alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-1551
Matching passage: CVE-2015-1551. CWE: CWE-264. CVSS: 4.0. Directory traversal vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.4 allows remote administrators to read arbitrary files via unspecified vectors.
Near-miss passage: CVE-2015-7031. CWE: CWE-264. CVSS: 5.0. The Web Service component in Apple OS X Server before 5.0.15 omits an unspecified HTTP header configuration, which allows remote attackers to bypass intended access restrictions via unknown vectors.
Query: adversary uses Transfer Data to Cloud Account
Matching passage: T1537 Transfer Data to Cloud Account. Tactics: exfiltration. Description: Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service. A defender who is monitoring for large transfers to outside the cloud environment through normal file transfers or over command and control channels may not be watching for data transfers to another account within the same cloud provider. Such transfers may utilize existing cloud provider APIs and the internal address space of the cloud provider to blend into normal traffic or avoid data transfers over external network interfaces.(Citation: TLDRSec AWS Attacks) Adversaries may also use cloud-native mechanisms to share victim data with adversary-controlled cloud accounts, such as creating anonymous file sharing links or, in Azure, a shared access signature (SAS) URI.(Citation: Microsoft Azure Storage Shared Access Signature) Incidents have been observed where adversaries have created backups of cloud instances and transferred them to separate accounts.(Citation: DOJ GRU Indictment Jul 2018)
Near-miss passage: T1567.004 Exfiltration Over Webhook. Tactics: exfiltration. Description: Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server.(Citation: RedHat Webhooks) Many public and commercial services, such as Discord, Slack, and `webhook.site`, support the creation of webhook endpoints that can be used by other services, such as Github, Jira, or Trello.(Citation: Discord Intro to Webhooks) When changes happen in the linked services (such as pushing a repository update or modifying a ticket), these services will automatically post the data to the webhook endpoint for use by the consuming application. Adversaries may link an adversary-owned environment to a victim-owned SaaS service to achieve repeated [Automated Exfiltration](https://attack.mitre.org/techniques/T1020) of emails, chat messages, and other data.(Citation: Push Security SaaS Attacks Repository Webhooks) Alternatively, instead of linking the webhook endpoint to a service, an adversary can manually post staged data directly to the URL in order to exfiltrate it.(Citation: Microsoft SQL Server) Access to webhook endpoints is often over HTTPS, which gives the adversary an additional level of protection. Exfiltration leveraging webhooks can also blend in with normal network traffic if the webhook endpoint points to a commonly used SaaS application or collaboration service.(Citation: CyberArk Labs Discord)(Citation: Talos Discord Webhook Abuse)(Citation: Checkmarx Webhooks)
Query: campaign using Service Exhaustion Flood
Matching passage: T1499.002 Service Exhaustion Flood. Tactics: impact. Description: Adversaries may target the different network services provided by systems to conduct a denial of service (DoS). Adversaries often target the availability of DNS and web services, however others have been targeted as well.(Citation: Arbor AnnualDoSreport Jan 2018) Web server software can be attacked through a variety of means, some of which apply generally while others are specific to the software being used to provide the service. One example of this type of attack is known as a simple HTTP flood, where an adversary sends a large number of HTTP requests to a web server to overwhelm it and/or an application that runs on top of it. This flood relies on raw volume to accomplish the objective, exhausting any of the various resources required by the victim software to provide the service.(Citation: Cloudflare HTTPflood) Another variation, known as a SSL renegotiation attack, takes advantage of a protocol feature in SSL/TLS. The SSL/TLS protocol suite includes mechanisms for the client and server to agree on an encryption algorithm to use for subsequent secure connections. If SSL renegotiation is enabled, a request can be made for renegotiation of the crypto algorithm. In a renegotiation attack, the adversary establishes a SSL/TLS connection and then proceeds to make a series of renegotiation requests. Because the cryptographic renegotiation has a meaningful cost in computation cycles, this can cause an impact to the availability of the service when done in volume.(Citation: Arbor SSLDoS April 2012)
Near-miss passage: T1499.004 Application or System Exploitation. Tactics: impact. Description: Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. (Citation: Sucuri BIND9 August 2015) Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition. Adversaries may exploit known or zero-day vulnerabilities to crash applications and/or systems, which may also lead to dependent applications and/or systems to be in a DoS condition. Crashed or restarted applications or systems may also have other effects such as [Data Destruction](https://attack.mitre.org/techniques/T1485), [Firmware Corruption](https://attack.mitre.org/techniques/T1495), [Service Stop](https://attack.mitre.org/techniques/T1489) etc. which may further cause a DoS condition and deny availability to critical information, applications and/or systems.
