alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: playbook for alert: Outbound C2 pattern associated with Search Engines
Matching passage: Playbook for T1593.002 Search Engines. 1) Validate alert telemetry against T1593.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: reconnaissance. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes).(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking) Adversaries may craft var
Near-miss passage: Playbook for T1593 Search Open Websites/Domains. Different response path focused on reconnaissance.
Query: describe CVE-2015-2969
Matching passage: CVE-2015-2969. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in index.php in LEMON-S PHP Simple Oekaki BBS before 1.21 allows remote attackers to inject arbitrary web script or HTML via the oekakis parameter.
Near-miss passage: CVE-2015-0967. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in SearchBlox before 8.2 allow remote attackers to inject arbitrary web script or HTML via (1) the search field in plugin/index.html or (2) the title field in the Create Featured Result form in admin/main.jsp.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.6.0 and WebSphere Lombardi Editio
Matching passage: CVE-2015-0156. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.6.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-7467. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: SOC runbook when seeing Multiple failed authentications followed by Component Object Model and Distributed COM
Matching passage: Playbook for T1175 Component Object Model and Distributed COM. 1) Validate alert telemetry against T1175. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: lateral movement, execution. 5) Eradicate persistence and recover. Reference detection notes: **This technique has been deprecated. Please use [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) and [Component Object Model](https://attack.mitre.org/techniques/T1559/001).** Adversaries may use the Windows Component Object Model (COM) and Distributed Component Object Model (DCOM) for local code execution or to execute on remote systems as part of lateral movem
Near-miss passage: Playbook for T1059.004 Unix Shell. Different response path focused on execution.
Query: risk of The chmd_read_headers function in chmd.c in libmspack before 0.5 does not validate name lengths, which allows remote attackers to cause a denial of service (buffer over-read and ap
Matching passage: CVE-2015-4469. CWE: CWE-119. CVSS: 4.300000190734863. The chmd_read_headers function in chmd.c in libmspack before 0.5 does not validate name lengths, which allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted CHM file.
Near-miss passage: CVE-2015-2899. CWE: CWE-119. CVSS: 6.800000190734863. Heap-based buffer overflow in the QualifierList retrieve_qualifier_list function in Medicomp MEDCIN Engine before 2.22.20153.226 might allow remote attackers to execute arbitrary code via a long list name in a packet on port 8190.
Query: CVE similar to CVE-2015-5458
Matching passage: CVE-2015-5458. CWE: UNKNOWN. CVSS: 6.800000190734863. Session fixation vulnerability in fileupload.php in PivotX before 2.3.11 allows remote attackers to hijack web sessions via the sess parameter.
Near-miss passage: CVE-2015-9217. CWE: UNKNOWN. CVSS: 7.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SDM630, SDM636, SDM660, and Snapdragon_High_Med_2016, certain malformed HVEC clips could cause an assertion to fail.
