alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Encoded PowerShell / command-line abuse matching Cloud Firewall
Matching passage: T1686.001 Cloud Firewall. Tactics: defense impairment. Description: Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols. An adversary with appropriate permissions may introduce new firewall rules or policies to allow access into a victim cloud environment and/or move laterally from the cloud control plane to the data plane. For example, an adversary may use a script or utility that creates new ingress rules in existing security groups (or creates new security groups entirely) to allow any TCP/IP connectivity to a cloud-hosted instance. They may also remove networking limitations to support traffic associated with malicious activity (such as cryptomining).(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022)(Citation: Expel AWS)
Near-miss passage: T1686.002 Network Device Firewall. Tactics: defense impairment. Description: Adversaries may disable network device-based firewall mechanisms entirely or add, delete, or modify particular rules in order to bypass controls limiting network usage. Adversaries may obtain access to devices such as routers, switches, or other perimeter/network devices and change access control lists (ACLs), security zones, or policy rules to permit otherwise blocked traffic. For example, adversaries may add new network firewall rules to allow access to all internal network subnets without restrictions. Allowing access to internal network subsets may enable unrestricted inbound/outbound connectivity or open paths for command and control and lateral movement. Adversaries may obtain access to network device management interfaces via [Valid Accounts](https://attack.mitre.org/techniques/T1078) or by exploiting vulnerabilities. In some cases, threat actors may target firewalls and other network infrastructure that are exposed to the internet by leveraging weaknesses in public-facing applications ([Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).(Citation: CVE-2024-55591 Detail) Adversaries may also modify host networking configurations that indirectly manipulate system firewalls, such as adjusting interface bandwidth or network connection request thresholds.
Query: describe CVE-2015-0882
Matching passage: CVE-2015-0882. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in zencart-ja (aka Zen Cart Japanese edition) 1.3 jp through 1.3.0.2 jp8 and 1.5 ja through 1.5.1 ja allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to admin/includes/init_includes/init_sanitize.php and includes/init_includes/init_sanitize.php.
Near-miss passage: CVE-2015-7398. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: alert when Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe,
Matching passage: Sigma rule: Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe,. Logsource: windows / process_creation. Rule: title: Potential Suspicious Browser Launch From Document Reader Process id: 1193d960-2369-499f-a158-7b50a31df682 status: test description: 'Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc. And connects to a web application over http(s), this could indicate a possible phishing attempt. ' references: - https://app.any.run/tasks/69c5abaa-92ad-45ba-8c53-c11e23e05d04/ - https://app.any.run/tasks/64043a79-165f-4052-bcba-e6e49f847ec1/ author: Joseph Kamau date: 2024-05-27 modified: 2025-10-07 tags: - attack.execution - attack.t1204.002 logsource: product: windows category: process_creation detection: selection: ParentImage|contains: - Acrobat Reader - Microsoft Office - PDF Reader Image|endswith: - \brave.exe - \chrome.exe - \firefox.exe - \msedge.exe - \opera.exe - \maxthon.exe - \seamonkey.exe - \vivaldi.exe CommandLine|contains: http filter_main_microsoft_help: CommandLine|contains: https://go.microsoft.com/fwlink/ filter_optional_foxit: CommandLine|contains: - http://ad.foxitsoftware.com/adlog.php? - https://globe-map.foxitservice.com/go.php?do=redirect condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unlikely in most cases, further investigation should be done in the commandline of the browser process to determine the context of the URL accessed. level: medium
Near-miss passage: Sigma rule: Detects new user account creation. Logsource: okta / okta. Rule: title: New Okta User Created id: b6c718dd-8f53-4b9f-98d8-93fdca966969 status: test description: Detects new user account creation author: Nasreddine Bencherchali (Nextron Systems) date: 2023-10-25 modified: 2026-04-27 references: - https://developer.okta.com/docs/reference/api/event-types/ tags: - attack.credential-access logsource: service: okta product: okta detection: selection: eventType: user.lifecycle.create condition: selection falsepositives: - Legitimate and authorized user creation level: informational
