2090b35/CVE-2022-47966.py - https://blog.viettelcybersecurity.com/saml-show-stopper/ author: Florian Roth (Nextron Systems) date: 2023-01-18 modified: 2023-08-29 tags: - attack.command-and-control - attack.t1102 logsource: category: process_creation product: windows detection: selection: ParentImage|contains|all: - \ManageEngine\ServiceDesk\ - \java.exe Image|endswith: - \AppVLP.exe - \bash.exe - \bitsadmin.exe - \calc.exe - \certutil.exe - \cscript.exe - \curl.exe - \forfiles.exe - \mftrace.exe - \mshta.exe - \net.exe - \net1.exe - \notepad.exe - \powershell.exe - \pwsh.exe - \query.exe - \reg.exe - \schtasks.exe - \scrcons.exe - \sh.exe - \systeminfo.exe - \whoami.exe - \wmic.exe - \wscript.exe filter_main_net: Image|endswith: - \net.exe - \net1.exe CommandLine|contains: ' stop' condition: selection and not 1 of filter_main_* falsepositives: - Legitimate sub processes started by Manage Engine ServiceDesk Pro level: high
Near-miss passage: Sigma rule: Detects execution of PktMon, a tool that captures network packets.. Logsource: windows / process_creation. Rule: title: PktMon.EXE Execution id: f956c7c1-0f60-4bc5-b7d7-b39ab3c08908 status: test description: Detects execution of PktMon, a tool that captures network packets. references: - https://lolbas-project.github.io/lolbas/Binaries/Pktmon/ author: frack113 date: 2022-03-17 modified: 2023-06-23 tags: - attack.discovery - attack.credential-access - attack.t1040 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \pktmon.exe - OriginalFileName: PktMon.exe condition: selection falsepositives: - Legitimate use level: medium
Query: Sigma YAML for macos / process_creation
Matching passage: Sigma rule: Detects potential suspicious child processes of "jamf". Could be a sign of potential abuse of Jamf as a C2 server as see. Logsource: macos / process_creation. Rule: title: JAMF MDM Potential Suspicious Child Process id: 2316929c-01aa-438c-970f-099145ab1ee6 status: test description: Detects potential suspicious child processes of "jamf". Could be a sign of potential abuse of Jamf as a C2 server as seen by Typhon MythicAgent. references: - https://github.com/MythicAgents/typhon/ - https://www.zoocoup.org/casper/jamf_cheatsheet.pdf - https://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Components_Installed_on_Managed_Computers.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-22 tags: - attack.execution logsource: category: process_creation product: macos detection: selection: ParentImage|endswith: /jamf Image|endswith: - /bash - /sh condition: selection falsepositives: - Legitimate execution of custom scripts or commands by Jamf administrators. Apply additional filters accordingly level: medium
Near-miss passage: Sigma rule: Detects usage of crontab to list the tasks of the user. Logsource: linux / process_creation. Rule: title: Crontab Enumeration id: 403ed92c-b7ec-4edd-9947-5b535ee12d46 status: test description: Detects usage of crontab to list the tasks of the user references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.discovery - attack.t1007 logsource: product: linux category: process_creation detection: selection: Image|endswith: /crontab CommandLine|contains: ' -l' condition: selection falsepositives: - Legitimate use of crontab level: low
Query: describe CVE-2015-6857
Matching passage: CVE-2015-6857. CWE: UNKNOWN. CVSS: 7.199999809265137. Unspecified vulnerability in Virtual Table Server (VTS) in HP LoadRunner 11.52, 12.00, 12.01, 12.02, and 12.50 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-3138.
Near-miss passage: CVE-2015-4813. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.0.34, 4.1.42, 4.2.34, 4.3.32, and 5.0.8, when using a Windows guest, allows local users to affect availability via unknown vectors related to Core.
Query: describe CVE-2015-2099
Matching passage: CVE-2015-2099. CWE: CWE-120. CVSS: 8.800000190734863. Multiple buffer overflows in WebGate Control Center allow remote attackers to execute arbitrary code via unspecified vectors to the (1) GetRecFileInfo function in the FileConverter.FileConverterCtrl.1 control, (2) Login function in the LoginContoller.LoginControllerCtrl.1 control, or (3) GetThumbnail function in the WESPPlayback.WESPPlaybackCtrl.1 control.
Near-miss passage: CVE-2015-5745. CWE: CWE-120. CVSS: 6.5. Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows guest users to cause a denial of service (QEMU process crash) via a crafted virtio control message.
Query: Sigma YAML for aws / cloudtrail
Matching passage: Sigma rule: Identifies when an ElastiCache security group has been modified or deleted.. Logsource: aws / cloudtrail. Rule: title: AWS ElastiCache Security Group Modified or Deleted id: 7c797da2-9cf2-4523-ba64-33b06339f0cc status: test description: Identifies when an ElastiCache security group has been modified or deleted. references: - https://github.com/elastic/detection-rules/blob/7d5efd68603f42be5e125b5a6a503b2ef3ac0f4e/rules/integrations/aws/impact_elasticache_security_group_modified_or_deleted.toml author: Austin Songer @austinsonger date: 2021-07-24 modified: 2022-10-09 tags: - attack.impact - attack.t1531 logsource: product: aws service: cloudtrail detection: selection: eventSource: elasticache.amazonaws.com eventName: - DeleteCacheSecurityGroup - AuthorizeCacheSecurityGroupIngress - RevokeCacheSecurityGroupIngress - AuthorizeCacheSecurityGroupEgress - RevokeCacheSecurityGroupEgress condition: selection falsepositives: - A ElastiCache security group deletion may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Security Group deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Near-miss passage: Sigma rule: Detects usage of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages. Logsource: windows / process_creation. Rule: title: Unsigned AppX Installation Attempt Using Add-AppxPackage id: 37651c2a-42cd-4a69-ae0d-22a4349aa04a related: - id: 975b2262-9a49-439d-92a6-0709cccdf0b2 type: similar - id: 9a025188-6f2d-42f8-bb2f-d3a83d24a5af type: similar status: test description: Detects usage of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages references: - https://learn.microsoft.com/en-us/windows/msix/package/unsigned-package - https://twitter.com/WindowsDocs/status/1620078135080325122 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-31 tags: - attack.persistence - attack.stealth logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cmdlet: CommandLine|contains: - 'Add-AppPackage ' - 'Add-AppxPackage ' selection_flag: CommandLine|contains: ' -AllowUnsigned' condition: all of selection_* falsepositives: - Installation of unsigned packages for testing purposes level: medium
Query: exploit The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate token extraction for table names, which allows remote attacke
Matching passage: CVE-2015-1352. CWE: UNKNOWN. CVSS: 5.0. The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate token extraction for table names, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name.
Near-miss passage: CVE-2015-0403. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.