alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: telemetry for T1114.003
Matching passage: T1114.003 Email Forwarding Rule. Tactics: collection. Description: Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.(Citation: Pfammatter - Hidden Inbox Rules) Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient. These rules may be created through a local email application, a web interface, or by command-line interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2)(Citation: Mac Forwarding Rules) Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more. Adversaries may also hide the rule by making use of the Microsoft Messaging API (MAPI) to modify the rule properties, making it hidden and not visible from Outlook, OWA or most Exchange Administration tools.(Citation: Pfammatter - Hidden Inbox Rules) In some environments, administrators may be able to enable email forwarding rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.(Citation: Microsof
Near-miss passage: T1114.002 Remote Email Collection. Tactics: collection. Description: Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords.
Query: vulnerability: HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to obtain sensitive information via unspecified vectors.
Matching passage: CVE-2015-5411. CWE: CWE-200. CVSS: 6.800000190734863. HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-0076. CWE: CWE-200. CVSS: 4.300000190734863. The photo-decoder implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly initialize memory for rendering of JXR images, which allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "JPEG XR Parser Information Disclosure Vulnerability."
Query: rule covering Detects keywords that could indicate clearing PowerShell history
Matching passage: Sigma rule: Detects keywords that could indicate clearing PowerShell history. Logsource: windows / ps_module. Rule: title: Clear PowerShell History - PowerShell Module id: f99276ad-d122-4989-a09a-d00904a5f9d2 related: - id: dfba4ce1-e0ea-495f-986e-97140f31af2d type: derived status: test description: Detects keywords that could indicate clearing PowerShell history references: - https://gist.github.com/hook-s3c/7363a856c3cdbadeb71085147f042c1a author: Ilyas Ochkov, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community date: 2019-10-25 modified: 2022-12-02 tags: - attack.stealth - attack.t1070.003 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_1a_payload: Payload|contains: - del - Remove-Item - rm selection_1b_payload: Payload|contains: (Get-PSReadlineOption).HistorySavePath selection_payload_2: Payload|contains|all: - Set-PSReadlineOption - –HistorySaveStyle - SaveNothing selection_payload_3: Payload|contains|all: - Set-PSReadlineOption - -HistorySaveStyle - SaveNothing condition: 1 of selection_payload_* or all of selection_1* falsepositives: - Legitimate PowerShell scripts level: medium
Near-miss passage: Sigma rule: Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS server, cre. Logsource: windows / file_event. Rule: title: Suspicious File Created by ArcSOC.exe id: e890acee-d488-420e-8f20-d9b19b3c3d43 status: experimental description: 'Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS server, creates a file with suspicious file type, indicating that it may be an executable, script file, or otherwise unusual. ' references: - https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/ - https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm author: Micah Babinski date: 2025-11-25 tags: - attack.command-and-control - attack.persistence - attack.initial-access - attack.execution - attack.stealth - attack.t1127 - attack.t1105 - attack.t1133 logsource: category: file_event product: windows detection: selection: Image|endswith: \ArcSOC.exe TargetFilename|endswith: - .ahk - .aspx - .au3 - .bat - .cmd - .dll - .exe - .hta - .js - .ps1 - .py - .vbe - .vbs - .wsf condition: selection falsepositives: - Unlikely level: high
Query: Multiple failed authentications followed by Encrypted Channel
Matching passage: T1573 Encrypted Channel. Tactics: command and control. Description: Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Near-miss passage: T1573.001 Symmetric Cryptography. Tactics: command and control. Description: Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.
Query: CVE similar to CVE-2015-5184
Matching passage: CVE-2015-5184. CWE: UNKNOWN. CVSS: 7.5. Console: CORS headers set to allow all in Red Hat AMQ.
Near-miss passage: CVE-2015-1775. CWE: UNKNOWN. CVSS: 5.5. Server-side request forgery (SSRF) vulnerability in the proxy endpoint (api/v1/proxy) in Apache Ambari before 2.1.0 allows remote authenticated users to conduct port scans and access unsecured services via a crafted REST call.
