alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detecting attempts to extract passwords with grep
Matching passage: Sigma rule: Detecting attempts to extract passwords with grep. Logsource: linux / auditd. Rule: title: Credentials In Files - Linux id: df3fcaea-2715-4214-99c5-0056ea59eb35 status: test description: Detecting attempts to extract passwords with grep references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md author: Igor Fits, oscd.community date: 2020-10-15 modified: 2023-04-30 tags: - attack.credential-access - attack.t1552.001 logsource: product: linux service: auditd detection: selection: type: EXECVE keywords: '|all': - grep - password condition: selection and keywords falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of the Microsoft signed script "CL_mutexverifiers" to proxy the execution of additional PowerShell scrip. Logsource: windows / process_creation. Rule: title: Potential Script Proxy Execution Via CL_Mutexverifiers.ps1 id: 1e0e1a81-e79b-44bc-935b-ddb9c8006b3d status: test description: Detects the use of the Microsoft signed script "CL_mutexverifiers" to proxy the execution of additional PowerShell script commands references: - https://lolbas-project.github.io/lolbas/Scripts/CL_mutexverifiers/ author: Nasreddine Bencherchali (Nextron Systems), oscd.community, Natalia Shornikova, frack113 date: 2022-05-21 modified: 2023-08-17 tags: - attack.stealth - attack.t1216 logsource: category: process_creation product: windows detection: selection_pwsh: ParentImage|endswith: - \powershell.exe - \pwsh.exe Image|endswith: \powershell.exe CommandLine|contains: ' -nologo -windowstyle minimized -file ' selection_temp: CommandLine|contains: - \AppData\Local\Temp\ - \Windows\Temp\ condition: all of selection_* falsepositives: - Unknown level: medium
Query: common weakness: Data Access Operations Outside of Expected Data Manager Component
Matching passage: CWE-1057 Data Access Operations Outside of Expected Data Manager Component. The product uses a dedicated, central data manager component as required by design, but it contains code that performs data-access operations that do not use this data manager.
Near-miss passage: CWE-396 Declaration of Catch for Generic Exception. Catching overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.
Query: patch priority for CVE-2015-7698
Matching passage: CVE-2015-7698. CWE: CWE-78. CVSS: 9.0. icewind1991 SMB before 1.0.3 allows remote authenticated users to execute arbitrary SMB commands via shell metacharacters in the user argument in the (1) listShares function in Server.php or the (2) connect or (3) read function in Share.php.
Near-miss passage: CVE-2015-7426. CWE: CWE-78. CVSS: 10.0. The Data Protection extension in the VMware GUI in IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual Environments) 7.1 before 7.1.3.0 and Tivoli Storage FlashCopy Manager for VMware (aka Spectrum Protect Snapshot) 4.1 before 4.1.3.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Query: detection rule: Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with M
Matching passage: Sigma rule: Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with M. Logsource: windows / process_creation. Rule: title: Potential Privilege Escalation via Service Permissions Weakness id: 0f9c21f1-6a73-4b0e-9809-cb562cb8d981 status: test description: Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment - https://pentestlab.blog/2017/03/31/insecure-registry-permissions/ author: Teymur Kheirkhabarov date: 2019-10-26 modified: 2024-12-01 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.011 logsource: product: windows category: process_creation detection: selection: IntegrityLevel: - Medium - S-1-16-8192 CommandLine|contains|all: - ControlSet - services CommandLine|contains: - \ImagePath - \FailureCommand - \ServiceDll condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via VAR++ LAUNCHER. Logsource: windows / process_creation. Rule: title: Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION id: e9f55347-2928-4c06-88e5-1a7f8169942e status: test description: Detects Obfuscated Powershell via VAR++ LAUNCHER references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-13 modified: 2022-11-16 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - '&&set' - cmd - /c - -f CommandLine|contains: - '{0}' - '{1}' - '{2}' - '{3}' - '{4}' - '{5}' condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-6031
Matching passage: CVE-2015-6031. CWE: CWE-119. CVSS: 6.800000190734863. Buffer overflow in the IGDstartelt function in igd_desc_parse.c in the MiniUPnP client (aka MiniUPnPc) before 1.9.20150917 allows remote UPNP servers to cause a denial of service (application crash) and possibly execute arbitrary code via an "oversized" XML element name.
Near-miss passage: CVE-2015-0555. CWE: CWE-119. CVSS: 6.800000190734863. Buffer overflow in the XnsSdkDeviceIpInstaller.ocx ActiveX control in Samsung iPOLiS Device Manager 1.12.2 allows remote attackers to execute arbitrary code via a long string in the first argument to the (1) ReadConfigValue or (2) WriteConfigValue function.
Query: CVE similar to CVE-2015-8363
Matching passage: CVE-2015-8363. CWE: CWE-119. CVSS: 6.800000190734863. The jpeg2000_read_main_headers function in libavcodec/jpeg2000dec.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not enforce uniqueness of the SIZ marker in a JPEG 2000 image, which allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via a crafted image with two or more of these markers.
Near-miss passage: CVE-2015-9128. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, and SD 835, lack of validation of the buffer size could lead to a buffer overread.
Query: vulnerability: Cross-site request forgery (CSRF) vulnerability in the WP Smiley plugin 1.4.1 for WordPress allows remote attackers to hijack the authentication of editors for requests that conduc
Matching passage: CVE-2015-4140. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the WP Smiley plugin 1.4.1 for WordPress allows remote attackers to hijack the authentication of editors for requests that conduct cross-site scripting (XSS) attacks via the s4w-more parameter to the smilies4wp.php page to wp-admin/options-general.php.
Near-miss passage: CVE-2015-8379. CWE: CWE-352. CVSS: 8.800000190734863. CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.
Query: vulnerability: The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service (out-of-bounds heap memory access and applicati
Matching passage: CVE-2015-8710. CWE: CWE-119. CVSS: 9.800000190734863. The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service (out-of-bounds heap memory access and application crash), or possibly have unspecified other impact via an unclosed HTML comment.
Near-miss passage: CVE-2015-3095. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5087, CVE-2015-5094, CVE-2015-5100, CVE-2015-5102, CVE-2015-5103, CVE-2015-5104, and CVE-2015-5115.
Query: risk of The Packet Data Network Gateway (aka PGW) component on Cisco ASR 5000 devices with software 18.0.0.59167 and 18.0.0.59211 allows remote attackers to cause a denial of service via a
Matching passage: CVE-2015-4275. CWE: CWE-399. CVSS: 5.0. The Packet Data Network Gateway (aka PGW) component on Cisco ASR 5000 devices with software 18.0.0.59167 and 18.0.0.59211 allows remote attackers to cause a denial of service via a malformed header in a GTPv2 packet, aka Bug ID CSCut11534.
Near-miss passage: CVE-2015-0063. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3; the proofing tools in Office 2010 SP2; Excel 2010 SP2; Excel 2013 Gold, SP1, and RT; Excel Viewer; and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Excel Remote Code Execution Vulnerability."
Query: rule covering Detects the execution of the BCP utility in order to export data from the database. Attackers were seen saving their mal
Matching passage: Sigma rule: Detects the execution of the BCP utility in order to export data from the database. Attackers were seen saving their mal. Logsource: windows / process_creation. Rule: title: Data Export From MSSQL Table Via BCP.EXE id: c615d676-f655-46b9-b913-78729021e5d7 status: test description: 'Detects the execution of the BCP utility in order to export data from the database. Attackers were seen saving their malware to a database column or table and then later extracting it via "bcp.exe" into a file. ' references: - https://docs.microsoft.com/en-us/sql/tools/bcp-utility - https://asec.ahnlab.com/en/61000/ - https://asec.ahnlab.com/en/78944/ - https://www.huntress.com/blog/attacking-mssql-servers - https://www.huntress.com/blog/attacking-mssql-servers-pt-ii - https://news.sophos.com/en-us/2024/08/07/sophos-mdr-hunt-tracks-mimic-ransomware-campaign-against-organizations-in-india/ - https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/ author: Omar Khaled (@beacon_exe), MahirAli Khan (in/mahiralikhan), Nasreddine Bencherchali (Nextron Systems) date: 2024-08-20 tags: - attack.execution - attack.exfiltration - attack.t1048 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \bcp.exe - OriginalFileName: BCP.exe selection_cli: CommandLine|contains: - ' out ' - ' queryout ' condition: all of selection_* falsepositives: - Legitimate data export operations. level: medium
Near-miss passage: Sigma rule: Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence. Logsource: windows / process_creation. Rule: title: Potential Persistence Via Logon Scripts - CommandLine id: 21d856f9-9281-4ded-9377-51a1a6e2a432 related: - id: 0a98a10c-685d-4ab0-bddc-b6bdd1d48458 type: derived status: test description: Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence references: - https://cocomelonc.github.io/persistence/2022/12/09/malware-pers-20.html author: Tom Ueltschi (@c_APT_ure) date: 2019-01-12 modified: 2023-06-09 tags: - attack.privilege-escalation - attack.persistence - attack.t1037.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: UserInitMprLogonScript condition: selection falsepositives: - Legitimate addition of Logon Scripts via the command line by administrators or third party tools level: high
Query: patch priority for CVE-2015-6574
Matching passage: CVE-2015-6574. CWE: CWE-399. CVSS: 7.5. The SNAP Lite component in certain SISCO MMS-EASE and AX-S4 ICCP products allows remote attackers to cause a denial of service (CPU consumption) via a crafted packet.
Near-miss passage: CVE-2015-0032. CWE: CWE-399. CVSS: 9.300000190734863. vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 8 through 11 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "VBScript Memory Corruption Vulnerability."
Query: Sigma rule for Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generate
Matching passage: Sigma rule: Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generate. Logsource: windows / file_event. Rule: title: PSScriptPolicyTest Creation By Uncommon Process id: 1027d292-dd87-4a1a-8701-2abe04d7783c status: test description: Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generated by Microsoft Powershell to test against Applocker. references: - https://www.paloaltonetworks.com/blog/security-operations/stopping-powershell-without-powershell/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-01 modified: 2026-07-28 tags: - attack.stealth logsource: product: windows category: file_event detection: selection: TargetFilename|contains: __PSScriptPolicyTest_ filter_main_powershell: Image: - C:\Program Files\PowerShell\7-preview\pwsh.exe - C:\Program Files\PowerShell\7\pwsh.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe filter_main_pwsh_preview: Image|contains: - C:\Program Files\WindowsApps\Microsoft.PowerShellPreview - \AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview Image|endswith: \pwsh.exe filter_main_generic: Image: - C:\Windows\System32\dsac.exe - C:\Windows\System32\sdiagnhost.exe - C:\Windows\System32\ServerManager.exe - C:\Windows\System32\wsmprovhost.exe - C:\Windows\SysWOW64\sdiagnhost.exe filter_optional_gethelp: Image|startswith: C:\Program Files\WindowsApps\Microsoft.GetHelp_ Image|endswith: \GetHelp.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Extract data from cab file and hide it in an alternate data stream. Logsource: windows / process_creation. Rule: title: Suspicious Extrac32 Alternate Data Stream Execution id: 4b13db67-0c45-40f1-aba8-66a1a7198a1e status: test description: Extract data from cab file and hide it in an alternate data stream references: - https://lolbas-project.github.io/lolbas/Binaries/Extrac32/ author: frack113 date: 2021-11-26 modified: 2022-12-30 tags: - attack.stealth - attack.t1564.004 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - extrac32.exe - .cab CommandLine|re: :[^\\] condition: selection falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-4529
Matching passage: CVE-2015-4529. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in EMC Documentum WebTop before 6.8P02, Documentum Administrator before 7.2P01, Documentum Digital Assets Manager through 6.5SP6, Documentum Web Publishers through 6.5SP7, and Documentum Task Space through 6.7SP2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
Near-miss passage: CVE-2015-0868. CWE: UNKNOWN. CVSS: 7.5. Unrestricted file upload vulnerability in Mrs. Shiromuku Perl CGI shiromuku(bu2)BBS before 2.91 allows remote attackers to execute arbitrary code by uploading an executable file.
Query: rule covering Detects applications or users re-enabling old TLS versions by setting the "Enabled" value to "1" for the "Protocols" reg
Matching passage: Sigma rule: Detects applications or users re-enabling old TLS versions by setting the "Enabled" value to "1" for the "Protocols" reg. Logsource: windows / registry_set. Rule: title: Old TLS1.0/TLS1.1 Protocol Version Enabled id: 439957a7-ad86-4a8f-9705-a28131c6821b status: test description: Detects applications or users re-enabling old TLS versions by setting the "Enabled" value to "1" for the "Protocols" registry key. references: - https://techcommunity.microsoft.com/t5/windows-it-pro-blog/tls-1-0-and-tls-1-1-soon-to-be-disabled-in-windows/ba-p/3887947 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-05 tags: - attack.stealth logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\ - \Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\ TargetObject|endswith: \Enabled Details: DWORD (0x00000001) condition: selection falsepositives: - Legitimate enabling of the old tls versions due to incompatibility level: medium
Near-miss passage: Sigma rule: Detects a WMI backdoor in Exchange Transport Agents via WMI event filters. Logsource: windows / process_creation. Rule: title: WMI Backdoor Exchange Transport Agent id: 797011dc-44f4-4e6f-9f10-a8ceefbe566b status: test description: Detects a WMI backdoor in Exchange Transport Agents via WMI event filters references: - https://twitter.com/cglyer/status/1182389676876980224 - https://twitter.com/cglyer/status/1182391019633029120 author: Florian Roth (Nextron Systems) date: 2019-10-11 modified: 2023-02-08 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.003 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \EdgeTransport.exe filter_conhost: Image: C:\Windows\System32\conhost.exe filter_oleconverter: Image|startswith: C:\Program Files\Microsoft\Exchange Server\ Image|endswith: \Bin\OleConverter.exe condition: selection and not 1 of filter_* falsepositives: - Unknown level: critical
Query: Sigma rule for Detects the creation of files with scripting or executable extensions by Mysql daemon. Which could be an indicator of "U
Matching passage: Sigma rule: Detects the creation of files with scripting or executable extensions by Mysql daemon. Which could be an indicator of "U. Logsource: windows / file_event. Rule: title: Uncommon File Creation By Mysql Daemon Process id: c61daa90-3c1e-4f18-af62-8f288b5c9aaf status: test description: 'Detects the creation of files with scripting or executable extensions by Mysql daemon. Which could be an indicator of "User Defined Functions" abuse to download malware. ' references: - https://asec.ahnlab.com/en/58878/ - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-recon-mysql-malware-infection-via-user-defined-functions-udf/ author: Joseph Kamau date: 2024-05-27 tags: - attack.stealth logsource: product: windows category: file_event detection: selection: Image|endswith: - \mysqld.exe - \mysqld-nt.exe TargetFilename|endswith: - .bat - .dat - .dll - .exe - .ps1 - .psm1 - .vbe - .vbs condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a. Logsource: windows / process_creation. Rule: title: Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script id: 7aa4e81a-a65c-4e10-9f81-b200eb229d7d related: - id: 236d8e89-ed95-4789-a982-36f4643738ba type: derived status: test description: Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state references: - https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/ - https://www.hexacorn.com/blog/2017/01/14/beyond-good-ol-run-key-part-53/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-14 tags: - attack.execution - attack.persistence - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \VMwareToolBoxCmd.exe - OriginalFileName: toolbox-cmd.exe selection_cli: CommandLine|contains|all: - ' script ' - ' set ' condition: all of selection_* falsepositives: - Unknown level: medium
Query: common weakness: Reliance on Component That is Not Updateable
Matching passage: CWE-1329 Reliance on Component That is Not Updateable. The product contains a component that cannot be updated or patched in order to remove vulnerabilities or significant bugs.
Near-miss passage: CWE-469 Use of Pointer Subtraction to Determine Size. The product subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk.
Query: vulnerability: Background For regular, unencrypted FTP traffic, the FTP ALG can inspect the unencrypted control channel and open related sessions for the FTP data channel. These related sessions 
Matching passage: CVE-2015-5361. CWE: CWE-326. CVSS: 6.5. Background For regular, unencrypted FTP traffic, the FTP ALG can inspect the unencrypted control channel and open related sessions for the FTP data channel. These related sessions (gates) are specific to source and destination IPs and ports of client and server. The design intent of the ftps-extensions option (which is disabled by default) is to provide similar functionality when the SRX secures the FTP/FTPS client. As the control channel is encrypted, the FTP ALG cannot inspect the port specific information and will open a wider TCP data channel (gate) from client IP to server IP on all destination TCP ports. In FTP/FTPS client environments to an enterprise network or the Internet, this is the desired behavior as it allows firewall policy to be written to FTP/FTPS servers on well-known control ports without using a policy with destination IP ANY and destination port ANY. Issue The ftps-extensions option is not intended or recommended where the SRX secures the FTPS server, as the wide data channel session (gate) will allow the FTPS client temporary access to all TCP ports on the FTPS server. The data session is associated to the control channel and will be closed when the control channel session closes. Depending on the configuration of the FTPS server, supporting load-balancer, and SRX inactivity-timeout values, the server/load-balancer and SRX may keep the control channel open for an extended period of time, allowing an FTPS client access for an equal duration.​ Note that the ftps-extensions option is not enabled by default.
Near-miss passage: CVE-2015-8085. CWE: CWE-326. CVSS: 4.900000095367432. Huawei AR routers with software before V200R007C00SPC100; Quidway S9300 routers with software before V200R009C00; S12700 routers with software before V200R008C00SPC500; S9300, Quidway S5300, and S5300 routers with software before V200R007C00; and S5700 routers with software before V200R007C00SPC500 make it easier for remote authenticated administrators to obtain and decrypt passwords by leveraging selection of a reversible encryption algorithm.
Query: patch priority for CVE-2015-1429
Matching passage: CVE-2015-1429. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in Cybele Software Thinfinity Remote Desktop Workstation 3.0.0.3 32-bit and 64-bit allows remote attackers to download arbitrary files via a .. (dot dot) in an unspecified parameter.
Near-miss passage: CVE-2015-1396. CWE: CWE-22. CVSS: 7.5. A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file. NOTE: this issue exists because of an incomplete fix for CVE-2015-1196.