alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compile
Matching passage: CVE-2015-5547. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5548, CVE-2015-5549, CVE-2015-5552, and CVE-2015-5553.
Near-miss passage: CVE-2015-7019. CWE: CWE-119. CVSS: 5.599999904632568. The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via unspecified vectors, a different vulnerability than CVE-2015-7020.
Query: exploit Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Ser
Matching passage: CVE-2015-5188. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitrary changes to an instance via vectors involving a file upload using a multipart/form-data submission.
Near-miss passage: CVE-2015-8814. CWE: CWE-352. CVSS: 8.800000190734863. Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks as demonstrated by editing user account information in the templates.asmx.cs file.
Query: patch priority for CVE-2015-1178
Matching passage: CVE-2015-1178. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in cart.php in X-Cart 5.1.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) product_id or (2) category_id parameter.
Near-miss passage: CVE-2015-5667. CWE: CWE-79. CVSS: 2.5999999046325684. Cross-site scripting (XSS) vulnerability in the HTML-Scrubber module before 0.15 for Perl, when the comment feature is enabled, allows remote attackers to inject arbitrary web script or HTML via a crafted comment.
Query: playbook for alert: Suspicious Patch System Image execution detected on endpoint
Matching passage: Playbook for T1601.001 Patch System Image. 1) Validate alert telemetry against T1601.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: defense impairment. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses.(Citation: Killing the myth of Cisco IOS rootkits) (Citation: Killing IOS diversity myth) (Citation: Cisco IOS Shellcode) (Citation: Cisco IOS Forensics Developments) (Citation: Juniper Netscreen of the Dead) Some network devices are built with a monolithic architecture, where
Near-miss passage: Playbook for T1601 Modify System Image. Different response path focused on defense impairment.
Query: rule covering Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus
Matching passage: Sigma rule: Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus. Logsource: windows / image_load. Rule: title: Potential SmadHook.DLL Sideloading id: 24b6cf51-6122-469e-861a-22974e9c1e5b status: test description: Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus references: - https://research.checkpoint.com/2023/malware-spotlight-camaro-dragons-tinynote-backdoor/ - https://www.qurium.org/alerts/targeted-malware-against-crph/ author: X__Junior (Nextron Systems) date: 2023-06-01 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: - \SmadHook32c.dll - \SmadHook64c.dll filter_main_legit_path: Image: - C:\Program Files (x86)\SMADAV\SmadavProtect32.exe - C:\Program Files (x86)\SMADAV\SmadavProtect64.exe - C:\Program Files\SMADAV\SmadavProtect32.exe - C:\Program Files\SMADAV\SmadavProtect64.exe ImageLoaded|startswith: - C:\Program Files (x86)\SMADAV\ - C:\Program Files\SMADAV\ condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer sec. Logsource: windows / process_creation. Rule: title: Disabled IE Security Features id: fb50eb7a-5ab1-43ae-bcc9-091818cb8424 status: test description: Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features references: - https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/ author: Florian Roth (Nextron Systems) date: 2020-06-19 modified: 2021-11-27 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection1: CommandLine|contains|all: - ' -name IEHarden ' - ' -value 0 ' selection2: CommandLine|contains|all: - ' -name DEPOff ' - ' -value 1 ' selection3: CommandLine|contains|all: - ' -name DisableFirstRunCustomize ' - ' -value 2 ' condition: 1 of selection* falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-5839
Matching passage: CVE-2015-5839. CWE: CWE-254. CVSS: 5.0. dyld in Apple iOS before 9 allows attackers to bypass a code-signing protection mechanism via an app that places a crafted signature in an executable file.
Near-miss passage: CVE-2015-8400. CWE: CWE-254. CVSS: 7.400000095367432. The HTTPS fallback implementation in Shell In A Box (aka shellinabox) before 2.19 makes it easier for remote attackers to conduct DNS rebinding attacks via the "/plain" URL.
Query: Sigma rule for Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that m
Matching passage: Sigma rule: Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that m. Logsource: windows / ps_script. Rule: title: Powershell Timestomp id: c6438007-e081-42ce-9483-b067fbef33c3 status: test description: 'Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md - https://www.offensive-security.com/metasploit-unleashed/timestomp/ author: frack113 date: 2021-08-03 modified: 2022-12-25 tags: - attack.stealth - attack.t1070.006 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_ioc: ScriptBlockText|contains: - .CreationTime = - .LastWriteTime = - .LastAccessTime = - '[IO.File]::SetCreationTime' - '[IO.File]::SetLastAccessTime' - '[IO.File]::SetLastWriteTime' condition: selection_ioc falsepositives: - Legitimate admin script level: medium
Near-miss passage: Sigma rule: Detects an uncommon child process of "odbcconf.exe" binary which normally shouldn't have any child processes.. Logsource: windows / process_creation. Rule: title: Uncommon Child Process Spawned By Odbcconf.EXE id: 8e3c7994-131e-4ba5-b6ea-804d49113a26 status: test description: Detects an uncommon child process of "odbcconf.exe" binary which normally shouldn't have any child processes. references: - https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16 - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/ - https://medium.com/@cyberjyot/t1218-008-dll-execution-using-odbcconf-exe-803fa9e08dac author: Harjot Singh @cyb3rjy0t date: 2023-05-22 tags: - attack.stealth - attack.t1218.008 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \odbcconf.exe condition: selection falsepositives: - In rare occurrences where "odbcconf" crashes. It might spawn a "werfault" process - Other child processes will depend on the DLL being registered by actions like "regsvr". In case where the DLLs have external calls (which should be rare). Other child processes might spawn and additional filters need to be applied. level: medium
Query: common weakness: Improper Neutralization of Section Delimiters
Matching passage: CWE-145 Improper Neutralization of Section Delimiters. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as section delimiters when they are sent to a downstream component.
