alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file.
Matching passage: Sigma rule: ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file.. Logsource: windows / process_creation. Rule: title: Suspicious ZipExec Execution id: 90dcf730-1b71-4ae7-9ffc-6fcf62bd0132 status: test description: ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file. references: - https://twitter.com/SBousseaden/status/1451237393017839616 - https://github.com/Tylous/ZipExec author: frack113 date: 2021-11-07 modified: 2022-12-25 tags: - attack.execution - attack.stealth - attack.t1218 - attack.t1202 logsource: category: process_creation product: windows detection: run: CommandLine|contains|all: - /generic:Microsoft_Windows_Shell_ZipFolder:filename= - .zip - '/pass:' - '/user:' delete: CommandLine|contains|all: - /delete - Microsoft_Windows_Shell_ZipFolder:filename= - .zip condition: run or delete falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.. Logsource: windows / process_creation. Rule: title: Potential Homoglyph Attack Using Lookalike Characters id: 32e280f1-8ad4-46ef-9e80-910657611fbc status: test description: 'Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters. ' references: - https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish - http://www.irongeek.com/homoglyph-attack-generator.php author: Micah Babinski, @micahbabinski date: 2023-05-07 tags: - attack.stealth - attack.t1036 - attack.t1036.003 logsource: category: process_creation product: windows detection: selection_upper: CommandLine|contains: - А - В - Е - К - М - Н - О - Р - С - Т - Х - Ѕ - І - Ј - Ү - Ӏ - Ԍ - Ԛ - Ԝ - Α - Β - Ε - Ζ - Η - Ι - Κ - Μ - Ν - Ο - Ρ - Τ - Υ - Χ selection_lower: CommandLine|contains: - а - е - о - р - с - х - ѕ - і - ӏ - ј - һ - ԁ - ԛ - ԝ - ο condition: 1 of selection_* falsepositives: - Commandlines with legitimate Cyrillic text; will likely require tuning (or not be usable) in countries where these alphabets are in use. level: medium
Query: rule covering Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execut
Matching passage: Sigma rule: Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execut. Logsource: windows / process_creation. Rule: title: New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE id: f63b56ee-3f79-4b8a-97fb-5c48007e8573 related: - id: e61e8a88-59a9-451c-874e-70fcc9740d67 type: derived - id: cbe51394-cd93-4473-b555-edf0144952d9 type: derived status: test description: Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required) references: - https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83 - https://blog.3or.de/hunting-dns-server-level-plugin-dll-injection.html author: Florian Roth (Nextron Systems) date: 2017-05-08 modified: 2023-02-05 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.defense-impairment - attack.t1574.001 - attack.t1112 logsource: category: process_creation product: windows detection: selection: Image|endswith: \dnscmd.exe CommandLine|contains|all: - /config - /serverlevelplugindll condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of a new local user on a Fortinet FortiGate Firewall. The new local user could be used for VPN conn. Logsource: fortigate / event. Rule: title: FortiGate - New Local User Created id: ddbbe845-1d74-43a8-8231-2156d180234d status: experimental description: 'Detects the creation of a new local user on a Fortinet FortiGate Firewall. The new local user could be used for VPN connections. ' references: - https://www.fortiguard.com/psirt/FG-IR-24-535 - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/109120963/config-user-local - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2025-11-01 tags: - attack.persistence - attack.t1136.001 logsource: product: fortigate service: event detection: selection: action: Add cfgpath: user.local condition: selection falsepositives: - A local user can be created for legitimate purposes. Investigate the user details to determine if it is authorized. level: medium
Query: vulnerability: The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 makes an incorrect memset call during interaction with the mozilla::layers::BufferTextureClient
Matching passage: CVE-2015-0805. CWE: CWE-17. CVSS: 7.5. The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 makes an incorrect memset call during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors that trigger rendering of 2D graphics content.
Near-miss passage: CVE-2015-1728. CWE: CWE-17. CVSS: 9.300000190734863. Microsoft Windows Media Player 10 through 12 allows remote attackers to execute arbitrary code via a crafted DataObject on a web site, aka "Windows Media Player RCE via DataObject Vulnerability."