Query: indicators of Odbcconf
Matching passage: T1218.008 Odbcconf. Tactics: stealth. Description: Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) The Odbcconf.exe binary may be digitally signed by Microsoft. Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse. Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010), odbcconf.exe has a <code>REGSVR</code> flag that can be misused to execute DLLs (ex: <code>odbcconf.exe /S /A &lbrace;REGSVR "C:\Users\Public\file.dll"&rbrace;</code>). (Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017)
Near-miss passage: T1218.002 Control Panel. Tactics: stealth. Description: Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings. Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a <code>CPlApplet</code> function.(Citation: Microsoft Implementing CPL)(Citation: TrendMicro CPL Malware Jan 2014) For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel.(Citation: Microsoft Implementing CPL) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.(Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013) Malicious Control Panel items can be delivered via [Phishing](https://attack.mitre.org/techniques/T1566) campaigns(Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware.(Citation: Palo Alto Reaver Nov 2017) Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists. Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to <code>HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls</code>. Even when these registered DLLs do not comply with the CPL file specification and do not export <code>CPlApplet</code> functions, they are loaded and executed through its <code>DllEntryPoint</code> when Control Panel is executed. CPL files not exporting <code>CPlApplet</code> are not directly executable.(Citation: ESET InvisiMole June 2020)
Query: detection rule: Detects enabling or disabling of Remote Desktop Protocol (RDP) using alternate methods such as WMIC or PowerShell. In Po
Matching passage: Sigma rule: Detects enabling or disabling of Remote Desktop Protocol (RDP) using alternate methods such as WMIC or PowerShell. In Po. Logsource: windows / process_creation. Rule: title: RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class id: 4b8f6d3a-9c5e-4f2a-a7d8-6b9c3e5f2a8d related: - id: a2863fbc-d5cb-48d5-83fb-d976d4b1743b type: similar status: experimental description: 'Detects enabling or disabling of Remote Desktop Protocol (RDP) using alternate methods such as WMIC or PowerShell. In PowerShell one-liner commands, the "SetAllowTSConnections" method of the "Win32_TerminalServiceSetting" class may be used to enable or disable RDP. In WMIC, the "rdtoggle" alias or "Win32_TerminalServiceSetting" class may be used for the same purpose. ' references: - https://www.trendmicro.com/en_gb/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html - https://github.com/HackTricks-wiki/hacktricks/blob/72f20a3fa26775b932bd819f1824c6377802a768/src/windows-hardening/basic-cmd-for-pentesters.md#firewall - https://github.com/Lifailon/RSA/blob/rsa/Sources/RSA-1.4.1.ps1#L1468 author: Daniel Koifman (KoifSec), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-15 tags: - attack.lateral-movement - attack.t1021.001 - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \wmic.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - wmic.exe - PowerShell.EXE - pwsh.dll selection_cli_method: CommandLine|contains: - rdtoggle - Win32_TerminalServiceSetting selection_cli_property: CommandLine|contains: SetAllowTSConnections condition: all of selection_* falsepositives: - Legitimate system administrators enabling RDP for remote support - System configuration scripts during deployment level: medium
Near-miss passage: Sigma rule: Detects code execution via Pester.bat (Pester - Powershell Modulte for testing). Logsource: windows / process_creation. Rule: title: Execute Code with Pester.bat as Parent id: 18988e1b-9087-4f8a-82fe-0414dce49878 related: - id: 59e938ff-0d6d-4dc3-b13f-36cc28734d4e type: similar status: test description: Detects code execution via Pester.bat (Pester - Powershell Modulte for testing) references: - https://twitter.com/Oddvarmoe/status/993383596244258816 - https://twitter.com/_st0pp3r_/status/1560072680887525378 author: frack113, Nasreddine Bencherchali date: 2022-08-20 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1216 logsource: category: process_creation product: windows detection: selection_module: ParentImage|endswith: - \powershell.exe - \pwsh.exe ParentCommandLine|contains: \WindowsPowerShell\Modules\Pester\ selection_cli: ParentCommandLine|contains: - '{ Invoke-Pester -EnableExit ;' - '{ Get-Help "' condition: all of selection_* falsepositives: - Legitimate use of Pester for writing tests for Powershell scripts and modules level: medium
Query: CVE similar to CVE-2015-2536
Matching passage: CVE-2015-2536. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Skype for Business Server and Lync Server XSS Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-0893. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Maroyaka CGI Maroyaka Relay Novel allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: patch priority for CVE-2015-4047
Matching passage: CVE-2015-4047. CWE: CWE-476. CVSS: 7.800000190734863. racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests.
Near-miss passage: CVE-2015-9043. CWE: CWE-476. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a NULL pointer can be dereferenced upon the expiry of a timer.
