alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects enabling TurnOffCheck which can be used to bypass defense of MSDT Follina vulnerability
Matching passage: Sigma rule: Detects enabling TurnOffCheck which can be used to bypass defense of MSDT Follina vulnerability. Logsource: windows / registry_set. Rule: title: Scripted Diagnostics Turn Off Check Enabled - Registry id: 7d995e63-ec83-4aa3-89d5-8a17b5c87c86 status: test description: Detects enabling TurnOffCheck which can be used to bypass defense of MSDT Follina vulnerability references: - https://twitter.com/wdormann/status/1537075968568877057?s=20&t=0lr18OAnmAGoGpma6grLUw author: Christopher Peacock @securepeacock, SCYTHE @scythe_io date: 2022-06-15 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: \Policies\Microsoft\Windows\ScriptedDiagnostics\TurnOffCheck Details: DWORD (0x00000001) condition: selection falsepositives: - Administrator actions level: medium
Near-miss passage: Sigma rule: Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-. Logsource: windows / process_creation. Rule: title: MMC Executing Files with Reversed Extensions Using RTLO Abuse id: 9cfe4b27-1e56-48b4-b7a8-d46851c91a44 status: experimental description: Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-Left Override (RLO) abuse, disguising them as document formats. references: - https://www.unicode.org/versions/Unicode5.2.0/ch02.pdf - https://en.wikipedia.org/wiki/Right-to-left_override - https://tria.ge/241015-l98snsyeje/behavioral2 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-05 tags: - attack.execution - attack.stealth - attack.t1204.002 - attack.t1218.014 - attack.t1036.002 logsource: category: process_creation product: windows detection: selection_image: - Image|endswith: \mmc.exe - OriginalFileName: MMC.exe selection_commandline: CommandLine|contains: - cod.msc - fdp.msc - ftr.msc - lmth.msc - slx.msc - tdo.msc - xcod.msc - xslx.msc - xtpp.msc condition: all of selection_* falsepositives: - Legitimate administrative actions using MMC to execute misnamed `.msc` files. - Unconventional but non-malicious usage of RLO or reversed extensions. level: high
Query: vulnerability: The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and 
Matching passage: CVE-2015-6174. CWE: CWE-264. CVSS: 7.199999809265137. The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-6171 and CVE-2015-6173.
Near-miss passage: CVE-2015-2512. CWE: CWE-264. CVSS: 7.199999809265137. The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Font Driver Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2507.
Query: vulnerability: XML external entity (XXE) vulnerability in the create-job CLI command in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to read arbitrary files via a crafted j
Matching passage: CVE-2015-5319. CWE: UNKNOWN. CVSS: 5.0. XML external entity (XXE) vulnerability in the create-job CLI command in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to read arbitrary files via a crafted job configuration that is then used in an "XML-aware tool," as demonstrated by get-job and update-job.
Near-miss passage: CVE-2015-1122. CWE: UNKNOWN. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE-SA-2015-04-08-4.
Query: rule covering Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.
Matching passage: Sigma rule: Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.. Logsource: rpc_firewall / application. Rule: title: SharpHound Recon Account Discovery id: 65f77b1e-8e79-45bf-bb67-5988a8ce45a5 status: test description: Detects remote RPC calls useb by SharpHound to map remote connections and local group membership. references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wkst/55118c55-2122-4ef9-8664-0c1ff9e168f3 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-WKST.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.t1087 - attack.discovery logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:6bffd098-a112-3610-9833-46c3f87e345a opnum:2' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 6bffd098-a112-3610-9833-46c3f87e345a OpNum: 2 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious command with /dev/tcp. Logsource: linux. Rule: title: Suspicious Use of /dev/tcp id: 6cc5fceb-9a71-4c23-aeeb-963abe0b279c status: test description: Detects suspicious command with /dev/tcp references: - https://www.andreafortuna.org/2021/03/06/some-useful-tips-about-dev-tcp/ - https://book.hacktricks.xyz/shells/shells/linux - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-1---port-scan author: frack113 date: 2021-12-10 modified: 2023-01-06 tags: - attack.reconnaissance logsource: product: linux detection: keywords: - cat </dev/tcp/ - exec 3<>/dev/tcp/ - echo >/dev/tcp/ - bash -i >& /dev/tcp/ - sh -i >& /dev/udp/ - 0<&196;exec 196<>/dev/tcp/ - exec 5<>/dev/tcp/ - (sh)0>/dev/tcp/ - bash -c 'bash -i >& /dev/tcp/ - echo -e '#!/bin/bash\nbash -i >& /dev/tcp/ condition: keywords falsepositives: - Unknown level: medium
