alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: threat report mentioning Disable or Modify Tools
Matching passage: T1685 Disable or Modify Tools. Tactics: defense impairment. Description: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.(Citation: SCADAfence_ransomware) In addition to directly targeting tools, adversaries may block or manipulate indicators and telemetry used for detection. This includes maliciously disabling or redirecting sensors such as Event Tracing for Windows (ETW), modifying event log configurations (e.g., redirecting Security logs), or interfering with logging pipelines and forwarding mechanisms (e.g., SIEM ingestion).(Citation: Microsoft Lamin Sept 2017)(Citation: ETW Palantir) More advanced techniques include leveraging legitimate drivers or debugging mechanisms to render tools non-functional, bypassing anti-tampering protections, and targeting specific defenses such as Sysmon or cloud monitoring agents. Adversaries may also disrupt broader defensive operations, including update mechanisms, logging infrastructure (e.g., syslog), or event aggregation, further degrading an organization’s ability to detect and respond to malicious activity.(Citation: Cocomazzi FIN7 Reboot)
Near-miss passage: T1685.002 Disable or Modify Cloud Log. Tactics: defense impairment. Description: An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities. For example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity. They may alternatively tamper with logging functionality, for example, by removing any associated SNS topics, disabling multi-region logging, or disabling settings that validate and/or encrypt log files.(Citation: AWS Cloud Trail)(Citation: Pacu Detection Disruption Module) In Office 365, an adversary may disable logging on mail collection activities for specific users by using the Set-MailboxAuditBypassAssociation cmdlet, by disabling M365 Advanced Auditing for the user, or by downgrading the user’s license from an Enterprise E5 to an Enterprise E3 license.(Citation: Dark Reading)
Query: exploit LOYTEC LIP-3ECTB 6.0.1, LINX-100, LVIS-3E100, and LIP-ME201 devices allow remote attackers to read a password-hash backup file via unspecified vectors.
Matching passage: CVE-2015-7906. CWE: CWE-255. CVSS: 10.0. LOYTEC LIP-3ECTB 6.0.1, LINX-100, LVIS-3E100, and LIP-ME201 devices allow remote attackers to read a password-hash backup file via unspecified vectors.
Near-miss passage: CVE-2015-7287. CWE: CWE-255. CVSS: 7.5. CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 use the same 001984 default PIN across different customers' installations, which allows remote attackers to execute commands by leveraging knowledge of this PIN and including it in an SMS message.
Query: patch priority for CVE-2015-8721
Matching passage: CVE-2015-8721. CWE: CWE-20. CVSS: 5.5. Buffer overflow in the tvb_uncompress function in epan/tvbuff_zlib.c in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 allows remote attackers to cause a denial of service (application crash) via a crafted packet with zlib compression.
Near-miss passage: CVE-2015-9049. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in the processing of certain responses from the USIM.
Query: patch priority for CVE-2015-7728
Matching passage: CVE-2015-7728. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in user creation in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to inject arbitrary web script or HTML via the username, aka SAP Security Note 2153898.
Near-miss passage: CVE-2015-9103. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in Synology Note Station 1.1-0212 and earlier allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) note title or (2) file name of attachments.
Query: rule covering Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled.
