alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Encoded PowerShell / command-line abuse matching Python
Matching passage: T1059.006 Python. Tactics: execution. Description: Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the <code>python.exe</code> interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.(Citation: Zscaler APT31 Covid-19 October 2020) Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.
Near-miss passage: T1059.001 PowerShell. Tactics: execution. Description: Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems). PowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk. A number of PowerShell-based offensive testing tools are available, including [Empire](https://attack.mitre.org/software/S0363), [PowerSploit](https://attack.mitre.org/software/S0194), [PoshC2](https://attack.mitre.org/software/S0378), and PSAttack.(Citation: Github PSAttack) PowerShell commands/scripts can also be executed without directly invoking the <code>powershell.exe</code> binary through interfaces to PowerShell's underlying <code>System.Management.Automation</code> assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).(Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)(Citation: Microsoft PSfromCsharp APR 2014)
Query: risk of Cross-site scripting (XSS) vulnerability in Fortinet FortiAuthenticator 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the operation parameter to cert/sce
Matching passage: CVE-2015-1459. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Fortinet FortiAuthenticator 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the operation parameter to cert/scep/.
Near-miss passage: CVE-2015-1179. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in data_point_details.shtm in Mango Automation 2.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dpid, (2) dpxid, or (3) pid parameter.
Query: exploit Secure Transport in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 does not properly restrict TLS state transitions, which makes it easier for remote att
Matching passage: CVE-2015-1067. CWE: CWE-310. CVSS: 4.300000190734863. Secure Transport in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204 and CVE-2015-1637.
Near-miss passage: CVE-2015-1146. CWE: CWE-310. CVSS: 1.899999976158142. The Code Signing implementation in Apple OS X before 10.10.3 does not properly validate signatures, which allows local users to bypass intended access restrictions via a crafted bundle, a different vulnerability than CVE-2015-1145.
Query: vulnerability: Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibl
Matching passage: CVE-2015-6525. CWE: CWE-189. CVSS: 7.5. Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact via "insanely large inputs" to the (1) evbuffer_add, (2) evbuffer_prepend, (3) evbuffer_expand, (4) exbuffer_reserve_space, or (5) evbuffer_read function, which triggers a heap-based buffer overflow or an infinite loop. NOTE: this identifier was SPLIT from CVE-2014-6272 per ADT3 due to different affected versions.
Near-miss passage: CVE-2015-4496. CWE: CWE-189. CVSS: 9.300000190734863. Multiple integer overflows in libstagefright in Mozilla Firefox before 38.0 allow remote attackers to execute arbitrary code via crafted sample metadata in an MPEG-4 video file, a related issue to CVE-2015-1538.
Query: risk of Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a denial of service or possibly have
Matching passage: CVE-2015-5706. CWE: CWE-416. CVSS: 4.599999904632568. Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a denial of service or possibly have unspecified other impact via O_TMPFILE filesystem operations that leverage a duplicate cleanup operation.
Near-miss passage: CVE-2015-8821. CWE: CWE-416. CVSS: 8.800000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via crafted MPEG-4 data, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, CVE-2015-8454, CVE-2015-8653, CVE-2015-8655, and CVE-2015-8822.
Query: incident response steps for Encoded PowerShell / command-line abuse matching JamPlus
Matching passage: Playbook for T1127.003 JamPlus. 1) Validate alert telemetry against T1127.003. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth, execution. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may use `JamPlus` to proxy the execution of a malicious script. `JamPlus` is a build utility tool for code and data build systems. It works with several popular compilers and can be used for generating workspaces in code editors such as Visual Studio.(Citation: JamPlus manual) Adversaries may abuse the `JamPlus` build utility to execute malicious scripts via a `.jam` file, which descri
Near-miss passage: Playbook for T1127.001 MSBuild. Different response path focused on stealth, execution.
