alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution
Matching passage: Sigma rule: One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution. Logsource: windows / security. Rule: title: Security Eventlog Cleared id: d99b79d2-0a6f-4f46-ad8b-260b6e17f982 related: - id: f2f01843-e7b8-4f95-a35a-d23584476423 type: obsolete - id: a122ac13-daf8-4175-83a2-72c387be339d type: obsolete status: test description: One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution references: - https://twitter.com/deviouspolack/status/832535435960209408 - https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100 - https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/SecurityEvent/SecurityEventLogCleared.yaml author: Florian Roth (Nextron Systems) date: 2017-01-10 modified: 2022-02-24 tags: - attack.defense-impairment - attack.t1685.005 - car.2016-04-002 logsource: product: windows service: security detection: selection_517: EventID: 517 Provider_Name: Security selection_1102: EventID: 1102 Provider_Name: Microsoft-Windows-Eventlog condition: 1 of selection_* falsepositives: - Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog) - System provisioning (system reset before the golden image creation) level: high
Near-miss passage: Sigma rule: Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change m. Logsource: windows / registry_set. Rule: title: New Netsh Helper DLL Registered From A Suspicious Location id: e7b18879-676e-4a0e-ae18-27039185a8e7 related: - id: 56321594-9087-49d9-bf10-524fe8479452 type: similar - id: c90362e0-2df3-4e61-94fe-b37615814cb1 type: similar status: test description: 'Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper ' references: - https://www.ired.team/offensive-security/persistence/t1128-netsh-helper-dll - https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-11-28 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.007 logsource: category: registry_set product: windows detection: selection_target: TargetObject|contains: \SOFTWARE\Microsoft\NetSh selection_folders_1: Details|contains: - :\Perflogs\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\Local\Temp\ - \Temporary Internet selection_folders_2: - Details|contains|all: - :\Users\ - \Favorites\ - Details|contains|all: - :\Users\ - \Favourites\ - Details|contains|all: - :\Users\ - \Contacts\ - Details|contains|all: - :\Users\ - \Pictures\ condition: selection_target and 1 of selection_folders_* falsepositives: - Unknown level: high
Query: exploit The Adobe Premiere Clip app before 1.2.1 for iOS mishandles unspecified input, which has unknown impact and attack vectors.
Matching passage: CVE-2015-8051. CWE: UNKNOWN. CVSS: 10.0. The Adobe Premiere Clip app before 1.2.1 for iOS mishandles unspecified input, which has unknown impact and attack vectors.
Near-miss passage: CVE-2015-2135. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in HP Intelligent Provisioning 1.00 through 1.62(a), 2.00, and 2.10 allows remote attackers to execute arbitrary code via unknown vectors.
Query: patch priority for CVE-2015-0293
Matching passage: CVE-2015-0293. CWE: CWE-20. CVSS: 5.0. The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon exit) via a crafted CLIENT-MASTER-KEY message.
Near-miss passage: CVE-2015-0636. CWE: CWE-20. CVSS: 7.800000190734863. The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS 12.2, 12.4, 15.0, 15.2, 15.3, and 15.4 and IOS XE 3.10.xS through 3.13.xS before 3.13.1S allows remote attackers to cause a denial of service (disrupted domain access) via spoofed AN messages that reset a finite state machine, aka Bug ID CSCup62293.
Query: vulnerability: Buffer overflow in IBM i Access 7.1 on Windows allows local users to gain privileges via unspecified vectors.
Matching passage: CVE-2015-2023. CWE: CWE-119. CVSS: 8.800000190734863. Buffer overflow in IBM i Access 7.1 on Windows allows local users to gain privileges via unspecified vectors.
Near-miss passage: CVE-2015-6064. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6084 and CVE-2015-6085.
Query: CVE similar to CVE-2015-6546
Matching passage: CVE-2015-6546. CWE: CWE-20. CVSS: 6.099999904632568. The vCMP host in F5 BIG-IP Analytics, APM, ASM, GTM, Link Controller, and LTM 11.0.0 before 11.6.0, BIG-IP AAM 11.4.0 before 11.6.0, BIG-IP AFM and PEM 11.3.0 before 11.6.0, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.0.0 through 11.3.0, BIG-IP PSM 11.0.0 through 11.4.1 allows remote attackers to cause a denial of service via "malicious traffic."
