alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: how to detect Exploitation for Stealth
Matching passage: T1211 Exploitation for Stealth. Tactics: stealth. Description: Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components. Adversaries may exploit a system or application vulnerability to avoid detection while maintaining access within an environment. Exploitation occurs when an adversary leverages a programming flaw to execute code in a manner that minimizes visibility or blends in with legitimate activity. Rather than directly disabling defenses, adversaries may use exploitation to circumvent monitoring and logging mechanisms. This can include abusing vulnerabilities in logging pipelines, security tools, or cloud infrastructure to evade audit trails, suppress alerts, or operate without generating telemetry. Adversaries may identify these opportunities through prior reconnaissance or by performing discovery of security controls after initial access. In some cases, vulnerabilities in SaaS or public cloud environments may be exploited to evade logging, obscure activity, or deploy infrastructure that remains hidden from standard monitoring tools.(Citation: Bypassing CloudTrail in AWS Service Catalog)(Citation: GhostToken GCP flaw)
Near-miss passage: T1679 Selective Exclusion. Tactics: stealth. Description: Adversaries may intentionally exclude certain files, folders, directories, file types, or system components from encryption or tampering during a ransomware or malicious payload execution. Some file extensions that adversaries may avoid encrypting include `.dll`, `.exe`, and `.lnk`.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024) Adversaries may perform this behavior to avoid alerting users, to evade detection by security tools and analysts, or, in the case of ransomware, to ensure that the system remains operational enough to deliver the ransom notice. Exclusions may target files and components whose corruption would cause instability, break core services, or immediately expose the attack. By carefully avoiding these areas, adversaries maintain system responsiveness while minimizing indicators that could trigger alarms or otherwise inhibit achieving their goals.
Query: patch priority for CVE-2015-0308
Matching passage: CVE-2015-0308. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allows attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-2593. CWE: UNKNOWN. CVSS: 7.099999904632568. Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.2.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Configuration Service.
Query: exploit Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing att
Matching passage: CVE-2015-3880. CWE: CWE-601. CVSS: 6.099999904632568. Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Near-miss passage: CVE-2015-10114. CWE: CWE-601. CVSS: 6.099999904632568. A vulnerability, which was classified as problematic, has been found in WooSidebars Plugin up to 1.4.1 on WordPress. Affected by this issue is the function enable_custom_post_sidebars of the file classes/class-woo-sidebars.php. The manipulation of the argument sendback leads to open redirect. The attack may be launched remotely. Upgrading to version 1.4.2 is able to address this issue. The patch is identified as 1ac6d6ac26e185673f95fc1ccc56a392169ba601. It is recommended to upgrade the affected component. VDB-230654 is the identifier assigned to this vulnerability.
Query: adversary uses Rootkit
Matching passage: T1014 Rootkit. Tactics: stealth. Description: Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits) Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or [System Firmware](https://attack.mitre.org/techniques/T1542/001). (Citation: Wikipedia Rootkit) Rootkits have been seen for Windows, Linux, and Mac OS X systems. (Citation: CrowdStrike Linux Rootkit) (Citation: BlackHat Mac OSX Rootkit) Rootkits that reside or modify boot sectors are known as [Bootkit](https://attack.mitre.org/techniques/T1542/003)s and specifically target the boot process of the operating system.
Near-miss passage: T1542.004 ROMMONkit. Tactics: stealth, persistence. Description: Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect. (Citation: Cisco Synful Knock Evolution)(Citation: Cisco Blog Legacy Device Attacks) ROMMON is a Cisco network device firmware that functions as a boot loader, boot image, or boot helper to initialize hardware and software when the platform is powered on or reset. Similar to [TFTP Boot](https://attack.mitre.org/techniques/T1542/005), an adversary may upgrade the ROMMON image locally or remotely (for example, through TFTP) with adversary code and restart the device in order to overwrite the existing ROMMON image. This provides adversaries with the means to update the ROMMON to gain persistence on a system in a way that may be difficult to detect.
Query: exploit Integer underflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2, when the configuration setting "Load printer settings with the document" is enabled, allows remote
Matching passage: CVE-2015-5212. CWE: CWE-191. CVSS: 6.800000190734863. Integer underflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2, when the configuration setting "Load printer settings with the document" is enabled, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via crafted PrinterSetup data in an ODF document.
Near-miss passage: CVE-2015-2311. CWE: CWE-191. CVSS: 9.800000190734863. Integer underflow in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 might allow remote peers to cause a denial of service or possibly obtain sensitive information from memory or execute arbitrary code via a crafted message.
