alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-2110
Matching passage: CVE-2015-2110. CWE: CWE-119. CVSS: 10.0. Buffer overflow in HP LoadRunner 11.52 allows remote attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-3317. CWE: CWE-119. CVSS: 4.599999904632568. CA Common Services, as used in CA Client Automation r12.5 SP01, r12.8, and r12.9; CA Network and Systems Management r11.0, r11.1, and r11.2; CA NSM Job Management Option r11.0, r11.1, and r11.2; CA Universal Job Management Agent; CA Virtual Assurance for Infrastructure Managers (aka SystemEDGE) 12.6, 12.7, 12.8, and 12.9; and CA Workload Automation AE r11, r11.3, r11.3.5, and r11.3.6 on UNIX, does not properly perform bounds checking, which allows local users to gain privileges via unspecified vectors.
Query: patch priority for CVE-2015-4345
Matching passage: CVE-2015-4345. CWE: CWE-200. CVSS: 5.0. The RESTWS Basic Auth submodule in the RESTful Web Services module 7.x-1.x before 7.x-1.5 and 7.x-2.x before 7.x-2.3 for Drupal caches pages for authenticated requests, which allows remote attackers to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-7502. CWE: CWE-200. CVSS: 5.099999904632568. Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the backend PostgreSQL database, which might allow local users to obtain sensitive data and consequently gain privileges by leveraging access to (1) database exports or (2) log files.
Query: describe CVE-2015-7979
Matching passage: CVE-2015-7979. CWE: CWE-19. CVSS: 7.5. NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server association tear down) by sending broadcast packets with invalid authentication to a broadcast client.
Near-miss passage: CVE-2015-0613. CWE: CWE-19. CVSS: 7.099999904632568. The Connection Conversation Manager (aka CuCsMgr) process in Cisco Unity Connection 8.5 before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, 9.x before 9.1(2)SU2, and 10.0 before 10.0(1)SU1, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (core dump and restart) via crafted SIP INVITE messages, aka Bug ID CSCul20444.
Query: vulnerability: Untrusted search path vulnerability in F-Secure Online Scanner allows remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse DLL that is lo
Matching passage: CVE-2015-8264. CWE: CWE-426. CVSS: 7.800000190734863. Untrusted search path vulnerability in F-Secure Online Scanner allows remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse DLL that is located in the same folder as F-SecureOnlineScanner.exe.
Near-miss passage: CVE-2015-3987. CWE: CWE-426. CVSS: 7.199999809265137. Multiple unquoted Windows search path vulnerabilities in the (1) Client Management and (2) Gateway in McAfee ePO Deep Command 2.1 and 2.2 before HF 1058831 allow local users to gain privileges via unspecified vectors.
Query: what is T1587.001
Matching passage: T1587.001 Malware. Tactics: resource development. Description: Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB) During malware development, adversaries may intentionally include indicators aligned with other known actors in order to mislead attribution by defenders.(Citation: Olympic Destroyer)(Citation: Risky Bulletin Threat actor impersonates FSB APT)(Citation: GamaCopy organization) As with legitimate development efforts, different skill sets may be required for developing malware. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware. Some aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure. For example, malware developed that will communicate with Twitter for C2, may require use of [Web Services](https://attack.mitre.org/techniques/T1583/006).(Citation: FireEye APT29)
Near-miss passage: T1587.002 Code Signing Certificates. Tactics: resource development. Description: Adversaries may create self-signed code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is. Prior to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may develop self-signed code signing certificates for use in operations.