alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: how to detect Content Injection
Matching passage: T1659 Content Injection. Tactics: initial access, command and control. Description: Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., [Drive-by Target](https://attack.mitre.org/techniques/T1608/004) followed by [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and other data to already compromised systems.(Citation: ESET MoustachedBouncer) Adversaries may inject content to victim systems in various ways, including: * From the middle, where the adversary is in-between legitimate online client-server communications (**Note:** this is similar but distinct from [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557), which describes AiTM activity solely within an enterprise environment) (Citation: Kaspersky Encyclopedia MiTM) * From the side, where malicious content is injected and races to the client as a fake response to requests of a legitimate online server (Citation: Kaspersky ManOnTheSide) Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with "lawful interception."(Citation: Kaspersky ManOnTheSide)(Citation: ESET MoustachedBouncer)(Citation: EFF China GitHub Attack)
Near-miss passage: T1219.002 Remote Desktop Software. Tactics: command and control. Description: An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) Remote access modules/features may also exist as part of otherwise existing software such as Zoom or Google Chrome’s Remote Desktop.(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)
Query: detect Detects when a secret scanning allowlist rule is added for projects. in logs
Matching passage: Sigma rule: Detects when a secret scanning allowlist rule is added for projects.. Logsource: bitbucket / audit. Rule: title: Bitbucket Project Secret Scanning Allowlist Added id: 42ccce6d-7bd3-4930-95cd-e4d83fa94a30 status: test description: Detects when a secret scanning allowlist rule is added for projects. references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html - https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.defense-impairment - attack.t1685 logsource: product: bitbucket service: audit definition: 'Requirements: "Basic" log level is required to receive these audit events.' detection: selection: auditType.category: Projects auditType.action: Project secret scanning allowlist rule added condition: selection falsepositives: - Legitimate user activity. level: low
Near-miss passage: Sigma rule: Detects when Okta FastPass prevents a known phishing site.. Logsource: okta / okta. Rule: title: Okta FastPass Phishing Detection id: ee39a9f7-5a79-4b0a-9815-d36b3cf28d3e status: test description: Detects when Okta FastPass prevents a known phishing site. references: - https://sec.okta.com/fastpassphishingdetection - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2023-05-07 modified: 2026-04-27 tags: - attack.initial-access - attack.t1566 logsource: product: okta service: okta detection: selection: outcome.reason: FastPass declined phishing attempt outcome.result: FAILURE eventType: user.authentication.auth_via_mfa condition: selection falsepositives: - Unlikely level: high
Query: actor TTPs: DNS
Matching passage: T1071.004 DNS. Tactics: command and control. Description: Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. The DNS protocol serves an administrative function in computer networking and thus may be very common in environments. DNS traffic may also be allowed even before network authentication is completed. DNS packets contain many fields and headers in which data can be concealed. Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: PAN DNS Tunneling)(Citation: Medium DnsTunneling) DNS beaconing may be used to send commands to remote systems via DNS queries. A DNS beacon is created by tunneling DNS traffic (i.e. [Protocol Tunneling](https://attack.mitre.org/techniques/T1572)). The commands may be embedded into different DNS records, for example, TXT or A records.(Citation: OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government) DNS beacons may be difficult to detect because the beacons infrequently communicate with infected devices.(Citation: DNS Beacons) Infrequent communication conceals the malicious DNS traffic with normal DNS traffic.
Near-miss passage: T1071.002 File Transfer Protocols. Tactics: command and control. Description: Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as SMB(Citation: US-CERT TA18-074A), FTP(Citation: ESET Machete July 2019), FTPS, and TFTP that transfer files may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the transferred files. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.
Query: vulnerability: SQL injection vulnerability in Concrete5 5.7.3.1.
Matching passage: CVE-2015-4724. CWE: CWE-89. CVSS: 8.800000190734863. SQL injection vulnerability in Concrete5 5.7.3.1.
Near-miss passage: CVE-2015-4222. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in Cisco Unified Communications Manager IM and Presence Service 9.1(1) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuq46325.
Query: describe CVE-2015-3747
Matching passage: CVE-2015-3747. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Near-miss passage: CVE-2015-3807. CWE: CWE-119. CVSS: 4.300000190734863. libxml2 in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (memory corruption) via a crafted XML document.
Query: patch priority for CVE-2015-8477
Matching passage: CVE-2015-8477. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Redmine before 2.6.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving flash message rendering.