Query: vulnerability: Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar plugin before 1.1.7 for WordPress allow remote attackers to execute arbitrary SQL comm
Matching passage: CVE-2015-7235. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar plugin before 1.1.7 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a dex_reservations_calendar_load2 action or (2) dex_item parameter in a dex_reservations_check_posted_data action in a request to the default URI.
Near-miss passage: CVE-2015-4233. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in Cisco Unified MeetingPlace 8.6(1.2) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuu54037.
Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects the injection of code by overwriting the memory map of a Linux process using the "dd" Linux command.. Logsource: linux / process_creation. Rule: title: Potential Linux Process Code Injection Via DD Utility id: 4cad6c64-d6df-42d6-8dae-eb78defdc415 status: test description: Detects the injection of code by overwriting the memory map of a Linux process using the "dd" Linux command. references: - https://www.aon.com/cyber-solutions/aon_cyber_labs/linux-based-inter-process-code-injection-without-ptrace2/ - https://github.com/AonCyberLabs/Cexigua/blob/34d338620afae4c6335ba8d8d499e1d7d3d5d7b5/overwrite.sh author: Joseph Kamau date: 2023-12-01 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.009 logsource: product: linux category: process_creation detection: selection: Image|endswith: /dd CommandLine|contains|all: - of= - /proc/ - /mem condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been. Logsource: macos / process_creation. Rule: title: Remote Access Tool - Team Viewer Session Started On MacOS Host id: f459ccb4-9805-41ea-b5b2-55e279e2424a related: - id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357 type: similar - id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d type: similar status: test description: 'Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder. ' references: - Internal Research author: Josh Nickels, Qi Nan date: 2024-03-11 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: process_creation product: macos detection: selection: ParentImage|endswith: /TeamViewer_Service Image|endswith: /TeamViewer_Desktop CommandLine|endswith: /TeamViewer_Desktop --IPCport 5939 --Module 1 condition: selection falsepositives: - Legitimate usage of TeamViewer level: low
Query: Persistence mechanism resembling Tool
Matching passage: T1588.002 Tool. Tactics: resource development. Description: Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). Adversaries may obtain tools to support their operations, including to support execution of post-compromise behaviors. Tools may also be leveraged for testing – for example, evaluating malware against commercial antivirus or endpoint detection and response (EDR) applications.(Citation: Forescout Conti Leaks 2022)(Citation: Sentinel Labs Top Tier Target 2025) Tool acquisition may involve the procurement of commercial software licenses, including for red teaming tools such as Cobalt Strike. In addition to freely downloading or purchasing software, adversaries may steal software and/or software licenses from third-party entities (including other adversaries). Threat actors may also crack trial versions of software.(Citation: Recorded Future Beacon 2019)
Near-miss passage: T1588.004 Digital Certificates. Tactics: resource development. Description: Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. Adversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) if the certificate is trusted or otherwise added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)). The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities.(Citation: DiginotarCompromise) Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for. Certificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free.(Citation: Let's Encrypt FAQ) After obtaining a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control.
Query: rule covering Detects a Sysmon configuration change, which could be the result of a legitimate reconfiguration or someone trying manip
Matching passage: Sigma rule: Detects a Sysmon configuration change, which could be the result of a legitimate reconfiguration or someone trying manip. Logsource: windows / sysmon. Rule: title: Sysmon Configuration Change id: 8ac03a65-6c84-4116-acad-dc1558ff7a77 status: test description: Detects a Sysmon configuration change, which could be the result of a legitimate reconfiguration or someone trying manipulate the configuration references: - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon author: frack113 date: 2022-01-12 tags: - attack.defense-impairment logsource: product: windows service: sysmon detection: selection: EventID: 16 condition: selection falsepositives: - Legitimate administrative action level: medium regression_tests_path: regression_data/rules/windows/sysmon/sysmon_config_modification/info.yml
Near-miss passage: Sigma rule: Detects when an attacker tries to change User Account Control (UAC) elevation request destination via the "PromptOnSecur. Logsource: windows / registry_set. Rule: title: UAC Secure Desktop Prompt Disabled id: 0d7ceeef-3539-4392-8953-3dc664912714 related: - id: c5f6a85d-b647-40f7-bbad-c10b66bab038 type: similar - id: 48437c39-9e5f-47fb-af95-3d663c3f2919 type: similar status: test description: 'Detects when an attacker tries to change User Account Control (UAC) elevation request destination via the "PromptOnSecureDesktop" value. The "PromptOnSecureDesktop" setting specifically determines whether UAC prompts are displayed on the secure desktop. The secure desktop is a separate desktop environment that''s isolated from other processes running on the system. It''s designed to prevent malicious software from intercepting or tampering with UAC prompts. When "PromptOnSecureDesktop" is set to 0, UAC prompts are displayed on the user''s current desktop instead of the secure desktop. This reduces the level of security because it potentially exposes the prompts to manipulation by malicious software. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/7e11e9b79583545f208a6dc3fa062f2ed443d999/atomics/T1548.002/T1548.002.md author: frack113 date: 2024-05-10 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-6530
Matching passage: CVE-2015-6530. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in OpenText Secure MFT 2013 before 2013 R3 P6 and 2014 before 2014 R2 P2 allows remote attackers to inject arbitrary web script or HTML via the querytext parameter to userdashboard.jsp.
