alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / application
Matching passage: Sigma rule: This rule detects a suspicious crash of the Microsoft Malware Protection Engine. Logsource: windows / application. Rule: title: Microsoft Malware Protection Engine Crash - WER id: 6c82cf5c-090d-4d57-9188-533577631108 status: test description: This rule detects a suspicious crash of the Microsoft Malware Protection Engine references: - https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5 - https://technet.microsoft.com/en-us/library/security/4022344 author: Florian Roth (Nextron Systems) date: 2017-05-09 modified: 2023-04-14 tags: - attack.stealth - attack.defense-impairment - attack.t1211 - attack.t1685 logsource: product: windows service: application detection: selection: Provider_Name: Windows Error Reporting EventID: 1001 Data|contains|all: - MsMpEng.exe - mpengine.dll condition: selection falsepositives: - MsMpEng might crash if the "C:\" partition is full level: high
Near-miss passage: Sigma rule: Detects when a Kubernetes CronJob or Job is created or modified. A Kubernetes Job creates one or more pods to accomplish. Logsource: kubernetes / audit. Rule: title: Kubernetes CronJob/Job Modification id: 0c9b3bda-41a6-4442-9345-356ae86343dc related: - id: cd3a808c-c7b7-4c50-a2f3-f4cfcd436435 type: similar status: test description: 'Detects when a Kubernetes CronJob or Job is created or modified. A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule. An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence. ' references: - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/ - https://www.redhat.com/en/blog/protecting-kubernetes-against-mitre-attck-persistence#technique-33-kubernetes-cronjob author: kelnage date: 2024-07-11 tags: - attack.persistence - attack.privilege-escalation - attack.execution logsource: product: kubernetes service: audit detection: selection: objectRef.apiGroup: batch objectRef.resource: - cronjobs - jobs verb: - create - delete - patch - replace - update condition: selection falsepositives: - Modifying a Kubernetes Job or CronJob may need to be done by a system administrator. - Automated processes may need to take these actions and may need to be filtered. level: medium
Query: patch priority for CVE-2015-4960
Matching passage: CVE-2015-4960. CWE: CWE-254. CVSS: 4.099999904632568. IBM InfoSphere Master Data Management - Collaborative Edition 9.1, 10.1, 11.0 before 11.0.0.0 IF11, 11.3 before 11.3.0.0 IF7, and 11.4 before 11.4.0.4 IF1 allows remote authenticated users to conduct clickjacking attacks via a crafted web site.
Near-miss passage: CVE-2015-0084. CWE: CWE-254. CVSS: 2.0999999046325684. The Task Scheduler in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly constrain impersonation levels, which allows local users to bypass intended restrictions on launching executable files via a crafted task, aka "Task Scheduler Security Feature Bypass Vulnerability."
Query: vulnerability: Cross-site scripting (XSS) vulnerability in IBM Emptoris Supplier Lifecycle Management and Emptoris Program Management 10.x before 10.0.1.4_iFix3, 10.0.2.x before 10.0.2.7_iFix1, 1
Matching passage: CVE-2015-4939. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in IBM Emptoris Supplier Lifecycle Management and Emptoris Program Management 10.x before 10.0.1.4_iFix3, 10.0.2.x before 10.0.2.7_iFix1, 10.0.3.x before 10.0.3.2, and 10.0.4.x before 10.0.4.0_iFix1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-9379. CWE: CWE-79. CVSS: 6.099999904632568. iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg().
Query: explain CWE-1107
Matching passage: CWE-1107 Insufficient Isolation of Symbolic Constant Definitions. The source code uses symbolic constants, but it does not sufficiently place the definitions of these constants into a more centralized or isolated location.
Near-miss passage: CWE-1342 Information Exposure through Microarchitectural State after Transient Execution. The processor does not properly clear microarchitectural state after incorrect microcode assists or speculative execution, resulting in transient execution.
Query: write Sigma for Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process inj
Matching passage: Sigma rule: Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process inj. Logsource: windows / process_creation. Rule: title: Uncommon Child Process Of Conhost.EXE id: 7dc2dedd-7603-461a-bc13-15803d132355 related: - id: dfa03a09-8b92-4d83-8e74-f72839b1c407 type: similar status: test description: Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process injection activity. references: - http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/ author: omkar72 date: 2020-10-25 modified: 2023-12-11 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \conhost.exe filter_main_conhost: Image|endswith: :\Windows\System32\conhost.exe filter_main_null: Image: null filter_main_empty: Image: '' filter_optional_provider: Provider_Name: SystemTraceProvider-Process condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel. Logsource: windows / process_creation. Rule: title: Visual Studio Code Tunnel Execution id: 90d6bd71-dffb-4989-8d86-a827fedd6624 status: test description: Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel references: - https://ipfyx.fr/post/visual-studio-code-tunnel/ - https://badoption.eu/blog/2023/01/31/code_c2.html - https://code.visualstudio.com/docs/remote/tunnels author: Nasreddine Bencherchali (Nextron Systems), citron_ninja date: 2023-10-25 modified: 2025-10-29 tags: - attack.command-and-control - attack.t1071.001 - attack.t1219 logsource: category: process_creation product: windows detection: selection_only_tunnel: OriginalFileName: null CommandLine|endswith: .exe tunnel selection_tunnel_args: CommandLine|contains|all: - .exe tunnel - --accept-server-license-terms selection_parent_tunnel: ParentCommandLine|endswith: ' tunnel' Image|endswith: \cmd.exe CommandLine|contains|all: - '/d /c ' - \servers\Stable- - code-server.cmd condition: 1 of selection_* falsepositives: - Legitimate use of Visual Studio Code tunnel level: medium
Query: rule covering Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).