Matching passage: Sigma rule: Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled.. Logsource: windows / security. Rule: title: Important Windows Event Auditing Disabled id: ab4561b1-6c7e-48a7-ad08-087cfb9ce8f1 related: - id: 69aeb277-f15f-4d2d-b32a-55e883609563 type: derived status: test description: Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled. references: - https://docs.google.com/presentation/d/1dkrldTTlN3La-OjWtkWJBb4hVk6vfsSMBFBERs6R8zA/edit - https://github.com/SigmaHQ/sigma/blob/ad1bfd3d28aa0ccc9656240f845022518ef65a2e/documentation/logsource-guides/windows/service/security.md author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-20 modified: 2023-11-17 tags: - attack.defense-impairment - attack.t1685.001 logsource: product: windows service: security definition: dfd8c0f4-e6ad-4e07-b91b-f2fca0ddef64 detection: selection_state_success_and_failure: EventID: 4719 SubcategoryGuid: - '{0CCE9210-69AE-11D9-BED3-505054503030}' - '{0CCE9211-69AE-11D9-BED3-505054503030}' - '{0CCE9212-69AE-11D9-BED3-505054503030}' - '{0CCE9215-69AE-11D9-BED3-505054503030}' - '{0CCE921B-69AE-11D9-BED3-505054503030}' - '{0CCE922B-69AE-11D9-BED3-505054503030}' - '{0CCE922F-69AE-11D9-BED3-505054503030}' - '{0CCE9230-69AE-11D9-BED3-505054503030}' - '{0CCE9235-69AE-11D9-BED3-505054503030}' - '{0CCE9236-69AE-11D9-BED3-505054503030}' - '{0CCE9237-69AE-11D9-BED3-505054503030}' - '{0CCE923F-69AE-11D9-BED3-505054503030}' - '{0CCE9240-69AE-11D9-BED3-505054503030}' - '{0CCE9242-69AE-11D9-BED3-505054503030}' AuditPolicyChanges|contains: - '%%8448' - '%%8450' selection_state_success_only: EventID: 4719 SubcategoryGuid: '{0CCE9217-69AE-11D9-BED3-505054503030}' AuditPolicyChanges|contains: '%%8448' condition: 1 of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects Obfuscated use of Environment Variables to execute PowerShell. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation VAR+ Launcher - PowerShell id: 0adfbc14-0ed1-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of Environment Variables to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|re: cmd.{0,5}(?:/c|/r)(?:\s|)"set\s[a-zA-Z]{3,6}.*(?:\{\d\}){1,}\\"\s+?-f(?:.*\)){1,}.*" condition: selection_4104 falsepositives: - Unknown level: high
Query: describe CVE-2015-8335
Matching passage: CVE-2015-8335. CWE: CWE-200. CVSS: 6.5. Huawei VCN500 with software before V100R002C00SPC201 logs passwords in cleartext, which allows remote authenticated users to obtain sensitive information by triggering log generation and then reading the log.
Near-miss passage: CVE-2015-5163. CWE: CWE-200. CVSS: 3.5. The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image.
Query: risk of HikaShop Joomla Component before 2.6.0 has XSS via an injected payload[/caption].
Matching passage: CVE-2015-7344. CWE: CWE-79. CVSS: 4.800000190734863. HikaShop Joomla Component before 2.6.0 has XSS via an injected payload[/caption].
Near-miss passage: CVE-2015-9397. CWE: CWE-79. CVSS: 5.400000095367432. The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS.
Query: common weakness: Multiple Releases of Same Resource or Handle
Matching passage: CWE-1341 Multiple Releases of Same Resource or Handle. The product attempts to close or release a resource or handle more than once, without any successful open between the close operations.
Near-miss passage: CWE-546 Suspicious Comment. The code contains comments that suggest the presence of bugs, incomplete functionality, or weaknesses.
Query: alert when Identifies when a Point-to-site VPN is Modified or Deleted.
Matching passage: Sigma rule: Identifies when a Point-to-site VPN is Modified or Deleted.. Logsource: azure / activitylogs. Rule: title: Azure Point-to-site VPN Modified or Deleted id: d9557b75-267b-4b43-922f-a775e2d1f792 status: test description: Identifies when a Point-to-site VPN is Modified or Deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-08-08 modified: 2022-08-23 tags: - attack.impact logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.NETWORK/P2SVPNGATEWAYS/WRITE - MICROSOFT.NETWORK/P2SVPNGATEWAYS/DELETE - MICROSOFT.NETWORK/P2SVPNGATEWAYS/RESET/ACTION - MICROSOFT.NETWORK/P2SVPNGATEWAYS/GENERATEVPNPROFILE/ACTION - MICROSOFT.NETWORK/P2SVPNGATEWAYS/DISCONNECTP2SVPNCONNECTIONS/ACTION - MICROSOFT.NETWORK/P2SVPNGATEWAYS/PROVIDERS/MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/WRITE condition: selection falsepositives: - Point-to-site VPN being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Point-to-site VPN modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata. SharpDPAPI is a C# port of some. Logsource: windows / process_creation. Rule: title: HackTool - SharpDPAPI Execution id: c7d33b50-f690-4b51-8cfb-0fb912a31e57 status: test description: 'Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata. SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project. ' references: - https://github.com/GhostPack/SharpDPAPI author: Nasreddine Bencherchali (Nextron Systems) date: 2024-06-26 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.001 - attack.t1134.003 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \SharpDPAPI.exe - OriginalFileName: SharpDPAPI.exe selection_other_cli: CommandLine|contains: - ' backupkey ' - ' blob ' - ' certificates ' - ' credentials ' - ' keepass ' - ' masterkeys ' - ' rdg ' - ' vaults ' selection_other_options_guid: CommandLine|contains|all: - ' {' - '}:' selection_other_options_flags: CommandLine|contains: - ' /file:' - ' /machine' - ' /mkfile:' - ' /password:' - ' /pvk:' - ' /server:' - ' /target:' - ' /unprotect' condition: selection_img or (selection_other_cli and 1 of selection_other_options_*) falsepositives: - Unknown level: high
Query: Suspicious Internal Defacement execution detected on endpoint
Matching passage: T1491.001 Internal Defacement. Tactics: impact. Description: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites or server login messages, or directly to user systems with the replacement of the desktop wallpaper.(Citation: Novetta Blockbuster)(Citation: Varonis) Disturbing or offensive images may be used as a part of [Internal Defacement](https://attack.mitre.org/techniques/T1491/001) in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.(Citation: Novetta Blockbuster Destructive Malware)
Near-miss passage: T1491 Defacement. Tactics: impact. Description: Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for [Defacement](https://attack.mitre.org/techniques/T1491) include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of [Defacement](https://attack.mitre.org/techniques/T1491) in order to cause user discomfort, or to pressure compliance with accompanying messages.