Near-miss passage: CVE-2015-5654. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Dojo Toolkit before 1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: CVE similar to CVE-2015-1231
Matching passage: CVE-2015-1231. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google Chrome before 41.0.2272.76 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Near-miss passage: CVE-2015-8403. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: ATT&CK technique for Publish/Subscribe Protocols
Matching passage: T1071.005 Publish/Subscribe Protocols. Tactics: command and control. Description: Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as <code>MQTT</code>, <code>XMPP</code>, <code>AMQP</code>, and <code>STOMP</code> use a publish/subscribe design, with message distribution managed by a centralized broker.(Citation: wailing crab sub/pub)(Citation: Mandiant APT1 Appendix) Publishers categorize their messages by topics, while subscribers receive messages according to their subscribed topics.(Citation: wailing crab sub/pub) An adversary may abuse publish/subscribe protocols to communicate with systems under their control from behind a message broker while also mimicking normal, expected traffic.
Near-miss passage: T1071 Application Layer Protocol. Tactics: command and control. Description: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.(Citation: Mandiant APT29 Eye Spy Email Nov 22)
Query: telemetry for T1547.007
Matching passage: T1547.007 Re-opened Applications. Tactics: persistence, privilege escalation. Description: Adversaries may modify plist files to automatically run an application when a user logs in. When a user logs out or restarts via the macOS Graphical User Interface (GUI), a prompt is provided to the user with a checkbox to "Reopen windows when logging back in".(Citation: Re-Open windows on Mac) When selected, all applications currently open are added to a property list file named <code>com.apple.loginwindow.[UUID].plist</code> within the <code>~/Library/Preferences/ByHost</code> directory.(Citation: Methods of Mac Malware Persistence)(Citation: Wardle Persistence Chapter) Applications listed in this file are automatically reopened upon the user’s next logon. Adversaries can establish [Persistence](https://attack.mitre.org/tactics/TA0003) by adding a malicious application path to the <code>com.apple.loginwindow.[UUID].plist</code> file to execute payloads when a user logs in.
Near-miss passage: T1547.008 LSASS Driver. Tactics: persistence, privilege escalation. Description: Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.(Citation: Microsoft Security Subsystem) Adversaries may target LSASS drivers to obtain persistence. By either replacing or adding illegitimate drivers (e.g., [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574)), an adversary can use LSA operations to continuously execute malicious payloads.
Query: patch priority for CVE-2015-8685
Matching passage: CVE-2015-8685. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) external calendar url or (2) the bank name field in the "import external calendar" page.
Near-miss passage: CVE-2015-7997. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the Nitro API in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 133.9, 10.5 before Build 58.11, and 10.5.e before Build 56.1505.e on NetScaler Service Delivery Appliance Service VM (SVM) devices allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: detection rule: Detects usage of Msiexec.exe to install packages hosted remotely quietly
Matching passage: Sigma rule: Detects usage of Msiexec.exe to install packages hosted remotely quietly. Logsource: windows / process_creation. Rule: title: Suspicious Msiexec Quiet Install From Remote Location id: 8150732a-0c9d-4a99-82b9-9efb9b90c40c related: - id: f7b5f842-a6af-4da5-9e95-e32478f3cd2f type: similar status: test description: Detects usage of Msiexec.exe to install packages hosted remotely quietly references: - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-28 modified: 2025-10-07 tags: - attack.stealth - attack.t1218.007 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \msiexec.exe - OriginalFileName: msiexec.exe selection_cli: CommandLine|contains|windash: - -i - -package - -a - -j selection_quiet: CommandLine|contains|windash: -q selection_remote: CommandLine|contains: - http - \\\\ filter_optional_openoffice: CommandLine|contains|all: - \AppData\Local\Temp\OpenOffice - Installation Files\openoffice condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged. Logsource: windows / process_creation. Rule: title: Persistence Via Sticky Key Backdoor id: 1070db9a-3e5d-412e-8e7b-7183b616e1b3 status: test description: 'By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged windows console session without authenticating to the system. When the sticky keys are "activated" the privilleged shell is launched. ' references: - https://www.fireeye.com/blog/threat-research/2017/03/apt29_domain_frontin.html - https://www.clearskysec.com/wp-content/uploads/2020/02/ClearSky-Fox-Kitten-Campaign-v1.pdf - https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors author: Sreeman date: 2020-02-18 modified: 2023-03-07 tags: - attack.persistence - attack.t1546.008 - attack.privilege-escalation logsource: product: windows category: process_creation detection: selection: CommandLine|contains|all: - 'copy ' - '/y ' - C:\windows\system32\cmd.exe C:\windows\system32\sethc.exe condition: selection falsepositives: - Unlikely level: critical
Query: risk of Buffer overflow in the Telnet service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Window
Matching passage: CVE-2015-0014. CWE: CWE-119. CVSS: 10.0. Buffer overflow in the Telnet service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows Telnet Service Buffer Overflow Vulnerability."
Near-miss passage: CVE-2015-4486. CWE: CWE-119. CVSS: 10.0. The decrease_ref_count function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via malformed WebM video data.
Query: detect Detects the execution of "csvde.exe" in order to export organizational Active Directory structure. in logs
Matching passage: Sigma rule: Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.. Logsource: windows / process_creation. Rule: title: Active Directory Structure Export Via Csvde.EXE id: e5d36acd-acb4-4c6f-a13f-9eb203d50099 status: test description: Detects the execution of "csvde.exe" in order to export organizational Active Directory structure. references: - https://www.cybereason.com/blog/research/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms - https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf - https://businessinsights.bitdefender.com/deep-dive-into-a-backdoordiplomacy-attack-a-study-of-an-attackers-toolkit - https://redcanary.com/blog/msix-installers/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-14 tags: - attack.exfiltration - attack.discovery - attack.t1087.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \csvde.exe - OriginalFileName: csvde.exe selection_remote: CommandLine|contains: ' -f' filter_import: CommandLine|contains: ' -i' condition: all of selection_* and not 1 of filter_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via use Rundll32 in Scripts. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation Via Use Rundll32 - PowerShell id: a5a30a6e-75ca-4233-8b8c-42e0f2037d3b status: test description: Detects Obfuscated Powershell via use Rundll32 in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2019-10-08 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|contains|all: - '&&' - rundll32 - shell32.dll - shellexec_rundll ScriptBlockText|contains: - value - invoke - comspec - iex condition: selection_4104 falsepositives: - Unknown level: high
Query: rule covering Detects the usage of wmic.exe to enumerate or read Windows registry via the WMI StdRegProv class read methods (EnumKey,
Matching passage: Sigma rule: Detects the usage of wmic.exe to enumerate or read Windows registry via the WMI StdRegProv class read methods (EnumKey,. Logsource: windows / process_creation. Rule: title: Registry Enumeration via WMI Stdregprov id: a0e417e2-2fa1-40da-b6d2-e094cd5e1191 related: - id: c453ab7a-1f5c-4716-a3b4-dea8135fb43a type: similar status: experimental description: 'Detects the usage of wmic.exe to enumerate or read Windows registry via the WMI StdRegProv class read methods (EnumKey, EnumValues, GetStringValue, etc.). While registry reads are common, attackers may use this technique to perform reconnaissance and discover sensitive configuration values, credentials, or installed software. The use of WMI as an alternative to standard tools like reg.exe can indicate an attempt to evade detection focused on traditional registry query commands. ' references: - https://trustedsec.com/blog/command-line-underdog-wmic-in-action - https://trustedsec.com/blog/wmi-for-script-kiddies - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-07-30 modified: 2026-06-19 tags: - attack.execution - attack.t1047 - attack.discovery - attack.t1012 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains|all: - stdregprov - call CommandLine|contains: - CheckAccess - EnumKey - EnumValues - GetBinaryValue - GetDWORDValue - GetExpandedStringValue - GetMultiStringValue - GetQWORDValue - GetSecurityDescriptor - GetStringValue condition: all of selection_* falsepositives: - Legitimate administrative activity level: medium
Near-miss passage: Sigma rule: Detects the execution of AdvancedRun utility. Logsource: windows / process_creation. Rule: title: PUA - AdvancedRun Execution id: d2b749ee-4225-417e-b20e-a8d2193cbb84 related: - id: fa00b701-44c6-4679-994d-5a18afa8a707 type: similar status: test description: Detects the execution of AdvancedRun utility references: - https://twitter.com/splinter_code/status/1483815103279603714 - https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3 - https://www.elastic.co/security-labs/operation-bleeding-bear - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/ author: Florian Roth (Nextron Systems) date: 2022-01-20 modified: 2023-02-21 tags: - attack.execution - attack.privilege-escalation - attack.stealth - attack.t1564.003 - attack.t1134.002 - attack.t1059.003 logsource: product: windows category: process_creation detection: selection: - OriginalFileName: AdvancedRun.exe - CommandLine|contains|all: - ' /EXEFilename ' - ' /Run' - CommandLine|contains|all: - ' /WindowState 0' - ' /RunAs ' - ' /CommandLine ' condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advancedrun/info.yml