alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: containment actions for Encoded PowerShell / command-line abuse matching Build Image on Host
Matching passage: Playbook for T1612 Build Image on Host. 1) Validate alert telemetry against T1612. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. A remote <code>build</code> request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or local registry and then builds a custom image upon it.(Citation: Docker Build Image) An
Near-miss passage: Playbook for T1564.001 Hidden Files and Directories. Different response path focused on stealth.
Query: alert when Detects execution of the "jamf" binary to create user accounts and run commands. For example, the binary can be abused b
Matching passage: Sigma rule: Detects execution of the "jamf" binary to create user accounts and run commands. For example, the binary can be abused b. Logsource: macos / process_creation. Rule: title: JAMF MDM Execution id: be2e3a5c-9cc7-4d02-842a-68e9cb26ec49 status: test description: 'Detects execution of the "jamf" binary to create user accounts and run commands. For example, the binary can be abused by attackers on the system in order to bypass security controls or remove application control polices. ' references: - https://github.com/MythicAgents/typhon/ - https://www.zoocoup.org/casper/jamf_cheatsheet.pdf - https://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Components_Installed_on_Managed_Computers.html author: Jay Pandit date: 2023-08-22 tags: - attack.execution logsource: category: process_creation product: macos detection: selection: Image|endswith: /jamf CommandLine|contains: - createAccount - manage - removeFramework - removeMdmProfile - resetPassword - setComputerName condition: selection falsepositives: - Legitimate use of the JAMF CLI tool by IT support and administrators level: low
Near-miss passage: Sigma rule: Detects the execution of the Restic backup tool, which can be used for data exfiltration. Threat actors may leverage Res. Logsource: windows / process_creation. Rule: title: PUA - Restic Backup Tool Execution id: 6ddff2e8-ea1a-45d0-8938-93dfc1d67ae7 status: experimental description: 'Detects the execution of the Restic backup tool, which can be used for data exfiltration. Threat actors may leverage Restic to back up and exfiltrate sensitive data to remote storage locations, including cloud services. If not legitimately used in the enterprise environment, its presence may indicate malicious activity. ' references: - https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/#exfiltration - https://restic.net/ - https://restic.readthedocs.io/en/stable/030_preparing_a_new_repo.html author: Nounou Mbeiri, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-10-17 tags: - attack.exfiltration - attack.t1048 - attack.t1567.002 logsource: product: windows category: process_creation detection: selection_specific: - CommandLine|contains|all: - --password-file - init - ' -r ' - CommandLine|contains|all: - --use-fs-snapshot - backup - ' -r ' selection_restic: CommandLine|contains: - 'sftp:' - rest:http - s3:s3. - s3.http - 'azure:' - ' gs:' - 'rclone:' - 'swift:' - ' b2:' CommandLine|contains|all: - ' init ' - ' -r ' condition: 1 of selection_* falsepositives: - Legitimate use of Restic for backup purposes within the organization. level: high
Query: CVE similar to CVE-2015-6771
Matching passage: CVE-2015-6771. CWE: CWE-119. CVSS: 7.5. js/array.js in Google V8, as used in Google Chrome before 47.0.2526.73, improperly implements certain map and filter operations for arrays, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted JavaScript code.
Near-miss passage: CVE-2015-2487. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486, CVE-2015-2490, CVE-2015-2492, CVE-2015-2494, CVE-2015-2498, and CVE-2015-2499.
Query: threat report mentioning Disable or Modify System Firewall
Matching passage: T1686 Disable or Modify System Firewall. Tactics: defense impairment. Description: Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gathered sufficient privileges, they can tamper with firewall services, policies, or rule sets to remove restrictions on inbound or outbound traffic. For example, this may include turning off firewall profiles, altering existing rules to permit previously blocked ports or protocols, or adding new rules that create covert communication paths (e.g., adding a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port.(Citation: change_rdp_port_conti) Adversaries may disable or modify firewalls using different behaviors, depending on the platform. For example, in ESXi, firewall rules may be modified directly via the esxcli (e.g., via esxcli network firewall set) or via the vCenter user interface.(Citation: Broadcom ESXi Firewall)(Citation: Trellix Rnasomhouse 2024)
Near-miss passage: T1686.001 Cloud Firewall. Tactics: defense impairment. Description: Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols. An adversary with appropriate permissions may introduce new firewall rules or policies to allow access into a victim cloud environment and/or move laterally from the cloud control plane to the data plane. For example, an adversary may use a script or utility that creates new ingress rules in existing security groups (or creates new security groups entirely) to allow any TCP/IP connectivity to a cloud-hosted instance. They may also remove networking limitations to support traffic associated with malicious activity (such as cryptomining).(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022)(Citation: Expel AWS)
Query: CVE similar to CVE-2015-3250
Matching passage: CVE-2015-3250. CWE: CWE-200. CVSS: 7.5. Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors.
Near-miss passage: CVE-2015-3092. CWE: CWE-200. CVSS: 5.0. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2015-3091.