Query: exploit Cross-site scripting (XSS) vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 9.1, 10.1, 11.0 before 11.0.0.0 IF11, 11.3 before 11.
Matching passage: CVE-2015-7414. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 9.1, 10.1, 11.0 before 11.0.0.0 IF11, 11.3 before 11.3.0.0 IF7, and 11.4 before 11.4.0.4 IF1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-2068. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allow remote attackers to inject arbitrary web script or HTML via the (1) profile parameter to web/magmi.php or (2) QUERY_STRING to web/magmi_import_run.php.
Query: risk of Juniper Junos OS 12.1X44 before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R9, 12.3X48 before 12.3X48-D15, 13.2 before 13.2R7, 13.2X51 bef
Matching passage: CVE-2015-5358. CWE: CWE-399. CVSS: 7.099999904632568. Juniper Junos OS 12.1X44 before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R9, 12.3X48 before 12.3X48-D15, 13.2 before 13.2R7, 13.2X51 before 13.2X51-D35, 13.2X52 before 13.2X52-D25, 13.3 before 13.3R6, 14.1R3 before 14.1R3-S2, 14.1 before 14.1R4, 14.1X53 before 14.1X53-D12, 14.1X53 before 14.1X53-D16, 14.1X55 before 14.1X55-D25, 14.2 before 14.2R2, and 15.1 before 15.1R1 allows remote attackers to cause a denial of service (mbuf and connection consumption and restart) via a large number of requests that trigger a TCP connection to move to the LAST_ACK state when there is more data to send.
Near-miss passage: CVE-2015-2339. CWE: CWE-399. CVSS: 6.099999904632568. TPview.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory, which allows guest OS users to cause a host OS denial of service via unspecified vectors, a different vulnerability than CVE-2015-2338.
Query: exploit Directory traversal vulnerability on Huawei HG532e, HG532n, and HG532s devices allows remote attackers to read arbitrary files via a .. (dot dot) in an icon/ URI.
Matching passage: CVE-2015-7254. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability on Huawei HG532e, HG532n, and HG532s devices allows remote attackers to read arbitrary files via a .. (dot dot) in an icon/ URI.
Near-miss passage: CVE-2015-5638. CWE: CWE-22. CVSS: 4.300000190734863. Directory traversal vulnerability in H2O before 1.4.5 and 1.5.x before 1.5.0-beta2, when the file.dir directive is enabled, allows remote attackers to read arbitrary files via a crafted URL.
