alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cook
Matching passage: CVE-2015-1820. CWE: CWE-384. CVSS: 9.800000190734863. REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect.
Near-miss passage: CVE-2015-5384. CWE: CWE-384. CVSS: 8.800000190734863. AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier is vulnerable to a Session Fixation attack.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting. Logsource: windows / process_creation. Rule: title: Use of OpenConsole id: 814c95cc-8192-4378-a70a-f1aafd877af1 status: test description: Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting references: - https://twitter.com/nas_bench/status/1537563834478645252 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-16 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: OpenConsole.exe - Image|endswith: \OpenConsole.exe filter: Image|startswith: C:\Program Files\WindowsApps\Microsoft.WindowsTerminal condition: selection and not filter falsepositives: - Legitimate use by an administrator level: medium
Near-miss passage: Sigma rule: Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights. Logsource: windows / process_creation. Rule: title: PsExec/PAExec Escalation to LOCAL SYSTEM id: 8834e2f7-6b4b-4f09-8906-d2276470ee23 related: - id: 207b0396-3689-42d9-8399-4222658efc99 type: similar status: test description: Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights references: - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec - https://www.poweradmin.com/paexec/ - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-11-23 modified: 2024-03-05 tags: - attack.resource-development - attack.t1587.001 logsource: category: process_creation product: windows detection: selection_sys: CommandLine|contains|windash: - ' -s cmd' - ' -s -i cmd' - ' -i -s cmd' - ' -s pwsh' - ' -s -i pwsh' - ' -i -s pwsh' - ' -s powershell' - ' -s -i powershell' - ' -i -s powershell' selection_other: CommandLine|contains: - psexec - paexec - accepteula condition: all of selection_* falsepositives: - Admins that use PsExec or PAExec to escalate to the SYSTEM account for maintenance purposes (rare) - Users that debug Microsoft Intune issues using the commands mentioned in the official documentation; see https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension level: high
Query: vulnerability: The Connector Migration Tool in IBM InfoSphere Information Server 8.1 through 11.3 allows remote authenticated users to bypass intended restrictions on job creation and modificatio
Matching passage: CVE-2015-0180. CWE: CWE-284. CVSS: 5.5. The Connector Migration Tool in IBM InfoSphere Information Server 8.1 through 11.3 allows remote authenticated users to bypass intended restrictions on job creation and modification via unspecified vectors.
Near-miss passage: CVE-2015-9024. CWE: CWE-284. CVSS: 5.5. In all Android releases from CAF using the Linux kernel, some interfaces were improperly exposed to QTEE applications.
Query: CVE similar to CVE-2015-5009
Matching passage: CVE-2015-5009. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM WebSphere Commerce 6.0 through FP11, 6.0 Feature Pack 4, 7.0 through FP9, 7.0 Feature Pack 5 through 8, and 8.0 before 8.0.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-6529. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in phpipam 1.1.010 allow remote attackers to inject arbitrary web script or HTML via the (1) section parameter to site/error.php or (2) ip parameter to site/tools/searchResults.php.
Query: detection rule: Detects process creation with suspicious whitespace padding followed by a '#' character, which may indicate ClickFix or
Matching passage: Sigma rule: Detects process creation with suspicious whitespace padding followed by a '#' character, which may indicate ClickFix or. Logsource: windows / process_creation. Rule: title: Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix id: 3ae9974a-eb09-4044-8e70-8980a50c12c8 related: - id: 8f2a5c3d-9e4b-4a7c-8d1f-2e5a6b9c3d7e type: similar - id: 7a1b4c5e-8f3d-4b9a-7c2e-1f4a5b8c6d9e type: similar status: experimental description: 'Detects process creation with suspicious whitespace padding followed by a ''#'' character, which may indicate ClickFix or FileFix techniques used to conceal malicious commands from visual inspection. ClickFix and FileFix are social engineering attack techniques where adversaries distribute phishing documents or malicious links that deceive users into opening the Windows Run dialog box or File Explorer search bar. The victims are then instructed to paste commands from their clipboard, which contain extensive whitespace padding using various Unicode space characters to push the actual malicious command far to the right, effectively hiding it from immediate view. ' references: - https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/ - https://mrd0x.com/filefix-clickfix-alternative/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-04 modified: 2025-11-26 tags: - attack.execution - attack.stealth - attack.t1204.004 - attack.t1027.010 logsource: category: process_creation product: windows detection: selection_explorer: ParentImage|endswith: \explorer.exe CommandLine|contains: '#' selection_space_variation: CommandLine|contains: - - - - - - - - - - - - - ' ' condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects an uncommon svchost parent process. Logsource: windows / process_creation. Rule: title: Uncommon Svchost Parent Process id: 01d2e2a1-5f09-44f7-9fc1-24faa7479b6d status: test description: Detects an uncommon svchost parent process references: - Internal Research author: Florian Roth (Nextron Systems) date: 2017-08-15 modified: 2022-06-28 tags: - attack.stealth - attack.t1036.005 logsource: category: process_creation product: windows detection: selection: Image|endswith: \svchost.exe filter_main_generic: ParentImage|endswith: - \Mrt.exe - \MsMpEng.exe - \ngen.exe - \rpcnet.exe - \services.exe - \TiWorker.exe filter_main_parent_null: ParentImage: null filter_main_parent_empty: ParentImage: - '-' - '' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: containment actions for EDR alert: possible Match Legitimate Resource Name or Location (T1036.005)
Matching passage: Playbook for T1036.005 Match Legitimate Resource Name or Location. 1) Validate alert telemetry against T1036.005. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: `svchost.exe`). Alternatively, a Windows Re
Near-miss passage: Playbook for T1036.003 Rename Legitimate Utilities. Different response path focused on stealth.
