alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code from them, is accessible by the attacker, a
Matching passage: CVE-2015-4165. CWE: CWE-264. CVSS: 7.5. The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code from them, is accessible by the attacker, and the Java VM on which Elasticsearch is running can write to a location that the other application can read and execute from, allows remote authenticated users to write to and create arbitrary snapshot metadata files, and potentially execute arbitrary code.
Near-miss passage: CVE-2015-1703. CWE: CWE-264. CVSS: 6.800000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-1704.
Query: alert when Detects a method to load DLL via LSASS process using an undocumented Registry key
Matching passage: Sigma rule: Detects a method to load DLL via LSASS process using an undocumented Registry key. Logsource: windows / registry_event. Rule: title: DLL Load via LSASS id: b3503044-60ce-4bf4-bbcb-e3db98788823 status: test description: Detects a method to load DLL via LSASS process using an undocumented Registry key references: - https://blog.xpnsec.com/exploring-mimikatz-part-1/ - https://twitter.com/SBousseaden/status/1183745981189427200 author: Florian Roth (Nextron Systems) date: 2019-10-16 modified: 2022-04-21 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1547.008 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: - \CurrentControlSet\Services\NTDS\DirectoryServiceExtPt - \CurrentControlSet\Services\NTDS\LsaDbExtPt filter_domain_controller: Image: C:\Windows\system32\lsass.exe Details: - '%%systemroot%%\system32\ntdsa.dll' - '%%systemroot%%\system32\lsadb.dll' condition: selection and not 1 of filter_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of the RunXCmd tool to execute commands with System or TrustedInstaller accounts. Logsource: windows / process_creation. Rule: title: PUA - RunXCmd Execution id: 93199800-b52a-4dec-b762-75212c196542 status: test description: Detects the use of the RunXCmd tool to execute commands with System or TrustedInstaller accounts references: - https://www.d7xtech.com/free-software/runx/ - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/ author: Florian Roth (Nextron Systems) date: 2022-01-24 modified: 2023-02-14 tags: - attack.execution - attack.t1569.002 - attack.s0029 logsource: category: process_creation product: windows detection: selection_account: CommandLine|contains: - ' /account=system ' - ' /account=ti ' selection_exec: CommandLine|contains: /exec= condition: all of selection_* falsepositives: - Legitimate use by administrators level: high
Query: detection rule: Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility.
Matching passage: Sigma rule: Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility.. Logsource: windows / ps_module. Rule: title: HackTool - Evil-WinRm Execution - PowerShell Module id: 9fe55ea2-4cd6-4491-8a54-dd6871651b51 status: test description: 'Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility. ' references: - https://github.com/Hackplayers/evil-winrm/blob/7514b055d67ec19836e95c05bd63e7cc47c4c2aa/evil-winrm.rb - https://github.com/search?q=repo%3AHackplayers%2Fevil-winrm++shell.run%28&type=code author: Nasreddine Bencherchali (Nextron Systems) date: 2024-02-25 tags: - attack.lateral-movement logsource: product: windows category: ps_module detection: selection_wsm: ContextInfo|contains: - :\Windows\System32\wsmprovhost.exe - :\Windows\SysWOW64\wsmprovhost.exe selection_payload_1: Payload|contains: - value="(get-location).path - value="(get-item*).length - 'Invoke-Binary ' - Donut-Loader -process_id*-donutfile - Bypass-4MSI - IEX ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($a))).replace('???','') selection_payload_2: Payload|contains|all: - $servicios = Get-ItemProperty "registry::HKLM\System\CurrentControlSet\Services\" - Where-Object {$_.imagepath -notmatch "system" -and $_.imagepath -ne $null } | Select-Object pschildname,imagepath selection_payload_3: Payload|contains|all: - $a += \"$($_.FullName.Replace('\\','/'))/\"}else{ $a += \"$($_.FullName.Replace('\\', '/'))\" } - $a=@();$ condition: selection_wsm and 1 of selection_payload_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc.. Logsource: windows / file_event. Rule: title: PowerShell Module File Created id: e36941d0-c0f0-443f-bc6f-cb2952eb69ea status: test description: Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc. references: - Internal Research - https://learn.microsoft.com/en-us/powershell/scripting/developer/module/understanding-a-windows-powershell-module?view=powershell-7.3 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-09 tags: - attack.persistence logsource: category: file_event product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe TargetFilename|contains: - \WindowsPowerShell\Modules\ - \PowerShell\7\Modules\ condition: selection falsepositives: - Likely level: low
Query: describe CVE-2015-5531
Matching passage: CVE-2015-5531. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.