Query: Persistence mechanism resembling Masquerading
Matching passage: T1036 Masquerading. Tactics: stealth. Description: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site)
Near-miss passage: T1036.011 Overwrite Process Arguments. Tactics: stealth. Description: Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign process. On Linux, the operating system stores command-line arguments in the process’s stack and passes them to the `main()` function as the `argv` array. The first element, `argv[0]`, typically contains the process name or path - by default, the command used to actually start the process (e.g., `cat /etc/passwd`). By default, the Linux `/proc` filesystem uses this value to represent the process name. The `/proc/<PID>/cmdline` file reflects the contents of this memory, and tools like `ps` use it to display process information. Since arguments are stored in user-space memory at launch, this modification can be performed without elevated privileges. During runtime, adversaries can erase the memory used by all command-line arguments for a process, overwriting each argument string with null bytes. This removes evidence of how the process was originally launched. They can then write a spoofed string into the memory region previously occupied by `argv[0]` to mimic a benign command, such as `cat resolv.conf`. The new command-line string is reflected in `/proc/<PID>/cmdline` and displayed by tools like `ps`.(Citation: Sandfly BPFDoor 2022)(Citation: Microsoft XorDdos Linux Stealth 2022)
Query: Sigma rule for Detects installation of suspicious packages using system installation utilities
Matching passage: Sigma rule: Detects installation of suspicious packages using system installation utilities. Logsource: linux / process_creation. Rule: title: Suspicious Package Installed - Linux id: 700fb7e8-2981-401c-8430-be58e189e741 status: test description: Detects installation of suspicious packages using system installation utilities references: - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-03 modified: 2026-01-01 tags: - attack.defense-impairment - attack.t1553.004 logsource: product: linux category: process_creation detection: selection_tool_apt: Image|endswith: - /apt - /apt-get CommandLine|contains: install selection_tool_yum: Image|endswith: /yum CommandLine|contains: - localinstall - install selection_tool_rpm: Image|endswith: /rpm CommandLine|contains: -i selection_tool_dpkg: Image|endswith: /dpkg CommandLine|contains: - --install - -i selection_keyword: CommandLine|contains: - nmap - ' nc' - netcat - wireshark - tshark - openconnect - proxychains - socat condition: 1 of selection_tool_* and selection_keyword falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects WinRAR creating files in Windows startup locations, which may indicate an attempt to establish persistence by ad. Logsource: windows / file_event. Rule: title: WinRAR Creating Files in Startup Locations id: 74a2b37d-fea4-41e0-9ac7-c9fbcf1f60cc status: experimental description: 'Detects WinRAR creating files in Windows startup locations, which may indicate an attempt to establish persistence by adding malicious files to the Startup folder. This kind of behaviour has been associated with exploitation of WinRAR path traversal vulnerability CVE-2025-6218 or CVE-2025-8088. ' references: - https://github.com/mulwareX/CVE-2025-6218-POC - https://x.com/0x534c/status/1944694507787710685 - https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-07-16 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: file_event product: windows detection: selection: Image|endswith: - \WinRAR.exe - \Rar.exe TargetFilename|contains: \Start Menu\Programs\Startup\ condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-4835
Matching passage: CVE-2015-4835. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2015-4881.
Near-miss passage: CVE-2015-8065. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: risk of Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary 
Matching passage: CVE-2015-7450. CWE: CWE-502. CVSS: 9.800000190734863. Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.
Near-miss passage: CVE-2015-4852. CWE: CWE-502. CVSS: 9.800000190734863. The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.
Query: describe CVE-2015-5094
Matching passage: CVE-2015-5094. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3095, CVE-2015-5087, CVE-2015-5100, CVE-2015-5102, CVE-2015-5103, CVE-2015-5104, and CVE-2015-5115.
Near-miss passage: CVE-2015-1768. CWE: CWE-119. CVSS: 7.199999809265137. win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application, aka "Win32k Memory Corruption Elevation of Privilege Vulnerability."
Query: exploit Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to write to arbitrary files within the underlying operating s
Matching passage: CVE-2015-3653. CWE: CWE-284. CVSS: 7.199999809265137. Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to write to arbitrary files within the underlying operating system and consequently cause a denial of service or gain privileges by leveraging incorrect permission checking.
Near-miss passage: CVE-2015-3644. CWE: CWE-284. CVSS: 5.800000190734863. Stunnel 5.00 through 5.13, when using the redirect option, does not redirect client connections to the expected server after the initial connection, which allows remote attackers to bypass authentication.
Query: vulnerability: Cisco Hosted Collaboration Mediation Fulfillment 10.6(3) does not use RBAC, which allows remote authenticated users to obtain sensitive credential information by leveraging admin a
Matching passage: CVE-2015-6404. CWE: CWE-200. CVSS: 4.0. Cisco Hosted Collaboration Mediation Fulfillment 10.6(3) does not use RBAC, which allows remote authenticated users to obtain sensitive credential information by leveraging admin access and making SOAP API requests, aka Bug ID CSCuw84374.