Query: Sigma rule for Indicates suspicious rules such as an inbox rule that forwards a copy of all emails to an external address
Matching passage: Sigma rule: Indicates suspicious rules such as an inbox rule that forwards a copy of all emails to an external address. Logsource: azure / riskdetection. Rule: title: Suspicious Inbox Forwarding Identity Protection id: 27e4f1d6-ae72-4ea0-8a67-77a73a289c3d status: test description: Indicates suspicious rules such as an inbox rule that forwards a copy of all emails to an external address references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-inbox-forwarding - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.t1114.003 - attack.collection logsource: product: azure service: riskdetection detection: selection: riskEventType: suspiciousInboxForwarding condition: selection falsepositives: - A legitimate forwarding rule. level: high
Near-miss passage: Sigma rule: Detects when a possible suspicious driver is being installed via pnputil.exe lolbin. Logsource: windows / process_creation. Rule: title: Suspicious Driver Install by pnputil.exe id: a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1 status: test description: Detects when a possible suspicious driver is being installed via pnputil.exe lolbin references: - https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/pnputil-command-syntax - https://strontic.github.io/xcyclopedia/library/pnputil.exe-60EDC5E6BDBAEE441F2E3AEACD0340D2.html author: Hai Vaknin @LuxNoBulIshit, Avihay eldad @aloneliassaf, Austin Songer @austinsonger date: 2021-09-30 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.persistence - attack.t1547 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - -i - /install - -a - /add-driver - '.inf' Image|endswith: \pnputil.exe condition: selection falsepositives: - Pnputil.exe being used may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Pnputil.exe being executed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: exploit Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugin before 1.4 for WordPress allows remot
Matching passage: CVE-2015-5065. CWE: CWE-22. CVSS: 5.0. Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugin before 1.4 for WordPress allows remote attackers to read arbitrary files via a full pathname in the requrl parameter.
Near-miss passage: CVE-2015-3301. CWE: CWE-22. CVSS: 4.0. Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote administrators to read arbitrary files via a .. (dot dot) in the tcp_box_path parameter in the checkout_editor_settings page to wp-admin/admin.php.
Query: patch priority for CVE-2015-1792
Matching passage: CVE-2015-1792. CWE: CWE-399. CVSS: 5.0. The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (infinite loop) via vectors that trigger a NULL value of a BIO data structure, as demonstrated by an unrecognized X.660 OID for a hash function.
Near-miss passage: CVE-2015-6332. CWE: CWE-399. CVSS: 5.0. Cisco Prime Infrastructure 2.2 allows remote attackers to cause a denial of service (daemon hang) by sending many SSL renegotiation requests, aka Bug ID CSCuv56830.
Query: vulnerability: Pulp does not remove permissions for named objects upon deletion, which allows authenticated users to gain the privileges of a deleted object via creating an object with the same n
Matching passage: CVE-2015-5153. CWE: CWE-275. CVSS: 8.800000190734863. Pulp does not remove permissions for named objects upon deletion, which allows authenticated users to gain the privileges of a deleted object via creating an object with the same name.
Near-miss passage: CVE-2015-8223. CWE: CWE-275. CVSS: 5.5. Huawei P7 before P7-L00C17B851, P7-L05C00B851, and P7-L09C92B85, and P8 ALE-UL00 before ALE-UL00B211 allows local users to cause a denial of service (OS crash) by leveraging camera permissions and via crafted input to the camera driver.
Query: detect Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential in logs
Matching passage: Sigma rule: Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential. Logsource: windows / ps_script. Rule: title: PowerShell Web Access Installation - PsScript id: 5f9c7f1a-7c21-4c39-b2f3-8d8006e0e51f status: test description: Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse references: - https://docs.microsoft.com/en-us/powershell/module/powershellwebaccess/install-pswawebapplication - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a - https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41 author: Michael Haag date: 2024-09-03 tags: - attack.persistence - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_install: ScriptBlockText|contains: Install-WindowsFeature WindowsPowerShellWebAccess selection_config: ScriptBlockText|contains: Install-PswaWebApplication selection_auth: ScriptBlockText|contains|all: - Add-PswaAuthorizationRule - -UserName * - -ComputerName * condition: 1 of selection_* falsepositives: - Legitimate PowerShell Web Access installations by administrators level: high
Near-miss passage: Sigma rule: Uses the .NET InstallUtil.exe application in order to execute image without log. Logsource: windows / process_creation. Rule: title: Suspicious Execution of InstallUtil Without Log id: d042284c-a296-4988-9be5-f424fadcc28c status: test description: Uses the .NET InstallUtil.exe application in order to execute image without log references: - https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/ - https://learn.microsoft.com/en-us/dotnet/framework/tools/installutil-exe-installer-tool author: frack113 date: 2022-01-23 modified: 2022-02-04 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: Image|endswith: \InstallUtil.exe Image|contains: Microsoft.NET\Framework CommandLine|contains|all: - '/logfile= ' - /LogToConsole=false condition: selection falsepositives: - Unknown level: medium
Query: telemetry for T1149
Matching passage: T1149 LC_MAIN Hijacking. Tactics: stealth. Description: **This technique has been deprecated and should no longer be used.** As of OS X 10.8, mach-O binaries introduced a new header called LC_MAIN that points to the binary’s entry point for execution. Previously, there were two headers to achieve this same effect: LC_THREAD and LC_UNIXTHREAD (Citation: Prolific OSX Malware History). The entry point for a binary can be hijacked so that initial execution flows to a malicious addition (either another section or a code cave) and then goes back to the initial entry point so that the victim doesn’t know anything was different (Citation: Methods of Mac Malware Persistence). By modifying a binary in this way, application whitelisting can be bypassed because the file name or application path is still the same.
