alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: threat report mentioning Make and Impersonate Token
Matching passage: T1134.003 Make and Impersonate Token. Tactics: stealth, privilege escalation. Description: Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function.(Citation: LogonUserW function) The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread. This behavior is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) in that this refers to creating a new user token instead of stealing or duplicating an existing one.
Near-miss passage: T1134.001 Token Impersonation/Theft. Tactics: stealth, privilege escalation. Description: Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`.(Citation: DuplicateToken function) The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread. An adversary may perform [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) when they have a specific, existing process they want to assign the duplicated token to. For example, this may be useful for when the target user has a non-network logon session on the system. When an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally [Create Process with Token](https://attack.mitre.org/techniques/T1134/002) using `CreateProcessWithTokenW` or `CreateProcessAsUserW`. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) is also distinct from [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) in that it refers to duplicating an existing token, rather than creating a new one.
Query: vulnerability: SVM in Websense TRITON V-Series appliances before 8.0.0 allows attackers to read arbitrary files via unspecified vectors.
Matching passage: CVE-2015-2773. CWE: UNKNOWN. CVSS: 5.0. SVM in Websense TRITON V-Series appliances before 8.0.0 allows attackers to read arbitrary files via unspecified vectors.
Near-miss passage: CVE-2015-1182. CWE: UNKNOWN. CVSS: 7.5. The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ASN.1 sequence in a certificate.
Query: patch priority for CVE-2015-8795
Matching passage: CVE-2015-8795. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in the Admin UI in Apache Solr before 5.1 allow remote attackers to inject arbitrary web script or HTML via crafted fields that are mishandled during the rendering of the (1) Analysis page, related to webapp/web/js/scripts/analysis.js or (2) Schema-Browser page, related to webapp/web/js/scripts/schema-browser.js.
Near-miss passage: CVE-2015-9297. CWE: CWE-79. CVSS: 6.099999904632568. The events-manager plugin before 5.6 for WordPress has XSS.
Query: describe CVE-2015-2313
Matching passage: CVE-2015-2313. CWE: CWE-400. CVSS: 7.5. Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.2, when an application invokes the totalSize method on an object reader, allows remote peers to cause a denial of service (CPU consumption) via a crafted small message, which triggers a "tight" for loop. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-2312.
Near-miss passage: CVE-2015-5695. CWE: CWE-400. CVSS: 6.5. Designate 2015.1.0 through 1.0.0.0b1 as packaged in OpenStack Kilo does not enforce RecordSets per domain, and Records per RecordSet quotas when processing an internal zone file transfer, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted resource record set.
Query: patch priority for CVE-2015-6601
Matching passage: CVE-2015-6601. CWE: CWE-119. CVSS: 10.0. libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22935234.
Near-miss passage: CVE-2015-5830. CWE: CWE-119. CVSS: 7.199999809265137. The Intel Graphics Driver component in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5877.
Query: CVE similar to CVE-2015-6693
Matching passage: CVE-2015-6693. CWE: CWE-119. CVSS: 6.800000190734863. The signatureSetSeedValue method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted arguments, a different vulnerability than CVE-2015-6685, CVE-2015-6686, CVE-2015-6694, CVE-2015-6695, and CVE-2015-7622.
Near-miss passage: CVE-2015-5368. CWE: CWE-119. CVSS: 7.800000190734863. The HP lt4112 LTE/HSPA+ Gobi 4G module with firmware before 12.500.00.15.1803 on EliteBook, ElitePad, Elite, ProBook, Spectre, ZBook, and mt41 Thin Client devices allows remote attackers to modify data or cause a denial of service, or execute arbitrary code, via unspecified vectors.