Query: indicators of Mavinject
Matching passage: T1218.013 Mavinject. Tactics: stealth. Description: Adversaries may abuse mavinject.exe to proxy execution of malicious code. Mavinject.exe is the Microsoft Application Virtualization Injector, a Windows utility that can inject code into external processes as part of Microsoft Application Virtualization (App-V).(Citation: LOLBAS Mavinject) Adversaries may abuse mavinject.exe to inject malicious DLLs into running processes (i.e. [Dynamic-link Library Injection](https://attack.mitre.org/techniques/T1055/001)), allowing for arbitrary code execution (ex. <code>C:\Windows\system32\mavinject.exe PID /INJECTRUNNING PATH_DLL</code>).(Citation: ATT Lazarus TTP Evolution)(Citation: Reaqta Mavinject) Since mavinject.exe may be digitally signed by Microsoft, proxying execution via this method may evade detection by security products because the execution is masked under a legitimate process. In addition to [Dynamic-link Library Injection](https://attack.mitre.org/techniques/T1055/001), Mavinject.exe can also be abused to perform import descriptor injection via its <code>/HMODULE</code> command-line parameter (ex. <code>mavinject.exe PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER</code>). This command would inject an import table entry consisting of the specified DLL into the module at the given base address.(Citation: Mavinject Functionality Deconstructed)
Near-miss passage: T1218.003 CMSTP. Tactics: stealth. Description: Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections. Adversaries may supply CMSTP.exe with INF files infected with malicious commands. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010) / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs (Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets (SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate binary that may be signed by Microsoft. CMSTP.exe can also be abused to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018)
Query: patch priority for CVE-2015-0176
Matching passage: CVE-2015-0176. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in MQ XR WebSockets Listener in WMQ Telemetry in IBM WebSphere MQ 8.0 before 8.0.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URI that is included in an error response.
Near-miss passage: CVE-2015-6584. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unit_testing/templates/6776.php.
Query: rule covering Detects the creation of diagcab file, which could be caused by some legitimate installer or is a sign of exploitation (r
Matching passage: Sigma rule: Detects the creation of diagcab file, which could be caused by some legitimate installer or is a sign of exploitation (r. Logsource: windows / file_event. Rule: title: Creation of a Diagcab id: 3d0ed417-3d94-4963-a562-4a92c940656a status: test description: Detects the creation of diagcab file, which could be caused by some legitimate installer or is a sign of exploitation (review the filename and its location) references: - https://threadreaderapp.com/thread/1533879688141086720.html author: frack113 date: 2022-06-08 tags: - attack.resource-development logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: .diagcab condition: selection falsepositives: - Legitimate microsoft diagcab level: medium
Near-miss passage: Sigma rule: Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversar. Logsource: windows / ps_script. Rule: title: Enable Windows Remote Management id: 991a9744-f2f0-44f2-bd33-9092eba17dc3 status: test description: Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.006/T1021.006.md#atomic-test-1---enable-windows-remote-management - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enable-psremoting?view=powershell-7.2 author: frack113 date: 2022-01-07 tags: - attack.lateral-movement - attack.t1021.006 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmdlet: ScriptBlockText|contains: 'Enable-PSRemoting ' condition: selection_cmdlet falsepositives: - Legitimate script level: medium
Query: CVE similar to CVE-2015-1818
Matching passage: CVE-2015-1818. CWE: UNKNOWN. CVSS: 7.5. XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery (SSRF) attacks, and have other unspecified impact via a crafted XML document.
Near-miss passage: CVE-2015-7303. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in the Update Manager service in Avira Management Console allows remote attackers to execute arbitrary code via a large header.
