alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: EDR alert: possible Shortcut Modification (T1547.009)
Matching passage: T1547.009 Shortcut Modification. Tactics: persistence, privilege escalation. Description: Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process. Adversaries may abuse shortcuts in the startup folder to execute their tools and achieve persistence.(Citation: Shortcut for Persistence ) Although often used as payloads in an infection chain (e.g. [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001)), adversaries may also create a new shortcut as a means of indirection, while also abusing [Masquerading](https://attack.mitre.org/techniques/T1036) to make the malicious shortcut appear as a legitimate program. Adversaries can also edit the target path or entirely replace an existing shortcut so their malware will be executed instead of the intended legitimate program. Shortcuts can also be abused to establish persistence by implementing other methods. For example, LNK browser extensions may be modified (e.g. [Browser Extensions](https://attack.mitre.org/techniques/T1176/001)) to persistently launch malware.
Near-miss passage: T1547.002 Authentication Package. Tactics: persistence, privilege escalation. Description: Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system.(Citation: MSDN Authentication Packages) Adversaries can use the autostart mechanism provided by LSA authentication packages for persistence by placing a reference to a binary in the Windows Registry location <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\</code> with the key value of <code>"Authentication Packages"=&lt;target binary&gt;</code>. The binary will then be executed by the system when the authentication packages are loaded.
Query: risk of Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, A
Matching passage: CVE-2015-7640. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.
Near-miss passage: CVE-2015-5408. CWE: UNKNOWN. CVSS: 6.0. HP CentralView Fraud Risk Management 11.1, 11.2, and 11.3; CentralView Revenue Leakage Control 4.1, 4.2, and 4.3; CentralView Dealer Performance Audit 2.0 and 2.1; CentralView Credit Risk Control 2.1, 2.2, and 2.3; CentralView Roaming Fraud Control 2.1, 2.2, and 2.3; and CentralView Subscription Fraud Prevention 2.0 and 2.1 allow remote attackers to obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2015-5406 and CVE-2015-5407.
Query: CVE similar to CVE-2015-6940
Matching passage: CVE-2015-6940. CWE: CWE-200. CVSS: 5.0. The GetResource servlet in Pentaho Business Analytics (BA) Suite 4.5.x, 4.8.x, and 5.0.x through 5.2.x and Pentaho Data Integration (PDI) Suite 4.3.x, 4.4.x, and 5.0.x through 5.2.x does not restrict access to files in the pentaho-solutions/system folder, which allows remote attackers to obtain passwords and other sensitive information via a file name in the resource parameter.
Near-miss passage: CVE-2015-9032. CWE: CWE-200. CVSS: 3.299999952316284. In all Android releases from CAF using the Linux kernel, a DRM key was exposed to QTEE applications.
Query: Sigma rule for Detects Base64 encoded Shellcode
Matching passage: Sigma rule: Detects Base64 encoded Shellcode. Logsource: windows / ps_script. Rule: title: PowerShell ShellCode id: 16b37b70-6fcf-4814-a092-c36bd3aafcbd status: test description: Detects Base64 encoded Shellcode references: - https://twitter.com/cyb3rops/status/1063072865992523776 author: David Ledbetter (shellcode), Florian Roth (Nextron Systems) date: 2018-11-17 modified: 2024-01-25 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - OiCAAAAYInlM - OiJAAAAYInlM condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that ar. Logsource: windows. Rule: title: Mimikatz Use id: 06d71506-7beb-4f22-8888-e2e5e2ca7fd8 status: test description: This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups) references: - https://tools.thehacker.recipes/mimikatz/modules author: Florian Roth (Nextron Systems), David ANDRE (additional keywords) date: 2017-01-10 modified: 2022-01-05 tags: - attack.s0002 - attack.lateral-movement - attack.credential-access - car.2013-07-001 - car.2019-04-004 - attack.t1003.002 - attack.t1003.004 - attack.t1003.001 - attack.t1003.006 logsource: product: windows detection: keywords: - dpapi::masterkey - eo.oe.kiwi - event::clear - event::drop - gentilkiwi.com - kerberos::golden - kerberos::ptc - kerberos::ptt - kerberos::tgt - Kiwi Legit Printer - 'lsadump::' - mimidrv.sys - \mimilib.dll - misc::printnightmare - misc::shadowcopies - misc::skeleton - privilege::backup - privilege::debug - privilege::driver - 'sekurlsa::' filter: EventID: 15 condition: keywords and not filter falsepositives: - Naughty administrators - AV Signature updates - Files with Mimikatz in their filename level: high