Query: rule covering Detects the execution of Dnx.EXE. The Dnx utility allows for the execution of C# code. Attackers might abuse this in ord
Matching passage: Sigma rule: Detects the execution of Dnx.EXE. The Dnx utility allows for the execution of C# code. Attackers might abuse this in ord. Logsource: windows / process_creation. Rule: title: Potential Application Whitelisting Bypass via Dnx.EXE id: 81ebd28b-9607-4478-bf06-974ed9d53ed7 status: test description: 'Detects the execution of Dnx.EXE. The Dnx utility allows for the execution of C# code. Attackers might abuse this in order to bypass application whitelisting. ' references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Csi/ - https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/ author: Beyu Denis, oscd.community date: 2019-10-26 modified: 2024-04-24 tags: - attack.stealth - attack.t1218 - attack.t1027.004 logsource: category: process_creation product: windows detection: selection: Image|endswith: \dnx.exe condition: selection falsepositives: - Legitimate use of dnx.exe by legitimate user level: medium
Near-miss passage: Sigma rule: Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execut. Logsource: windows / process_creation. Rule: title: New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE id: f63b56ee-3f79-4b8a-97fb-5c48007e8573 related: - id: e61e8a88-59a9-451c-874e-70fcc9740d67 type: derived - id: cbe51394-cd93-4473-b555-edf0144952d9 type: derived status: test description: Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required) references: - https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83 - https://blog.3or.de/hunting-dns-server-level-plugin-dll-injection.html author: Florian Roth (Nextron Systems) date: 2017-05-08 modified: 2023-02-05 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.defense-impairment - attack.t1574.001 - attack.t1112 logsource: category: process_creation product: windows detection: selection: Image|endswith: \dnscmd.exe CommandLine|contains|all: - /config - /serverlevelplugindll condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-0980
Matching passage: CVE-2015-0980. CWE: CWE-20. CVSS: 9.0. Format string vulnerability in BACnOPCServer.exe in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via format string specifiers in a request.
Near-miss passage: CVE-2015-8739. CWE: CWE-20. CVSS: 5.5. The ipmi_fmt_udpport function in epan/dissectors/packet-ipmi.c in the IPMI dissector in Wireshark 2.0.x before 2.0.1 improperly attempts to access a packet scope, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted packet.
Query: vulnerability: Philips In.Sight B120/37 has a password of b120root for the backdoor root account, a password of /ADMIN/ for the backdoor admin account, a password of merlin for the backdoor mg350
Matching passage: CVE-2015-2882. CWE: CWE-798. CVSS: 9.800000190734863. Philips In.Sight B120/37 has a password of b120root for the backdoor root account, a password of /ADMIN/ for the backdoor admin account, a password of merlin for the backdoor mg3500 account, a password of M100-4674448 for the backdoor user account, and a password of M100-4674448 for the backdoor admin account.
Near-miss passage: CVE-2015-2887. CWE: CWE-798. CVSS: 9.800000190734863. iBaby M3S has a password of admin for the backdoor admin account.
Query: CVE similar to CVE-2015-0179
Matching passage: CVE-2015-0179. CWE: CWE-264. CVSS: 7.199999809265137. Notes System Diagnostic (NSD) in IBM Domino 8.5.x before 8.5.3 FP6 IF6 and 9.x before 9.0.1 FP3 IF1 allows local users to obtain the System privilege via unspecified vectors, aka SPR TCHL9SST8V.
Near-miss passage: CVE-2015-4282. CWE: CWE-264. CVSS: 6.900000095367432. Cisco Mobility Services Engine (MSE) through 8.0.120.7 uses weak permissions for unspecified binary files, which allows local users to obtain root privileges by writing to a file, aka Bug ID CSCuv40504.
Query: threat report mentioning Virtual Private Server
Matching passage: T1584.003 Virtual Private Server. Tactics: resource development. Description: Adversaries may compromise third-party Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. Adversaries may compromise VPSs purchased by third-party entities. By compromising a VPS to use as infrastructure, adversaries can make it difficult to physically tie back operations to themselves.(Citation: NSA NCSC Turla OilRig) Compromising a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers as well as that added by the compromised third-party.