Query: Sigma rule for Monitor and alert on group membership removal of groups that have CA policy modification access
Matching passage: Sigma rule: Monitor and alert on group membership removal of groups that have CA policy modification access. Logsource: azure / auditlogs. Rule: title: User Removed From Group With CA Policy Modification Access id: 665e2d43-70dc-4ccc-9d27-026c9dd7ed9c status: test description: Monitor and alert on group membership removal of groups that have CA policy modification access references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner' date: 2022-08-04 tags: - attack.privilege-escalation - attack.credential-access - attack.persistence - attack.defense-impairment - attack.t1548 - attack.t1556 logsource: product: azure service: auditlogs detection: selection: properties.message: Remove member from group condition: selection falsepositives: - User removed from the group is approved level: medium
Near-miss passage: Sigma rule: Detects registry modifications to the 'ms-settings' protocol handler, which is frequently targeted for UAC bypass or per. Logsource: windows / process_creation. Rule: title: Registry Modification of MS-settings Protocol Handler id: dd3ee8cc-f751-41c9-ba53-5a32ed47e563 related: - id: 152f3630-77c1-4284-bcc0-4cc68ab2f6e7 type: similar status: test description: 'Detects registry modifications to the ''ms-settings'' protocol handler, which is frequently targeted for UAC bypass or persistence. Attackers can modify this registry to execute malicious code with elevated privileges by hijacking the command execution path. ' references: - https://thedfirreport.com/2021/12/13/diavol-ransomware/ - https://www.trendmicro.com/en_us/research/25/f/water-curse.html author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2021-12-20 modified: 2026-01-24 tags: - attack.privilege-escalation - attack.persistence - attack.defense-impairment - attack.t1548.002 - attack.t1546.001 - attack.t1112 logsource: category: process_creation product: windows detection: selection_reg_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_pwsh_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - powershell.exe - pwsh.dll selection_reg_cli: CommandLine|contains: add selection_pwsh_cli: CommandLine|contains: - New-ItemProperty - Set-ItemProperty - 'ni ' - 'sp ' selection_cli_key: CommandLine|contains: \ms-settings\shell\open\command condition: (all of selection_reg_* or all of selection_pwsh_*) and selection_cli_key falsepositives: - Unknown level: medium
Query: risk of Array index error in LightDM (aka Light Display Manager) 1.14.3, 1.16.x before 1.16.6 when the XDMCP server is enabled allows remote attackers to cause a denial of service (process
Matching passage: CVE-2015-8316. CWE: CWE-129. CVSS: 5.900000095367432. Array index error in LightDM (aka Light Display Manager) 1.14.3, 1.16.x before 1.16.6 when the XDMCP server is enabled allows remote attackers to cause a denial of service (process crash) via an XDMCP request packet with no address.
Near-miss passage: CVE-2015-8366. CWE: CWE-129. CVSS: 9.800000190734863. Array index error in smal_decode_segment function in LibRaw before 0.17.1 allows context-dependent attackers to cause memory errors and possibly execute arbitrary code via vectors related to indexes.
Query: secure coding against Inappropriate Encoding for Output Context
Matching passage: CWE-838 Inappropriate Encoding for Output Context. The product uses or specifies an encoding when generating output to a downstream component, but the specified encoding is not the same as the encoding that is expected by the downstream component.
Near-miss passage: CWE-25 Path Traversal: '/../filedir'. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize /../ sequences that can resolve to a location that is outside of that directory.
Query: risk of Honda Moto LINC 1.6.1 does not verify SSL certificates.
Matching passage: CVE-2015-2943. CWE: CWE-295. CVSS: 5.900000095367432. Honda Moto LINC 1.6.1 does not verify SSL certificates.
Near-miss passage: CVE-2015-2674. CWE: CWE-295. CVSS: 5.900000095367432. Restkit allows man-in-the-middle attackers to spoof TLS servers by leveraging use of the ssl.wrap_socket function in Python with the default CERT_NONE value for the cert_reqs argument.
Query: describe CVE-2015-2326
Matching passage: CVE-2015-2326. CWE: CWE-125. CVSS: 5.5. The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/".
Near-miss passage: CVE-2015-8763. CWE: CWE-125. CVSS: 8.100000381469727. The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to have unspecified impact via a crafted (1) commit or (2) confirm message, which triggers an out-of-bounds read.