Near-miss passage: CVE-2015-2960. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: describe CVE-2015-5405
Matching passage: CVE-2015-5405. CWE: UNKNOWN. CVSS: 6.5. HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote authenticated users to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors.
Near-miss passage: CVE-2015-4820. CWE: UNKNOWN. CVSS: 6.199999809265137. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than CVE-2015-4907.
Query: detection engineering for Invalid Code Signature
Matching passage: T1036.001 Invalid Code Signature. Tactics: stealth. Description: Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program. Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may improperly handle these files.(Citation: Threatexpress MetaTwin 2017) Unlike [Code Signing](https://attack.mitre.org/techniques/T1553/002), this activity will not result in a valid signature.
Near-miss passage: T1036.005 Match Legitimate Resource Name or Location. Tactics: stealth. Description: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: `svchost.exe`). Alternatively, a Windows Registry key may be given a close approximation to a key used by a legitimate program. In containerized environments, a threat actor may create a resource in a trusted namespace or one that matches the naming convention of a container pod or cluster.(Citation: Aquasec Kubernetes Backdoor 2023)
Query: vulnerability: Cross-site request forgery (CSRF) vulnerability in the Watchdog Aggregator module for Drupal allows remote attackers to hijack the authentication of administrators for requests tha
Matching passage: CVE-2015-4355. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Watchdog Aggregator module for Drupal allows remote attackers to hijack the authentication of administrators for requests that enable or disable monitoring sites via unspecified vectors.
Near-miss passage: CVE-2015-3946. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in Advantech WebAccess before 8.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Query: patch priority for CVE-2015-10070
Matching passage: CVE-2015-10070. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in copperwall Twiddit. It has been rated as critical. This issue affects some unknown processing of the file index.php. The manipulation leads to sql injection. The identifier of the patch is 2203d4ce9810bdaccece5c48ff4888658a01acfc. It is recommended to apply a patch to fix this issue. The identifier VDB-218897 was assigned to this vulnerability.
Near-miss passage: CVE-2015-4658. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in admin/login.php in Milw0rm Clone Script 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) usr or (2) pwd parameter.
Query: write Sigma for Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature t
Matching passage: Sigma rule: Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature t. Logsource: windows / network_connection. Rule: title: Network Connection Initiated To DevTunnels Domain id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4 related: - id: 4b657234-038e-4ad5-997c-4be42340bce4 type: similar - id: b3e6418f-7c7a-4fad-993a-93b65027a9f1 type: similar - id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b type: similar status: test description: 'Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. ' references: - https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2 - https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security - https://cydefops.com/devtunnels-unleashed author: Kamran Saifullah date: 2023-11-20 tags: - attack.exfiltration - attack.command-and-control - attack.t1567.001 - attack.t1572 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationHostname|endswith: .devtunnels.ms condition: selection falsepositives: - Legitimate use of Devtunnels will also trigger this. level: medium
Near-miss passage: Sigma rule: Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen. Logsource: windows / process_creation. Rule: title: Suspicious Velociraptor Child Process id: 4bc90587-e6ca-4b41-be0b-ed4d04e4ed0c status: experimental description: Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks. references: - https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-08-29 tags: - attack.command-and-control - attack.persistence - attack.t1219 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \Velociraptor.exe selection_child_vscode_tunnel: CommandLine|contains|all: - code.exe - tunnel - --accept-server-license-terms selection_child_msiexec: CommandLine|contains|all: - msiexec - /i - http selection_child_powershell: Image|endswith: - \powershell.exe - \powershell_ise.exe - \pwsh.exe CommandLine|contains: - 'Invoke-WebRequest ' - 'IWR ' - .DownloadFile - .DownloadString condition: selection_parent and 1 of selection_child_* falsepositives: - Legitimate administrators or incident responders might use Velociraptor to execute scripts or tools. However, the combination of Velociraptor spawning these specific processes with these command lines is suspicious. Tuning may be required to exclude known administrative actions or specific scripts. level: high