Near-miss passage: CVE-2015-0552. CWE: CWE-22. CVSS: 6.400000095367432. Directory traversal vulnerability in the gcab_folder_extract function in libgcab/gcab-folder.c in gcab 0.4 allows remote attackers to write to arbitrary files via crafted path in a CAB file, as demonstrated by "\tmp\moo."
Query: threat report mentioning Email Forwarding Rule
Matching passage: T1114.003 Email Forwarding Rule. Tactics: collection. Description: Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.(Citation: Pfammatter - Hidden Inbox Rules) Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient. These rules may be created through a local email application, a web interface, or by command-line interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2)(Citation: Mac Forwarding Rules) Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more. Adversaries may also hide the rule by making use of the Microsoft Messaging API (MAPI) to modify the rule properties, making it hidden and not visible from Outlook, OWA or most Exchange Administration tools.(Citation: Pfammatter - Hidden Inbox Rules) In some environments, administrators may be able to enable email forwarding rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.(Citation: Microsof
Near-miss passage: T1114 Email Collection. Tactics: collection. Description: Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses.(Citation: TrustedSec OOB Communications)(Citation: CISA AA20-352A 2021) Adversaries can collect or forward email from mail servers or clients.
Query: threat report mentioning Safe Mode Boot
Matching passage: T1688 Safe Mode Boot. Tactics: defense impairment. Description: Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot.(Citation: Microsoft Windows Startup Settings)(Citation: Sophos Safe Mode Boot) Adversaries may abuse safe mode to disable endpoint defenses that may not start with a limited boot. Hosts can be forced into safe mode after the next reboot via modifications to Boot Configuration Data (BCD) stores, which are files that manage boot application settings.(Citation: Microsoft bcdedit) Adversaries may also add their malicious applications to the list of minimal services that start in safe mode by modifying relevant Registry values (i.e. [Modify Registry](https://attack.mitre.org/techniques/T1112)). Malicious [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) objects may also be registered and loaded in safe mode.(Citation: CyberArk Labs Safe Mode 2016)(Citation: Cybereason safe mode boot)(Citation: BleepingComputer REvil 2021)
Near-miss passage: T1556.001 Domain Controller Authentication. Tactics: defense impairment, persistence, credential access. Description: Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts. Malware may be used to inject false credentials into the authentication process on a domain controller with the intent of creating a backdoor used to access any user’s account and/or credentials (ex: [Skeleton Key](https://attack.mitre.org/software/S0007)). Skeleton key works through a patch on an enterprise domain controller authentication process (LSASS) with credentials that adversaries may use to bypass the standard authentication system. Once patched, an adversary can use the injected password to successfully authenticate as any domain user account (until the the skeleton key is erased from memory by a reboot of the domain controller). Authenticated access may enable unfettered access to hosts and/or resources within single-factor authentication environments.(Citation: Dell Skeleton)
Query: patch priority for CVE-2015-5371
Matching passage: CVE-2015-5371. CWE: UNKNOWN. CVSS: 10.0. The AuthenticationFilter class in SolarWinds Storage Manager allows remote attackers to upload and execute arbitrary scripts via unspecified vectors.
Near-miss passage: CVE-2015-3054. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3053, CVE-2015-3055, CVE-2015-3059, and CVE-2015-3075.
Query: vulnerability: Belkin F9K1102 2 devices with firmware 2.10.17 rely on client-side JavaScript code for authorization, which allows remote attackers to obtain administrative privileges via certain 
Matching passage: CVE-2015-5989. CWE: CWE-264. CVSS: 9.800000190734863. Belkin F9K1102 2 devices with firmware 2.10.17 rely on client-side JavaScript code for authorization, which allows remote attackers to obtain administrative privileges via certain changes to LockStatus and Login_Success values.
Near-miss passage: CVE-2015-3865. CWE: CWE-264. CVSS: 9.300000190734863. The Runtime subsystem in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23050463.
Query: risk of Unspecified vulnerability in the XDB - XML Database component in Oracle Database Server 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confi
Matching passage: CVE-2015-0455. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the XDB - XML Database component in Oracle Database Server 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors.
Near-miss passage: CVE-2015-6051. CWE: UNKNOWN. CVSS: 4.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Internet Explorer Elevation of Privilege Vulnerability."
Query: CVE similar to CVE-2015-6700
Matching passage: CVE-2015-6700. CWE: CWE-772. CVSS: 5.0. The setBackground function in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to obtain sensitive information from process memory via invalid arguments, a different vulnerability than CVE-2015-6697, CVE-2015-6699, CVE-2015-6701, CVE-2015-6702, CVE-2015-6703, and CVE-2015-6704.
Near-miss passage: CVE-2015-6704. CWE: CWE-772. CVSS: 4.300000190734863. The animations property implementation in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to obtain sensitive information from process memory via a function call, a different vulnerability than CVE-2015-6697, CVE-2015-6699, CVE-2015-6700, CVE-2015-6701, CVE-2015-6702, and CVE-2015-6703.
Query: exploit Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the Business Search (search_no
Matching passage: CVE-2015-3935. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the Business Search (search_nom) field to (1) htdocs/societe/societe.php or (2) htdocs/societe/admin/societe.php.
Near-miss passage: CVE-2015-4380. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Linear Case module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Query: weakness Source Code File with Excessive Number of Lines of Code
Matching passage: CWE-1080 Source Code File with Excessive Number of Lines of Code. A source code file has too many lines of code.
Near-miss passage: CWE-213 Exposure of Sensitive Information Due to Incompatible Policies. The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.
Query: vulnerability: The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizar
Matching passage: CVE-2015-2794. CWE: CWE-264. CVSS: 9.800000190734863. The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.
Near-miss passage: CVE-2015-6768. CWE: CWE-264. CVSS: 7.5. The DOM implementation in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-6770.
Query: describe CVE-2015-7431
Matching passage: CVE-2015-7431. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Queue Watcher in IBM Sterling B2B Integrator 5.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-8010. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inject arbitrary web script or HTML via the query string to cgi-bin/status.cgi.
Query: alert when Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat a
Matching passage: Sigma rule: Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat a. Logsource: windows / process_creation. Rule: title: AADInternals PowerShell Cmdlets Execution - ProccessCreation id: c86500e9-a645-4680-98d7-f882c70c1ea3 related: - id: 91e69562-2426-42ce-a647-711b8152ced6 type: similar status: test description: Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365. references: - https://o365blog.com/aadinternals/ - https://github.com/Gerenios/AADInternals author: Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2022-12-23 modified: 2025-02-06 tags: - attack.execution - attack.reconnaissance - attack.discovery - attack.credential-access - attack.impact logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: - \powershell.exe - \powershell_ise.exe - \pwsh.exe - OriginalFileName: - PowerShell.Exe - pwsh.dll selection_cli: CommandLine|contains: - Add-AADInt - ConvertTo-AADInt - Disable-AADInt - Enable-AADInt - Export-AADInt - Find-AADInt - Get-AADInt - Grant-AADInt - Initialize-AADInt - Install-AADInt - Invoke-AADInt - Join-AADInt - New-AADInt - Open-AADInt - Read-AADInt - Register-AADInt - Remove-AADInt - Reset-AADInt - Resolve-AADInt - Restore-AADInt - Save-AADInt - Search-AADInt - Send-AADInt - Set-AADInt - Start-AADInt - Unprotect-AADInt - Update-AADInt condition: all of selection_* falsepositives: - Legitimate use of the library for administrative activity level: high
Near-miss passage: Sigma rule: Detects when the "Windows Defender Threat Protection" service is disabled.. Logsource: windows / system. Rule: title: Windows Defender Threat Detection Service Disabled id: 6c0a7755-6d31-44fa-80e1-133e57752680 related: - id: fe34868f-6e0e-4882-81f6-c43aa8f15b62 type: derived status: stable description: Detects when the "Windows Defender Threat Protection" service is disabled. references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md author: Ján Trenčanský, frack113 date: 2020-07-28 modified: 2024-07-02 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: system detection: selection: EventID: 7036 Provider_Name: Service Control Manager param1: - Windows Defender Antivirus Service - Service antivirus Microsoft Defender param2: - stopped - arrêté condition: selection falsepositives: - Administrator actions - Auto updates of Windows Defender causes restarts level: medium
Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects registry modifications that disable internal tools or functions in explorer (malware like Agent Tesla uses this. Logsource: windows / registry_set. Rule: title: Registry Explorer Policy Modification id: 1c3121ed-041b-4d97-a075-07f54f20fb4a status: test description: Detects registry modifications that disable internal tools or functions in explorer (malware like Agent Tesla uses this technique) references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md author: frack113 date: 2022-03-18 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection_set_1: TargetObject|endswith: - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogOff - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileMenu - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetTaskbar - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyDocuments - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu Details: DWORD (0x00000001) condition: selection_set_1 falsepositives: - Legitimate admin script level: medium
Near-miss passage: Sigma rule: Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be. Logsource: windows / ps_script. Rule: title: Powershell Local Email Collection id: 2837e152-93c8-43d2-85ba-c3cd3c2ae614 status: test description: 'Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a users local system, such as Outlook storage or cache files. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1114.001/T1114.001.md author: frack113 date: 2021-07-21 modified: 2022-12-25 tags: - attack.collection - attack.t1114.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Get-Inbox.ps1 - Microsoft.Office.Interop.Outlook - Microsoft.Office.Interop.Outlook.olDefaultFolders - -comobject outlook.application condition: selection falsepositives: - Unknown level: medium