Query: SIEM correlation: stealth activity consistent with Hide Artifacts
Matching passage: T1564 Hide Artifacts. Tactics: stealth. Description: Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.(Citation: Sofacy Komplex Trojan)(Citation: Cybereason OSX Pirrit)(Citation: MalwareBytes ADS July 2015) Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation, such as through the use of virtualization technology.(Citation: Sophos Ragnar May 2020)
Near-miss passage: T1564.012 File/Path Exclusions. Tactics: stealth. Description: Adversaries may attempt to hide their file-based artifacts by writing them to specific folders or file names excluded from antivirus (AV) scanning and other defensive capabilities. AV and other file-based scanners often include exclusions to optimize performance as well as ease installation and legitimate use of applications. These exclusions may be contextual (e.g., scans are only initiated in response to specific triggering events/alerts), but are also often hardcoded strings referencing specific folders and/or files assumed to be trusted and legitimate.(Citation: Microsoft File Folder Exclusions) Adversaries may abuse these exclusions to hide their file-based artifacts. For example, rather than tampering with tool settings to add a new exclusion (i.e., [Disable or Modify Tools](https://attack.mitre.org/techniques/T1685)), adversaries may drop their file-based payloads in default or otherwise well-known exclusions. Adversaries may also use [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) and other [Discovery](https://attack.mitre.org/tactics/TA0007)/[Reconnaissance](https://attack.mitre.org/tactics/TA0043) activities to both discover and verify existing exclusions in a victim environment.
Query: ATT&CK technique for Exfiltration Over C2 Channel
Matching passage: T1041 Exfiltration Over C2 Channel. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
Near-miss passage: T1011.001 Exfiltration Over Bluetooth. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel. Adversaries may choose to do this if they have sufficient access and proximity. Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Query: write Sigma for Detects when a user is removed from a privileged role. Bulk changes should be investigated.
Matching passage: Sigma rule: Detects when a user is removed from a privileged role. Bulk changes should be investigated.. Logsource: azure / auditlogs. Rule: title: Bulk Deletion Changes To Privileged Account Permissions id: 102e11e3-2db5-4c9e-bc26-357d42585d21 status: test description: Detects when a user is removed from a privileged role. Bulk changes should be investigated. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H' date: 2022-08-05 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: azure service: auditlogs detection: selection: properties.message: - Remove eligible member (permanent) - Remove eligible member (eligible) condition: selection falsepositives: - Legtimate administrator actions of removing members from a role level: high
Near-miss passage: Sigma rule: Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file. Logsource: windows / process_creation. Rule: title: Potential Binary Proxy Execution Via Cdb.EXE id: b5c7395f-e501-4a08-94d4-57fe7a9da9d2 status: test description: Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Cdb/ - https://web.archive.org/web/20170715043507/http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html - https://twitter.com/nas_bench/status/1534957360032120833 author: Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2019-10-26 modified: 2024-04-22 tags: - attack.execution - attack.stealth - attack.t1106 - attack.t1218 - attack.t1127 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cdb.exe - OriginalFileName: CDB.Exe selection_cli: CommandLine|contains: - ' -c ' - ' -cf ' condition: all of selection* falsepositives: - Legitimate use of debugging tools level: medium
Query: exploit ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x before 4.3.3-P1 allows remote attackers to cause a denial of service (application crash) via an invalid length field in a UDP I
Matching passage: CVE-2015-8605. CWE: CWE-20. CVSS: 6.5. ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x before 4.3.3-P1 allows remote attackers to cause a denial of service (application crash) via an invalid length field in a UDP IPv4 packet.
Near-miss passage: CVE-2015-8740. CWE: CWE-20. CVSS: 5.300000190734863. The dissect_tds7_colmetadata_token function in epan/dissectors/packet-tds.c in the TDS dissector in Wireshark 2.0.x before 2.0.1 does not validate the number of columns, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet.
Query: SOC runbook when seeing SIEM correlation: execution activity consistent with Service Execution
Matching passage: Playbook for T1569.002 Service Execution. 1) Validate alert telemetry against T1569.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: execution. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and [Net](htt
Near-miss passage: Playbook for T1569.001 Launchctl. Different response path focused on execution.