Query: Sigma YAML for kubernetes / application / audit
Matching passage: Sigma rule: Detects creation of a container with a hostPath mount. A hostPath volume mounts a directory or a file from the node to t. Logsource: kubernetes / application / audit. Rule: title: Container With A hostPath Mount Created id: 402b955c-8fe0-4a8c-b635-622b4ac5f902 status: test description: 'Detects creation of a container with a hostPath mount. A hostPath volume mounts a directory or a file from the node to the container. Attackers who have permissions to create a new pod in the cluster may create one with a writable hostPath volume and chroot to escape to the underlying node. ' references: - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Writable%20hostPath%20mount/ - https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216 author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.t1611 - attack.privilege-escalation logsource: category: application product: kubernetes service: audit detection: selection: verb: create objectRef.resource: pods hostPath: '*' condition: selection falsepositives: - The DaemonSet controller creates pods with hostPath volumes within the kube-system namespace. level: low
Near-miss passage: Sigma rule: Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a. Logsource: windows / file_event. Rule: title: NTDS.DIT Creation By Uncommon Process id: 11b1ed55-154d-4e82-8ad7-83739298f720 related: - id: 4e7050dd-e548-483f-b7d6-527ab4fa784d type: similar status: test description: Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a suspicious directory references: - https://stealthbits.com/blog/extracting-password-hashes-from-the-ntds-dit-file/ - https://adsecurity.org/?p=2398 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-01-11 modified: 2022-07-14 tags: - attack.credential-access - attack.t1003.002 - attack.t1003.003 logsource: product: windows category: file_event detection: selection_ntds: TargetFilename|endswith: \ntds.dit selection_process_img: Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - \wsl.exe - \wt.exe selection_process_paths: Image|contains: - \AppData\ - \Temp\ - \Public\ - \PerfLogs\ condition: selection_ntds and 1 of selection_process_* falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-7102
Matching passage: CVE-2015-7102. CWE: CWE-119. CVSS: 6.800000190734863. WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, and CVE-2015-7103.
Near-miss passage: CVE-2015-7085. CWE: CWE-119. CVSS: 6.599999904632568. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
Query: SOC alert related to Log Enumeration
Matching passage: T1654 Log Enumeration. Tactics: discovery. Description: Adversaries may enumerate system and service logs to find useful data. These logs may highlight various types of valuable insights for an adversary, such as user authentication records ([Account Discovery](https://attack.mitre.org/techniques/T1087)), security or vulnerable software ([Software Discovery](https://attack.mitre.org/techniques/T1518)), or hosts within a compromised network ([Remote System Discovery](https://attack.mitre.org/techniques/T1018)). Host binaries may be leveraged to collect system logs. Examples include using `wevtutil.exe` or [PowerShell](https://attack.mitre.org/techniques/T1059/001) on Windows to access and/or export security event information.(Citation: WithSecure Lazarus-NoPineapple Threat Intel Report 2023)(Citation: Cadet Blizzard emerges as novel threat actor) In cloud environments, adversaries may leverage utilities such as the Azure VM Agent’s `CollectGuestLogs.exe` to collect security logs from cloud hosted infrastructure.(Citation: SIM Swapping and Abuse of the Microsoft Azure Serial Console) Adversaries may also target centralized logging infrastructure such as SIEMs. Logs may also be bulk exported and sent to adversary-controlled infrastructure for offline analysis. In addition to gaining a better understanding of the environment, adversaries may also monitor logs in real time to track incident response procedures. This may allow them to adjust their techniques in order to maintain persistence or evade defenses.(Citation: Permiso GUI-Vil 2023)
Near-miss passage: T1018 Remote System Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as [Ping](https://attack.mitre.org/software/S0097), <code>net view</code> using [Net](https://attack.mitre.org/software/S0039), or, on ESXi servers, `esxcli network diag ping`. Adversaries may also analyze data from local host files (ex: <code>C:\Windows\System32\Drivers\etc\hosts</code> or <code>/etc/hosts</code>) or other passive means (such as local [Arp](https://attack.mitre.org/software/S0099) cache entries) in order to discover the presence of remote systems in an environment. Adversaries may also target discovery of network infrastructure as well as leverage [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands on network devices to gather detailed information about systems within a network (e.g. <code>show cdp neighbors</code>, <code>show arp</code>).(Citation: US-CERT-TA18-106A)(Citation: CISA AR21-126A FIVEHANDS May 2021)