Near-miss passage: CWE-329 Generation of Predictable IV with CBC Mode. The product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key.
Query: how to detect Windows Remote Management
Matching passage: T1021.006 Windows Remote Management. Tactics: lateral movement. Description: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services).(Citation: Microsoft WinRM) It may be called with the `winrm` command or by any number of programs such as PowerShell.(Citation: Jacobsen 2014) WinRM can be used as a method of remotely interacting with [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).(Citation: MSDN WMI)
Near-miss passage: T1021.001 Remote Desktop Protocol. Tactics: lateral movement. Description: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services) Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. Adversaries may also use RDP in conjunction with the [Accessibility Features](https://attack.mitre.org/techniques/T1546/008) or [Terminal Services DLL](https://attack.mitre.org/techniques/T1505/005) for Persistence.(Citation: Alperovitch Malware)
Query: describe CVE-2015-6435
Matching passage: CVE-2015-6435. CWE: CWE-78. CVSS: 9.800000190734863. An unspecified CGI script in Cisco FX-OS before 1.1.2 on Firepower 9000 devices and Cisco Unified Computing System (UCS) Manager before 2.2(4b), 2.2(5) before 2.2(5a), and 3.0 before 3.0(2e) allows remote attackers to execute arbitrary shell commands via a crafted HTTP request, aka Bug ID CSCur90888.
Near-miss passage: CVE-2015-2845. CWE: CWE-78. CVSS: 10.0. The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1421902800 allows remote attackers to execute arbitrary commands via the $type portion of the PATH_INFO.
Query: risk of Apache Cordova iOS before 4.0.0 allows remote attackers to execute arbitrary plugins via a link.
Matching passage: CVE-2015-5208. CWE: CWE-20. CVSS: 4.400000095367432. Apache Cordova iOS before 4.0.0 allows remote attackers to execute arbitrary plugins via a link.
Near-miss passage: CVE-2015-4648. CWE: CWE-20. CVSS: 7.5. Stack-based buffer overflow in the Ipropsapi.ipropsapiCtrl.1 ActiveX control in ipropsapivideo in Panasonic Security API (PS-API) ActiveX SDK before 8.10.18 allows remote attackers to execute arbitrary code via a long string to the MulticastAddr method.
Query: Sigma rule for Detects suspicious modification of crontab file.
Matching passage: Sigma rule: Detects suspicious modification of crontab file.. Logsource: linux / cron. Rule: title: Modifying Crontab id: af202fd3-7bff-4212-a25a-fb34606cfcbe status: test description: Detects suspicious modification of crontab file. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md author: Pawel Mazur date: 2022-04-16 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.003 logsource: product: linux service: cron detection: keywords: - REPLACE condition: keywords falsepositives: - Legitimate modification of crontab level: medium
Near-miss passage: Sigma rule: Detects when an access level is changed for a Google workspace application. An access level is part of BeyondCorp Enterp. Logsource: gcp / google_workspace.admin. Rule: title: Google Workspace Application Access Level Modified id: 22f2fb54-5312-435d-852f-7c74f81684ca status: test description: 'Detects when an access level is changed for a Google workspace application. An access level is part of BeyondCorp Enterprise which is Google Workspace''s way of enforcing Zero Trust model. An adversary would be able to remove access levels to gain easier access to Google workspace resources. ' references: - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-application-settings - https://support.google.com/a/answer/9261439 author: Bryan Lim date: 2024-01-12 tags: - attack.persistence - attack.privilege-escalation - attack.t1098.003 logsource: product: gcp service: google_workspace.admin detection: selection: eventService: admin.googleapis.com eventName: CHANGE_APPLICATION_SETTING setting_name|startswith: ContextAwareAccess condition: selection falsepositives: - Legitimate administrative activities changing the access levels for an application level: medium
Query: rule covering Detects important or interesting Windows services that got terminated for whatever reason
Matching passage: Sigma rule: Detects important or interesting Windows services that got terminated for whatever reason. Logsource: windows / system. Rule: title: Important Windows Service Terminated With Error id: d6b5520d-3934-48b4-928c-2aa3f92d6963 related: - id: acfa2210-0d71-4eeb-b477-afab494d596c type: similar status: test description: Detects important or interesting Windows services that got terminated for whatever reason references: - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-14 tags: - attack.stealth logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7023 selection_name: - param1|contains: - ' Antivirus' - ' Firewall' - Application Guard - BitLocker Drive Encryption Service - Encrypting File System - Microsoft Defender - Threat Protection - Windows Event Log - Binary|contains: - 770069006e0064006500660065006e006400 - 4500760065006e0074004c006f006700 - 6d0070007300730076006300 - 530065006e0073006500 - '450046005300' - '420044004500530056004300' condition: all of selection_* falsepositives: - Rare false positives could occur since service termination could happen due to multiple reasons level: high