Query: detect Detects the image load of "Python Core" by a non-Python process. This might be indicative of a execution of executable t in logs
Matching passage: Sigma rule: Detects the image load of "Python Core" by a non-Python process. This might be indicative of a execution of executable t. Logsource: windows / image_load. Rule: title: Python Image Load By Non-Python Process id: cbb56d62-4060-40f7-9466-d8aaf3123f83 status: test description: 'Detects the image load of "Python Core" by a non-Python process. This might be indicative of a execution of executable that has been bundled from Python code. Various tools like Py2Exe, PyInstaller, and cx_Freeze are used to bundle Python code into standalone executables. Threat actors often use these tools to bundle malicious Python scripts into executables, sometimes to obfuscate the code or to bypass security measures. ' references: - https://www.py2exe.org/ - https://unit42.paloaltonetworks.com/unit-42-technical-analysis-seaduke/ author: Patrick St. John, OTR (Open Threat Research) date: 2020-05-03 modified: 2025-08-18 tags: - attack.stealth - attack.t1027.002 logsource: product: windows category: image_load detection: selection: Description: Python Core filter_main_generic: - Image|contains: Python - Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ - C:\ProgramData\Anaconda3\ filter_optional_null_image: Image: null condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate Py2Exe Binaries - Known false positive caused with Python Anaconda - Various legitimate software is bundled from Python code into executables level: low
Near-miss passage: Sigma rule: Detects triggering of AMSI by Windows Defender.. Logsource: windows / windefend. Rule: title: Windows Defender AMSI Trigger Detected id: ea9bf0fa-edec-4fb8-8b78-b119f2528186 status: stable description: Detects triggering of AMSI by Windows Defender. references: - https://learn.microsoft.com/en-us/windows/win32/amsi/how-amsi-helps author: Bhabesh Raj date: 2020-09-14 modified: 2022-12-07 tags: - attack.execution - attack.t1059 logsource: product: windows service: windefend detection: selection: EventID: 1116 SourceName: AMSI condition: selection falsepositives: - Unlikely level: high
Query: Sigma YAML for azure / signinlogs
Matching passage: Sigma rule: Detect failed attempts to sign in to disabled accounts.. Logsource: azure / signinlogs. Rule: title: Login to Disabled Account id: 908655e0-25cf-4ae1-b775-1c8ce9cf43d8 status: test description: Detect failed attempts to sign in to disabled accounts. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts author: AlertIQ date: 2021-10-10 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078.004 logsource: product: azure service: signinlogs detection: selection: ResultType: 50057 ResultDescription: User account is disabled. The account has been disabled by an administrator. condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of "odbcconf" with the "-f" flag in order to load a response file with a non-".rsp" extension.. Logsource: windows / process_creation. Rule: title: Suspicious Response File Execution Via Odbcconf.EXE id: 2d32dd6f-3196-4093-b9eb-1ad8ab088ca5 related: - id: 5f03babb-12db-4eec-8c82-7b4cb5580868 type: derived - id: 65d2be45-8600-4042-b4c0-577a1ff8a60e type: obsolete status: test description: Detects execution of "odbcconf" with the "-f" flag in order to load a response file with a non-".rsp" extension. references: - https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16 - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/ - https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-22 modified: 2024-03-13 tags: - attack.stealth - attack.t1218.008 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \odbcconf.exe - OriginalFileName: odbcconf.exe selection_cli: CommandLine|contains|windash: ' -f ' filter_main_rsp_ext: CommandLine|contains: .rsp filter_main_runonce_odbc: ParentImage: C:\Windows\System32\runonce.exe Image: C:\Windows\System32\odbcconf.exe CommandLine|contains: .exe /E /F "C:\WINDOWS\system32\odbcconf.tmp" condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unlikely level: high