Query: Sigma rule for Detects the execution of an AnyDesk binary with a version prior to 8.0.8. Prior to version 8.0.8, the Anydesk applicatio
Matching passage: Sigma rule: Detects the execution of an AnyDesk binary with a version prior to 8.0.8. Prior to version 8.0.8, the Anydesk applicatio. Logsource: windows / process_creation. Rule: title: Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate id: 41f407b5-3096-44ea-a74f-96d04fbc41be status: test description: 'Detects the execution of an AnyDesk binary with a version prior to 8.0.8. Prior to version 8.0.8, the Anydesk application used a signing certificate that got compromised by threat actors. Use this rule to detect instances of older versions of Anydesk using the compromised certificate This is recommended in order to avoid attackers leveraging the certificate and signing their binaries to bypass detections. ' references: - https://www.bleepingcomputer.com/news/security/anydesk-says-hackers-breached-its-production-servers-reset-passwords/ - https://anydesk.com/en/changelog/windows author: Sai Prashanth Pulisetti, Nasreddine Bencherchali (Nextron Systems) date: 2024-02-08 tags: - attack.execution - attack.initial-access logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \AnyDesk.exe - Description: AnyDesk - Product: AnyDesk - Company: AnyDesk Software GmbH selection_version: FileVersion|startswith: - 7.0. - 7.1. - 8.0.1 - 8.0.2 - 8.0.3 - 8.0.4 - 8.0.5 - 8.0.6 - 8.0.7 filter_main_uninstall: CommandLine|contains: - ' --remove' - ' --uninstall' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Detects when a user is removed from a privileged role. Bulk changes should be investigated.. Logsource: azure / auditlogs. Rule: title: Bulk Deletion Changes To Privileged Account Permissions id: 102e11e3-2db5-4c9e-bc26-357d42585d21 status: test description: Detects when a user is removed from a privileged role. Bulk changes should be investigated. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H' date: 2022-08-05 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: azure service: auditlogs detection: selection: properties.message: - Remove eligible member (permanent) - Remove eligible member (eligible) condition: selection falsepositives: - Legtimate administrator actions of removing members from a role level: high
Query: Outbound C2 pattern associated with System Owner/User Discovery
Matching passage: T1033 System Owner/User Discovery. Tactics: discovery. Description: Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Various utilities and commands may acquire this information, including <code>whoami</code>. In macOS and Linux, the currently logged in user can be identified with <code>w</code> and <code>who</code>. On macOS the <code>dscl . list /Users | grep -v '_'</code> command can also be used to enumerate user accounts. Environment variables, such as <code>%USERNAME%</code> and <code>$USER</code>, may also be used to access this information. On network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show users` and `show ssh` can be used to display users currently logged into the device.(Citation: show_ssh_users_cmd_cisco)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)
Near-miss passage: T1613 Container and Resource Discovery. Tactics: discovery. Description: Adversaries may attempt to discover containers and other resources that are available within a containers environment. Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster. These resources can be viewed within web applications such as the Kubernetes dashboard or can be queried via the Docker and Kubernetes APIs.(Citation: Docker API)(Citation: Kubernetes API) In Docker, logs may leak information about the environment, such as the environment’s configuration, which services are available, and what cloud provider the victim may be utilizing. The discovery of these resources may inform an adversary’s next steps in the environment, such as how to perform lateral movement and which methods to utilize for execution.