Near-miss passage: T1108 Redundant Access. Tactics: stealth, persistence. Description: **This technique has been deprecated. Please use [Create Account](https://attack.mitre.org/techniques/T1136), [Web Shell](https://attack.mitre.org/techniques/T1505/003), and [External Remote Services](https://attack.mitre.org/techniques/T1133) where appropriate.** Adversaries may use more than one remote access tool with varying command and control protocols or credentialed access to remote services so they can maintain access if an access mechanism is detected or mitigated. If one type of tool is detected and blocked or removed as a response but the organization did not gain a full understanding of the adversary's tools and access, then the adversary will be able to retain access to the network. Adversaries may also attempt to gain access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) to use [External Remote Services](https://attack.mitre.org/techniques/T1133) such as external VPNs as a way to maintain access despite interruptions to remote access tools deployed within a target network.(Citation: Mandiant APT1) Adversaries may also retain access through cloud-based infrastructure and applications. Use of a [Web Shell](https://attack.mitre.org/techniques/T1100) is one such way to maintain access to a network through an externally accessible Web server.
Query: write Sigma for This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that
Matching passage: Sigma rule: This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that. Logsource: windows / security. Rule: title: Account Tampering - Suspicious Failed Logon Reasons id: 9eb99343-d336-4020-a3cd-67f3819e68ee status: test description: This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625 - https://twitter.com/SBousseaden/status/1101431884540710913 author: Florian Roth (Nextron Systems) date: 2017-02-19 modified: 2025-10-17 tags: - attack.persistence - attack.privilege-escalation - attack.initial-access - attack.stealth - attack.t1078 logsource: product: windows service: security detection: selection_eid: EventID: - 4625 - 4776 selection_status: - Status: - '0xC0000072' - '0xC000006F' - '0xC0000070' - '0xC0000413' - '0xC000018C' - '0xC000015B' - SubStatus: - '0xC0000072' - '0xC000006F' - '0xC0000070' - '0xC0000413' - '0xC000018C' - '0xC000015B' filter: SubjectUserSid: S-1-0-0 condition: all of selection_* and not filter falsepositives: - User using a disabled account level: medium
Near-miss passage: Sigma rule: Detects a highly relevant Antivirus alert that reports a remote access tool. This event must not be ignored just because. Logsource: antivirus. Rule: title: Antivirus - Remote Access Tools Signature id: 97233998-3838-4581-88c6-f1d19d3993fb status: experimental description: 'Detects a highly relevant Antivirus alert that reports a remote access tool. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. ' references: - https://www.nextron-systems.com/?s=antivirus - https://www.virustotal.com/gui/file/d9669f7e3eb3a9cdf6a750eeb2ba303b5ae148a43e36546896f1d1801e912466 author: Arnim Rupp (Nextron Systems) date: 2026-06-15 tags: - attack.execution - attack.t1203 - attack.command-and-control - attack.t1219.002 logsource: category: antivirus detection: selection: Signature|contains: - AgentB - AgentTesla - AMRat - Ammyy - AsyncRAT - Bandook - Bitrat - Bladabindi - Connectwise - CyberGate - DarkComet - DCrat - Delf - DokStorm - Egairtigado - Gh0st - Gorat - GodRat - Jalapeno - LummaC2 - Minirat - Netwire - NanoCore - NJRat - Paralax - PlugX - Pulsar - Quasar - Remcos - Ravartar - RemoteAdmin - RemoteTool - revengeRAT - rokRAT - salatstealer - Salgorea - SmokedHam - TigerRat - Tzeebot - WarZone - VenomRAT - Vidar - Wirenet - XWorm - Zapchast - Zegost condition: selection falsepositives: - Unlikely level: critical
Query: patch priority for CVE-2015-0655
Matching passage: CVE-2015-0655. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Unified Web Interaction Manager in Cisco Unified Web and E-Mail Interaction Manager allows remote attackers to inject arbitrary web script or HTML via vectors related to a POST request, aka Bug ID CSCus74184.
Near-miss passage: CVE-2015-4072. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to inject arbitrary web script or HTML via vectors related to name and message.
Query: patch priority for CVE-2015-2896
Matching passage: CVE-2015-2896. CWE: CWE-200. CVSS: 5.300000190734863. The up.time client in Idera Uptime Infrastructure Monitor through 7.6 allows remote attackers to obtain potentially sensitive version, OS, process, and event-log information via a command.
Near-miss passage: CVE-2015-3969. CWE: CWE-200. CVSS: 5.0. Janitza UMG 508, 509, 511, 604, and 605 devices allow remote attackers to obtain sensitive network-connection information via a request to UDP port (1) 1234 or (2) 1235.
Query: exploit Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.
Matching passage: CVE-2015-8444. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8451, and CVE-2015-8455.
Near-miss passage: CVE-2015-9150. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, SD 400, and SD 800, while computing the length of memory allocated for a Diag event, if the buffer length is very small or greater than the maximum, an integer overflow may occur, which later results in a buffer overflow.