Query: alert when Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0
Matching passage: Sigma rule: Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0. Logsource: windows / process_creation. Rule: title: Potential PowerShell Downgrade Attack id: b3512211-c67e-4707-bedc-66efc7848863 related: - id: 6331d09b-4785-4c13-980f-f96661356249 type: derived status: test description: Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0 references: - http://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/ - https://github.com/r00t-3xp10it/hacking-material-books/blob/43cb1e1932c16ff1f58b755bc9ab6b096046853f/obfuscation/simple_obfuscation.md#bypass-or-avoid-amsi-by-version-downgrade- author: Harish Segar (rule) date: 2020-03-20 modified: 2023-01-04 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: \powershell.exe CommandLine|contains: - ' -version 2 ' - ' -versio 2 ' - ' -versi 2 ' - ' -vers 2 ' - ' -ver 2 ' - ' -ve 2 ' - ' -v 2 ' condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping. Logsource: zeek / dce_rpc. Rule: title: MITRE BZAR Indicators for Persistence id: 53389db6-ba46-48e3-a94c-e0f2cefe1583 status: test description: Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE. references: - https://github.com/mitre-attack/bzar#indicators-for-attck-persistence author: '@neu5ron, SOC Prime' date: 2020-03-19 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.004 logsource: product: zeek service: dce_rpc detection: op1: endpoint: spoolss operation: RpcAddMonitor op2: endpoint: spoolss operation: RpcAddPrintProcessor op3: endpoint: IRemoteWinspool operation: RpcAsyncAddMonitor op4: endpoint: IRemoteWinspool operation: RpcAsyncAddPrintProcessor op5: endpoint: ISecLogon operation: SeclCreateProcessWithLogonW op6: endpoint: ISecLogon operation: SeclCreateProcessWithLogonExW condition: 1 of op* falsepositives: - Windows administrator tasks or troubleshooting - Windows management scripts or software level: medium
Query: vulnerability: Cisco ASR 9000 devices with software 5.3.0.BASE do not recognize that certain ACL entries have a single-host constraint, which allows remote attackers to bypass intended network-re
Matching passage: CVE-2015-0694. CWE: CWE-284. CVSS: 5.0. Cisco ASR 9000 devices with software 5.3.0.BASE do not recognize that certain ACL entries have a single-host constraint, which allows remote attackers to bypass intended network-resource access restrictions by using an address that was not supposed to have been allowed, aka Bug ID CSCur28806.
Near-miss passage: CVE-2015-7473. CWE: CWE-284. CVSS: 2.5. runmqsc in IBM WebSphere MQ 8.x before 8.0.0.5 allows local users to bypass intended queue-manager command access restrictions by leveraging authority for +connect and +dsp.
Query: vulnerability: Cisco Prime Collaboration Assurance 10.0 allows remote attackers to cause a denial of service (HTTP service outage) via a crafted HTTP request, aka Bug ID CSCum38844.
Matching passage: CVE-2015-4280. CWE: CWE-399. CVSS: 5.0. Cisco Prime Collaboration Assurance 10.0 allows remote attackers to cause a denial of service (HTTP service outage) via a crafted HTTP request, aka Bug ID CSCum38844.
Near-miss passage: CVE-2015-1072. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Query: describe CVE-2015-9040
Matching passage: CVE-2015-9040. CWE: CWE-284. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in a GERAN API.
Near-miss passage: CVE-2015-3691. CWE: CWE-284. CVSS: 9.300000190734863. The Monitor Control Command Set kernel extension in the Display Drivers subsystem in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages control of a function pointer.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in EMC Documentum CenterStage 1.2SP1 and 1.2SP2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified ve
Matching passage: CVE-2015-4528. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in EMC Documentum CenterStage 1.2SP1 and 1.2SP2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-0674. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the Alert Service of Cisco Cloud Web Security base revision allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Query: risk of Directory traversal vulnerability in the web server on Honeywell Midas gas detectors before 1.13b3 and Midas Black gas detectors before 2.13b3 allows remote attackers to bypass aut
Matching passage: CVE-2015-7907. CWE: CWE-22. CVSS: 8.600000381469727. Directory traversal vulnerability in the web server on Honeywell Midas gas detectors before 1.13b3 and Midas Black gas detectors before 2.13b3 allows remote attackers to bypass authentication, and write to a configuration file or trigger a calibration or test, via unspecified vectors.