Query: detect Detects potential Kubernetes enumeration or attack activity via the audit log. This includes the execution of common she in logs
Matching passage: Sigma rule: Detects potential Kubernetes enumeration or attack activity via the audit log. This includes the execution of common she. Logsource: kubernetes / audit. Rule: title: Kubernetes Potential Enumeration Activity id: 597a7e84-187d-458b-9e4f-2f5a0e676711 status: experimental description: 'Detects potential Kubernetes enumeration or attack activity via the audit log. This includes the execution of common shells, utilities, or specialized tools like ''Rakkess'' (access_matrix) and ''TruffleHog'' via Kubernetes API requests. Attackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster. ' references: - https://www.nccgroup.com/research/detection-engineering-for-kubernetes-clusters/ - https://github.com/trufflesecurity/trufflehog - https://github.com/corneliusweig/rakkess author: uniqu3-us3r date: 2026-04-28 tags: - attack.execution - attack.discovery - attack.t1609 - attack.t1613 logsource: product: kubernetes service: audit detection: selection_status: responseStatus.code: ALLOW selection_request_uri: requestURI|contains: - '%2fbin%2fash' - '%2fbin%2fbash' - '%2fbin%2fbusybox' - '%2fbin%2fdash' - '%2fbin%2fsh' - '%2fbin%2fzsh' - /bin/ash - /bin/bash - /bin/busybox - /bin/dash - /bin/sh - /bin/zsh - '%2fusr%2fbin%2fcurl' - '%2fusr%2fbin%2fkubectl' - '%2fusr%2fbin%2fperl' - '%2fusr%2fbin%2fpython' - '%2fusr%2fbin%2fwget' - /usr/bin/curl - /usr/bin/kubectl - /usr/bin/perl - /usr/bin/python - /usr/bin/wget selection_request_user_agent: userAgent|contains: - access_matrix - trufflehog - azurehound - micro-scanner condition: selection_status and 1 of selection_request_* falsepositives: - Authorized administrative maintenance via kubectl - Automated internal infrastructure monitoring and certificate rotation - Security-approved vulnerability or secret scanning in DevSecOps pipelines level: medium
Near-miss passage: Sigma rule: Detects disabling security tools. Logsource: linux / syslog. Rule: title: Disabling Security Tools - Builtin id: 49f5dfc1-f92e-4d34-96fa-feba3f6acf36 related: - id: e3a8a052-111f-4606-9aee-f28ebeb76776 type: derived status: test description: Detects disabling security tools references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md author: Ömer Günal, Alejandro Ortuno, oscd.community date: 2020-06-17 modified: 2022-11-26 tags: - attack.defense-impairment - attack.t1686 logsource: product: linux service: syslog detection: keywords: - stopping iptables - stopping ip6tables - stopping firewalld - stopping cbdaemon - stopping falcon-sensor condition: keywords falsepositives: - Legitimate administration activities level: medium
Query: risk of Cross-site scripting (XSS) vulnerability in OpenCart before 2.1.0.2 allows remote attackers to inject arbitrary web script or HTML via the zone_id parameter to index.php.
Matching passage: CVE-2015-4671. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in OpenCart before 2.1.0.2 allows remote attackers to inject arbitrary web script or HTML via the zone_id parameter to index.php.
Near-miss passage: CVE-2015-0891. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Maroyaka CGI Maroyaka Simple Board allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: detection rule: Detects potential token impersonation and theft. Example, when using "DuplicateToken(Ex)" and "ImpersonateLoggedOnUser"
Matching passage: Sigma rule: Detects potential token impersonation and theft. Example, when using "DuplicateToken(Ex)" and "ImpersonateLoggedOnUser". Logsource: windows / security. Rule: title: Potential Access Token Abuse id: 02f7c9c1-1ae8-4c6a-8add-04693807f92f status: test description: Detects potential token impersonation and theft. Example, when using "DuplicateToken(Ex)" and "ImpersonateLoggedOnUser" with the "LOGON32_LOGON_NEW_CREDENTIALS flag". references: - https://www.elastic.co/fr/blog/how-attackers-abuse-access-token-manipulation - https://www.manageengine.com/log-management/cyber-security/access-token-manipulation.html author: Michaela Adams, Zach Mathis date: 2022-11-06 modified: 2023-04-26 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.001 - stp.4u logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 9 LogonProcessName: Advapi AuthenticationPackageName: Negotiate ImpersonationLevel: '%%1833' condition: selection falsepositives: - Anti-Virus level: medium
Near-miss passage: Sigma rule: Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.. Logsource: windows / file_event. Rule: title: Potential Homoglyph Attack Using Lookalike Characters in Filename id: 4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6 status: test description: 'Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters. ' references: - https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish - http://www.irongeek.com/homoglyph-attack-generator.php author: Micah Babinski, @micahbabinski date: 2023-05-08 tags: - attack.stealth - attack.t1036 - attack.t1036.003 logsource: category: file_event product: windows detection: selection_upper: TargetFilename|contains: - А - В - Е - К - М - Н - О - Р - С - Т - Х - Ѕ - І - Ј - Ү - Ӏ - Ԍ - Ԛ - Ԝ - Α - Β - Ε - Ζ - Η - Ι - Κ - Μ - Ν - Ο - Ρ - Τ - Υ - Χ selection_lower: TargetFilename|contains: - а - е - о - р - с - х - ѕ - і - ӏ - ј - һ - ԁ - ԛ - ԝ - ο condition: 1 of selection_* falsepositives: - File names with legitimate Cyrillic text. Will likely require tuning (or not be usable) in countries where these alphabets are in use. level: medium