Query: Sigma rule for Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or r
Matching passage: Sigma rule: Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or r. Logsource: windows / process_creation. Rule: title: Potentially Suspicious NTFS Symlink Behavior Modification id: c0b2768a-dd06-4671-8339-b16ca8d1f27f status: test description: 'Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks. ' references: - https://www.cybereason.com/blog/cybereason-vs.-blackcat-ransomware - https://learn.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior - https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/ author: frack113, The DFIR Report date: 2022-03-02 modified: 2025-11-13 tags: - attack.execution - attack.defense-impairment - attack.t1059 - attack.t1222.001 logsource: category: process_creation product: windows detection: selection_img_proxy: - Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - Cmd.Exe - PowerShell.EXE - pwsh.dll selection_fsutil_cli: CommandLine|contains|all: - fsutil - behavior - set - SymlinkEvaluation selection_symlink_params: CommandLine|contains: - R2L:1 - R2R:1 - L2L:1 condition: all of selection_* falsepositives: - Legitimate usage, investigate the parent process and context to determine if benign. level: medium
Near-miss passage: Sigma rule: Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'. Logsource: windows / registry_set. Rule: title: COM Hijack via Sdclt id: 07743f65-7ec9-404a-a519-913db7118a8d status: test description: Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute' references: - http://blog.sevagas.com/?Yet-another-sdclt-UAC-bypass - https://www.exploit-db.com/exploits/47696 author: Omkar Gudhate date: 2020-09-27 modified: 2023-09-28 tags: - attack.persistence - attack.privilege-escalation - attack.t1546 - attack.t1548 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Software\Classes\Folder\shell\open\command\DelegateExecute condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-5427
Matching passage: CVE-2015-5427. CWE: UNKNOWN. CVSS: 7.5. HP Matrix Operating Environment before 7.5.0 allows remote attackers to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2015-5428 and CVE-2015-5429.
Near-miss passage: CVE-2015-1587. CWE: UNKNOWN. CVSS: 7.5. Unrestricted file upload vulnerability in file_to_index.php in Maarch LetterBox 2.8 and earlier and GEC/GED 1.4 and earlier allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a request to a predictable filename in tmp/.
Query: alert when Detects enumeration of local system accounts. This information can help adversaries determine which local accounts exist
Matching passage: Sigma rule: Detects enumeration of local system accounts. This information can help adversaries determine which local accounts exist. Logsource: linux / process_creation. Rule: title: Local System Accounts Discovery - Linux id: b45e3d6f-42c6-47d8-a478-df6bd6cf534c status: test description: Detects enumeration of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.001/T1087.001.md - https://my.f5.com/manage/s/article/K589 - https://man.freebsd.org/cgi/man.cgi?pwd_mkdb author: Alejandro Ortuno, oscd.community, CheraghiMilad date: 2020-10-08 modified: 2024-12-10 tags: - attack.discovery - attack.t1087.001 logsource: category: process_creation product: linux detection: selection_1: Image|endswith: /lastlog selection_2: CommandLine|contains: '''x:0:''' selection_3: Image|endswith: - /cat - /ed - /head - /more - /nano - /tail - /vi - /vim - /less - /emacs - /sqlite3 - /makemap CommandLine|contains: - /etc/passwd - /etc/shadow - /etc/sudoers - /etc/spwd.db - /etc/pwd.db - /etc/master.passwd selection_4: Image|endswith: /id selection_5: Image|endswith: /lsof CommandLine|contains: -u condition: 1 of selection* falsepositives: - Legitimate administration activities level: low
Near-miss passage: Sigma rule: Detects suspicious PowerShell download command. Logsource: windows / ps_script. Rule: title: Suspicious PowerShell Download - Powershell Script id: 403c2cc0-7f6b-4925-9423-bfa573bed7eb related: - id: 65531a81-a694-4e31-ae04-f8ba5bc33759 type: derived status: test description: Detects suspicious PowerShell download command references: - https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-8.0 - https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-8.0 author: Florian Roth (Nextron Systems) date: 2017-03-05 modified: 2022-12-02 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: webclient: ScriptBlockText|contains: System.Net.WebClient download: ScriptBlockText|contains: - .DownloadFile( - .DownloadFileAsync( - .DownloadString( - .DownloadStringAsync( condition: webclient and download falsepositives: - PowerShell scripts that download content from the Internet level: medium
Query: exploit The wiki component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 does not consider the mod/wiki:managefiles capability before authorizin
Matching passage: CVE-2015-5265. CWE: CWE-264. CVSS: 4.300000190734863. The wiki component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 does not consider the mod/wiki:managefiles capability before authorizing file management, which allows remote authenticated users to delete arbitrary files by using a manage-files button in a text editor.