Near-miss passage: CVE-2015-3309. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. (dot dot) in the path parameter of HTTP API requests. NOTE: This vulnerability is due to an incomplete fix to CVE-2015-3297.
Query: describe CVE-2015-6403
Matching passage: CVE-2015-6403. CWE: CWE-20. CVSS: 7.199999809265137. The TFTP implementation on Cisco Small Business SPA30x, SPA50x, SPA51x phones 7.5.7 improperly validates firmware-image file integrity, which allows local users to load a Trojan horse image by leveraging shell access, aka Bug ID CSCut67400.
Near-miss passage: CVE-2015-4020. CWE: CWE-20. CVSS: 4.300000190734863. RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack." NOTE: this vulnerability exists because to an incomplete fix for CVE-2015-3900.
Query: CVE similar to CVE-2015-6036
Matching passage: CVE-2015-6036. CWE: UNKNOWN. CVSS: 7.5. QNAP Signage Station before 2.0.1 allows remote attackers to bypass authentication, and consequently upload files, via a spoofed HTTP request.
Near-miss passage: CVE-2015-4789. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, and CVE-2015-4790.
Query: describe CVE-2015-2820
Matching passage: CVE-2015-2820. CWE: CWE-119. CVSS: 5.0. Buffer overflow in XcListener in SAP Afaria 7.0.6001.5 allows remote attackers to cause a denial of service (process termination) via a crafted request, aka SAP Security Note 2132584.
Near-miss passage: CVE-2015-5797. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Query: patch priority for CVE-2015-9159
Matching passage: CVE-2015-9159. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, lack of input validation OEMCrypto_GetRandom can cause potential buffer overflow.
Near-miss passage: CVE-2015-1902. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in IBM Domino 8.5 before 8.5.3 FP6 IF7 and 9.0 before 9.0.1 FP3 IF3 allows remote attackers to execute arbitrary code via a crafted BMP image, aka SPR KLYH9TSMLA.
Query: exploit pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload functionality, which allows remote attackers to write to ar
Matching passage: CVE-2015-1375. CWE: CWE-264. CVSS: 7.5. pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload functionality, which allows remote attackers to write to arbitrary files.
Near-miss passage: CVE-2015-0682. CWE: CWE-264. CVSS: 6.5. Cisco Unified Communications Domain Manager 8.1(4) allows remote authenticated users to execute arbitrary code by visiting a "deprecated page," aka Bug ID CSCup90168.
Query: explain CWE-478
Matching passage: CWE-478 Missing Default Case in Multiple Condition Expression. The code does not have a default case in an expression with multiple conditions, such as a switch statement.
Near-miss passage: CWE-704 Incorrect Type Conversion or Cast. The product does not correctly convert an object, resource, or structure from one type to a different type.