Near-miss passage: Sigma rule: Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure functi. Logsource: windows / registry_event. Rule: title: HybridConnectionManager Service Installation - Registry id: ac8866c7-ce44-46fd-8c17-b24acff96ca8 status: test description: Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function. references: - https://twitter.com/Cyb3rWard0g/status/1381642789369286662 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2021-04-12 modified: 2022-11-27 tags: - attack.resource-development - attack.t1608 logsource: category: registry_event product: windows detection: selection1: TargetObject|contains: \Services\HybridConnectionManager selection2: EventType: SetValue Details|contains: Microsoft.HybridConnectionManager.Listener.exe condition: selection1 or selection2 falsepositives: - Unknown level: high
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the creation of new scheduled tasks via commandline, using Schtasks.exe. This rule detects tasks creating that c. Logsource: windows / process_creation. Rule: title: Potential SSH Tunnel Persistence Install Using A Scheduled Task id: 2daa93a0-a5fb-41c5-8cd8-3c11294bfd1f status: experimental description: Detects the creation of new scheduled tasks via commandline, using Schtasks.exe. This rule detects tasks creating that call OpenSSH, which may indicate the creation of reverse SSH tunnel to the attacker's server. references: - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/ - https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection author: Rory Duncan date: 2025-07-14 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 - attack.command-and-control logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_cli_sshd: CommandLine|contains|all: - ' /create ' - sshd.exe - -f selection_cli_ssh: CommandLine|contains|all: - ' /create ' - ssh.exe - -i condition: selection_img and 1 of selection_cli_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the Setting of Windows Defender Exclusions. Logsource: windows / registry_set. Rule: title: Windows Defender Exclusions Added - Registry id: a982fc9c-6333-4ffb-a51d-addb04e8b529 related: - id: 1321dc4e-a1fe-481d-a016-52c45f0c8b4f type: derived status: test description: Detects the Setting of Windows Defender Exclusions references: - https://twitter.com/_nullbind/status/1204923340810543109 author: Christian Burkard (Nextron Systems) date: 2021-07-06 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_set detection: selection2: TargetObject|contains: \Microsoft\Windows Defender\Exclusions condition: selection2 falsepositives: - Administrator actions level: medium
Query: describe CVE-2015-8057
Matching passage: CVE-2015-8057. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-4860. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4883.
Query: vulnerability: Multiple buffer overflows in SAP 3D Visual Enterprise Viewer (VEV) allow remote attackers to execute arbitrary code via a crafted (1) 3DM or (2) Flic Animation file.
Matching passage: CVE-2015-8028. CWE: CWE-119. CVSS: 6.800000190734863. Multiple buffer overflows in SAP 3D Visual Enterprise Viewer (VEV) allow remote attackers to execute arbitrary code via a crafted (1) 3DM or (2) Flic Animation file.
Near-miss passage: CVE-2015-6072. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6068, CVE-2015-6073, CVE-2015-6075, CVE-2015-6077, CVE-2015-6079, CVE-2015-6080, and CVE-2015-6082.
Query: actor TTPs: Traffic Duplication
Matching passage: T1020.001 Traffic Duplication. Tactics: exfiltration. Description: Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis. For example, devices may be configured to forward network traffic to one or more destinations for analysis by a network analyzer or other monitoring device. (Citation: Cisco Traffic Mirroring)(Citation: Juniper Traffic Mirroring) Adversaries may abuse traffic mirroring to mirror or redirect network traffic through other infrastructure they control. Malicious modifications to network devices to enable traffic redirection may be possible through [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) or [Patch System Image](https://attack.mitre.org/techniques/T1601/001).(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks) Many cloud-based environments also support traffic mirroring. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to.(Citation: AWS Traffic Mirroring)(Citation: GCP Packet Mirroring)(Citation: Azure Virtual Network TAP) Adversaries may use traffic duplication in conjunction with [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Input Capture](https://attack.mitre.org/techniques/T1056), or [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) depending on the goals and objectives of the adversary.
Near-miss passage: T1020 Automated Exfiltration. Tactics: exfiltration. Description: Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.(Citation: ESET Gamaredon June 2020) When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).