Query: rule covering Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe
Matching passage: Sigma rule: Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe. Logsource: windows / process_creation. Rule: title: Regedit as Trusted Installer id: 883835a7-df45-43e4-bf1d-4268768afda4 status: test description: Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe references: - https://twitter.com/1kwpeter/status/1397816101455765504 author: Florian Roth (Nextron Systems) date: 2021-05-27 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548 logsource: category: process_creation product: windows detection: selection: Image|endswith: \regedit.exe ParentImage|endswith: - \TrustedInstaller.exe - \ProcessHacker.exe condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes Secret or Config Object Access id: 7ee0b4aa-d8d4-4088-b661-20efdf41a04c status: test description: Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1 author: Austin Songer @austinsonger date: 2021-08-07 modified: 2022-08-23 tags: - attack.impact - attack.t1485 - attack.t1496 - attack.t1489 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/CONFIGMAPS/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/CONFIGMAPS/DELETE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SECRETS/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SECRETS/DELETE condition: selection falsepositives: - Sensitive objects may be accessed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Sensitive objects accessed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: Sigma YAML for windows / process_access
Matching passage: Sigma rule: Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as a way to dump the LS. Logsource: windows / process_access. Rule: title: LSASS Access From Potentially White-Listed Processes id: 4be8b654-0c01-4c9d-a10c-6b28467fc651 status: test description: 'Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as a way to dump the LSASS process memory without Microsoft Defender interference ' references: - https://twitter.com/_xpn_/status/1491557187168178176 - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz - https://twitter.com/mrd0x/status/1460597833917251595 author: Florian Roth (Nextron Systems) date: 2022-02-10 modified: 2023-11-29 tags: - attack.credential-access - attack.t1003.001 - attack.s0002 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe SourceImage|endswith: - \TrolleyExpress.exe - \ProcessDump.exe - \dump64.exe GrantedAccess|endswith: - '10' - '30' - '50' - '70' - '90' - B0 - D0 - F0 - '18' - '38' - '58' - '78' - '98' - B8 - D8 - F8 - 1A - 3A - 5A - 7A - 9A - BA - DA - FA - '0x14C2' - FF condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious service installation commands. Logsource: windows / system. Rule: title: Suspicious Service Installation id: 1d61f71d-59d2-479e-9562-4ff5f4ead16b related: - id: ca83e9f3-657a-45d0-88d6-c1ac280caf53 type: obsolete - id: 26481afe-db26-4228-b264-25a29fe6efc7 type: similar status: test description: Detects suspicious service installation commands references: - Internal Research author: pH-T (Nextron Systems), Florian Roth (Nextron Systems) date: 2022-03-18 modified: 2023-12-04 tags: - attack.persistence - attack.privilege-escalation - car.2013-09-005 - attack.t1543.003 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains: - ' -nop ' - ' -sta ' - ' -w hidden ' - :\Temp\ - .downloadfile( - .downloadstring( - \ADMIN$\ - \Perflogs\ - '&&' condition: selection falsepositives: - Unknown level: high
Query: Outbound C2 pattern associated with Exfiltration Over Physical Medium
Matching passage: T1052 Exfiltration Over Physical Medium. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
Near-miss passage: T1052.001 Exfiltration over USB. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
Query: exploit Multiple cross-site scripting (XSS) vulnerabilities in the WP Media Cleaner plugin 2.2.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) vie
Matching passage: CVE-2015-2195. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the WP Media Cleaner plugin 2.2.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) view, (2) paged, or (3) s parameter in the wp-media-cleaner page to wp-admin/upload.php.
Near-miss passage: CVE-2015-0714. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Cisco Finesse Server 10.0(1), 10.5(1), 10.6(1), and 11.0(1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCut53595.
Query: exploit Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allow remote authenticated users to insert the content of an arbitrary file into a FR
Matching passage: CVE-2015-6491. CWE: UNKNOWN. CVSS: 4.0. Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allow remote authenticated users to insert the content of an arbitrary file into a FRAME element via unspecified vectors.