Query: detection rule: Detects the creation of the default output filename used by the wmiexec tool
Matching passage: Sigma rule: Detects the creation of the default output filename used by the wmiexec tool. Logsource: windows / file_event. Rule: title: Wmiexec Default Output File id: 8d5aca11-22b3-4f22-b7ba-90e60533e1fb status: test description: Detects the creation of the default output filename used by the wmiexec tool references: - https://www.crowdstrike.com/blog/how-to-detect-and-prevent-impackets-wmiexec/ - https://github.com/fortra/impacket/blob/f4b848fa27654ca95bc0f4c73dbba8b9c2c9f30a/examples/wmiexec.py author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-02 modified: 2023-03-08 tags: - attack.lateral-movement - attack.execution - attack.t1047 logsource: category: file_event product: windows detection: selection: - TargetFilename|re: \\Windows\\__1\d{9}\.\d{1,7}$ - TargetFilename|re: C:\\__1\d{9}\.\d{1,7}$ - TargetFilename|re: D:\\__1\d{9}\.\d{1,7}$ condition: selection falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a. Logsource: windows / process_creation. Rule: title: Elevated System Shell Spawned From Uncommon Parent Location id: 178e615d-e666-498b-9630-9ed363038101 related: - id: 61065c72-5d7d-44ef-bf41-6a36684b545f type: similar status: test description: Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location. references: - https://github.com/Wh04m1001/SysmonEoP author: frack113, Tim Shelton (update fp) date: 2022-12-05 modified: 2025-03-06 tags: - attack.privilege-escalation - attack.execution - attack.t1059 logsource: product: windows category: process_creation detection: selection_shell: - Image|endswith: - \powershell.exe - \powershell_ise.exe - \pwsh.exe - \cmd.exe - OriginalFileName: - PowerShell.EXE - powershell_ise.EXE - pwsh.dll - Cmd.Exe selection_user: User|contains: - AUTHORI - AUTORI LogonId: '0x3e7' filter_main_generic: ParentImage|contains: - :\Program Files (x86)\ - :\Program Files\ - :\ProgramData\ - :\Windows\System32\ - :\Windows\SysWOW64\ - :\Windows\Temp\ - :\Windows\WinSxS\ filter_optional_manageengine: ParentImage|endswith: :\ManageEngine\ADManager Plus\pgsql\bin\postgres.exe Image|endswith: \cmd.exe filter_optional_asgard: CommandLine|contains: :\WINDOWS\system32\cmd.exe /c " CurrentDirectory|contains: :\WINDOWS\Temp\asgard2-agent\ filter_optional_ibm_spectrumprotect: ParentImage|contains: :\IBM\SpectrumProtect\webserver\scripts\ CommandLine|contains: :\IBM\SpectrumProtect\webserver\scripts\ filter_main_parent_null: ParentImage: null filter_main_parent_empty: ParentImage: - '' - '-' condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Some legitimate applications may spawn shells from uncommon parent locations. Apply additional filters and perform an initial baseline before deploying. level: medium
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the integrated web server on the Siemens Climatix BACnet/IP communication module with firmware before 10.34 allows remote attackers to i
Matching passage: CVE-2015-4174. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the integrated web server on the Siemens Climatix BACnet/IP communication module with firmware before 10.34 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-4378. CWE: CWE-79. CVSS: 2.0999999046325684. Cross-site scripting (XSS) vulnerability in the Crumbs module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with the "Administer Crumbs" permission to inject arbitrary web script or HTML via a custom breadcrumb separator.
