alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to
Matching passage: Sigma rule: Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to. Logsource: windows / registry_set. Rule: title: DHCP Callout DLL Installation id: 9d3436ef-9476-4c43-acca-90ce06bdf33a status: test description: Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required) references: - https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html - https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx - https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx author: Dimitrios Slamaris date: 2017-05-15 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.defense-impairment - attack.t1574.001 - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: - \Services\DHCPServer\Parameters\CalloutDlls - \Services\DHCPServer\Parameters\CalloutEnabled condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application. This can be. Logsource: windows / file_access. Rule: title: Access To Windows DPAPI Master Keys By Uncommon Applications id: 46612ae6-86be-4802-bc07-39b59feb1309 status: test description: 'Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::masterkey" function ' references: - http://blog.harmj0y.net/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/ - https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-17 modified: 2026-07-28 tags: - attack.credential-access - attack.t1555.004 logsource: category: file_access product: windows definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider' detection: selection: FileName|contains: - \Microsoft\Protect\S-1-5-18\ - \Microsoft\Protect\S-1-5-21- filter_main_system_folders: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ - C:\Windows\system32\ - C:\Windows\SysWOW64\ filter_main_explorer: Image: C:\Windows\explorer.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: risk of The decode_uncompressed function in libavcodec/faxcompr.c in FFmpeg before 2.8.2 does not validate uncompressed runs, which allows remote attackers to cause a denial of service (ou
Matching passage: CVE-2015-8218. CWE: CWE-20. CVSS: 6.800000190734863. The decode_uncompressed function in libavcodec/faxcompr.c in FFmpeg before 2.8.2 does not validate uncompressed runs, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted CCITT FAX data.
Near-miss passage: CVE-2015-6824. CWE: CWE-20. CVSS: 7.5. The sws_init_context function in libswscale/utils.c in FFmpeg before 2.7.2 does not initialize certain pixbuf data structures, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted video data.
Query: vulnerability: IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to bypass intended access restrictions and
Matching passage: CVE-2015-1984. CWE: CWE-200. CVSS: 4.0. IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to bypass intended access restrictions and read arbitrary profiles via unspecified vectors, as demonstrated by discovering usernames for use in brute-force attacks.
Near-miss passage: CVE-2015-9194. CWE: CWE-200. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 425, SD 427, SD 430, SD 435, SD 450, SD 617, SD 625, SD 650/52, SD 800, SD 845, and Snapdragon_High_Med_2016, during module load at TZ Startup, memory statically allocated by modules was not being properly set to zero first. Allowing the module to execute without reset gives it access to information from previous app thus leading to information exposure.
Query: CVE similar to CVE-2015-4778
Matching passage: CVE-2015-4778. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790.
Near-miss passage: CVE-2015-6787. CWE: UNKNOWN. CVSS: 10.0. Multiple unspecified vulnerabilities in Google Chrome before 47.0.2526.73 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Query: alert when Detects activity when The Windows Defender Firewall service failed to load Group Policy
Matching passage: Sigma rule: Detects activity when The Windows Defender Firewall service failed to load Group Policy. Logsource: windows / firewall-as. Rule: title: The Windows Defender Firewall Service Failed To Load Group Policy id: 7ec15688-fd24-4177-ba43-1a950537ee39 status: test description: Detects activity when The Windows Defender Firewall service failed to load Group Policy references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10) author: frack113 date: 2022-02-19 modified: 2023-01-17 tags: - attack.defense-impairment - attack.t1686.003 logsource: product: windows service: firewall-as detection: selection: EventID: 2009 condition: selection level: low
Near-miss passage: Sigma rule: This rule detects a suspicious crash of the Microsoft Malware Protection Engine. Logsource: windows / application. Rule: title: Microsoft Malware Protection Engine Crash - WER id: 6c82cf5c-090d-4d57-9188-533577631108 status: test description: This rule detects a suspicious crash of the Microsoft Malware Protection Engine references: - https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5 - https://technet.microsoft.com/en-us/library/security/4022344 author: Florian Roth (Nextron Systems) date: 2017-05-09 modified: 2023-04-14 tags: - attack.stealth - attack.defense-impairment - attack.t1211 - attack.t1685 logsource: product: windows service: application detection: selection: Provider_Name: Windows Error Reporting EventID: 1001 Data|contains|all: - MsMpEng.exe - mpengine.dll condition: selection falsepositives: - MsMpEng might crash if the "C:\" partition is full level: high
Query: secure coding against Reusing a Nonce, Key Pair in Encryption
Matching passage: CWE-323 Reusing a Nonce, Key Pair in Encryption. Nonces should be used for the present occasion and only once.
Near-miss passage: CWE-491 Public cloneable() Method Without Final ('Object Hijack'). A class has a cloneable() method that is not declared final, which allows an object to be created without calling the constructor. This can cause the object to be in an unexpected state.
Query: describe CVE-2015-3346
Matching passage: CVE-2015-3346. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the WikiWiki module before 6.x-1.2 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-6319. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in the web-based management interface on Cisco RV220W devices allows remote attackers to execute arbitrary SQL commands via a crafted header in an HTTP request, aka Bug ID CSCuv29574.
Query: patch priority for CVE-2015-1517
Matching passage: CVE-2015-1517. CWE: CWE-89. CVSS: 6.0. SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users to execute arbitrary SQL commands via the filter_level parameter in a "Refresh photo set" action in the batch_manager page to admin.php.
Near-miss passage: CVE-2015-1560. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the isUserAdmin function in include/common/common-Func.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in Centreon web 2.7.0) allows remote attackers to execute arbitrary SQL commands via the sid parameter to include/common/XmlTree/GetXmlTree.php.
Query: CVE similar to CVE-2015-5537
Matching passage: CVE-2015-5537. CWE: CWE-312. CVSS: 4.300000190734863. The SSL layer of the HTTPS service in Siemens RuggedCom ROS before 4.2.0 and ROX II does not properly implement CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a different vulnerability than CVE-2014-3566.
Near-miss passage: CVE-2015-1931. CWE: CWE-312. CVSS: 5.5. IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR1 FP10, 7 R1 before SR3 FP10, 7 before SR9 FP10, 6 R1 before SR8 FP7, 6 before SR16 FP7, and 5.0 before SR16 FP13 stores plaintext information in memory dumps, which allows local users to obtain sensitive information by reading a file.
Query: alert when Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into
Matching passage: Sigma rule: Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into. Logsource: windows / registry_set. Rule: title: Uncommon Extension In Keyboard Layout IME File Registry Value id: b888e3f2-224d-4435-b00b-9dd66e9ea1f1 related: - id: 9d8f9bb8-01af-4e15-a3a2-349071530530 type: derived status: test description: 'Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message. Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path. IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean. ' references: - https://www.linkedin.com/pulse/guntior-story-advanced-bootkit-doesnt-rely-windows-disk-baranov-wue8e/ author: X__Junior (Nextron Systems) date: 2023-11-21 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_set detection: selection: TargetObject|contains|all: - \Control\Keyboard Layouts\ - Ime File filter_main_known_extension: Details|endswith: .ime condition: selection and not 1 of filter_main_* falsepositives: - IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean. level: high
Near-miss passage: Sigma rule: Detects suspicious process command line that starts with a shell that executes something and finally gets piped into ano. Logsource: linux / process_creation. Rule: title: Linux Shell Pipe to Shell id: 880973f3-9708-491c-a77b-2a35a1921158 status: test description: Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell references: - Internal Research author: Florian Roth (Nextron Systems) date: 2022-03-14 modified: 2022-07-26 tags: - attack.stealth - attack.t1140 logsource: product: linux category: process_creation detection: selection: CommandLine|startswith: - 'sh -c ' - 'bash -c ' selection_exec: - CommandLine|contains: - '| bash ' - '| sh ' - '|bash ' - '|sh ' - CommandLine|endswith: - '| bash' - '| sh' - '|bash' - ' |sh' condition: all of selection* falsepositives: - Legitimate software that uses these patterns level: medium
Query: exploit Microsoft Internet Explorer 8 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site
Matching passage: CVE-2015-6151. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6083.
Near-miss passage: CVE-2015-9174. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 410/12, SD 617, SD 650/52, SD 800, SD 808, and SD 810, lack of validation of the return value prior to using for buffer allocation in QSEE application, TQS, may result in memory overwrite.
Query: rule covering Detects the addition of a new user to a privileged group such as "root" or "sudo"
Matching passage: Sigma rule: Detects the addition of a new user to a privileged group such as "root" or "sudo". Logsource: linux. Rule: title: Privileged User Has Been Created id: 0ac15ec3-d24f-4246-aa2a-3077bb1cf90e status: test description: Detects the addition of a new user to a privileged group such as "root" or "sudo" references: - https://digital.nhs.uk/cyber-alerts/2018/cc-2825 - https://linux.die.net/man/8/useradd - https://github.com/redcanaryco/atomic-red-team/blob/25acadc0b43a07125a8a5b599b28bbc1a91ffb06/atomics/T1136.001/T1136.001.md#atomic-test-5---create-a-new-user-in-linux-with-root-uid-and-gid author: Pawel Mazur date: 2022-12-21 modified: 2025-01-21 tags: - attack.privilege-escalation - attack.persistence - attack.t1136.001 - attack.t1098 logsource: product: linux definition: /var/log/secure on REHL systems or /var/log/auth.log on debian like Systems needs to be collected in order for this detection to work detection: selection_new_user: - new user selection_uids_gids: - GID=0, - UID=0, - GID=10, - GID=27, condition: all of selection_* falsepositives: - Administrative activity level: high
Near-miss passage: Sigma rule: Detects potential persistence activity via the registering of a new custom protocole handlers. While legitimate applicat. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Custom Protocol Handler id: fdbf0b9d-0182-4c43-893b-a1eaab92d085 status: test description: Detects potential persistence activity via the registering of a new custom protocole handlers. While legitimate applications register protocole handlers often times during installation. And attacker can abuse this by setting a custom handler to be used as a persistence mechanism. references: - https://ladydebug.com/blog/2019/06/21/custom-protocol-handler-cph/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-05-30 modified: 2023-05-12 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|startswith: HKCR\ Details|startswith: 'URL:' filter_main_ms_trusted: Details|startswith: URL:ms- filter_main_generic_locations: Image|startswith: - C:\Program Files (x86) - C:\Program Files\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ condition: selection and not 1 of filter_main_* falsepositives: - Many legitimate applications can register a new custom protocol handler. Additional filters needs to applied according to your environment. level: medium
Query: detection engineering for Cloud Firewall
Matching passage: T1686.001 Cloud Firewall. Tactics: defense impairment. Description: Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols. An adversary with appropriate permissions may introduce new firewall rules or policies to allow access into a victim cloud environment and/or move laterally from the cloud control plane to the data plane. For example, an adversary may use a script or utility that creates new ingress rules in existing security groups (or creates new security groups entirely) to allow any TCP/IP connectivity to a cloud-hosted instance. They may also remove networking limitations to support traffic associated with malicious activity (such as cryptomining).(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022)(Citation: Expel AWS)
Near-miss passage: T1686 Disable or Modify System Firewall. Tactics: defense impairment. Description: Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gathered sufficient privileges, they can tamper with firewall services, policies, or rule sets to remove restrictions on inbound or outbound traffic. For example, this may include turning off firewall profiles, altering existing rules to permit previously blocked ports or protocols, or adding new rules that create covert communication paths (e.g., adding a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port.(Citation: change_rdp_port_conti) Adversaries may disable or modify firewalls using different behaviors, depending on the platform. For example, in ESXi, firewall rules may be modified directly via the esxcli (e.g., via esxcli network firewall set) or via the vCenter user interface.(Citation: Broadcom ESXi Firewall)(Citation: Trellix Rnasomhouse 2024)
Query: vulnerability: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Ex
Matching passage: CVE-2015-0042. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0038 and CVE-2015-0046.
Near-miss passage: CVE-2015-0643. CWE: CWE-399. CVSS: 7.800000190734863. Cisco IOS 12.2, 12.4, 15.0, 15.1, 15.2, 15.3, and 15.4 and IOS XE 2.5.x, 2.6.x, 3.1.xS through 3.12.xS before 3.12.3S, 3.2.xE through 3.7.xE before 3.7.1E, 3.3.xSG, 3.4.xSG, and 3.13.xS before 3.13.2S allow remote attackers to cause a denial of service (memory consumption and device reload) by sending malformed IKEv2 packets over (1) IPv4 or (2) IPv6, aka Bug ID CSCuo75572.
Query: risk of Cross-site scripting (XSS) vulnerability in usersettings.php in e107 2.0.0 allows remote attackers to inject arbitrary web script or HTML via the "Real Name" value.
Matching passage: CVE-2015-1057. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in usersettings.php in e107 2.0.0 allows remote attackers to inject arbitrary web script or HTML via the "Real Name" value.
Near-miss passage: CVE-2015-2941. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error message, related to unsafe calls to wddx_serialize_value.
Query: risk of A vulnerability was found in Video Playlist and Gallery Plugin up to 1.136 on WordPress. It has been rated as problematic. Affected by this issue is some unknown functionality of t
Matching passage: CVE-2015-10109. CWE: CWE-352. CVSS: 8.800000190734863. A vulnerability was found in Video Playlist and Gallery Plugin up to 1.136 on WordPress. It has been rated as problematic. Affected by this issue is some unknown functionality of the file wp-media-cincopa.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. Upgrading to version 1.137 is able to address this issue. The name of the patch is ee28e91f4d5404905204c43b7b84a8ffecad932e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230264.
Near-miss passage: CVE-2015-5731. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in wp-admin/post.php in WordPress before 4.2.4 allows remote attackers to hijack the authentication of administrators for requests that lock a post, and consequently cause a denial of service (editing blockage), via a get-post-lock action.
Query: Persistence mechanism resembling Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
Matching passage: T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Asymmetric encryption algorithms are those that use different keys on each end of the channel. Also known as public-key cryptography, this requires pairs of cryptographic keys that can encrypt/decrypt data from the corresponding key. Each end of the communication channels requires a private key (only in the procession of that entity) and the public key of the other entity. The public keys of each entity are exchanged before encrypted communications begin. Network protocols that use asymmetric encryption (such as HTTPS/TLS/SSL) often utilize symmetric encryption once keys are exchanged. Adversaries may opt to use these encrypted mechanisms that are baked into a protocol.
Near-miss passage: T1048 Exfiltration Over Alternative Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and/or obfuscate these alternate channels. [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048) can be done using various common operating system utilities such as [Net](https://attack.mitre.org/software/S0039)/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016) On macOS and Linux <code>curl</code> may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.(Citation: 20 macOS Common Tools and Techniques) Many IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or [Cloud API](https://attack.mitre.org/techniques/T1059/009).