Query: describe CVE-2015-5195
Matching passage: CVE-2015-5195. CWE: CWE-20. CVSS: 7.5. ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.
Near-miss passage: CVE-2015-3621. CWE: CWE-20. CVSS: 9.300000190734863. Untrusted search path vulnerability in SAP Enterprise Central Component (ECC) allows local users to gain privileges via a Trojan horse program.
Query: SOC runbook when seeing Suspicious AppleScript execution detected on endpoint
Matching passage: Playbook for T1059.002 AppleScript. 1) Validate alert telemetry against T1059.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: execution. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.(Citation: Apple AppleScript) These AppleEvent messages can be sent independently or easily scripted with AppleScript. These events can locate open windows, send keystrokes, and interact with almost any ope
Near-miss passage: Playbook for T1059.008 Network Device CLI. Different response path focused on execution.
Query: vulnerability: EMC RSA Archer GRC 5.x before 5.5.3 uses cleartext for stored passwords in unspecified circumstances, which allows remote authenticated users to obtain sensitive information by rea
Matching passage: CVE-2015-4543. CWE: CWE-200. CVSS: 4.0. EMC RSA Archer GRC 5.x before 5.5.3 uses cleartext for stored passwords in unspecified circumstances, which allows remote authenticated users to obtain sensitive information by reading database fields.
Near-miss passage: CVE-2015-6059. CWE: CWE-200. CVSS: 4.300000190734863. The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Scripting Engine Information Disclosure Vulnerability."
Query: secure coding against Incorrect Pointer Scaling
Matching passage: CWE-468 Incorrect Pointer Scaling. In C and C++, one may often accidentally refer to the wrong memory due to the semantics of when math operations are implicitly scaled.
Near-miss passage: CWE-1311 Improper Translation of Security Attributes by Fabric Bridge. The bridge incorrectly translates security attributes from either trusted to untrusted or from untrusted to trusted when converting from one fabric protocol to another.
Query: threat report mentioning Port Knocking
Matching passage: T1205.001 Port Knocking. Tactics: stealth, persistence, command and control. Description: Adversaries may use port knocking to hide open ports used for persistence or command and control. To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports. After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software. This technique has been observed both for the dynamic opening of a listening port as well as the initiating of a connection to a listening server on a different system. The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.