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects a renamed "dctask64.exe" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. T. Logsource: windows / process_creation. Rule: title: Renamed ZOHO Dctask64 Execution id: 340a090b-c4e9-412e-bb36-b4b16fe96f9b status: test description: 'Detects a renamed "dctask64.exe" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution. ' references: - https://twitter.com/gN3mes1s/status/1222088214581825540 - https://twitter.com/gN3mes1s/status/1222095963789111296 - https://twitter.com/gN3mes1s/status/1222095371175911424 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2020-01-28 modified: 2025-01-22 tags: - attack.privilege-escalation - attack.stealth - attack.t1036 - attack.t1055.001 - attack.t1202 - attack.t1218 logsource: category: process_creation product: windows detection: selection: Hashes|contains: - IMPHASH=6834B1B94E49701D77CCB3C0895E1AFD - IMPHASH=1BB6F93B129F398C7C4A76BB97450BBA - IMPHASH=FAA2AC19875FADE461C8D89DCF2710A3 - IMPHASH=F1039CED4B91572AB7847D26032E6BBF filter_main_legit_name: Image|endswith: \dctask64.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that ma. Logsource: windows / ps_script. Rule: title: Suspicious Invoke-Item From Mount-DiskImage id: 902cedee-0398-4e3a-8183-6f3a89773a96 status: test description: Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.005/T1553.005.md#atomic-test-2---mount-an-iso-image-and-run-executable-from-the-iso - https://learn.microsoft.com/en-us/powershell/module/storage/mount-diskimage?view=windowsserver2022-ps author: frack113 date: 2022-02-01 tags: - attack.defense-impairment - attack.t1553.005 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'Mount-DiskImage ' - '-ImagePath ' - Get-Volume - .DriveLetter - 'invoke-item ' - ):\ condition: selection falsepositives: - Legitimate PowerShell scripts level: medium
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by usi. Logsource: windows / process_creation. Rule: title: Esentutl Steals Browser Information id: 6a69f62d-ce75-4b57-8dce-6351eb55b362 status: test description: One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe references: - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ - https://redcanary.com/threat-detection-report/threats/qbot/ - https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/ author: frack113 date: 2022-02-13 modified: 2024-03-05 tags: - attack.collection - attack.t1005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \esentutl.exe - OriginalFileName: esentutl.exe selection_flag: CommandLine|contains|windash: -r selection_webcache: CommandLine|contains: \Windows\WebCache condition: all of selection* falsepositives: - Legitimate use level: medium
Near-miss passage: Sigma rule: Detection of sc.exe utility adding a new service with special permission which hides that service.. Logsource: windows / process_creation. Rule: title: Service Security Descriptor Tampering Via Sc.EXE id: 98c5aeef-32d5-492f-b174-64a691896d25 related: - id: 99cf1e02-00fb-4c0d-8375-563f978dfd37 type: similar - id: a537cfc3-4297-4789-92b5-345bfd845ad0 type: similar status: test description: Detection of sc.exe utility adding a new service with special permission which hides that service. references: - https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html - https://www.sans.org/blog/red-team-tactics-hiding-windows-services/ - https://twitter.com/Alh4zr3d/status/1580925761996828672 - https://twitter.com/0gtweet/status/1628720819537936386 - https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-28 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.011 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \sc.exe - OriginalFileName: sc.exe selection_cli: CommandLine|contains: sdset condition: all of selection_* falsepositives: - Unknown level: medium
Query: incident response steps for EDR alert: possible Password Filter DLL (T1556.002)
Matching passage: Playbook for T1556.002 Password Filter DLL. 1) Validate alert telemetry against T1556.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: defense impairment, persistence, credential access. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated. Windows password filters are password policy enforcement mechanisms for both domain and local accounts. Filters are implemented as DLLs containing a method to validate potential passwords against password policies. Filter DLLs can be po
