alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-9460
Matching passage: CVE-2015-9460. CWE: CWE-89. CVSS: 8.800000190734863. The booking-system plugin before 2.1 for WordPress has DOPBSPBackEndTranslation::display SQL injection via the language parameter.
Near-miss passage: CVE-2015-1397. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set.
Query: Sigma rule for Detect use of Get-GPO to get one GPO or all the GPOs in a domain.
Matching passage: Sigma rule: Detect use of Get-GPO to get one GPO or all the GPOs in a domain.. Logsource: windows / ps_script. Rule: title: Suspicious GPO Discovery With Get-GPO id: eb2fd349-ec67-4caa-9143-d79c7fb34441 status: test description: Detect use of Get-GPO to get one GPO or all the GPOs in a domain. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1615/T1615.md - https://learn.microsoft.com/en-us/powershell/module/grouppolicy/get-gpo?view=windowsserver2022-ps author: frack113 date: 2022-06-04 tags: - attack.discovery - attack.t1615 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: Get-GPO condition: selection falsepositives: - Legitimate PowerShell scripts level: low
Near-miss passage: Sigma rule: An adversary might use WMI to check if a certain remote service is running on a remote device. When the test completes,. Logsource: windows / process_creation. Rule: title: Service Reconnaissance Via Wmic.EXE id: 76f55eaa-d27f-4213-9d45-7b0e4b60bbae related: - id: 68bcd73b-37ef-49cb-95fc-edc809730be6 type: similar status: test description: 'An adversary might use WMI to check if a certain remote service is running on a remote device. When the test completes, a service information will be displayed on the screen if it exists. A common feedback message is that "No instance(s) Available" if the service queried is not running. A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the provided remote host is unreachable ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-service author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-02-14 modified: 2026-01-07 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WMIC.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains: service filter_main_manipulation: CommandLine|contains: - stopservice - startservice filter_main_win32_methods: CommandLine|contains: - Change - Create - Delete - PauseService - ResumeService - SetSecurityDescriptor - StartService - StopService - UserControlService condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium simulation: - type: atomic-red-team name: WMI Reconnaissance List Remote Services technique: T1047 atomic_guid: 0fd48ef7-d890-4e93-a533-f7dedd5191d3 regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_service/info.yml
Query: vulnerability: The wp-polls plugin before 2.72 for WordPress has SQL injection.
Matching passage: CVE-2015-9352. CWE: CWE-89. CVSS: 9.800000190734863. The wp-polls plugin before 2.72 for WordPress has SQL injection.
Near-miss passage: CVE-2015-9449. CWE: CWE-89. CVSS: 7.199999809265137. The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter.
Query: exploit Directory traversal vulnerability in Avast before 150918-0 allows remote attackers to delete or write to arbitrary files via a crafted entry in a ZIP archive.
Matching passage: CVE-2015-5662. CWE: CWE-22. CVSS: 6.400000095367432. Directory traversal vulnerability in Avast before 150918-0 allows remote attackers to delete or write to arbitrary files via a crafted entry in a ZIP archive.
Near-miss passage: CVE-2015-8794. CWE: CWE-22. CVSS: 6.5. Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via a full pathname in the _alt parameter, related to contact photo handling.
Query: secure coding against Insecure Storage of Sensitive Information
Matching passage: CWE-922 Insecure Storage of Sensitive Information. The product stores sensitive information without properly limiting read or write access by unauthorized actors.
Near-miss passage: CWE-1038 Insecure Automated Optimizations. The product uses a mechanism that automatically optimizes code, e.g. to improve a characteristic such as performance, but the optimizations can have an unintended side effect that might violate an intended security assumption.
Query: Encoded PowerShell / command-line abuse matching Time Based Checks
Matching passage: T1497.003 Time Based Checks. Tactics: stealth, discovery. Description: Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. This may include enumerating time-based properties, such as uptime or the system clock. Adversaries may use calls like `GetTickCount` and `GetSystemTimeAsFileTime` to discover if they are operating within a virtual machine or sandbox, or may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.(Citation: ISACA Malware Tricks)
Near-miss passage: T1497 Virtualization/Sandbox Evasion. Tactics: stealth, discovery. Description: Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness) Adversaries may use several methods to accomplish [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) such as checking for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) or other system artifacts associated with analysis or virtualization. Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment. Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.(Citation: Unit 42 Pirpi July 2015)
Query: vulnerability: The ucnv_io_getConverterName function in common/ucnv_io.cpp in International Components for Unicode (ICU), as used in Google Chrome before 44.0.2403.89, mishandles converter names 
Matching passage: CVE-2015-1270. CWE: CWE-19. CVSS: 6.800000190734863. The ucnv_io_getConverterName function in common/ucnv_io.cpp in International Components for Unicode (ICU), as used in Google Chrome before 44.0.2403.89, mishandles converter names with initial x- substrings, which allows remote attackers to cause a denial of service (read of uninitialized memory) or possibly have unspecified other impact via a crafted file.
Near-miss passage: CVE-2015-7979. CWE: CWE-19. CVSS: 7.5. NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server association tear down) by sending broadcast packets with invalid authentication to a broadcast client.
Query: Sigma YAML for windows / dns_query
Matching passage: Sigma rule: Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes. Logsource: windows / dns_query. Rule: title: DNS Query for Anonfiles.com Domain - Sysmon id: 065cceea-77ec-4030-9052-fc0affea7110 related: - id: 29f171d7-aa47-42c7-9c7b-3c87938164d9 type: similar status: test description: Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes references: - https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte author: pH-T (Nextron Systems) date: 2022-07-15 modified: 2023-01-16 tags: - attack.exfiltration - attack.t1567.002 logsource: product: windows category: dns_query detection: selection: QueryName|contains: .anonfiles.com condition: selection falsepositives: - Rare legitimate access to anonfiles.com level: high
Near-miss passage: Sigma rule: Detects usage of the "usermod" binary to add users add users to the root or suoders groups. Logsource: linux / process_creation. Rule: title: User Added To Root/Sudoers Group Using Usermod id: 6a50f16c-3b7b-42d1-b081-0fdd3ba70a73 status: test description: Detects usage of the "usermod" binary to add users add users to the root or suoders groups references: - https://pberba.github.io/security/2021/11/23/linux-threat-hunting-for-persistence-account-creation-manipulation/ - https://www.configserverfirewall.com/ubuntu-linux/ubuntu-add-user-to-root-group/ author: TuanLe (GTSC) date: 2022-12-21 tags: - attack.privilege-escalation - attack.persistence logsource: product: linux category: process_creation detection: selection: Image|endswith: /usermod CommandLine|contains: - -aG root - -aG sudoers condition: selection falsepositives: - Legitimate administrator activities level: medium
Query: weakness J2EE Bad Practices: Direct Use of Sockets
Matching passage: CWE-246 J2EE Bad Practices: Direct Use of Sockets. The J2EE application directly uses sockets instead of using framework method calls.
Near-miss passage: CWE-610 Externally Controlled Reference to a Resource in Another Sphere. The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
Query: describe CVE-2015-1905
Matching passage: CVE-2015-1905. CWE: CWE-264. CVSS: 4.0. The REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to bypass intended access restrictions on task-variable value changes via unspecified vectors.
Near-miss passage: CVE-2015-5043. CWE: CWE-264. CVSS: 7.199999809265137. diag in IBM Security Guardium 8.2 before p6015, 9.0 before p6015, 9.1, 9.5, and 10.0 before p6015 allows local users to obtain root access via unspecified key sequences.
Query: exploit Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-OpenBSD platforms might allow local users to gain privileges b
Matching passage: CVE-2015-6564. CWE: CWE-264. CVSS: 7.0. Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-OpenBSD platforms might allow local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request.
Near-miss passage: CVE-2015-4306. CWE: CWE-264. CVSS: 8.5. The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended login-session read restrictions, and impersonate administrators of arbitrary tenant domains, by discovering a session identifier and constructing a crafted URL, aka Bug IDs CSCus88343 and CSCus88334.
Query: patch priority for CVE-2015-1735
Matching passage: CVE-2015-1735. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1740, CVE-2015-1744, CVE-2015-1745, and CVE-2015-1766.
Near-miss passage: CVE-2015-5747. CWE: CWE-399. CVSS: 4.900000095367432. The fasttrap driver in the kernel in Apple OS X before 10.10.5 allows local users to cause a denial of service (resource consumption) via unspecified vectors.
Query: describe CVE-2015-0508
Matching passage: CVE-2015-0508. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB, a different vulnerability than CVE-2015-0506.
Near-miss passage: CVE-2015-8597. CWE: UNKNOWN. CVSS: 7.400000095367432. Open redirect vulnerability in Blue Coat ProxySG 6.5 before 6.5.8.8 and 6.6 and Advanced Secure Gateway (ASG) 6.6 might allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a base64-encoded URL in conjunction with a "clear text" one in a coaching page, as demonstrated by "http://www.%humbug-URL%.local/bluecoat-splash-API?%BASE64-URL%."
Query: vulnerability: WebKit in Apple iOS before 9.2 and Safari before 9.0.2 misparses content extensions, which allows remote attackers to obtain sensitive browsing-history information via a crafted we
Matching passage: CVE-2015-7050. CWE: CWE-200. CVSS: 4.300000190734863. WebKit in Apple iOS before 9.2 and Safari before 9.0.2 misparses content extensions, which allows remote attackers to obtain sensitive browsing-history information via a crafted web site.
Near-miss passage: CVE-2015-5898. CWE: CWE-200. CVSS: 2.0999999046325684. CFNetwork in Apple iOS before 9 relies on the hardware UID for its cache encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.
Query: patch priority for CVE-2015-1398
Matching passage: CVE-2015-1398. CWE: CWE-22. CVSS: 6.5. Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute certain PHP files via (1) .. (dot dot) sequences in the PATH_INFO to index.php or (2) vectors involving a block value in the ___directive parameter to the Cms_Wysiwyg controller in the Adminhtml module, related to the blockDirective function and the auto loading mechanism. NOTE: vector 2 might not cross privilege boundaries, since administrators might already have the privileges to execute code and upload files.
Near-miss passage: CVE-2015-1395. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrary files with the permissions of the target user via a .. (dot dot) in a diff file name.
Query: secure coding against Improper Link Resolution Before File Access ('Link Following')
Matching passage: CWE-59 Improper Link Resolution Before File Access ('Link Following'). The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Near-miss passage: CWE-665 Improper Initialization. The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
Query: actor TTPs: Local Storage Discovery
Matching passage: T1680 Local Storage Discovery. Tactics: discovery. Description: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number. This can be done to prepare for ransomware-related encryption, to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0109), or as a precursor to [Direct Volume Access](https://attack.mitre.org/techniques/T1006). On ESXi systems, adversaries may use [Hypervisor CLI](https://attack.mitre.org/techniques/T1059/012) commands such as `esxcli` to list storage connected to the host as well as `.vmdk` files.(Citation: TrendMicro)(Citation: TrendMicro ESXI Ransomware) On Windows systems, adversaries can use `wmic logicaldisk get` to find information about local network drives. They can also use `Get-PSDrive` in PowerShell to retrieve drives and may additionally use Windows API functions such as `GetDriveType`.(Citation: Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024)(Citation: Volexity) Linux has commands such as `parted`, `lsblk`, `fdisk`, `lshw`, and `df` that can list information about disk partitions such as size, type, file system types, and free space. The command `diskutil` on MacOS can be used to list disks while `system_profiler SPStorageDataType` can additionally show information such as a volume’s mount path, file system, and the type of drive in the system. Infrastructure as a Service (IaaS) cloud providers also have commands for storage discovery such as `describe volume` in AWS, `gcloud compute disks list` in GCP, and `az disk list` in Azure.(Citation: AWS docs describe volumes)(Citation: GCP gcloud compute disks list)(Citation: azure az disk)
Near-miss passage: T1538 Cloud Service Dashboard. Tactics: discovery. Description: An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features. For example, the GCP Command Center can be used to view all assets, review findings of potential security risks, and run additional queries, such as finding public IP addresses and open ports.(Citation: Google Command Center Dashboard) Depending on the configuration of the environment, an adversary may be able to enumerate more information via the graphical dashboard than an API. This also allows the adversary to gain information without manually making any API requests.
Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detect change of the user account associated with the FAX service to avoid the escalation problem.. Logsource: windows / registry_set. Rule: title: Change User Account Associated with the FAX Service id: e3fdf743-f05b-4051-990a-b66919be1743 status: test description: Detect change of the user account associated with the FAX service to avoid the escalation problem. references: - https://twitter.com/dottor_morte/status/1544652325570191361 - https://raw.githubusercontent.com/RiccardoAncarani/talks/master/F-Secure/unorthodox-lateral-movement.pdf author: frack113 date: 2022-07-17 modified: 2022-12-30 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection: TargetObject: HKLM\System\CurrentControlSet\Services\Fax\ObjectName filter: Details|contains: NetworkService condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other. Logsource: windows / process_creation. Rule: title: PUA - System Informer Execution id: 5722dff1-4bdd-4949-86ab-fbaf707e767a related: - id: 811e0002-b13b-4a15-9d00-a613fce66e42 type: similar status: test description: Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations references: - https://github.com/winsiderss/systeminformer author: Florian Roth (Nextron Systems) date: 2023-05-08 modified: 2024-11-23 tags: - attack.persistence - attack.privilege-escalation - attack.discovery - attack.stealth - attack.t1082 - attack.t1564 - attack.t1543 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \SystemInformer.exe - OriginalFileName: SystemInformer.exe - Description: System Informer - Product: System Informer - Hashes|contains: - MD5=19426363A37C03C3ED6FEDF57B6696EC - SHA1=8B12C6DA8FAC0D5E8AB999C31E5EA04AF32D53DC - SHA256=8EE9D84DE50803545937A63C686822388A3338497CDDB660D5D69CF68B68F287 - IMPHASH=B68908ADAEB5D662F87F2528AF318F12 condition: selection falsepositives: - System Informer is regularly used legitimately by system administrators or developers. Apply additional filters accordingly level: medium
Query: alert when Identifies when a service principal was removed in Azure.
Matching passage: Sigma rule: Identifies when a service principal was removed in Azure.. Logsource: azure / auditlogs. Rule: title: Azure Service Principal Removed id: 448fd1ea-2116-4c62-9cde-a92d120e0f08 status: test description: Identifies when a service principal was removed in Azure. references: - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory - https://techcommunity.microsoft.com/blog/microsoft-entra-blog/keeping-track-of-object-deletions-in-microsoft-entra-id/4053415 author: Austin Songer @austinsonger date: 2021-09-03 modified: 2026-04-30 tags: - attack.stealth logsource: product: azure service: auditlogs detection: selection: operationName: Remove service principal condition: selection falsepositives: - Service principal being removed may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Service principal removed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects remote thread creation from CACTUSTORCH as described in references.. Logsource: windows / create_remote_thread. Rule: title: HackTool - CACTUSTORCH Remote Thread Creation id: 2e4e488a-6164-4811-9ea1-f960c7359c40 status: test description: Detects remote thread creation from CACTUSTORCH as described in references. references: - https://twitter.com/SBousseaden/status/1090588499517079552 - https://github.com/mdsecactivebreach/CACTUSTORCH author: '@SBousseaden (detection), Thomas Patzke (rule)' date: 2019-02-01 modified: 2023-05-05 tags: - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1055.012 - attack.t1059.005 - attack.t1059.007 - attack.t1218.005 logsource: product: windows category: create_remote_thread detection: selection: SourceImage|endswith: - \System32\cscript.exe - \System32\wscript.exe - \System32\mshta.exe - \winword.exe - \excel.exe TargetImage|contains: \SysWOW64\ StartModule: null condition: selection falsepositives: - Unknown level: high