Query: rule covering Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like
Matching passage: Sigma rule: Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like. Logsource: windows / security. Rule: title: RottenPotato Like Attack Pattern id: 16f5d8ca-44bd-47c8-acbe-6fc95a16c12f status: test description: Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like references: - https://twitter.com/SBousseaden/status/1195284233729777665 author: '@SBousseaden, Florian Roth' date: 2019-11-15 modified: 2022-12-22 tags: - attack.collection - attack.privilege-escalation - attack.credential-access - attack.t1557.001 logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 3 TargetUserName: ANONYMOUS LOGON WorkstationName: '-' IpAddress: - 127.0.0.1 - ::1 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious parent processes that should not have any children or should only have a single possible child progra. Logsource: windows / process_creation. Rule: title: Suspicious Process Parents id: cbec226f-63d9-4eca-9f52-dfb6652f24df status: test description: Detects suspicious parent processes that should not have any children or should only have a single possible child program references: - https://twitter.com/x86matthew/status/1505476263464607744?s=12 - https://svch0st.medium.com/stats-from-hunting-cobalt-strike-beacons-c17e56255f9b author: Florian Roth (Nextron Systems) date: 2022-03-21 modified: 2022-09-08 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \minesweeper.exe - \winver.exe - \bitsadmin.exe selection_special: ParentImage|endswith: - \csrss.exe - \certutil.exe - \eventvwr.exe - \calc.exe - \notepad.exe filter_special: Image|endswith: - \WerFault.exe - \wermgr.exe - \conhost.exe - \mmc.exe - \win32calc.exe - \notepad.exe filter_null: Image: null condition: selection or ( selection_special and not 1 of filter_* ) falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-3172
Matching passage: CVE-2015-3172. CWE: CWE-79. CVSS: 5.400000095367432. EidoGo is susceptible to Cross-Site Scripting (XSS) attacks via maliciously crafted SGF input.
Near-miss passage: CVE-2015-4671. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in OpenCart before 2.1.0.2 allows remote attackers to inject arbitrary web script or HTML via the zone_id parameter to index.php.
Query: patch priority for CVE-2015-3013
Matching passage: CVE-2015-3013. CWE: CWE-74. CVSS: 6.0. ownCloud Server before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allows remote authenticated users to bypass the file blacklist and upload arbitrary files via a file path with UTF-8 encoding, as demonstrated by uploading a .htaccess file.
Near-miss passage: CVE-2015-8258. CWE: CWE-74. CVSS: 7.5. AXIS Communications products with firmware through 5.80.x allow remote attackers to modify arbitrary files as root via vectors involving Open Script Editor, aka a "resource injection vulnerability."
Query: Sigma rule for Detects registry key established after masqueraded .scr file execution using Rundll32 through desk.cpl
Matching passage: Sigma rule: Detects registry key established after masqueraded .scr file execution using Rundll32 through desk.cpl. Logsource: windows / registry_set. Rule: title: ScreenSaver Registry Key Set id: 40b6e656-4e11-4c0c-8772-c1cc6dae34ce status: test description: Detects registry key established after masqueraded .scr file execution using Rundll32 through desk.cpl references: - https://twitter.com/VakninHai/status/1517027824984547329 - https://twitter.com/pabraeken/status/998627081360695297 - https://jstnk9.github.io/jstnk9/research/InstallScreenSaver-SCR-files author: Jose Luis Sanchez Martinez (@Joseliyo_Jstnk) date: 2022-05-04 modified: 2023-08-17 tags: - attack.stealth - attack.t1218.011 logsource: product: windows category: registry_set detection: selection: Image|endswith: \rundll32.exe registry: TargetObject|contains: \Control Panel\Desktop\SCRNSAVE.EXE Details|endswith: .scr filter: Details|contains: - C:\Windows\System32\ - C:\Windows\SysWOW64\ condition: selection and registry and not filter falsepositives: - Legitimate use of screen saver level: medium
Near-miss passage: Sigma rule: detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is us. Logsource: zeek / smb_files. Rule: title: Suspicious PsExec Execution - Zeek id: f1b3a22a-45e6-4004-afb5-4291f9c21166 related: - id: c462f537-a1e3-41a6-b5fc-b2c2cef9bf82 type: derived status: test description: detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one references: - https://web.archive.org/web/20230329171218/https://blog.menasec.net/2019/02/threat-hunting-3-detecting-psexec.html author: Samir Bousseaden, @neu5ron, Tim Shelton date: 2020-04-02 modified: 2022-12-27 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: zeek service: smb_files detection: selection: path|contains|all: - \\ - \IPC$ name|endswith: - -stdin - -stdout - -stderr filter: name|startswith: PSEXESVC condition: selection and not filter falsepositives: - Unknown level: high
Query: risk of The smka_decode_frame function in libavcodec/smacker.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not verify that the data size is consistent with the
Matching passage: CVE-2015-8365. CWE: CWE-119. CVSS: 6.800000190734863. The smka_decode_frame function in libavcodec/smacker.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not verify that the data size is consistent with the number of channels, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Smacker data.