Near-miss passage: Playbook for T1556.009 Conditional Access Policies. Different response path focused on defense impairment, persistence, credential access.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the usage of the "Accesschk" utility, an access and privilege audit tool developed by SysInternal and often bein. Logsource: windows / process_creation. Rule: title: Permission Check Via Accesschk.EXE id: c625d754-6a3d-4f65-9c9a-536aea960d37 status: test description: Detects the usage of the "Accesschk" utility, an access and privilege audit tool developed by SysInternal and often being abused by attacker to verify process privileges references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment?slide=43 - https://www.youtube.com/watch?v=JGs-aKf2OtU&ab_channel=OFFZONEMOSCOW - https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat - https://github.com/gladiatx0r/Powerless/blob/04f553bbc0c65baf4e57344deff84e3f016e6b51/Powerless.bat author: Teymur Kheirkhabarov (idea), Mangatas Tondang, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2020-10-13 modified: 2026-06-29 tags: - attack.discovery - attack.t1069.001 logsource: product: windows category: process_creation detection: selection_img: - Product|endswith: AccessChk - Description|contains: Reports effective permissions - Image|endswith: - \accesschk.exe - \accesschk64.exe - \accesschk64a.exe - OriginalFileName: accesschk.exe selection_cli: CommandLine|contains: - 'uwcqv ' - 'kwsu ' - 'qwsu ' - 'uwdqs ' condition: all of selection* falsepositives: - System administrator Usage level: medium
Near-miss passage: Sigma rule: Detect failed attempts to sign in to disabled accounts.. Logsource: azure / signinlogs. Rule: title: Login to Disabled Account id: 908655e0-25cf-4ae1-b775-1c8ce9cf43d8 status: test description: Detect failed attempts to sign in to disabled accounts. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts author: AlertIQ date: 2021-10-10 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078.004 logsource: product: azure service: signinlogs detection: selection: ResultType: 50057 ResultDescription: User account is disabled. The account has been disabled by an administrator. condition: selection falsepositives: - Unknown level: medium
Query: rule covering Detects a ping command that uses a hex encoded IP address
Matching passage: Sigma rule: Detects a ping command that uses a hex encoded IP address. Logsource: windows / process_creation. Rule: title: Ping Hex IP id: 1a0d4aba-7668-4365-9ce4-6d79ab088dfd status: test description: Detects a ping command that uses a hex encoded IP address references: - https://github.com/vysecurity/Aggressor-VYSEC/blob/0d61c80387b9432dab64b8b8a9fb52d20cfef80e/ping.cna - https://twitter.com/vysecurity/status/977198418354491392 author: Florian Roth (Nextron Systems) date: 2018-03-23 modified: 2025-10-17 tags: - attack.stealth - attack.t1140 - attack.t1027 logsource: category: process_creation product: windows detection: selection: Image|endswith: \ping.exe CommandLine|re: 0x[a-fA-F0-9]{8} condition: selection falsepositives: - Unlikely, because no sane admin pings IP addresses in a hexadecimal form level: high
Near-miss passage: Sigma rule: Detects attempts to disable Windows Credential Guard by deleting registry values. Credential Guard uses virtualization-b. Logsource: windows / registry_delete. Rule: title: Windows Credential Guard Related Registry Value Deleted - Registry id: d645ef86-2396-48a1-a2b6-b629ca3f57ff related: - id: c17d47b7-dcd6-4109-87eb-d1817bd4cbc9 type: similar status: experimental description: 'Detects attempts to disable Windows Credential Guard by deleting registry values. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation. ' references: - https://github.com/DambergC/SaveFolder/blob/90e945eba80fae85f2d54b4616e05a44ec90c500/Cygate%20Installation%20tool%206.22/Script/OSD/OSDeployment-CredentialGuardDisable.ps1#L50 - https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/configure author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-12-26 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_delete product: windows detection: selection: TargetObject|endswith: - \DeviceGuard\EnableVirtualizationBasedSecurity - \DeviceGuard\LsaCfgFlags - \DeviceGuard\RequirePlatformSecurityFeatures - \Lsa\LsaCfgFlags condition: selection falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/registry/registry_delete/registry_delete_disable_credential_guard/info.yml
Query: patch priority for CVE-2015-1285
Matching passage: CVE-2015-1285. CWE: CWE-200. CVSS: 5.0. The XSSAuditor::canonicalize function in core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 44.0.2403.89, does not properly choose a truncation point, which makes it easier for remote attackers to obtain sensitive information via an unspecified linear-time attack.