Near-miss passage: CVE-2015-0136. CWE: CWE-200. CVSS: 2.0999999046325684. powervc-iso-import in IBM PowerVC 1.2.0.x before 1.2.0.4 and 1.2.1.x before 1.2.2 places an access token on the command line during IVM and PowerKVM management, which allows local users to obtain sensitive information by listing the process.
Query: patch priority for CVE-2015-7233
Matching passage: CVE-2015-7233. CWE: CWE-352. CVSS: 5.099999904632568. Cross-site request forgery (CSRF) vulnerability in the OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Import module is enabled, allows remote attackers to hijack the authentication of administrators for requests that create new OSF datasets via unspecified vectors.
Near-miss passage: CVE-2015-2089. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the CrossSlide jQuery (crossslide-jquery-plugin-for-wordpress) plugin 2.0.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2) csj_width, (3) csj_height, (4) csj_sleep, (5) csj_fade, or (6) upload_image parameter in the thisismyurl_csj.php page to wp-admin/options-general.php.
Query: command and control using Asymmetric Cryptography
Matching passage: T1573.002 Asymmetric Cryptography. Tactics: command and control. Description: Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal. For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002).
Near-miss passage: T1573.001 Symmetric Cryptography. Tactics: command and control. Description: Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in the web-based console management interface in Palo Alto Networks Traps (formerly Cyvera Endpoint Protection) 3.1.2.1546 allow
Matching passage: CVE-2015-2223. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the web-based console management interface in Palo Alto Networks Traps (formerly Cyvera Endpoint Protection) 3.1.2.1546 allow remote attackers to inject arbitrary web script or HTML via the (1) Arguments, (2) FileName, or (3) URL parameter in a SOAP request.
Near-miss passage: CVE-2015-3970. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the web interface on Janitza UMG 508, 509, 511, 604, and 605 devices allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: describe CVE-2015-5624
Matching passage: CVE-2015-5624. CWE: CWE-119. CVSS: 6.800000190734863. Buffer overflow in the ExecCall method in c2lv6.ocx in the FreeBit ELPhoneBtnV6 ActiveX control allows remote attackers to execute arbitrary code via a crafted HTML document, related to the discontinued "Click to Live" service.
Near-miss passage: CVE-2015-6992. CWE: CWE-119. CVSS: 7.5. CoreText in Apple iOS before 9.1, OS X before 10.11.1, and iTunes before 12.3.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6975 and CVE-2015-7017.
Query: write Sigma for Detects the change of user type from "Guest" to "Member" for potential elevation of privilege.
Matching passage: Sigma rule: Detects the change of user type from "Guest" to "Member" for potential elevation of privilege.. Logsource: azure / auditlogs. Rule: title: User State Changed From Guest To Member id: 8dee7a0d-43fd-4b3c-8cd1-605e189d195e status: test description: Detects the change of user type from "Guest" to "Member" for potential elevation of privilege. references: - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts#monitoring-external-user-sign-ins author: MikeDuddington, '@dudders1' date: 2022-06-30 tags: - attack.persistence - attack.privilege-escalation - attack.initial-access - attack.stealth - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: Category: UserManagement OperationName: Update user properties.message: '"displayName":"UserType","oldValue":"[\"Guest\"]","newValue":"[\"Member\"]"' condition: selection falsepositives: - If this was approved by System Administrator. level: medium
Near-miss passage: Sigma rule: Detects suspicious malformed user agent strings in proxy logs. Logsource: proxy. Rule: title: Suspicious User Agent id: 7195a772-4b3f-43a4-a210-6a003d65caa1 status: test description: Detects suspicious malformed user agent strings in proxy logs references: - https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb author: Florian Roth (Nextron Systems) date: 2017-07-08 modified: 2022-10-31 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection1: c-useragent|startswith: - user-agent - 'Mozilla/3.0 ' - 'Mozilla/2.0 ' - 'Mozilla/1.0 ' - 'Mozilla ' - ' Mozilla/' - Mozila/ - Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol selection2: c-useragent|contains: - ' (compatible;MSIE ' - '.0;Windows NT ' - loader selection3: c-useragent: - _ - CertUtil URL Agent - Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0) - Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 - HTTPS - Erbium-UA-4ce7c27cb4be9d32e333bf032c88235a - x - xxx falsepositives: - c-useragent: Mozilla/3.0 * Acrobat * - cs-host|endswith: - .acrobat.com - .adobe.com - .adobe.io condition: 1 of selection* and not falsepositives falsepositives: - Unknown level: high
Query: describe CVE-2015-5912
Matching passage: CVE-2015-5912. CWE: CWE-17. CVSS: 5.0. The CFNetwork FTPProtocol component in Apple iOS before 9 allows remote FTP proxy servers to trigger TCP connection attempts to intranet hosts via crafted responses.
Near-miss passage: CVE-2015-7045. CWE: CWE-17. CVSS: 5.0. Keychain Access in Apple OS X before 10.11.2 and tvOS before 9.1 improperly interacts with Keychain Agent, which allows attackers to spoof the Keychain Server via unspecified vectors.