Query: detect Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260 in logs
Matching passage: Sigma rule: Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260. Logsource: windows / process_creation. Rule: title: Suspicious LNK Command-Line Padding with Whitespace Characters id: dd8756e7-a3a0-4768-b47e-8f545d1a751c status: experimental description: 'Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260-character UI limit while the actual command-line argument field supports 4096 characters using whitespace padding (e.g., 0x20, 0x09-0x0D). Adversaries insert non-printable whitespace characters (e.g., Line Feed \x0A, Carriage Return \x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary. The hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks. This rule flags suspicious use of such padding observed in real-world attacks. ' references: - https://syedhasan010.medium.com/forensics-analysis-of-an-lnk-file-da68a98b8415 - https://thehackernews.com/2025/03/unpatched-windows-zero-day-flaw.html - https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-03-19 tags: - attack.initial-access - attack.execution - attack.t1204.002 logsource: category: process_creation product: windows detection: selection_img: - ParentImage|endswith: \explorer.exe - ParentCommandLine|contains: .lnk selection_cmd: - CommandLine|contains: - ' ' - \u0009 - \u000A - \u0011 - \u0012 - \u0013 - \u000B - \u000C - \u000D - CommandLine|re: \n\n\n\n\n\n condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detection use of the command "split" to split files into parts and possible transfer.. Logsource: linux / auditd. Rule: title: Split A File Into Pieces - Linux id: 2dad0cba-c62a-4a4f-949f-5f6ecd619769 status: test description: Detection use of the command "split" to split files into parts and possible transfer. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1030/T1030.md author: Igor Fits, oscd.community date: 2020-10-15 modified: 2022-11-28 tags: - attack.exfiltration - attack.t1030 logsource: product: linux service: auditd detection: selection: type: SYSCALL comm: split condition: selection falsepositives: - Legitimate administrative activity level: low
Query: write Sigma for Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access
Matching passage: Sigma rule: Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access. Logsource: aws / cloudtrail. Rule: title: AWS Key Pair Import Activity id: 92f84194-8d9a-4ee0-8699-c30bfac59780 status: experimental description: 'Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations. ' references: - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportKeyPair.html author: Ivan Saakov date: 2024-12-19 tags: - attack.initial-access - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation logsource: product: aws service: cloudtrail detection: selection: eventSource: ec2.amazonaws.com eventName: ImportKeyPair condition: selection falsepositives: - Legitimate administrative actions by authorized users importing keys for valid purposes. - Automated processes for infrastructure setup may trigger this alert. - Verify the user identity, user agent, and source IP address to ensure they are expected. level: medium
Near-miss passage: Sigma rule: Detects the creation of screensaver files (.scr) outside of system folders. Attackers may execute an application as an ". Logsource: windows / file_event. Rule: title: SCR File Write Event id: c048f047-7e2a-4888-b302-55f509d4a91d status: test description: Detects the creation of screensaver files (.scr) outside of system folders. Attackers may execute an application as an ".SCR" file using "rundll32.exe desk.cpl,InstallScreenSaver" for example. references: - https://lolbas-project.github.io/lolbas/Libraries/Desk/ author: Christopher Peacock @securepeacock, SCYTHE @scythe_io date: 2022-04-27 modified: 2023-08-23 tags: - attack.stealth - attack.t1218.011 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: .scr filter: TargetFilename|contains: - :\$WINDOWS.~BT\NewOS\ - :\Windows\System32\ - :\Windows\SysWOW64\ - :\Windows\WinSxS\ - :\WUDownloadCache\ condition: selection and not filter falsepositives: - The installation of new screen savers by third party software level: medium
Query: describe CVE-2015-6500
Matching passage: CVE-2015-6500. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in ownCloud Server before 8.0.6 and 8.1.x before 8.1.1 allows remote authenticated users to list directory contents and possibly cause a denial of service (CPU consumption) via a .. (dot dot) in the dir parameter to index.php/apps/files/ajax/scan.php.