Near-miss passage: T1205 Traffic Signaling. Tactics: stealth, persistence, command and control. Description: Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control. Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task. This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control. Usually this series of packets consists of attempted connections to a predefined sequence of closed ports (i.e. [Port Knocking](https://attack.mitre.org/techniques/T1205/001)), but can involve unusual flags, specific strings, or other unique characteristics. After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software. Adversaries may also communicate with an already open port, but the service listening on that port will only respond to commands or trigger other malicious functionality if passed the appropriate magic value(s). The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs. On network devices, adversaries may use crafted packets to enable [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004) for standard services offered by the device such as telnet. Such signaling may also be used to open a closed service port such as telnet, or to trigger module modification of malware implants on the device, adding, removing, or changing malicious capabilities. Adversaries may use crafted packets to attempt to connect to one or more (open or closed) ports, but may also
Query: impact using Transmitted Data Manipulation
Matching passage: T1565.002 Transmitted Data Manipulation. Tactics: impact. Description: Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Manipulation may be possible over a network connection or between system processes where there is an opportunity deploy a tool that will intercept and change information. The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Near-miss passage: T1565.003 Runtime Data Manipulation. Tactics: impact. Description: Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating runtime data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Adversaries may alter application binaries used to display data in order to cause runtime manipulations. Adversaries may also conduct [Change Default File Association](https://attack.mitre.org/techniques/T1546/001) and [Masquerading](https://attack.mitre.org/techniques/T1036) to cause a similar effect. The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Query: containment actions for Suspicious Domain Account execution detected on endpoint
Matching passage: Playbook for T1136.002 Domain Account. 1) Validate alert telemetry against T1136.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: persistence. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the <code>net user /add /domain</code> command
Near-miss passage: Playbook for T1136 Create Account. Different response path focused on persistence.
Query: vulnerability: RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to 
Matching passage: CVE-2015-3900. CWE: CWE-254. CVSS: 5.0. RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."
Near-miss passage: CVE-2015-3729. CWE: CWE-254. CVSS: 4.300000190734863. Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not indicate what web site originated an input prompt, which allows remote attackers to conduct spoofing attacks via a crafted site.
Query: patch priority for CVE-2015-6563
Matching passage: CVE-2015-6563. CWE: CWE-20. CVSS: 6.400000095367432. The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITOR_REQ_PAM_INIT_CTX requests, which allows local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted MONITOR_REQ_PWNAM request, related to monitor.c and monitor_wrap.c.
Near-miss passage: CVE-2015-2458. CWE: CWE-20. CVSS: 9.300000190734863. ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability," a different vulnerability than CVE-2015-2459 and CVE-2015-2461.
Query: write Sigma for Detects when an attacker register a new SIP provider for persistence and defense evasion
Matching passage: Sigma rule: Detects when an attacker register a new SIP provider for persistence and defense evasion. Logsource: windows / registry_set. Rule: title: Persistence Via New SIP Provider id: 5a2b21ee-6aaa-4234-ac9d-59a59edf90a1 status: test description: Detects when an attacker register a new SIP provider for persistence and defense evasion references: - https://persistence-info.github.io/Data/codesigning.html - https://github.com/gtworek/PSBits/tree/master/SIP - https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1553.003 logsource: category: registry_set product: windows detection: selection_root: TargetObject|contains: - \SOFTWARE\Microsoft\Cryptography\Providers\ - \SOFTWARE\Microsoft\Cryptography\OID\EncodingType - \SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\ - \SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType selection_dll: TargetObject|contains: - \Dll - \$DLL filter: Details: - WINTRUST.DLL - mso.dll filter_poqexec: Image: C:\Windows\System32\poqexec.exe TargetObject|contains: \CryptSIPDll Details: C:\Windows\System32\PsfSip.dll condition: all of selection_* and not 1 of filter* falsepositives: - Legitimate SIP being registered by the OS or different software. level: medium
Near-miss passage: Sigma rule: Detects uncommon child processes of Appvlp.EXE Appvlp or the Application Virtualization Utility is included with Microso. Logsource: windows / process_creation. Rule: title: Uncommon Child Process Of Appvlp.EXE id: 9c7e131a-0f2c-4ae0-9d43-b04f4e266d43 status: test description: 'Detects uncommon child processes of Appvlp.EXE Appvlp or the Application Virtualization Utility is included with Microsoft Office. Attackers are able to abuse "AppVLP" to execute shell commands. Normally, this binary is used for Application Virtualization, but it can also be abused to circumvent the ASR file path rule folder or to mark a file as a system file. ' references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Appvlp/ author: Sreeman date: 2020-03-13 modified: 2023-11-09 tags: - attack.stealth - attack.t1218 - attack.execution logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \appvlp.exe filter_main_generic: Image|endswith: - :\Windows\SysWOW64\rundll32.exe - :\Windows\System32\rundll32.exe filter_optional_office_msoasb: Image|contains: :\Program Files\Microsoft Office Image|endswith: \msoasb.exe filter_optional_office_skype: Image|contains|all: - :\Program Files\Microsoft Office - \SkypeSrv\ Image|endswith: \SKYPESERVER.EXE filter_optional_office_msouc: Image|contains: :\Program Files\Microsoft Office Image|endswith: \MSOUC.EXE condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium