alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Unspecified vulnerability in Oracle Sun Solaris 3.3 and 4.2 allows local users to affect availability via unknown vectors related to DevFS.
Matching passage: CVE-2015-2616. CWE: UNKNOWN. CVSS: 4.900000095367432. Unspecified vulnerability in Oracle Sun Solaris 3.3 and 4.2 allows local users to affect availability via unknown vectors related to DevFS.
Near-miss passage: CVE-2015-0364. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect availability via unknown vectors related to Integration Business Services.
Query: threat report mentioning XPC Services
Matching passage: T1559.003 XPC Services. Tactics: execution. Description: Adversaries can provide malicious content to an XPC service daemon for local code execution. macOS uses XPC services for basic inter-process communication between various processes, such as between the XPC Service daemon and third-party application privileged helper tools. Applications can send messages to the XPC Service daemon, which runs as root, using the low-level XPC Service <code>C API</code> or the high level <code>NSXPCConnection API</code> in order to handle tasks that require elevated privileges (such as network connections). Applications are responsible for providing the protocol definition which serves as a blueprint of the XPC services. Developers typically use XPC Services to provide applications stability and privilege separation between the application client and the daemon.(Citation: creatingXPCservices)(Citation: Designing Daemons Apple Dev) Adversaries can abuse XPC services to execute malicious content. Requests for malicious execution can be passed through the application's XPC Services handler.(Citation: CVMServer Vuln)(Citation: Learn XPC Exploitation) This may also include identifying and abusing improper XPC client validation and/or poor sanitization of input parameters to conduct [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).
Near-miss passage: T1559 Inter-Process Communication. Tactics: execution. Description: Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern. Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002) or [Component Object Model](https://attack.mitre.org/techniques/T1559/001). Linux environments support several different IPC mechanisms, two of which being sockets and pipes.(Citation: Linux IPC) Higher level execution mediums, such as those of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s, may also leverage underlying IPC mechanisms. Adversaries may also use [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) to facilitate remote IPC execution.(Citation: Fireeye Hunting COM June 2019)
Query: describe CVE-2015-4078
Matching passage: CVE-2015-4078. CWE: CWE-200. CVSS: 3.0999999046325684. Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).
Near-miss passage: CVE-2015-5443. CWE: CWE-200. CVSS: 4.0. HP 3PAR Service Processor SP 4.2.0.GA-29 (GA) SPOCC, SP 4.3.0.GA-17 (GA) SPOCC, and SP 4.3.0-GA-24 (MU1) SPOCC allows remote authenticated users to obtain sensitive information via unspecified vectors.
Query: patch priority for CVE-2015-8601
Matching passage: CVE-2015-8601. CWE: CWE-200. CVSS: 5.0. The Chat Room module 7.x-2.x before 7.x-2.2 for Drupal does not properly check permissions when setting up a websocket for chat messages, which allows remote attackers to bypass intended access restrictions and read messages from arbitrary Chat Rooms via unspecified vectors.
Near-miss passage: CVE-2015-5859. CWE: CWE-200. CVSS: 4.300000190734863. The CFNetwork HTTPProtocol component in Apple iOS before 9 and OS X before 10.11 does not properly recognize the HSTS preload list during a Safari private-browsing session, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
Query: alert when Detects remote RPC calls to read information about scheduled tasks
Matching passage: Sigma rule: Detects remote RPC calls to read information about scheduled tasks. Logsource: rpc_firewall / application. Rule: title: Remote Schedule Task Recon via ITaskSchedulerService id: 7f7c49eb-2977-4ac8-8ab0-ab1bae14730e status: test description: Detects remote RPC calls to read information about scheduled tasks references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.discovery logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:86d35949-83c9-4044-b424-db363231fd0c"' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 86d35949-83c9-4044-b424-db363231fd0c filter: OpNum: - 1 - 3 - 4 - 10 - 11 - 12 - 13 - 14 - 15 condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently acc. Logsource: windows / ps_module. Rule: title: Use Get-NetTCPConnection - PowerShell Module id: aff815cc-e400-4bf0-a47a-5d8a2407d4e1 status: test description: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-2---system-network-connections-discovery-with-powershell author: frack113 date: 2021-12-10 modified: 2022-12-02 tags: - attack.discovery - attack.t1049 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection: ContextInfo|contains: Get-NetTCPConnection condition: selection falsepositives: - Unknown level: low
Query: Sigma YAML for linux / auditd
Matching passage: Sigma rule: Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate the. Logsource: linux / auditd. Rule: title: Linux Capabilities Discovery id: fe10751f-1995-40a5-aaa2-c97ccb4123fe status: test description: Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges. references: - https://man7.org/linux/man-pages/man8/getcap.8.html - https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/ - https://mn3m.info/posts/suid-vs-capabilities/ - https://int0x33.medium.com/day-44-linux-capabilities-privilege-escalation-via-openssl-with-selinux-enabled-and-enforced-74d2bec02099 author: Pawel Mazur date: 2021-11-28 modified: 2022-12-25 tags: - attack.discovery - attack.privilege-escalation - attack.t1083 - attack.t1548 logsource: product: linux service: auditd detection: selection: type: EXECVE a0: getcap a1: -r a2: / condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects the execution of "dotnet-dump" with the "collect" flag. The execution could indicate potential process dumping o. Logsource: windows / process_creation. Rule: title: Process Memory Dump Via Dotnet-Dump id: 53d8d3e1-ca33-4012-adf3-e05a4d652e34 status: test description: 'Detects the execution of "dotnet-dump" with the "collect" flag. The execution could indicate potential process dumping of critical processes such as LSASS. ' references: - https://learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-dump#dotnet-dump-collect - https://twitter.com/bohops/status/1635288066909966338 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-14 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \dotnet-dump.exe - OriginalFileName: dotnet-dump.dll selection_cli: CommandLine|contains: collect condition: all of selection_* falsepositives: - Process dumping is the expected behavior of the tool. So false positives are expected in legitimate usage. The PID/Process Name of the process being dumped needs to be investigated level: medium
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the addition of a new rule to the Windows firewall via netsh. Logsource: windows / process_creation. Rule: title: New Firewall Rule Added Via Netsh.EXE id: cd5cfd80-aa5f-44c0-9c20-108c4ae12e3c status: test description: Detects the addition of a new rule to the Windows firewall via netsh references: - https://web.archive.org/web/20190508165435/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf author: Markus Neis, Sander Wiebing date: 2019-01-29 modified: 2023-02-10 tags: - attack.defense-impairment - attack.t1686.003 - attack.s0246 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: CommandLine|contains|all: - ' firewall ' - ' add ' filter_optional_dropbox: CommandLine|contains: - advfirewall firewall add rule name=Dropbox dir=in action=allow "program=?:\Program Files (x86)\Dropbox\Client\Dropbox.exe" enable=yes profile=Any - advfirewall firewall add rule name=Dropbox dir=in action=allow "program=?:\Program Files\Dropbox\Client\Dropbox.exe" enable=yes profile=Any condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Legitimate administration activity - Software installations level: medium
Near-miss passage: Sigma rule: Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argum. Logsource: windows / image_load. Rule: title: WMIC Loading Scripting Libraries id: 06ce37c2-61ab-4f05-9ff5-b1a96d18ae32 related: - id: 8d63dadf-b91b-4187-87b6-34a1114577ea type: similar - id: 05c36dd6-79d6-4a9a-97da-3db20298ab2d type: similar status: test description: 'Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argument switch to download and execute an XSL file (i.e js, vbs, etc). It could be an indicator of SquiblyTwo technique, which uses Windows Management Instrumentation (WMI) to execute malicious code. ' references: - https://securitydatasets.com/notebooks/atomic/windows/defense_evasion/SDWIN-201017061100.html - https://twitter.com/dez_/status/986614411711442944 - https://lolbas-project.github.io/lolbas/Binaries/Wmic/ author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-17 modified: 2022-10-13 tags: - attack.stealth - attack.t1220 logsource: category: image_load product: windows detection: selection: Image|endswith: \wmic.exe ImageLoaded|endswith: - \jscript.dll - \vbscript.dll condition: selection falsepositives: - The command wmic os get lastbootuptime loads vbscript.dll - The command wmic os get locale loads vbscript.dll - Since the ImageLoad event doesn't have enough information in this case. It's better to look at the recent process creation events that spawned the WMIC process and investigate the command line and parent/child processes to get more insights - The command `wmic ntevent` loads vbscript.dll level: medium
Query: exploit Use-after-free vulnerability in the Connect function in the WESPMonitor.WESPMonitorCtrl.1 ActiveX control in WebGate eDVR Manager allows remote attackers to execute arbitrary code 
Matching passage: CVE-2015-2096. CWE: UNKNOWN. CVSS: 6.800000190734863. Use-after-free vulnerability in the Connect function in the WESPMonitor.WESPMonitorCtrl.1 ActiveX control in WebGate eDVR Manager allows remote attackers to execute arbitrary code via an invalid IP address and a page reload.
Near-miss passage: CVE-2015-7616. CWE: UNKNOWN. CVSS: 6.800000190734863. The ANVerifyComments method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Query: exploit The private-browsing implementation in Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 allows attackers to obtain sensitive browsing-history information via vecto
Matching passage: CVE-2015-1128. CWE: CWE-200. CVSS: 5.0. The private-browsing implementation in Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 allows attackers to obtain sensitive browsing-history information via vectors involving push-notification requests.
Near-miss passage: CVE-2015-3400. CWE: CWE-200. CVSS: 4.300000190734863. sharenfs 0.6.4, when built with commits bcdd594 and 7d08880 from the zfs repository, provides world readable access to the shared zfs file system, which might allow remote authenticated users to obtain sensitive information by reading shared files.
Query: alert when Detect file time attribute change to hide new or changes to existing files
Matching passage: Sigma rule: Detect file time attribute change to hide new or changes to existing files. Logsource: macos / process_creation. Rule: title: File Time Attribute Change id: 88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0 status: test description: Detect file time attribute change to hide new or changes to existing files references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md author: Igor Fits, Mikhail Larin, oscd.community date: 2020-10-19 modified: 2022-01-12 tags: - attack.stealth - attack.t1070.006 logsource: product: macos category: process_creation detection: selection: Image|endswith: /touch CommandLine|contains: - -t - -acmr - -d - -r condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any. Logsource: windows / process_creation. Rule: title: MpiExec Lolbin id: 729ce0ea-5d8f-4769-9762-e35de441586d status: test description: Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary references: - https://twitter.com/mrd0x/status/1465058133303246867 - https://learn.microsoft.com/en-us/powershell/high-performance-computing/mpiexec?view=hpc19-ps author: Florian Roth (Nextron Systems) date: 2022-01-11 modified: 2024-11-23 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_binary: - Image|endswith: \mpiexec.exe - Hashes|contains: IMPHASH=d8b52ef6aaa3a81501bdfff9dbb96217 selection_flags: CommandLine|contains: - ' /n 1 ' - ' -n 1 ' condition: all of selection* falsepositives: - Unknown level: high
Query: how to detect Clear Persistence
Matching passage: T1070.009 Clear Persistence. Tactics: stealth. Description: Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, [Modify Registry](https://attack.mitre.org/techniques/T1112), [Plist File Modification](https://attack.mitre.org/techniques/T1647), or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence.(Citation: Cylance Dust Storm) Adversaries may also delete accounts previously created to maintain persistence (i.e. [Create Account](https://attack.mitre.org/techniques/T1136)).(Citation: Talos - Cisco Attack 2022) In some instances, artifacts of persistence may also be removed once an adversary’s persistence is executed in order to prevent errors with the new instance of the malware.(Citation: NCC Group Team9 June 2020)
Near-miss passage: T1070.007 Clear Network Connection History and Configurations. Tactics: stealth. Description: Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations. Configuration settings as well as various artifacts that highlight connection history may be created on a system and/or in application logs from behaviors that require network connections, such as [Remote Services](https://attack.mitre.org/techniques/T1021) or [External Remote Services](https://attack.mitre.org/techniques/T1133). Defenders may use these artifacts to monitor or otherwise analyze network connections created by adversaries. Network connection history may be stored in various locations. For example, RDP connection history may be stored in Windows Registry values under (Citation: Microsoft RDP Removal): * <code>HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default</code> * <code>HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers</code> Windows may also store information about recent RDP connections in files such as <code>C:\Users\\%username%\Documents\Default.rdp</code> and `C:\Users\%username%\AppData\Local\Microsoft\Terminal Server Client\Cache\`.(Citation: Moran RDPieces) Similarly, macOS and Linux hosts may store information highlighting connection history in system logs (such as those stored in `/Library/Logs` and/or `/var/log/`).(Citation: Apple Culprit Access)(Citation: FreeDesktop Journal)(Citation: Apple Unified Log Analysis Remote Login and Screen Sharing) Malicious network connections may also require changes to third-party applications or network configuration settings, such as [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1686) or tampering to enable [Proxy](https://attack.mitre.org/techniques/T1090). Adversaries may delete or modify this data to conceal indicators and/or impede defensive analysis.
Query: exploit ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01_R05 allows remote authenticated users to execute arbitrary commands via shel
Matching passage: CVE-2015-6024. CWE: CWE-77. CVSS: 9.800000190734863. ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01_R05 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the DIA_IPADDRESS parameter.
Near-miss passage: CVE-2015-1949. CWE: CWE-77. CVSS: 10.0. The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to execute arbitrary commands with SYSTEM privileges via unspecified vectors.
Query: secure coding against Incorrect Selection of Fuse Values
Matching passage: CWE-1253 Incorrect Selection of Fuse Values. The logic level used to set a system to a secure state relies on a fuse being unblown.
Near-miss passage: CWE-131 Incorrect Calculation of Buffer Size. The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
Query: risk of Multiple race conditions in drivers/char/adsprpc.c and drivers/char/adsprpc_compat.c in the ADSPRPC driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) An
Matching passage: CVE-2015-0572. CWE: CWE-362. CVSS: 7.0. Multiple race conditions in drivers/char/adsprpc.c and drivers/char/adsprpc_compat.c in the ADSPRPC driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a denial of service (zero-value write) or possibly have unspecified other impact via a COMPAT_FASTRPC_IOCTL_INVOKE_FD ioctl call.
Near-miss passage: CVE-2015-5232. CWE: CWE-362. CVSS: 8.100000381469727. Race conditions in opa-fm before 10.4.0.0.196 and opa-ff before 10.4.0.0.197.
Query: detect Detects Obfuscated Powershell via use Clip.exe in Scripts in logs
Matching passage: Sigma rule: Detects Obfuscated Powershell via use Clip.exe in Scripts. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation Via Use Clip - PowerShell Module id: ebdf49d8-b89c-46c9-8fdf-2c308406f6bd related: - id: db92dd33-a3ad-49cf-8c2c-608c3e30ace0 type: derived status: test description: Detects Obfuscated Powershell via use Clip.exe in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-09 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|re: (?i)echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?e`?) condition: selection_4103 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen sourc. Logsource: azure / activitylogs. Rule: title: Rare Subscription-level Operations In Azure id: c1182e02-49a3-481c-b3de-0fadc4091488 status: test description: Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used. references: - https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/RareOperations.yaml author: sawwinnnaung date: 2020-05-07 modified: 2023-10-11 tags: - attack.t1003 - attack.credential-access logsource: product: azure service: activitylogs detection: keywords: - Microsoft.DocumentDB/databaseAccounts/listKeys/action - Microsoft.Maps/accounts/listKeys/action - Microsoft.Media/mediaservices/listKeys/action - Microsoft.CognitiveServices/accounts/listKeys/action - Microsoft.Storage/storageAccounts/listKeys/action - Microsoft.Compute/snapshots/write - Microsoft.Network/networkSecurityGroups/write condition: keywords falsepositives: - Valid change level: medium
Query: risk of Stack-based buffer overflow in the URI handler in DWRCC.exe in SolarWinds DameWare Mini Remote Control before 12.0 HotFix 1 allows remote attackers to execute arbitrary code via a 
Matching passage: CVE-2015-8220. CWE: CWE-119. CVSS: 7.5. Stack-based buffer overflow in the URI handler in DWRCC.exe in SolarWinds DameWare Mini Remote Control before 12.0 HotFix 1 allows remote attackers to execute arbitrary code via a crafted commandline argument in a link.
Near-miss passage: CVE-2015-8446. CWE: CWE-119. CVSS: 9.300000190734863. Heap-based buffer overflow in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via an MP3 file with COMM tags that are mishandled during memory allocation, a different vulnerability than CVE-2015-8438.