Near-miss passage: CVE-2015-7909. CWE: CWE-119. CVSS: 7.300000190734863. Stack-based buffer overflow in Hospira Communication Engine (CE) before 1.2 in LifeCare PCA Infusion System 5.07, Plum A+ Infusion System 13.40, and Plum A+3 Infusion System 13.40 allows remote attackers to cause a denial of service or possibly have unspecified other impact via traffic on TCP port 5000.
Query: risk of Microsoft System Center Virtual Machine Manager (VMM) 2012 R2 Update Rollup 4 does not properly validate the roles of users, which allows local users to obtain server and virtual-m
Matching passage: CVE-2015-0012. CWE: CWE-264. CVSS: 6.900000095367432. Microsoft System Center Virtual Machine Manager (VMM) 2012 R2 Update Rollup 4 does not properly validate the roles of users, which allows local users to obtain server and virtual-machine administrative privileges by establishing a server session with Active Directory credentials, aka "Virtual Machine Manager Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-5244. CWE: CWE-264. CVSS: 9.800000190734863. The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions.
Query: vulnerability: AppNav in Cisco IOS XE 3.8 through 3.10 before 3.10.3S, 3.11 before 3.11.3S, 3.12 before 3.12.1S, 3.13 before 3.13.0S, 3.14 before 3.14.0S, and 3.15 before 3.15.0S allows remote at
Matching passage: CVE-2015-0644. CWE: CWE-20. CVSS: 7.800000190734863. AppNav in Cisco IOS XE 3.8 through 3.10 before 3.10.3S, 3.11 before 3.11.3S, 3.12 before 3.12.1S, 3.13 before 3.13.0S, 3.14 before 3.14.0S, and 3.15 before 3.15.0S allows remote attackers to execute arbitrary code or cause a denial of service (device reload) via a crafted TCP packet, aka Bug ID CSCuo53622.
Near-miss passage: CVE-2015-0754. CWE: CWE-20. CVSS: 7.5. Cisco Finesse 10.5(1) allows remote authenticated users to obtain sensitive information or cause a denial of service (CPU and memory consumption) via a crafted XML document, aka Bug ID CSCut95810.
Query: CVE similar to CVE-2015-0922
Matching passage: CVE-2015-0922. CWE: CWE-200. CVSS: 5.0. McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password.
Near-miss passage: CVE-2015-7946. CWE: CWE-200. CVSS: 4.599999904632568. Information Exposure vulnerability in Unity8 as used on the Ubuntu phone and possibly also in Unity8 shipped elsewhere. This allows an attacker to enable the MTP service by opening the emergency dialer. Fixed in 8.11+16.04.20160111.1-0ubuntu1 and 8.11+15.04.20160122-0ubuntu1.
Query: explain CWE-756
Matching passage: CWE-756 Missing Custom Error Page. The product does not return custom error pages to the user, possibly exposing sensitive information.
Near-miss passage: CWE-839 Numeric Range Comparison Without Minimum Check. The product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum.
Query: patch priority for CVE-2015-6727
Matching passage: CVE-2015-6727. CWE: CWE-200. CVSS: 5.0. The Special:DeletedContributions page in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to determine if an IP is autoblocked via the "Change block" text.
Near-miss passage: CVE-2015-1600. CWE: CWE-200. CVSS: 7.5. Information disclosure vulnerability in Netatmo Indoor Module firmware 100 and earlier.
Query: vulnerability: Unspecified vulnerability in HP LoadRunner Controller before 12.50 allows local users to gain privileges via unknown vectors, aka ZDI-CAN-2756.
Matching passage: CVE-2015-5426. CWE: UNKNOWN. CVSS: 4.599999904632568. Unspecified vulnerability in HP LoadRunner Controller before 12.50 allows local users to gain privileges via unknown vectors, aka ZDI-CAN-2756.
Near-miss passage: CVE-2015-2346. CWE: UNKNOWN. CVSS: 4.0. XML external entity (XXE) vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote authenticated users to read arbitrary files via the req parameter.