Near-miss passage: CVE-2015-3146. CWE: UNKNOWN. CVSS: 7.5. The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cb.c in libssh before 0.6.5 do not properly validate state, which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted SSH packet.
Query: exploit The rtsp_getdlsendtime method in the CNC_Ctrl control in Samsung SmartViewer allows remote attackers to execute arbitrary code via an index value.
Matching passage: CVE-2015-8040. CWE: CWE-20. CVSS: 6.800000190734863. The rtsp_getdlsendtime method in the CNC_Ctrl control in Samsung SmartViewer allows remote attackers to execute arbitrary code via an index value.
Near-miss passage: CVE-2015-8733. CWE: CWE-20. CVSS: 5.5. The ngsniffer_process_record function in wiretap/ngsniffer.c in the Sniffer file parser in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the relationships between record lengths and record header lengths, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file.
Query: risk of MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A buffer overflow vulnerability was reported, (fixed and publicly disclosed in 2015) in the Leno
Matching passage: CVE-2015-5684. CWE: CWE-120. CVSS: 9.800000190734863. MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A buffer overflow vulnerability was reported, (fixed and publicly disclosed in 2015) in the Lenovo Service Engine (LSE), affecting various versions of BIOS for Lenovo Notebooks, that could allow a remote user to execute arbitrary code on the system.
Near-miss passage: CVE-2015-10123. CWE: CWE-120. CVSS: 8.800000190734863. An unautheticated remote attacker could send specifically crafted packets to a affected device. If an authenticated user then views that data in a specific page of the web-based management a buffer overflow will be triggered to gain full access of the device.
Query: patch priority for CVE-2015-1327
Matching passage: CVE-2015-1327. CWE: CWE-264. CVSS: 7.800000190734863. Content Hub before version 0.0+15.04.20150331-0ubuntu1.0 DBUS API only requires a file path for a content item, it doesn't actually require the confined app have access to the file to create a transfer. This could allow a malicious application using the DBUS API to export file:///etc/passwd which would then send a copy of that file to another app.
Near-miss passage: CVE-2015-6779. CWE: CWE-264. CVSS: 4.300000190734863. PDFium, as used in Google Chrome before 47.0.2526.73, does not properly restrict use of chrome: URLs, which allows remote attackers to bypass intended scheme restrictions via a crafted PDF document, as demonstrated by a document with a link to a chrome://settings URL.
Query: detect Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy in logs
Matching passage: Sigma rule: Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy. Logsource: windows / process_creation. Rule: title: Potential Suspicious Activity Using SeCEdit id: c2c76b77-32be-4d1f-82c9-7e544bdfe0eb status: test description: Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy references: - https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/secedit author: Janantha Marasinghe date: 2022-11-18 modified: 2022-12-30 tags: - attack.collection - attack.discovery - attack.persistence - attack.credential-access - attack.privilege-escalation - attack.execution - attack.stealth - attack.defense-impairment - attack.t1685.001 - attack.t1547.001 - attack.t1505.005 - attack.t1556.002 - attack.t1685 - attack.t1574.007 - attack.t1564.002 - attack.t1546.008 - attack.t1546.007 - attack.t1547.014 - attack.t1547.010 - attack.t1547.002 - attack.t1557 - attack.t1082 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \secedit.exe - OriginalFileName: SeCEdit selection_flags_discovery: CommandLine|contains|all: - /export - /cfg selection_flags_configure: CommandLine|contains|all: - /configure - /db condition: selection_img and (1 of selection_flags_*) falsepositives: - Legitimate administrative use level: medium
Near-miss passage: Sigma rule: Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePo. Logsource: linux / process_creation. Rule: title: PUA - TruffleHog Execution - Linux id: d7a650c4-226c-451e-948f-cc490db506aa related: - id: 44030449-b0df-4c94-aae1-502359ab28ee type: similar status: experimental description: 'Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously. While it is a legitimate tool, intended for use in CI pipelines and security assessments, It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information. ' references: - https://github.com/trufflesecurity/trufflehog - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-09-24 tags: - attack.discovery - attack.credential-access - attack.t1083 - attack.t1552.001 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /trufflehog selection_cli_platform: CommandLine|contains: - ' docker --image ' - ' Git ' - ' GitHub ' - ' Jira ' - ' Slack ' - ' Confluence ' - ' SharePoint ' - ' s3 ' - ' gcs ' selection_cli_verified: CommandLine|contains: ' --results=verified' condition: selection_img or all of selection_cli_* falsepositives: - Legitimate use of TruffleHog by security teams or developers. level: medium
Query: CVE similar to CVE-2015-2914
Matching passage: CVE-2015-2914. CWE: UNKNOWN. CVSS: 5.0. Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M use a fixed source-port number in outbound DNS queries performed on behalf of any device, which makes it easier for remote attackers to spoof responses by using this number for the destination port, a different vulnerability than CVE-2015-7296.