Near-miss passage: CVE-2015-7456. CWE: CWE-200. CVSS: 6.5. IBM Spectrum Scale 4.1.1 before 4.1.1.4, and 4.2.0.0, allows remote authenticated users to discover object-storage admin passwords via unspecified vectors.
Query: describe CVE-2015-1265
Matching passage: CVE-2015-1265. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google Chrome before 43.0.2357.65 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Near-miss passage: CVE-2015-0455. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the XDB - XML Database component in Oracle Database Server 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors.
Query: indicators of DNS Calculation
Matching passage: T1568.003 DNS Calculation. Tactics: command and control. Description: Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address. A IP and/or port number calculation can be used to bypass egress filtering on a C2 channel.(Citation: Meyers Numbered Panda) One implementation of [DNS Calculation](https://attack.mitre.org/techniques/T1568/003) is to take the first three octets of an IP address in a DNS response and use those values to calculate the port for command and control traffic.(Citation: Meyers Numbered Panda)(Citation: Moran 2014)(Citation: Rapid7G20Espionage)
Near-miss passage: T1568 Dynamic Resolution. Tactics: command and control. Description: Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control. Adversaries may use dynamic resolution for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)
Query: detection rule: Detects a JAVA process running with remote debugging allowing more than just localhost to connect
Matching passage: Sigma rule: Detects a JAVA process running with remote debugging allowing more than just localhost to connect. Logsource: windows / process_creation. Rule: title: Java Running with Remote Debugging id: 8f88e3f6-2a49-48f5-a5c4-2f7eedf78710 status: test description: Detects a JAVA process running with remote debugging allowing more than just localhost to connect references: - https://dzone.com/articles/remote-debugging-java-applications-with-jdwp author: Florian Roth (Nextron Systems) date: 2019-01-16 modified: 2023-02-01 tags: - attack.t1203 - attack.execution logsource: category: process_creation product: windows detection: selection_jdwp_transport: CommandLine|contains: transport=dt_socket,address= selection_old_jvm_version: CommandLine|contains: - jre1. - jdk1. exclusion: CommandLine|contains: - address=127.0.0.1 - address=localhost condition: all of selection_* and not exclusion falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl. This activity m. Logsource: linux / process_creation. Rule: title: Kaspersky Endpoint Security Stopped Via CommandLine - Linux id: 36388120-b3f1-4ce9-b50b-280d9a7f4c04 status: experimental description: 'Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl. This activity may indicate a manual interruption of the antivirus service by an administrator, or it could be a sign of potential tampering or evasion attempts by malicious actors. ' references: - https://support.kaspersky.com/KES4Linux/12.0.0/en-US/197929.htm author: Milad Cheraghi date: 2025-10-18 tags: - attack.execution - attack.defense-impairment - attack.t1685 logsource: product: linux category: process_creation detection: selection: Image|endswith: - /systemctl - /bash - /sh CommandLine|contains|all: - stop - kesl condition: selection falsepositives: - System administrator manually stopping Kaspersky services level: high
Query: CVE similar to CVE-2015-1834
Matching passage: CVE-2015-1834. CWE: CWE-22. CVSS: 6.5. A path traversal vulnerability was identified in the Cloud Foundry component Cloud Controller that affects cf-release versions prior to v208 and Pivotal Cloud Foundry Elastic Runtime versions prior to 1.4.2. Path traversal is the 'outbreak' of a given directory structure through relative file paths in the user input. It aims at accessing files and directories that are stored outside the web root folder, for disallowed reading or even executing arbitrary system commands. An attacker could use a certain parameter of the file path for instance to inject '../' sequences in order to navigate through the file system. In this particular case a remote authenticated attacker can exploit the identified vulnerability in order to upload arbitrary files to the server running a Cloud Controller instance - outside the isolated application container.
Near-miss passage: CVE-2015-7780. CWE: CWE-22. CVSS: 6.5. Directory traversal vulnerability in ManageEngine Firewall Analyzer before 8.0.