Near-miss passage: CVE-2015-8040. CWE: CWE-20. CVSS: 6.800000190734863. The rtsp_getdlsendtime method in the CNC_Ctrl control in Samsung SmartViewer allows remote attackers to execute arbitrary code via an index value.
Query: write Sigma for Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)
Matching passage: Sigma rule: Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52). Logsource: windows / process_creation. Rule: title: UAC Bypass Abusing Winsat Path Parsing - Process id: 7a01183d-71a2-46ad-ad5c-acd989ac1793 status: test description: Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 ParentImage|endswith: \AppData\Local\Temp\system32\winsat.exe ParentCommandLine|contains: C:\Windows \system32\winsat.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has. Logsource: windows / security. Rule: title: Password Protected ZIP File Opened (Email Attachment) id: 571498c8-908e-40b4-910b-d2369159a3da status: test description: Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened. references: - https://twitter.com/sbousseaden/status/1523383197513379841 author: Florian Roth (Nextron Systems) date: 2022-05-09 tags: - attack.initial-access - attack.stealth - attack.t1027 - attack.t1566.001 logsource: product: windows service: security detection: selection: EventID: 5379 TargetName|contains|all: - Microsoft_Windows_Shell_ZipFolder:filename - \Temporary Internet Files\Content.Outlook condition: selection falsepositives: - Legitimate used of encrypted ZIP files level: high
Query: risk of The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and 
Matching passage: CVE-2015-1545. CWE: UNKNOWN. CVSS: 5.0. The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request.
Near-miss passage: CVE-2015-2600. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Siebel Core - Server OM Svcs component in Oracle Siebel CRM 8.1.1, 8.2.2, and 15.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
Query: exploit IBM WebSphere Message Broker 8 before 8.0.0.6 and Integration Bus 9 before 9.0.0.4 do not check authorization for MQSISTARTMSGFLOW and MQSISTOPMSGFLOW commands, which allows local 
Matching passage: CVE-2015-5011. CWE: CWE-77. CVSS: 3.200000047683716. IBM WebSphere Message Broker 8 before 8.0.0.6 and Integration Bus 9 before 9.0.0.4 do not check authorization for MQSISTARTMSGFLOW and MQSISTOPMSGFLOW commands, which allows local users to bypass intended access restrictions, and start or stop a service, by issuing a command.
Near-miss passage: CVE-2015-20107. CWE: CWE-77. CVSS: 7.599999904632568. In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9
Query: describe CVE-2015-6944
Matching passage: CVE-2015-6944. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in JSP/MySQL Administrador Web 1 allows remote attackers to hijack the authentication of users for requests that execute arbitrary SQL commands via the cmd parameter to sys/sys/listaBD2.jsp.
Near-miss passage: CVE-2015-9427. CWE: CWE-352. CVSS: 6.5. The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID parameter.
Query: patch priority for CVE-2015-9407
Matching passage: CVE-2015-9407. CWE: CWE-79. CVSS: 6.099999904632568. The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS.
Near-miss passage: CVE-2015-7386. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in includes/metaboxes.php in the Gallery - Photo Albums - Portfolio plugin 1.3.47 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) Media Title or (2) Media Subtitle fields.
Query: rule covering Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity
Matching passage: Sigma rule: Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity. Logsource: windows / process_creation. Rule: title: Potential Credential Dumping Via LSASS Process Clone id: c8da0dfd-4ed0-4b68-962d-13c9c884384e status: test description: Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity references: - https://www.matteomalvica.com/blog/2019/12/02/win-defender-atp-cred-bypass/ - https://twitter.com/Hexacorn/status/1420053502554951689 - https://twitter.com/SBousseaden/status/1464566846594691073?s=20 author: Florian Roth (Nextron Systems), Samir Bousseaden date: 2021-11-27 modified: 2023-03-02 tags: - attack.credential-access - attack.t1003 - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \Windows\System32\lsass.exe Image|endswith: \Windows\System32\lsass.exe condition: selection falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location. Logsource: windows / image_load. Rule: title: Microsoft Excel Add-In Loaded From Uncommon Location id: af4c4609-5755-42fe-8075-4effb49f5d44 related: - id: c5f4b5cb-4c25-4249-ba91-aa03626e3185 type: derived status: test description: Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location references: - https://www.mandiant.com/resources/blog/lnk-between-browsers - https://wazuh.com/blog/detecting-xll-files-used-for-dropping-fin7-jssloader-with-wazuh/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-12 tags: - attack.execution - attack.t1204.002 logsource: category: image_load product: windows detection: selection: Image|endswith: \excel.exe ImageLoaded|contains: - \Desktop\ - \Downloads\ - \Perflogs\ - \Temp\ - \Users\Public\ - \Windows\Tasks\ ImageLoaded|endswith: .xll condition: selection falsepositives: - Some tuning might be required to allow or remove certain locations used by the rule if you consider them as safe locations level: medium
Query: risk of Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Replication.
Matching passage: CVE-2015-4890. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Replication.
Near-miss passage: CVE-2015-0424. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in the Integrated Lights Out Manager (ILOM) component in Oracle Sun Systems Products Suite ILOM prior to 3.2.4 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to IPMI.
Query: CWE for Unsynchronized Access to Shared Data in a Multithreaded Context
Matching passage: CWE-567 Unsynchronized Access to Shared Data in a Multithreaded Context. The product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes.
Near-miss passage: CWE-39 Path Traversal: 'C:dirname'. The product accepts input that contains a drive letter or Windows volume letter ('C:dirname') that potentially redirects access to an unintended location or arbitrary file.
Query: risk of The _write_config function in trove/guestagent/datastore/experimental/mongodb/service.py, reset_configuration function in trove/guestagent/datastore/experimental/postgresql/service
Matching passage: CVE-2015-3156. CWE: CWE-59. CVSS: 5.5. The _write_config function in trove/guestagent/datastore/experimental/mongodb/service.py, reset_configuration function in trove/guestagent/datastore/experimental/postgresql/service/config.py, write_config function in trove/guestagent/datastore/experimental/redis/service.py, _write_mycnf function in trove/guestagent/datastore/mysql/service.py, InnoBackupEx::_run_prepare function in trove/guestagent/strategies/restore/mysql_impl.py, InnoBackupEx::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, MySQLDump::cmd in trove/guestagent/strategies/backup/mysql_impl.py, InnoBackupExIncremental::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, _get_actual_db_status function in trove/guestagent/datastore/experimental/cassandra/system.py and trove/guestagent/datastore/experimental/cassandra/service.py, and multiple class CbBackup methods in trove/guestagent/strategies/backup/experimental/couchbase_impl.py in Openstack DBaaS (aka Trove) as packaged in Openstack before 2015.1.0 (aka Kilo) allows local users to write to configuration files via a symlink attack on a temporary file.
Near-miss passage: CVE-2015-0858. CWE: CWE-59. CVSS: 3.299999952316284. Cool Projects TarDiff allows local users to write to arbitrary files via a symlink attack on a pathname in a /tmp/tardiff-$$ temporary directory.
Query: rule covering Detects Cobalt Strike module/commands accidentally entered in CMD shell
Matching passage: Sigma rule: Detects Cobalt Strike module/commands accidentally entered in CMD shell. Logsource: windows / process_creation. Rule: title: Operator Bloopers Cobalt Strike Modules id: 4f154fb6-27d1-4813-a759-78b93e0b9c48 related: - id: 647c7b9e-d784-4fda-b9a0-45c565a7b729 type: similar status: test description: Detects Cobalt Strike module/commands accidentally entered in CMD shell references: - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/cobalt-4-5-user-guide.pdf - https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/ - https://thedfirreport.com/2022/06/16/sans-ransomware-summit-2022-can-you-detect-this/ author: _pete_0, TheDFIRReport date: 2022-05-06 modified: 2023-01-30 tags: - attack.execution - attack.t1059.003 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: Cmd.Exe - Image|endswith: \cmd.exe selection_cli: CommandLine|contains: - Invoke-UserHunter - Invoke-ShareFinder - Invoke-Kerberoast - Invoke-SMBAutoBrute - Invoke-Nightmare - zerologon - av_query condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the image load of "Python Core" by a non-Python process. This might be indicative of a execution of executable t. Logsource: windows / image_load. Rule: title: Python Image Load By Non-Python Process id: cbb56d62-4060-40f7-9466-d8aaf3123f83 status: test description: 'Detects the image load of "Python Core" by a non-Python process. This might be indicative of a execution of executable that has been bundled from Python code. Various tools like Py2Exe, PyInstaller, and cx_Freeze are used to bundle Python code into standalone executables. Threat actors often use these tools to bundle malicious Python scripts into executables, sometimes to obfuscate the code or to bypass security measures. ' references: - https://www.py2exe.org/ - https://unit42.paloaltonetworks.com/unit-42-technical-analysis-seaduke/ author: Patrick St. John, OTR (Open Threat Research) date: 2020-05-03 modified: 2025-08-18 tags: - attack.stealth - attack.t1027.002 logsource: product: windows category: image_load detection: selection: Description: Python Core filter_main_generic: - Image|contains: Python - Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ - C:\ProgramData\Anaconda3\ filter_optional_null_image: Image: null condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate Py2Exe Binaries - Known false positive caused with Python Anaconda - Various legitimate software is bundled from Python code into executables level: low
Query: risk of The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to execute arbitrary commands via unspecified vectors, a different vulnerability than CV
Matching passage: CVE-2015-1986. CWE: CWE-77. CVSS: 10.0. The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to execute arbitrary commands via unspecified vectors, a different vulnerability than CVE-2015-1938.
Near-miss passage: CVE-2015-5082. CWE: CWE-77. CVSS: 10.0. Endian Firewall before 3.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) NEW_PASSWORD_1 or (2) NEW_PASSWORD_2 parameter to cgi-bin/chpasswd.cgi.
Query: exploit realmd allows remote attackers to inject arbitrary configurations in to sssd.conf and smb.conf via a newline character in an LDAP response.
Matching passage: CVE-2015-2704. CWE: CWE-74. CVSS: 5.0. realmd allows remote attackers to inject arbitrary configurations in to sssd.conf and smb.conf via a newline character in an LDAP response.
Near-miss passage: CVE-2015-4075. CWE: CWE-74. CVSS: 8.100000381469727. The Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to write to arbitrary .ini files via a crafted language.save task.
Query: describe CVE-2015-2736
Matching passage: CVE-2015-2736. CWE: CWE-17. CVSS: 9.300000190734863. The nsZipArchive::BuildFileList function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which allows remote attackers to have an unspecified impact via a crafted ZIP archive.
Near-miss passage: CVE-2015-2682. CWE: CWE-17. CVSS: 5.0. Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 allows remote attackers to obtain credentials via a direct request to conf/securitydbData.xml.
Query: mitigate Local Storage Discovery
Matching passage: T1680 Local Storage Discovery. Tactics: discovery. Description: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number. This can be done to prepare for ransomware-related encryption, to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0109), or as a precursor to [Direct Volume Access](https://attack.mitre.org/techniques/T1006). On ESXi systems, adversaries may use [Hypervisor CLI](https://attack.mitre.org/techniques/T1059/012) commands such as `esxcli` to list storage connected to the host as well as `.vmdk` files.(Citation: TrendMicro)(Citation: TrendMicro ESXI Ransomware) On Windows systems, adversaries can use `wmic logicaldisk get` to find information about local network drives. They can also use `Get-PSDrive` in PowerShell to retrieve drives and may additionally use Windows API functions such as `GetDriveType`.(Citation: Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024)(Citation: Volexity) Linux has commands such as `parted`, `lsblk`, `fdisk`, `lshw`, and `df` that can list information about disk partitions such as size, type, file system types, and free space. The command `diskutil` on MacOS can be used to list disks while `system_profiler SPStorageDataType` can additionally show information such as a volume’s mount path, file system, and the type of drive in the system. Infrastructure as a Service (IaaS) cloud providers also have commands for storage discovery such as `describe volume` in AWS, `gcloud compute disks list` in GCP, and `az disk list` in Azure.(Citation: AWS docs describe volumes)(Citation: GCP gcloud compute disks list)(Citation: azure az disk)
Near-miss passage: T1518 Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from [Software Discovery](https://attack.mitre.org/techniques/T1518) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Such software may be deployed widely across the environment for configuration management or security reasons, such as [Software Deployment Tools](https://attack.mitre.org/techniques/T1072), and may allow adversaries broad access to infect devices or move laterally. Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable to [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).