Matching passage: Sigma rule: Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).. Logsource: windows / security. Rule: title: SMB Create Remote File Admin Share id: b210394c-ba12-4f89-9117-44a2464b9511 status: test description: Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$). references: - https://github.com/OTRF/ThreatHunter-Playbook/blob/f7a58156dbfc9b019f17f638b8c62d22e557d350/playbooks/WIN-201012004336.yaml - https://securitydatasets.com/notebooks/atomic/windows/lateral_movement/SDWIN-200806015757.html?highlight=create%20file author: Jose Rodriguez (@Cyb3rPandaH), OTR (Open Threat Research) date: 2020-08-06 modified: 2025-10-17 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: security detection: selection: EventID: 5145 ShareName|endswith: C$ AccessMask: '0x2' filter_main_subjectusername: SubjectUserName|endswith: $ filter_optional_local_ip: IpAddress: ::1 condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when an attacker modifies the "REG_MULTI_SZ" value named "Extensions" to include a custom DLL to achieve persist. Logsource: windows / registry_set. Rule: title: Potential Persistence Via LSA Extensions id: 41f6531d-af6e-4c6e-918f-b946f2b85a36 status: test description: 'Detects when an attacker modifies the "REG_MULTI_SZ" value named "Extensions" to include a custom DLL to achieve persistence via lsass. The "Extensions" list contains filenames of DLLs being automatically loaded by lsass.exe. Each DLL has its InitializeLsaExtension() method called after loading. ' references: - https://persistence-info.github.io/Data/lsaaextension.html - https://twitter.com/0gtweet/status/1476286368385019906 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2023-08-17 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SYSTEM\CurrentControlSet\Control\LsaExtensionConfig\LsaSrv\Extensions condition: selection falsepositives: - Unlikely level: high
Query: Outbound C2 pattern associated with DNS
Matching passage: T1071.004 DNS. Tactics: command and control. Description: Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. The DNS protocol serves an administrative function in computer networking and thus may be very common in environments. DNS traffic may also be allowed even before network authentication is completed. DNS packets contain many fields and headers in which data can be concealed. Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: PAN DNS Tunneling)(Citation: Medium DnsTunneling) DNS beaconing may be used to send commands to remote systems via DNS queries. A DNS beacon is created by tunneling DNS traffic (i.e. [Protocol Tunneling](https://attack.mitre.org/techniques/T1572)). The commands may be embedded into different DNS records, for example, TXT or A records.(Citation: OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government) DNS beacons may be difficult to detect because the beacons infrequently communicate with infected devices.(Citation: DNS Beacons) Infrequent communication conceals the malicious DNS traffic with normal DNS traffic.
Near-miss passage: T1071.003 Mail Protocols. Tactics: command and control. Description: Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as SMTP/S, POP3/S, and IMAP that carry electronic mail may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the email messages themselves. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: FireEye APT28)
Query: exploit Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive info
Matching passage: CVE-2015-6671. CWE: CWE-200. CVSS: 5.900000095367432. Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup.
Near-miss passage: CVE-2015-5341. CWE: CWE-200. CVSS: 4.300000190734863. mod_scorm in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 mishandles availability dates, which allows remote authenticated users to bypass intended access restrictions and read SCORM contents via unspecified vectors.
Query: risk of The core_enrol_get_enrolled_users web service in enrol/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly i
Matching passage: CVE-2015-5339. CWE: CWE-200. CVSS: 4.300000190734863. The core_enrol_get_enrolled_users web service in enrol/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly implement group-based access restrictions, which allows remote authenticated users to obtain sensitive course-participant information via a web-service request.
Near-miss passage: CVE-2015-4980. CWE: CWE-200. CVSS: 4.0. Unspecified vulnerability in IBM WebSphere Commerce 7.0.0.6 through 7.0.0.9 allows remote authenticated users to obtain sensitive personal information via unknown vectors.
Query: patch priority for CVE-2015-5696
Matching passage: CVE-2015-5696. CWE: CWE-20. CVSS: 5.0. Dell Netvault Backup before 10.0.5 allows remote attackers to cause a denial of service (crash) via a crafted request.
