alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of "forfiles" with the "/c" flag. While this is an expected behavior of the tool, it can be abused. Logsource: windows / process_creation. Rule: title: Forfiles Command Execution id: 9aa5106d-bce3-4b13-86df-3a20f1d5cf0b related: - id: a85cf4e3-56ee-4e79-adeb-789f8fb209a8 type: obsolete - id: fa47597e-90e9-41cd-ab72-c3b74cfb0d02 type: obsolete status: test description: 'Detects the execution of "forfiles" with the "/c" flag. While this is an expected behavior of the tool, it can be abused in order to proxy execution through it with any binary. Can be used to bypass application whitelisting. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Forfiles/ - https://pentestlab.blog/2020/07/06/indirect-command-execution/ author: Tim Rauch, Elastic, E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community date: 2022-06-14 modified: 2024-03-05 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \forfiles.exe - OriginalFileName: forfiles.exe selection_cli: CommandLine|contains|windash: ' -c ' condition: all of selection_* falsepositives: - Legitimate use via a batch script or by an administrator. level: medium
Near-miss passage: Sigma rule: Detects when someone is adding or removing applications or folders from exploit guard "ProtectedFolders" or "AllowedAppl. Logsource: windows / windefend. Rule: title: Windows Defender Exploit Guard Tamper id: a3ab73f1-bd46-4319-8f06-4b20d0617886 status: test description: 'Detects when someone is adding or removing applications or folders from exploit guard "ProtectedFolders" or "AllowedApplications" ' references: - https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-controlled-folder-access-event-search/ba-p/2326088 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 modified: 2022-12-06 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: allowed_apps_key: EventID: 5007 NewValue|contains: \Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications\ allowed_apps_path: NewValue|contains: - \Users\Public\ - \AppData\Local\Temp\ - \Desktop\ - \PerfLogs\ - \Windows\Temp\ protected_folders: EventID: 5007 OldValue|contains: \Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders\ condition: all of allowed_apps* or protected_folders falsepositives: - Unlikely level: high
Query: risk of OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another cont
Matching passage: CVE-2015-5223. CWE: CWE-200. CVSS: 5.0. OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container.
Near-miss passage: CVE-2015-6086. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."
Query: patch priority for CVE-2015-3082
Matching passage: CVE-2015-3082. CWE: CWE-264. CVSS: 6.400000095367432. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow remote attackers to bypass intended restrictions on filesystem write operations via unspecified vectors, a different vulnerability than CVE-2015-3083 and CVE-2015-3085.
Near-miss passage: CVE-2015-5233. CWE: CWE-264. CVSS: 4.199999809265137. Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view_hosts permissions, which allows (1) remote authenticated users with the view_reports permission to read reports from arbitrary hosts or (2) remote authenticated users with the destroy_reports permission to delete reports from arbitrary hosts via direct access to the (a) individual report show/delete pages or (b) APIs.
Query: risk of The SSL layer of the HTTPS service in Siemens RuggedCom ROS before 4.2.0 and ROX II does not properly implement CBC padding, which makes it easier for man-in-the-middle attackers t
Matching passage: CVE-2015-5537. CWE: CWE-312. CVSS: 4.300000190734863. The SSL layer of the HTTPS service in Siemens RuggedCom ROS before 4.2.0 and ROX II does not properly implement CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a different vulnerability than CVE-2014-3566.
Near-miss passage: CVE-2015-1931. CWE: CWE-312. CVSS: 5.5. IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR1 FP10, 7 R1 before SR3 FP10, 7 before SR9 FP10, 6 R1 before SR8 FP7, 6 before SR16 FP7, and 5.0 before SR16 FP13 stores plaintext information in memory dumps, which allows local users to obtain sensitive information by reading a file.
Query: CVE similar to CVE-2015-9453
Matching passage: CVE-2015-9453. CWE: CWE-79. CVSS: 6.099999904632568. The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist.
Near-miss passage: CVE-2015-4656. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station before 6.3-2945 allow remote attackers to inject arbitrary web script or HTML via the (1) success parameter to login.php or (2) crafted URL parameters to index.php, as demonstrated by the t parameter to photo/.
Query: Sigma rule for User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the accoun
Matching passage: Sigma rule: User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the accoun. Logsource: azure / signinlogs. Rule: title: Multifactor Authentication Denied id: e40f4962-b02b-4192-9bfe-245f7ece1f99 status: test description: User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account. references: - https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/ author: AlertIQ date: 2022-03-24 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.credential-access - attack.stealth - attack.t1078.004 - attack.t1110 - attack.t1621 logsource: product: azure service: signinlogs detection: selection: AuthenticationRequirement: multiFactorAuthentication Status|contains: MFA Denied condition: selection falsepositives: - Users actually login but miss-click into the Deny button when MFA prompt. level: medium
Near-miss passage: Sigma rule: Detects when an admin share is mounted using net.exe. Logsource: windows / process_creation. Rule: title: Windows Admin Share Mount Via Net.EXE id: 3abd6094-7027-475f-9630-8ab9be7b9725 related: - id: f117933c-980c-4f78-b384-e3d838111165 type: similar status: test description: Detects when an admin share is mounted using net.exe references: - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view author: oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, wagga date: 2020-10-05 modified: 2023-02-21 tags: - attack.lateral-movement - attack.t1021.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: CommandLine|contains|all: - ' use ' - ' \\\\*\\*$' condition: all of selection_* falsepositives: - Administrators level: medium
Query: common weakness: Weak Password Recovery Mechanism for Forgotten Password
Matching passage: CWE-640 Weak Password Recovery Mechanism for Forgotten Password. The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Near-miss passage: CWE-463 Deletion of Data Structure Sentinel. The accidental deletion of a data-structure sentinel can cause serious programming logic problems.
Query: explain CWE-792
Matching passage: CWE-792 Incomplete Filtering of One or More Instances of Special Elements. The product receives data from an upstream component, but does not completely filter one or more instances of special elements before sending it to a downstream component.
Near-miss passage: CWE-1328 Security Version Number Mutable to Older Versions. Security-version number in hardware is mutable, resulting in the ability to downgrade (roll-back) the boot firmware to vulnerable code versions.
Query: Outbound C2 pattern associated with Create Process with Token
Matching passage: T1134.002 Create Process with Token. Tactics: stealth, privilege escalation. Description: Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as <code>CreateProcessWithTokenW</code> and <code>runas</code>.(Citation: Microsoft RunAs) Creating processes with a token not associated with the current user may require the credentials of the target user, specific privileges to impersonate that user, or access to the token to be used. For example, the token could be duplicated via [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) or created via [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) before being used to create a process. While this technique is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001), the techniques can be used in conjunction where a token is duplicated and then used to create a new process.
Near-miss passage: T1134.003 Make and Impersonate Token. Tactics: stealth, privilege escalation. Description: Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function.(Citation: LogonUserW function) The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread. This behavior is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) in that this refers to creating a new user token instead of stealing or duplicating an existing one.
Query: CVE similar to CVE-2015-5862
Matching passage: CVE-2015-5862. CWE: CWE-119. CVSS: 4.300000190734863. The Audio component in Apple iOS before 9 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted audio file.
Near-miss passage: CVE-2015-8561. CWE: CWE-119. CVSS: 6.800000190734863. The F1BookView ActiveX control in F1 Bookview in Schneider Electric ProClima before 6.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted integer value to the (1) AttachToSS, (2) CopyAll, (3) CopyRange, (4) CopyRangeEx, or (5) SwapTable method, a different vulnerability than CVE-2015-7918.
Query: exploit SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitrary SQL commands via the sid cookie, as demonstrated by a re
Matching passage: CVE-2015-5452. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitrary SQL commands via the sid cookie, as demonstrated by a request to borderpost/imp/compose.php3.
Near-miss passage: CVE-2015-8604. CWE: CWE-89. CVSS: 8.800000190734863. SQL injection vulnerability in the host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via the cg_g parameter in a save action.
Query: detect Detects creation of a local user via PowerShell in logs
Matching passage: Sigma rule: Detects creation of a local user via PowerShell. Logsource: windows / ps_script. Rule: title: PowerShell Create Local User id: 243de76f-4725-4f2e-8225-a8a69b15ad61 status: test description: Detects creation of a local user via PowerShell references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.001/T1136.001.md author: '@ROxPinTeddy' date: 2020-04-11 modified: 2022-12-25 tags: - attack.execution - attack.t1059.001 - attack.persistence - attack.t1136.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: New-LocalUser condition: selection falsepositives: - Legitimate user creation level: medium
Near-miss passage: Sigma rule: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential. Logsource: windows / ps_script. Rule: title: Create Volume Shadow Copy with Powershell id: afd12fed-b0ec-45c9-a13d-aa86625dac81 status: test description: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1&viewFallbackFrom=powershell-7 author: frack113 date: 2022-01-12 tags: - attack.credential-access - attack.t1003.003 - attack.ds0005 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Win32_ShadowCopy - ).Create( - ClientAccessible condition: selection falsepositives: - Legitimate PowerShell scripts level: high
Query: describe CVE-2015-1885
Matching passage: CVE-2015-1885. CWE: CWE-264. CVSS: 9.300000190734863. WebSphereOauth20SP.ear in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, 8.5 Liberty Profile before 8.5.5.5, and 8.5 Full Profile before 8.5.5.6, when the OAuth grant type requires sending a password, allows remote attackers to gain privileges via unspecified vectors.
Near-miss passage: CVE-2015-8966. CWE: CWE-264. CVSS: 7.800000190734863. arch/arm/kernel/sys_oabi-compat.c in the Linux kernel before 4.4 allows local users to gain privileges via a crafted (1) F_OFD_GETLK, (2) F_OFD_SETLK, or (3) F_OFD_SETLKW command in an fcntl64 system call.
Query: describe CVE-2015-1334
Matching passage: CVE-2015-1334. CWE: CWE-17. CVSS: 4.599999904632568. attach.c in LXC 1.1.2 and earlier uses the proc filesystem in a container, which allows local container users to escape AppArmor or SELinux confinement by mounting a proc filesystem with a crafted (1) AppArmor profile or (2) SELinux label.
Near-miss passage: CVE-2015-2751. CWE: CWE-17. CVSS: 7.099999904632568. Xen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows remote domains with partial management control to cause a denial of service (host lock) via unspecified domctl operations.
Query: describe CVE-2015-3356
Matching passage: CVE-2015-3356. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Tadaa! module before 7.x-1.4 for Drupal allow remote attackers to hijack the authentication of arbitrary users for requests that (1) enable or (2) disable modules or (3) change variables via unspecified vectors.
Near-miss passage: CVE-2015-6660. CWE: CWE-352. CVSS: 6.800000190734863. The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks."
Query: describe CVE-2015-4418
Matching passage: CVE-2015-4418. CWE: CWE-284. CVSS: 5.0. Zoho NetFlow Analyzer build 10250 and earlier does not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
Near-miss passage: CVE-2015-7263. CWE: CWE-284. CVSS: 7.5. The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a crafted host value.
Query: CVE similar to CVE-2015-5938
Matching passage: CVE-2015-5938. CWE: CWE-119. CVSS: 6.800000190734863. ImageIO in Apple OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted metadata in an image.
Near-miss passage: CVE-2015-2666. CWE: CWE-119. CVSS: 6.900000095367432. Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to the initrd.
Query: patch priority for CVE-2015-2189
Matching passage: CVE-2015-2189. CWE: CWE-189. CVSS: 5.0. Off-by-one error in the pcapng_read function in wiretap/pcapng.c in the pcapng file parser in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via an invalid Interface Statistics Block (ISB) interface ID in a crafted packet.
Near-miss passage: CVE-2015-4022. CWE: CWE-189. CVSS: 7.5. Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow.
Query: exploit Mozilla Network Security Services (NSS) before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and other products, does not prope
Matching passage: CVE-2015-2730. CWE: CWE-310. CVSS: 4.300000190734863. Mozilla Network Security Services (NSS) before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and other products, does not properly perform Elliptical Curve Cryptography (ECC) multiplications, which makes it easier for remote attackers to spoof ECDSA signatures via unspecified vectors.
Near-miss passage: CVE-2015-1672. CWE: CWE-310. CVSS: 5.0. Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allows remote attackers to cause a denial of service (recursion and performance degradation) via crafted encrypted data in an XML document, aka ".NET XML Decryption Denial of Service Vulnerability."
Query: detection rule: Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub processes of that new
Matching passage: Sigma rule: Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub processes of that new. Logsource: windows / process_creation. Rule: title: Explorer NOUACCHECK Flag id: 534f2ef7-e8a2-4433-816d-c91bccde289b status: test description: Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub processes of that newly started explorer.exe without any UAC checks references: - https://twitter.com/ORCA6665/status/1496478087244095491 author: Florian Roth (Nextron Systems) date: 2022-02-23 modified: 2022-04-21 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: Image|endswith: \explorer.exe CommandLine|contains: /NOUACCHECK filter_dc_logon: - ParentCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule - ParentImage: C:\Windows\System32\svchost.exe condition: selection and not 1 of filter_* falsepositives: - Domain Controller User Logon - Unknown how many legitimate software products use that method level: high
Near-miss passage: Sigma rule: Detects the usage of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode. Logsource: macos / process_creation. Rule: title: Network Sniffing - MacOs id: adc9bcc4-c39c-4f6b-a711-1884017bf043 status: test description: 'Detects the usage of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1040/T1040.md author: Alejandro Ortuno, oscd.community date: 2020-10-14 modified: 2022-11-26 tags: - attack.discovery - attack.credential-access - attack.t1040 logsource: category: process_creation product: macos detection: selection: Image|endswith: - /tcpdump - /tshark condition: selection falsepositives: - Legitimate administration activities level: informational
Query: patch priority for CVE-2015-2531
Matching passage: CVE-2015-2531. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the jQuery engine in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Skype for Business Server and Lync Server XSS Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-10119. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability, which was classified as problematic, has been found in View All Posts Page Plugin up to 0.9.0 on WordPress. This issue affects the function action_admin_notices_activation of the file view-all-posts-pages.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 0.9.1 is able to address this issue. The patch is named bf914f3a59063fa4df8fd4925ae18a5d852396d7. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-233363.
Query: patch priority for CVE-2015-2062
Matching passage: CVE-2015-2062. CWE: CWE-89. CVSS: 7.199999809265137. Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) plugin before 2.7.0 for WordPress allow remote administrators to execute arbitrary SQL commands via the removeslide parameter in a popup_posts or edit_cat action in the sliders_huge_it_slider page to wp-admin/admin.php.
Near-miss passage: CVE-2015-4627. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in Pragyan CMS 3.0.