Query: Sigma YAML for windows / security
Matching passage: Sigma rule: Detects a service installed by a client which has PID 0 or whose parent has PID 0. Logsource: windows / security. Rule: title: Service Installed By Unusual Client - Security id: c4e92a97-a9ff-4392-9d2d-7a4c642768ca related: - id: 71c276aa-49cd-43d2-b920-2dcd3e6962d5 type: similar status: test description: Detects a service installed by a client which has PID 0 or whose parent has PID 0 references: - https://www.elastic.co/guide/en/security/current/windows-service-installed-via-an-unusual-client.html - https://www.x86matthew.com/view_post?id=create_svc_rpc - https://twitter.com/SBousseaden/status/1490608838701166596 author: Tim Rauch (Nextron Systems), Elastic (idea) date: 2022-09-15 modified: 2023-01-04 tags: - attack.persistence - attack.privilege-escalation - attack.t1543 logsource: service: security product: windows definition: 'Requirements: The System Security Extension audit subcategory need to be enabled to log the EID 4697' detection: selection_eid: EventID: 4697 selection_pid: - ClientProcessId: 0 - ParentProcessId: 0 condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of JavaScript or JSC files using NodeJs binary node.exe, that could be potentially suspicious. Node.js. Logsource: windows / process_creation. Rule: title: NodeJS Execution of JavaScript File id: ba3874b9-0fae-465f-836c-eb5d071a1789 status: experimental description: 'Detects execution of JavaScript or JSC files using NodeJs binary node.exe, that could be potentially suspicious. Node.js is a popular open-source JavaScript runtime that runs code outside browsers and is widely used for both frontend and backend development. Adversaries have been observed abusing Node.js to disguise malware as legitimate processes, evade security defenses, and maintain persistence within target systems. Because Node.js is commonly used, this rule may generate false positives in some environments. However, if such activity is unusual in your environment, it is highly suspicious and warrants immediate investigation. ' references: - https://www.microsoft.com/en-us/security/blog/2025/04/15/threat-actors-misuse-node-js-to-deliver-malware-and-other-malicious-payloads/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-04-21 tags: - attack.execution - attack.t1059.007 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \node.exe - OriginalFileName: node.exe - Product: Node.js selection_cmd: CommandLine|contains: .js condition: all of selection_* falsepositives: - Legitimate use of node.exe to execute JavaScript or JSC files on your environment level: low
Query: detect Credentials in Registry
Matching passage: T1552.002 Credentials in Registry. Tactics: credential access. Description: Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons. Example commands to find Registry keys related to password information: (Citation: Pentestlab Stored Credentials) * Local Machine Hive: <code>reg query HKLM /f password /t REG_SZ /s</code> * Current User Hive: <code>reg query HKCU /f password /t REG_SZ /s</code>
Near-miss passage: T1552.008 Chat Messages. Tactics: credential access. Description: Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels. Rather than accessing the stored chat logs (i.e., [Credentials In Files](https://attack.mitre.org/techniques/T1552/001)), adversaries may directly access credentials within these services on the user endpoint, through servers hosting the services, or through administrator portals for cloud hosted services. Adversaries may also compromise integration tools like Slack Workflows to automatically search through messages to extract user credentials. These credentials may then be abused to perform follow-on activities such as lateral movement or privilege escalation (Citation: Slack Security Risks).
Query: detect Detects the usage of "reg.exe" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusi in logs
Matching passage: Sigma rule: Detects the usage of "reg.exe" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusi. Logsource: windows / process_creation. Rule: title: Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE id: 48917adc-a28e-4f5d-b729-11e75da8941f status: test description: Detects the usage of "reg.exe" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusions for folders within AppData and ProgramData. references: - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ - https://redcanary.com/threat-detection-report/threats/qbot/ author: frack113 date: 2022-02-13 modified: 2023-02-04 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection: Image|endswith: \reg.exe CommandLine|contains: - SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths - SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths CommandLine|contains|all: - 'ADD ' - '/t ' - 'REG_DWORD ' - '/v ' - '/d ' - '0' condition: selection falsepositives: - Legitimate use level: medium
Near-miss passage: Sigma rule: Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.. Logsource: windows / image_load. Rule: title: VMGuestLib DLL Sideload id: 70e8e9b4-6a93-4cb7-8cde-da69502e7aff status: test description: Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service. references: - https://decoded.avast.io/martinchlumecky/png-steganography/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-01 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|contains|all: - \VMware\VMware Tools\vmStatsProvider\win32 - \vmGuestLib.dll Image|endswith: \Windows\System32\wbem\WmiApSrv.exe filter: Signed: 'true' condition: selection and not filter falsepositives: - FP could occur if the legitimate version of vmGuestLib already exists on the system level: medium
Query: CVE similar to CVE-2015-2980
Matching passage: CVE-2015-2980. CWE: CWE-78. CVSS: 6.800000190734863. The Yodobashi application 1.2.1.0 and earlier for Android allows remote attackers to execute arbitrary Java methods, and consequently obtain sensitive information or execute OS commands, via a crafted HTML document.
Near-miss passage: CVE-2015-6380. CWE: CWE-78. CVSS: 6.5. An unspecified script in the web interface in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows remote authenticated users to execute arbitrary OS commands via crafted parameters, aka Bug ID CSCux10622.