Near-miss passage: CVE-2015-1787. CWE: CWE-20. CVSS: 2.5999999046325684. The ssl3_get_client_key_exchange function in s3_srvr.c in OpenSSL 1.0.2 before 1.0.2a, when client authentication and an ephemeral Diffie-Hellman ciphersuite are enabled, allows remote attackers to cause a denial of service (daemon crash) via a ClientKeyExchange message with a length of zero.
Query: how to detect Exfiltration Over Alternative Protocol
Matching passage: T1048 Exfiltration Over Alternative Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and/or obfuscate these alternate channels. [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048) can be done using various common operating system utilities such as [Net](https://attack.mitre.org/software/S0039)/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016) On macOS and Linux <code>curl</code> may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.(Citation: 20 macOS Common Tools and Techniques) Many IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or [Cloud API](https://attack.mitre.org/techniques/T1059/009).
Near-miss passage: T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.(Citation: copy_cmd_cisco) Adversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted (such as HTTP, FTP, or DNS). This may include custom or publicly available encoding/compression algorithms (such as base64) as well as embedding data within protocol headers and fields.
Query: describe CVE-2015-6547
Matching passage: CVE-2015-6547. CWE: CWE-77. CVSS: 8.300000190734863. The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands at boot time via unspecified vectors.
Near-miss passage: CVE-2015-20108. CWE: CWE-77. CVSS: 9.800000190734863. xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.
Query: intelligence brief on T1001.003
Matching passage: T1001.003 Protocol or Service Impersonation. Tactics: command and control. Description: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity. Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.(Citation: ESET Okrum July 2019)(Citation: Malleable-C2-U42)
Near-miss passage: T1001.002 Steganography. Tactics: command and control. Description: Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.
Query: common weakness: Insufficient Isolation of Symbolic Constant Definitions
Matching passage: CWE-1107 Insufficient Isolation of Symbolic Constant Definitions. The source code uses symbolic constants, but it does not sufficiently place the definitions of these constants into a more centralized or isolated location.
Near-miss passage: CWE-473 PHP External Variable Modification. A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise.
Query: command and control using DNS Calculation
Matching passage: T1568.003 DNS Calculation. Tactics: command and control. Description: Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address. A IP and/or port number calculation can be used to bypass egress filtering on a C2 channel.(Citation: Meyers Numbered Panda) One implementation of [DNS Calculation](https://attack.mitre.org/techniques/T1568/003) is to take the first three octets of an IP address in a DNS response and use those values to calculate the port for command and control traffic.(Citation: Meyers Numbered Panda)(Citation: Moran 2014)(Citation: Rapid7G20Espionage)
Near-miss passage: T1568 Dynamic Resolution. Tactics: command and control. Description: Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control. Adversaries may use dynamic resolution for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)
Query: detect Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of mali in logs
Matching passage: Sigma rule: Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of mali. Logsource: windows / terminalservices-localsessionmanager. Rule: title: Ngrok Usage with Remote Desktop Service id: 64d51a51-32a6-49f0-9f3d-17e34d640272 status: test description: Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of malicious behaviour references: - https://twitter.com/tekdefense/status/1519711183162556416?s=12&t=OTsHCBkQOTNs1k3USz65Zg - https://ngrok.com/ author: Florian Roth (Nextron Systems) date: 2022-04-29 tags: - attack.command-and-control - attack.t1090 logsource: product: windows service: terminalservices-localsessionmanager detection: selection: EventID: 21 Address|contains: '16777216' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel. Logsource: windows / process_creation. Rule: title: Visual Studio Code Tunnel Execution id: 90d6bd71-dffb-4989-8d86-a827fedd6624 status: test description: Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel references: - https://ipfyx.fr/post/visual-studio-code-tunnel/ - https://badoption.eu/blog/2023/01/31/code_c2.html - https://code.visualstudio.com/docs/remote/tunnels author: Nasreddine Bencherchali (Nextron Systems), citron_ninja date: 2023-10-25 modified: 2025-10-29 tags: - attack.command-and-control - attack.t1071.001 - attack.t1219 logsource: category: process_creation product: windows detection: selection_only_tunnel: OriginalFileName: null CommandLine|endswith: .exe tunnel selection_tunnel_args: CommandLine|contains|all: - .exe tunnel - --accept-server-license-terms selection_parent_tunnel: ParentCommandLine|endswith: ' tunnel' Image|endswith: \cmd.exe CommandLine|contains|all: - '/d /c ' - \servers\Stable- - code-server.cmd condition: 1 of selection_* falsepositives: - Legitimate use of Visual Studio Code tunnel level: medium
Query: patch priority for CVE-2015-2332
Matching passage: CVE-2015-2332. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in member.php in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-1567. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the admin page in the GD Infinite Scroll module before 7.x-1.4 for Drupal allows remote authenticated users with the "edit gd infinite scroll settings" permission to inject arbitrary web script or HTML via unspecified vectors.