Near-miss passage: CVE-2015-4838. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.4.0, 12.1.2.0.0, and 12.1.3.0.0 allows remote authenticated users to affect confidentiality via vectors related to ADF Faces.
Query: risk of Heap-based buffer overflow in Aruba Instant (IAP) with firmware before 4.0.0.7 and 4.1.x before 4.1.1.2 allows remote attackers to cause a denial of service (crash or reset to fact
Matching passage: CVE-2015-1348. CWE: CWE-119. CVSS: 7.800000190734863. Heap-based buffer overflow in Aruba Instant (IAP) with firmware before 4.0.0.7 and 4.1.x before 4.1.1.2 allows remote attackers to cause a denial of service (crash or reset to factory default) via a malformed frame to the wireless interface.
Near-miss passage: CVE-2015-3247. CWE: CWE-119. CVSS: 6.900000095367432. Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via unspecified vectors.
Query: patch priority for CVE-2015-4758
Matching passage: CVE-2015-4758. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality based on Trillium, a different vulnerability than CVE-2015-0443, CVE-2015-0444, CVE-2015-0445, CVE-2015-0446, CVE-2015-2634, CVE-2015-2635, CVE-2015-2636, and CVE-2015-4759.
Near-miss passage: CVE-2015-4888. CWE: UNKNOWN. CVSS: 6.5. Unspecified vulnerability in the Java VM component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-4796.
Query: patch priority for CVE-2015-5831
Matching passage: CVE-2015-5831. CWE: CWE-200. CVSS: 5.0. NetworkExtension in the kernel in Apple iOS before 9 does not properly initialize an unspecified data structure, which allows attackers to obtain sensitive memory-layout information via a crafted app.
Near-miss passage: CVE-2015-3269. CWE: CWE-200. CVSS: 5.0. Apache Flex BlazeDS, as used in flex-messaging-core.jar in Adobe LiveCycle Data Services (LCDS) 3.0.x before 3.0.0.354170, 4.5 before 4.5.1.354169, 4.6.2 before 4.6.2.354169, and 4.7 before 4.7.0.354169 and other products, allows remote attackers to read arbitrary files via an AMF message containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Query: CVE similar to CVE-2015-4772
Matching passage: CVE-2015-4772. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition.
Near-miss passage: CVE-2015-2813. CWE: UNKNOWN. CVSS: 5.0. XML external entity (XXE) vulnerability in SAP Mobile Platform allows remote attackers to send requests to intranet servers via crafted XML, aka SAP Security Note 2125358.
Query: vulnerability: Use-after-free vulnerability in the spl_ptr_heap_insert function in ext/spl/spl_heap.c in PHP before 5.5.27 and 5.6.x before 5.6.11 allows remote attackers to execute arbitrary cod
Matching passage: CVE-2015-4116. CWE: UNKNOWN. CVSS: 9.800000190734863. Use-after-free vulnerability in the spl_ptr_heap_insert function in ext/spl/spl_heap.c in PHP before 5.5.27 and 5.6.x before 5.6.11 allows remote attackers to execute arbitrary code by triggering a failed SplMinHeap::compare operation.
Near-miss passage: CVE-2015-2605. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in the Oracle Endeca Information Discovery Studio component in Oracle Fusion Middleware 2.2.2, 2.3, 2.4, 3.0, and 3.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Integrator, a different vulnerability than CVE-2015-2602, CVE-2015-2603, CVE-2015-2604, CVE-2015-2606, and CVE-2015-4745.