Near-miss passage: T1584.002 DNS Server. Tactics: resource development. Description: Adversaries may compromise third-party DNS servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: [Application Layer Protocol](https://attack.mitre.org/techniques/T1071)). Instead of setting up their own DNS servers, adversaries may compromise third-party DNS servers in support of operations. By compromising DNS servers, adversaries can alter DNS records. Such control can allow for redirection of an organization's traffic, facilitating Collection and Credential Access efforts for the adversary.(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye DNS Hijack 2019) Additionally, adversaries may leverage such control in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004) to redirect traffic to adversary-controlled infrastructure, mimicking normal trusted network communications.(Citation: FireEye DNS Hijack 2019)(Citation: Crowdstrike DNS Hijack 2019) Alternatively, they may be able to prove ownership of a domain to a SaaS service in order to assert control of the service or create a new administrative [Cloud Account](https://attack.mitre.org/techniques/T1136/003).(Citation: CyberCX SaaS Domain Hijacking 2025) Adversaries may also be able to silently create subdomains pointed at malicious servers without tipping off the actual owner of the DNS server.(Citation: CiscoAngler)(Citation: Proofpoint Domain Shadowing)
Query: detect Detects creation of a new service (kernel driver) with the type "kernel" in logs
Matching passage: Sigma rule: Detects creation of a new service (kernel driver) with the type "kernel". Logsource: windows / process_creation. Rule: title: New Kernel Driver Via SC.EXE id: 431a1fdb-4799-4f3b-91c3-a683b003fc49 status: test description: Detects creation of a new service (kernel driver) with the type "kernel" references: - https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-14 modified: 2025-10-07 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: category: process_creation product: windows detection: selection: Image|endswith: \sc.exe CommandLine|contains: - create - config CommandLine|contains|all: - binPath - type - kernel filter_optional_avira_driver: - CommandLine|contains|all: - create netprotection_network_filter - 'type= kernel start= ' - binPath= System32\drivers\netprotection_network_filter - DisplayName= netprotection_network_filter - group= PNP_TDI tag= yes - CommandLine|contains|all: - create avelam binpath=C:\Windows\system32\drivers\avelam.sys - type=kernel start=boot error=critical group=Early-Launch condition: selection and not 1 of filter_optional_* falsepositives: - Rare legitimate installation of kernel drivers via sc.exe level: medium
Near-miss passage: Sigma rule: Detects suspicious user agent strings user by hack tools in proxy logs. Logsource: proxy. Rule: title: Hack Tool User Agent id: c42a3073-30fb-48ae-8c99-c23ada84b103 status: test description: Detects suspicious user agent strings user by hack tools in proxy logs references: - https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb - http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules author: Florian Roth (Nextron Systems) date: 2017-07-08 modified: 2022-07-07 tags: - attack.initial-access - attack.t1190 - attack.credential-access - attack.t1110 logsource: category: proxy detection: selection: c-useragent|contains: - (hydra) - ' arachni/' - ' BFAC ' - ' brutus ' - ' cgichk ' - core-project/1.0 - ' crimscanner/' - datacha0s - dirbuster - domino hunter - dotdotpwn - FHScan Core - floodgate - get-minimal - gootkit auto-rooter scanner - grendel-scan - ' inspath ' - internet ninja - jaascois - ' zmeu ' - masscan - ' metis ' - morfeus fucking scanner - n-stealth - nsauditor - pmafind - security scan - springenwerk - teh forest lobster - toata dragostea - ' vega/' - voideye - webshag - webvulnscan - ' whcc/' - ' Havij' - absinthe - bsqlbf - mysqloit - pangolin - sql power injector - sqlmap - sqlninja - uil2pn - ruler - Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-PT; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729) condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-7871
Matching passage: CVE-2015-7871. CWE: CWE-287. CVSS: 9.800000190734863. Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.
Near-miss passage: CVE-2015-6816. CWE: CWE-287. CVSS: 9.800000190734863. ganglia-web before 3.7.1 allows remote attackers to bypass authentication.