Near-miss passage: CVE-2015-6860. CWE: CWE-264. CVSS: 8.399999618530273. HPE Network Switches with software 15.16.x and 15.17.x allow local users to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2015-6859.
Query: exploit Integer overflow in the make_filter_table function in pixops/pixops.c in gdk-pixbuf before 2.31.5, as used in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Linux,
Matching passage: CVE-2015-4491. CWE: CWE-189. CVSS: 6.800000190734863. Integer overflow in the make_filter_table function in pixops/pixops.c in gdk-pixbuf before 2.31.5, as used in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Linux, Google Chrome on Linux, and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via crafted bitmap dimensions that are mishandled during scaling.
Near-miss passage: CVE-2015-7222. CWE: CWE-189. CVSS: 6.800000190734863. Integer underflow in the Metadata::setData function in MetaData.cpp in libstagefright in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect memory allocation and application crash) via an MP4 video file with crafted covr metadata that triggers a buffer overflow.
Query: describe CVE-2015-1097
Matching passage: CVE-2015-1097. CWE: CWE-200. CVSS: 1.899999976158142. IOMobileFramebuffer in Apple iOS before 8.3 and Apple TV before 7.2 allows attackers to obtain sensitive information about kernel memory via a crafted app.
Near-miss passage: CVE-2015-3319. CWE: CWE-200. CVSS: 5.0. Hotspot Express hotEx Billing Manager 73 does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Query: patch priority for CVE-2015-2253
Matching passage: CVE-2015-2253. CWE: CWE-200. CVSS: 5.0. The XML interface in Huawei OceanStor UDS devices with software before V100R002C01SPC102 allows remote authenticated users to obtain sensitive information via a crafted XML document.
Near-miss passage: CVE-2015-3097. CWE: CWE-200. CVSS: 5.0. Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160, Adobe AIR before 18.0.0.144, Adobe AIR SDK before 18.0.0.144, and Adobe AIR SDK & Compiler before 18.0.0.144 on 64-bit Windows 7 systems do not properly select a random memory address for the Flash heap, which makes it easier for attackers to conduct unspecified attacks by predicting this address.
Query: weakness Release of Invalid Pointer or Reference
Matching passage: CWE-763 Release of Invalid Pointer or Reference. The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.
Near-miss passage: CWE-436 Interpretation Conflict. Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
Query: patch priority for CVE-2015-0422
Matching passage: CVE-2015-0422. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, and 6.3.5 allows remote authenticated users to affect confidentiality via unknown vectors related to UI Infrastructure.
Near-miss passage: CVE-2015-1172. CWE: UNKNOWN. CVSS: 7.5. Unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme (aka holding_pattern) 0.6 and earlier for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in an unspecified directory.
Query: describe CVE-2015-5053
Matching passage: CVE-2015-5053. CWE: CWE-284. CVSS: 10.0. The host memory mapping path feature in the NVIDIA GPU graphics driver R346 before 346.87 and R352 before 352.41 for Linux and R352 before 352.46 for GRID vGPU and vSGA does not properly restrict access to third-party device IO memory, which allows attackers to gain privileges, cause a denial of service (resource consumption), or possibly have unspecified other impact via unknown vectors related to the follow_pfn kernel-mode API call.
Near-miss passage: CVE-2015-1464. CWE: CWE-284. CVSS: 6.400000095367432. RT (aka Request Tracker) before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL.
Query: CVE similar to CVE-2015-4325
Matching passage: CVE-2015-4325. CWE: CWE-264. CVSS: 6.900000095367432. The process-management implementation in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to gain privileges by terminating a firestarter.py supervised process and then triggering the restart of a process by the root account, aka Bug ID CSCuv12272.
Near-miss passage: CVE-2015-3188. CWE: CWE-264. CVSS: 9.800000190734863. The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors.