alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects powershell scripts that adds a Name Resolution Policy Table (NRPT) rule for the specified namespace. This will b
Matching passage: Sigma rule: Detects powershell scripts that adds a Name Resolution Policy Table (NRPT) rule for the specified namespace. This will b. Logsource: windows / ps_script. Rule: title: Powershell Add Name Resolution Policy Table Rule id: 4368354e-1797-463c-bc39-a309effbe8d7 status: test description: 'Detects powershell scripts that adds a Name Resolution Policy Table (NRPT) rule for the specified namespace. This will bypass the default DNS server and uses a specified server for answering the query. ' references: - https://twitter.com/NathanMcNulty/status/1569497348841287681 - https://learn.microsoft.com/en-us/powershell/module/dnsclient/add-dnsclientnrptrule?view=windowsserver2022-ps author: Borna Talebi date: 2021-09-14 modified: 2022-10-09 tags: - attack.impact - attack.t1565 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Add-DnsClientNrptRule - -Namesp - -NameSe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious. Logsource: windows / process_creation. Rule: title: Execute From Alternate Data Streams id: 7f43c430-5001-4f8b-aaa9-c3b88f18fa5c status: test description: Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md author: frack113 date: 2021-09-01 modified: 2022-10-09 tags: - attack.stealth - attack.t1564.004 logsource: category: process_creation product: windows detection: selection_stream: CommandLine|contains: 'txt:' selection_tools_type: CommandLine|contains|all: - 'type ' - ' > ' selection_tools_makecab: CommandLine|contains|all: - 'makecab ' - .cab selection_tools_reg: CommandLine|contains|all: - 'reg ' - ' export ' selection_tools_regedit: CommandLine|contains|all: - 'regedit ' - ' /E ' selection_tools_esentutl: CommandLine|contains|all: - 'esentutl ' - ' /y ' - ' /d ' - ' /o ' condition: selection_stream and (1 of selection_tools_*) falsepositives: - Unknown level: medium
Query: detect Detects potential local file read vulnerability in JVM based apps. If the exceptions are caused due to user input and co in logs
Matching passage: Sigma rule: Detects potential local file read vulnerability in JVM based apps. If the exceptions are caused due to user input and co. Logsource: jvm / application. Rule: title: Potential Local File Read Vulnerability In JVM Based Application id: e032f5bc-4563-4096-ae3b-064bab588685 status: test description: 'Detects potential local file read vulnerability in JVM based apps. If the exceptions are caused due to user input and contain path traversal payloads then it''s a red flag. ' references: - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs author: Moti Harmats date: 2023-02-11 tags: - attack.initial-access - attack.t1190 logsource: category: application product: jvm definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)' detection: keywords_local_file_read: '|all': - FileNotFoundException - /../../.. condition: keywords_local_file_read falsepositives: - Application bugs level: high
Near-miss passage: Sigma rule: Detects changes to the PowerShell execution policy in order to bypass signing requirements for script execution. Logsource: windows / registry_set. Rule: title: Potential PowerShell Execution Policy Tampering id: fad91067-08c5-4d1a-8d8c-d96a21b37814 related: - id: cf2e938e-9a3e-4fe8-a347-411642b28a9f type: similar - id: 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180 type: similar - id: 61d0475c-173f-4844-86f7-f3eebae1c66b type: similar status: test description: Detects changes to the PowerShell execution policy in order to bypass signing requirements for script execution references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.3 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-11 modified: 2023-12-14 tags: - attack.defense-impairment logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: - \ShellIds\Microsoft.PowerShell\ExecutionPolicy - \Policies\Microsoft\Windows\PowerShell\ExecutionPolicy Details|contains: - Bypass - Unrestricted filter_main_svchost: Image|contains: - :\Windows\System32\ - :\Windows\SysWOW64\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: describe CVE-2015-0574
Matching passage: CVE-2015-0574. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, the validation of filesystem access was insufficient.
Near-miss passage: CVE-2015-1492. CWE: CWE-20. CVSS: 8.5. Untrusted search path vulnerability in the client in Symantec Endpoint Protection 12.1 before 12.1-RU6-MP1 allows local users to gain privileges via a Trojan horse DLL in a client install package.
Query: common weakness: Improper Adherence to Coding Standards
Matching passage: CWE-710 Improper Adherence to Coding Standards. The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.
Near-miss passage: CWE-526 Cleartext Storage of Sensitive Information in an Environment Variable. The product uses an environment variable to store unencrypted sensitive information.
Query: CWE for Race Condition During Access to Alternate Channel
Matching passage: CWE-421 Race Condition During Access to Alternate Channel. The product opens an alternate channel to communicate with an authorized user, but the channel is accessible to other actors.
Near-miss passage: CWE-432 Dangerous Signal Handler not Disabled During Sensitive Operations. The product uses a signal handler that shares state with other signal handlers, but it does not properly mask or prevent those signal handlers from being invoked while the original signal handler is still running.
Query: CVE similar to CVE-2015-1375
Matching passage: CVE-2015-1375. CWE: CWE-264. CVSS: 7.5. pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload functionality, which allows remote attackers to write to arbitrary files.
Near-miss passage: CVE-2015-0682. CWE: CWE-264. CVSS: 6.5. Cisco Unified Communications Domain Manager 8.1(4) allows remote authenticated users to execute arbitrary code by visiting a "deprecated page," aka Bug ID CSCup90168.
Query: Sigma rule for Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration
Matching passage: Sigma rule: Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration. Logsource: windows / dns-client. Rule: title: DNS Query To Ufile.io - DNS Client id: 090ffaad-c01a-4879-850c-6d57da98452d related: - id: 1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b type: similar status: test description: Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration references: - https://thedfirreport.com/2021/12/13/diavol-ransomware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-16 modified: 2023-09-18 tags: - attack.exfiltration - attack.t1567.002 logsource: product: windows service: dns-client definition: 'Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events.' detection: selection: EventID: 3008 QueryName|contains: ufile.io condition: selection falsepositives: - DNS queries for "ufile" are not malicious by nature necessarily. Investigate the source to determine the necessary actions to take level: low
Near-miss passage: Sigma rule: Detects suspicious Windows Error Reporting manager (wermgr.exe) child process. Logsource: windows / process_creation. Rule: title: Suspicious Child Process Of Wermgr.EXE id: 396f6630-f3ac-44e3-bfc8-1b161bc00c4e related: - id: 5394fcc7-aeb2-43b5-9a09-cac9fc5edcd5 type: similar status: test description: Detects suspicious Windows Error Reporting manager (wermgr.exe) child process references: - https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html - https://www.echotrail.io/insights/search/wermgr.exe - https://github.com/binderlabs/DirCreate2System author: Florian Roth (Nextron Systems) date: 2022-10-14 modified: 2024-08-29 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 - attack.t1036 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \wermgr.exe Image|endswith: - \cmd.exe - \cscript.exe - \ipconfig.exe - \mshta.exe - \net.exe - \net1.exe - \netstat.exe - \nslookup.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \systeminfo.exe - \whoami.exe - \wscript.exe filter_main_rundll32: Image|endswith: \rundll32.exe CommandLine|contains|all: - C:\Windows\system32\WerConCpl.dll - 'LaunchErcApp ' CommandLine|contains: - -queuereporting - -responsepester condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: Outbound C2 pattern associated with Reflective Code Loading
Matching passage: T1620 Reflective Code Loading. Tactics: stealth. Description: Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., [Shared Modules](https://attack.mitre.org/techniques/T1129)). Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode).(Citation: Introducing Donut)(Citation: S1 Custom Shellcode Tool)(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Mandiant BYOL) For example, the `Assembly.Load()` method executed by [PowerShell](https://attack.mitre.org/techniques/T1059/001) may be abused to load raw code into the running process.(Citation: Microsoft AssemblyLoad) Reflective code injection is very similar to [Process Injection](https://attack.mitre.org/techniques/T1055) except that the “injection” loads code into the processes’ own memory instead of that of a separate process. Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process. Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Intezer ACBackdoor)(Citation: S1 Old Rat New Tricks)
Near-miss passage: T1542.005 TFTP Boot. Tactics: stealth, persistence. Description: Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images. Adversaries may manipulate the configuration on the network device specifying use of a malicious TFTP server, which may be used in conjunction with [Modify System Image](https://attack.mitre.org/techniques/T1601) to load a modified image on device startup or reset. The unauthorized image allows adversaries to modify device configuration, add malicious capabilities to the device, and introduce backdoors to maintain control of the network device while minimizing detection through use of a standard functionality. This technique is similar to [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) and may result in the network device running a modified image. (Citation: Cisco Blog Legacy Device Attacks)
Query: exploit IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows local users to obtain sensitive information by reading cached data.
Matching passage: CVE-2015-0170. CWE: CWE-200. CVSS: 2.0999999046325684. IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows local users to obtain sensitive information by reading cached data.
Near-miss passage: CVE-2015-7859. CWE: CWE-200. CVSS: 5.0. The com_contenthistory component in Joomla! 3.2 before 3.4.5 does not properly check ACLs, which allows remote attackers to obtain sensitive information via unspecified vectors.
Query: describe CVE-2015-4366
Matching passage: CVE-2015-4366. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Mover module 6.x-1.0 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-3429. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HTML via a fragment identifier.
Query: vulnerability: NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to conduct replay attacks by sniffing the network.
Matching passage: CVE-2015-7973. CWE: CWE-254. CVSS: 6.5. NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to conduct replay attacks by sniffing the network.
Near-miss passage: CVE-2015-8801. CWE: CWE-254. CVSS: 2.9000000953674316. Race condition in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6 MP5 allows local users to bypass intended restrictions on USB file transfer by conducting filesystem operations before the SEP device manager recognizes a new USB device.
Query: vulnerability: IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to inject arguments via unspecified vectors.
Matching passage: CVE-2015-0169. CWE: CWE-74. CVSS: 4.0. IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to inject arguments via unspecified vectors.
Near-miss passage: CVE-2015-2180. CWE: CWE-74. CVSS: 8.800000190734863. The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the password.
Query: vulnerability: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.
Matching passage: CVE-2015-5559. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.
Near-miss passage: CVE-2015-0112. CWE: UNKNOWN. CVSS: 4.0. Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management (CLM) 3.0.1, 4.x before 4.0.7 IF5, and 5.x before 5.0.2 IF4; Rational Quality Manager (RQM) 2.0 through 2.0.1, 3.0 through 3.0.1.6, 4.0 through 4.0.7, and 5.0 through 5.0.2; Rational Team Concert (RTC) 2.0 through 2.0.0.2, 3.x before 3.0.1.6 IF6, 4.x before 4.0.7 IF5, and 5.x before 5.0.2 IF4; Rational Requirements Composer (RRC) 2.0 through 2.0.0.4, 3.x before 3.0.1.6 IF6, and 4.0 through 4.0.7; Rational DOORS Next Generation (RDNG) 4.x before 4.0.7 IF5 and 5.x before 5.0.2 IF4; Rational Engineering Lifecycle Manager (RELM) 1.0 through 1.0.0.1, 4.0.3 through 4.0.7, and 5.0 through 5.0.2; Rational Rhapsody Design Manager (DM) 3.0 through 3.0.1, 4.0 through 4.0.7, and 5.0 through 5.0.2; and Rational Software Architect Design Manager (RSA DM) 3.0 through 3.0.1, 4.0 through 4.0.7, and 5.0 through 5.0.2 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Query: vulnerability: Services and files in Lenovo Fingerprint Manager before 8.01.42 have incorrect ACLs, which allows local users to invalidate local checks and gain privileges via standard filesystem
Matching passage: CVE-2015-3321. CWE: CWE-264. CVSS: 6.699999809265137. Services and files in Lenovo Fingerprint Manager before 8.01.42 have incorrect ACLs, which allows local users to invalidate local checks and gain privileges via standard filesystem operations.
Near-miss passage: CVE-2015-8214. CWE: CWE-264. CVSS: 9.699999809265137. A vulnerability has been identified in SIMATIC NET CP 342-5 (incl. SIPLUS variants) (All versions), SIMATIC NET CP 343-1 Advanced (incl. SIPLUS variants) (All versions < V3.0.44), SIMATIC NET CP 343-1 Lean (incl. SIPLUS variants) (All versions < V3.1.1), SIMATIC NET CP 343-1 Standard (incl. SIPLUS variants) (All versions < V3.1.1), SIMATIC NET CP 443-1 Advanced (incl. SIPLUS variants) (All versions < V3.2.9), SIMATIC NET CP 443-1 Standard (incl. SIPLUS variants) (All versions < V3.2.9), SIMATIC NET CP 443-5 Basic (incl. SIPLUS variants) (All versions), SIMATIC NET CP 443-5 Extended (All versions), TIM 3V-IE / TIM 3V-IE Advanced (incl. SIPLUS NET variants) (All versions < V2.6.0), TIM 3V-IE DNP3 (incl. SIPLUS NET variants) (All versions < V3.1.0), TIM 4R-IE (incl. SIPLUS NET variants) (All versions < V2.6.0), TIM 4R-IE DNP3 (incl. SIPLUS NET variants) (All versions < V3.1.0). The implemented access protection level enforcement of the affected communication processors (CP) could possibly allow unauthenticated users to perform administrative operations on the CPs if network access (port 102/TCP) is available and the CPs' configuration was stored on their corresponding CPUs.
Query: threat report mentioning Pluggable Authentication Modules
Matching passage: T1556.003 Pluggable Authentication Modules. Tactics: defense impairment, persistence, credential access. Description: Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is <code>pam_unix.so</code>, which retrieves, sets, and verifies account authentication information in <code>/etc/passwd</code> and <code>/etc/shadow</code>.(Citation: Apple PAM)(Citation: Man Pam_Unix)(Citation: Red Hat PAM) Adversaries may modify components of the PAM system to create backdoors. PAM components, such as <code>pam_unix.so</code>, can be patched to accept arbitrary adversary supplied values as legitimate credentials.(Citation: PAM Backdoor) Malicious modifications to the PAM system may also be abused to steal credentials. Adversaries may infect PAM resources with code to harvest user credentials, since the values exchanged with PAM components may be plain-text since PAM does not store passwords.(Citation: PAM Creds)(Citation: Apple PAM)
Near-miss passage: T1556.004 Network Device Authentication. Tactics: defense impairment, persistence, credential access. Description: Adversaries may use [Patch System Image](https://attack.mitre.org/techniques/T1601/001) to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices. [Modify System Image](https://attack.mitre.org/techniques/T1601) may include implanted code to the operating system for network devices to provide access for adversaries using a specific password. The modification includes a specific password which is implanted in the operating system image via the patch. Upon authentication attempts, the inserted code will first check to see if the user input is the password. If so, access is granted. Otherwise, the implanted code will pass the credentials on for verification of potentially valid credentials.(Citation: Mandiant - Synful Knock)
Query: exploit Cross-site scripting (XSS) vulnerability in the googleSearch (CSE) (com_googlesearch_cse) component 3.0.2 for Joomla! allows remote attackers to inject arbitrary web script or HTML
Matching passage: CVE-2015-6919. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the googleSearch (CSE) (com_googlesearch_cse) component 3.0.2 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the q parameter to index.php.
Near-miss passage: CVE-2015-9251. CWE: CWE-79. CVSS: 6.099999904632568. jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
Query: patch priority for CVE-2015-0616
Matching passage: CVE-2015-0616. CWE: CWE-19. CVSS: 7.099999904632568. The Connection Conversation Manager (aka CuCsMgr) process in Cisco Unity Connection 8.5 before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, and 9.x before 9.1(2)SU2, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (core dump and restart) by improperly terminating SIP TCP connections, aka Bug ID CSCul69819.
Near-miss passage: CVE-2015-8772. CWE: CWE-19. CVSS: 9.100000381469727. McPvDrv.sys 4.6.111.0 in McAfee File Lock 5.x in McAfee Total Protection allows local users to obtain sensitive information from kernel memory or cause a denial of service (system crash) via a large VERIFY_INFORMATION.Length value in an IOCTL_DISK_VERIFY ioctl call.