Near-miss passage: CVE-2015-5079. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in widgets/logs.php in BlackCat CMS before 1.1.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the dl parameter.
Query: secure coding against UNIX Symbolic Link (Symlink) Following
Matching passage: CWE-61 UNIX Symbolic Link (Symlink) Following. The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
Near-miss passage: CWE-1322 Use of Blocking Code in Single-threaded, Non-blocking Context. The product uses a non-blocking model that relies on a single threaded process for features such as scalability, but it contains code that can block when it is invoked.
Query: exploit Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0
Matching passage: CVE-2015-8406. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-6983. CWE: UNKNOWN. CVSS: 8.800000190734863. Double free vulnerability in Apple iOS before 9.1 and OS X before 10.11.1 allows attackers to write to arbitrary files via a crafted app that accesses AtomicBufferedFile descriptors.
Query: exploit HP Asset Manager 9.40 and 9.41 before 9.41.11103 P4-rev1 and 9.50 before 9.50.11925 P3 allows local users to obtain sensitive information via unspecified vectors.
Matching passage: CVE-2015-5448. CWE: CWE-200. CVSS: 2.0999999046325684. HP Asset Manager 9.40 and 9.41 before 9.41.11103 P4-rev1 and 9.50 before 9.50.11925 P3 allows local users to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-7915. CWE: CWE-200. CVSS: 9.800000190734863. Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 sends cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the network.
Query: CVE similar to CVE-2015-0098
Matching passage: CVE-2015-0098. CWE: CWE-264. CVSS: 7.199999809265137. Task Scheduler in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges by triggering application execution by an invalid task, aka "Task Scheduler Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-7227. CWE: CWE-264. CVSS: 3.5. The Fieldable Panels Panes module 7.x-1.x before 7.x-1.7 for Drupal does not properly check permissions to edit Fieldable Panels Panes entities, which allows remote authenticated users to edit panes by leveraging permissions to edit panels.
Query: Sigma rule for Detects execution of the Kernel Driver Utility (KDU) tool. KDU can be used to bypass driver signature enforcement and lo
Matching passage: Sigma rule: Detects execution of the Kernel Driver Utility (KDU) tool. KDU can be used to bypass driver signature enforcement and lo. Logsource: windows / process_creation. Rule: title: PUA - Kernel Driver Utility (KDU) Execution id: e76ca062-4de0-4d79-8d90-160a0d335eca status: experimental description: 'Detects execution of the Kernel Driver Utility (KDU) tool. KDU can be used to bypass driver signature enforcement and load unsigned or malicious drivers into the Windows kernel. Potentially allowing for privilege escalation, persistence, or evasion of security controls. ' references: - https://github.com/h4rmy/KDU - https://huntress.com/blog/esxi-vm-escape-exploit author: Matt Anderson, Dray Agha, Anna Pham (Huntress) date: 2026-01-02 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \kdu.exe - \hamakaze.exe - OriginalFileName: hamakaze.exe selection_cli_suspicious: CommandLine|contains: - '-map ' - '-prv ' - '-dse ' - '-ps ' condition: all of selection_* falsepositives: - Legitimate driver development, testing, or administrative troubleshooting (e.g., enabling/disabling hardware) level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_kdu_driver_tool/info.yml
Near-miss passage: Sigma rule: Detects a tscon.exe start as LOCAL SYSTEM. Logsource: windows / process_creation. Rule: title: Suspicious TSCON Start as SYSTEM id: 9847f263-4a81-424f-970c-875dab15b79b status: test description: Detects a tscon.exe start as LOCAL SYSTEM references: - http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html - https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6 - https://www.ired.team/offensive-security/lateral-movement/t1076-rdp-hijacking-for-lateral-movement author: Florian Roth (Nextron Systems) date: 2018-03-17 modified: 2022-05-27 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: User|contains: - AUTHORI - AUTORI Image|endswith: \tscon.exe condition: selection falsepositives: - Unknown level: high