Query: mitigate Launchctl
Matching passage: T1569.001 Launchctl. Tactics: execution. Description: Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.(Citation: Launchctl Man) Adversaries use launchctl to execute commands and programs as [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s. Common subcommands include: <code>launchctl load</code>,<code>launchctl unload</code>, and <code>launchctl start</code>. Adversaries can use scripts or manually run the commands <code>launchctl load -w "%s/Library/LaunchAgents/%s"</code> or <code>/bin/launchctl load</code> to execute [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s.(Citation: Sofacy Komplex Trojan)(Citation: 20 macOS Common Tools and Techniques)
Near-miss passage: T1569.003 Systemctl. Tactics: execution. Description: Adversaries may abuse systemctl to execute commands or programs. Systemctl is the primary interface for systemd, the Linux init system and service manager. Typically invoked from a shell, Systemctl can also be integrated into scripts or applications. Adversaries may use systemctl to execute commands or programs as [Systemd Service](https://attack.mitre.org/techniques/T1543/002)s. Common subcommands include: `systemctl start`, `systemctl stop`, `systemctl enable`, `systemctl disable`, and `systemctl status`.(Citation: Red Hat Systemctl 2022)
Query: exploit Cross-site scripting (XSS) vulnerabilities in Synology Audio Station 5.1 before 5.1-2550 and 5.4 before 5.4-2857 allows remote authenticated attackers to inject arbitrary web scrip
Matching passage: CVE-2015-9104. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerabilities in Synology Audio Station 5.1 before 5.1-2550 and 5.4 before 5.4-2857 allows remote authenticated attackers to inject arbitrary web script or HTML via the album title.
Near-miss passage: CVE-2015-0703. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the administrative web interface in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCus95857.
Query: detect Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious pare in logs
Matching passage: Sigma rule: Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious pare. Logsource: windows / process_creation. Rule: title: Suspicious WMIC Execution Via Office Process id: e1693bc8-7168-4eab-8718-cdcaa68a1738 related: - id: 438025f9-5856-4663-83f7-52f878a70a50 type: derived - id: 518643ba-7d9c-4fa5-9f37-baed36059f6a type: obsolete - id: 9d1c72f5-43f0-4da5-9320-648cf2099dd0 type: obsolete - id: c0e1c3d5-4381-4f18-8145-2583f06a1fe5 type: obsolete - id: 04f5363a-6bca-42ff-be70-0d28bf629ead type: obsolete status: test description: Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin). references: - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml author: Vadim Khrykov, Cyb3rEng date: 2021-08-23 modified: 2023-02-14 tags: - attack.stealth - attack.t1204.002 - attack.t1047 - attack.t1218.010 - attack.execution logsource: product: windows category: process_creation detection: selection_parent: ParentImage|endswith: - \WINWORD.EXE - \EXCEL.EXE - \POWERPNT.exe - \MSPUB.exe - \VISIO.exe - \MSACCESS.EXE - \EQNEDT32.EXE - \ONENOTE.EXE - \wordpad.exe - \wordview.exe selection_wmic_img: - Image|endswith: \wbem\WMIC.exe - OriginalFileName: wmic.exe selection_wmic_cli: CommandLine|contains|all: - process - create - call CommandLine|contains: - regsvr32 - rundll32 - msiexec - mshta - verclsid - wscript - cscript condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order t. Logsource: linux / process_creation. Rule: title: Access of Sudoers File Content id: 0f79c4d2-4e1f-4683-9c36-b5469a665e06 status: test description: Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order to potentially list all users that have sudo rights. references: - https://github.com/sleventyeleven/linuxprivchecker/ author: Florian Roth (Nextron Systems) date: 2022-06-20 modified: 2025-06-04 tags: - attack.reconnaissance - attack.t1592.004 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /cat - /ed - /egrep - /emacs - /fgrep - /grep - /head - /less - /more - /nano - /tail CommandLine|contains: ' /etc/sudoers' condition: selection falsepositives: - Legitimate administration activities level: medium
Query: vulnerability: ceph-deploy before 1.5.23 uses weak permissions (644) for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file.
Matching passage: CVE-2015-3010. CWE: CWE-200. CVSS: 2.0999999046325684. ceph-deploy before 1.5.23 uses weak permissions (644) for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file.
Near-miss passage: CVE-2015-7731. CWE: CWE-200. CVSS: 5.5. SAP Mobile Platform 3.0 SP05 ClientHub allows attackers to obtain the keystream and other sensitive information via the DataVault, aka SAP Security Note 2094830.