Query: rule covering Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. Disabling default enc
Matching passage: Sigma rule: Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. Disabling default enc. Logsource: aws / cloudtrail. Rule: title: AWS EC2 Disable EBS Encryption id: 16124c2d-e40b-4fcc-8f2c-5ab7870a2223 status: stable description: 'Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. Disabling default encryption does not change the encryption status of your existing volumes. ' references: - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableEbsEncryptionByDefault.html author: Sittikorn S date: 2021-06-29 modified: 2021-08-20 tags: - attack.impact - attack.t1486 - attack.t1565 logsource: product: aws service: cloudtrail detection: selection: eventSource: ec2.amazonaws.com eventName: DisableEbsEncryptionByDefault condition: selection falsepositives: - System Administrator Activities - DEV, UAT, SAT environment. You should apply this rule with PROD account only. level: medium
Near-miss passage: Sigma rule: Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network sha. Logsource: linux / process_creation. Rule: title: File and Directory Discovery - Linux id: d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72 status: test description: 'Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md author: Daniil Yugoslavskiy, oscd.community, CheraghiMilad date: 2020-10-19 modified: 2024-12-01 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: linux detection: selection_file_with_asterisk: Image|endswith: /file CommandLine|re: (.){200,} selection_recursive_ls: Image|endswith: /ls CommandLine|contains: -R selection_find_execution: Image|endswith: /find selection_tree_execution: Image|endswith: /tree selection_findmnt_execution: Image|endswith: /findmnt selection_locate_execution: Image|endswith: /mlocate condition: 1 of selection_* falsepositives: - Legitimate activities level: informational
Query: Sigma rule for Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.
Matching passage: Sigma rule: Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.. Logsource: azure / pim. Rule: title: Roles Assigned Outside PIM id: b1bc08d1-8224-4758-a0e6-fbcfc98c73bb status: test description: Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack. references: - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#roles-are-being-assigned-outside-of-privileged-identity-management author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-14 tags: - attack.initial-access - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation logsource: product: azure service: pim detection: selection: riskEventType: rolesAssignedOutsidePrivilegedIdentityManagementAlertConfiguration condition: selection falsepositives: - Investigate where users are being assigned privileged roles outside of Privileged Identity Management and prohibit future assignments from there. level: high
Near-miss passage: Sigma rule: Detects suspicious mshta process execution patterns. Logsource: windows / process_creation. Rule: title: Suspicious Mshta.EXE Execution Patterns id: e32f92d1-523e-49c3-9374-bdb13b46a3ba status: test description: Detects suspicious mshta process execution patterns references: - https://en.wikipedia.org/wiki/HTML_Application - https://www.echotrail.io/insights/search/mshta.exe - https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-07-17 modified: 2023-02-21 tags: - attack.execution - attack.t1106 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mshta.exe - OriginalFileName: MSHTA.EXE selection_susp: ParentImage|endswith: - \cmd.exe - \cscript.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe CommandLine|contains: - \AppData\Local\ - C:\ProgramData\ - C:\Users\Public\ - C:\Windows\Temp\ filter_img: - Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - CommandLine|contains: - .htm - .hta - CommandLine|endswith: - mshta.exe - mshta condition: all of selection_* or (selection_img and not filter_img) falsepositives: - Unknown level: high
Query: rule covering Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. I
Matching passage: Sigma rule: Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. I. Logsource: windows / dns_query. Rule: title: AppX Package Installation Attempts Via AppInstaller.EXE id: 7cff77e1-9663-46a3-8260-17f2e1aa9d0a related: - id: 180c7c5c-d64b-4a63-86e9-68910451bc8b type: derived status: test description: 'Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. It attempts to load/install a package from the referenced URL ' references: - https://twitter.com/notwhickey/status/1333900137232523264 - https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/ author: frack113 date: 2021-11-24 modified: 2023-11-09 tags: - attack.command-and-control - attack.t1105 logsource: product: windows category: dns_query detection: selection: Image|startswith: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_ Image|endswith: \AppInstaller.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Identifies user activities originating from geographically distant locations within a time period shorter than the time. Logsource: azure / riskdetection. Rule: title: Impossible Travel id: b2572bf9-e20a-4594-b528-40bde666525a status: test description: Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#impossible-travel - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation - attack.initial-access logsource: product: azure service: riskdetection detection: selection: riskEventType: impossibleTravel condition: selection falsepositives: - Connecting to a VPN, performing activity and then dropping and performing additional activity. level: high
Query: risk of In all Qualcomm products with Android releases from CAF using the Linux kernel, a NULL pointer can be dereferenced upon the expiry of a timer.
Matching passage: CVE-2015-9043. CWE: CWE-476. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a NULL pointer can be dereferenced upon the expiry of a timer.
Near-miss passage: CVE-2015-9114. CWE: CWE-476. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, lack of address argument validation in qsee_query_counter syscall could lead to untrusted pointer dereference.