alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: The login function in the RequestController class in Moxa OnCell Central Manager before 2.2 has a hardcoded root password, which allows remote attackers to obtain administrative ac
Matching passage: CVE-2015-6481. CWE: UNKNOWN. CVSS: 8.300000190734863. The login function in the RequestController class in Moxa OnCell Central Manager before 2.2 has a hardcoded root password, which allows remote attackers to obtain administrative access via a login session.
Near-miss passage: CVE-2015-4778. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790.
Query: common weakness: Externally Controlled Reference to a Resource in Another Sphere
Matching passage: CWE-610 Externally Controlled Reference to a Resource in Another Sphere. The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
Near-miss passage: CWE-616 Incomplete Identification of Uploaded File Variables (PHP). The PHP application uses an old method for processing uploaded files by referencing the four global variables that are set for each file (e.g. $varname, $varname_size, $varname_name, $varname_type). These variables could be overwritten by attackers, causing the application to process unauthorized files.
Query: alert when Detects calls to hidden files or files located in hidden directories in NIX systems.
Matching passage: Sigma rule: Detects calls to hidden files or files located in hidden directories in NIX systems.. Logsource: linux / auditd. Rule: title: Use Of Hidden Paths Or Files id: 9e1bef8d-0fff-46f6-8465-9aa54e128c1e related: - id: d08722cd-3d09-449a-80b4-83ea2d9d4616 type: similar status: test description: Detects calls to hidden files or files located in hidden directories in NIX systems. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md author: David Burkett, @signalblur date: 2022-12-30 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: linux service: auditd detection: selection: type: PATH name|contains: /. filter: name|contains: - /.cache/ - /.config/ - /.pyenv/ - /.rustup/toolchains condition: selection and not filter falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects parameters used by WMImplant. Logsource: windows / ps_script. Rule: title: WMImplant Hack Tool id: 8028c2c3-e25a-46e3-827f-bbb5abf181d7 status: test description: Detects parameters used by WMImplant references: - https://github.com/FortyNorthSecurity/WMImplant author: NVISO date: 2020-03-26 modified: 2022-12-25 tags: - attack.execution - attack.t1047 - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - WMImplant - ' change_user ' - ' gen_cli ' - ' command_exec ' - ' disable_wdigest ' - ' disable_winrm ' - ' enable_wdigest ' - ' enable_winrm ' - ' registry_mod ' - ' remote_posh ' - ' sched_job ' - ' service_mod ' - ' process_kill ' - ' active_users ' - ' basic_info ' - ' power_off ' - ' vacant_system ' - ' logon_events ' condition: selection falsepositives: - Administrative scripts that use the same keywords. level: high
Query: patch priority for CVE-2015-6706
Matching passage: CVE-2015-6706. CWE: CWE-200. CVSS: 5.0. Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2015-5583, CVE-2015-6705, and CVE-2015-7624.
Near-miss passage: CVE-2015-6862. CWE: CWE-200. CVSS: 8.399999618530273. HPE UCMDB Browser before 4.02 allows remote attackers to obtain sensitive information or bypass intended access restrictions via unspecified vectors.
Query: Sigma rule for Detect set EnableFirewall to 0 to disable the Windows firewall
Matching passage: Sigma rule: Detect set EnableFirewall to 0 to disable the Windows firewall. Logsource: windows / registry_set. Rule: title: Disable Windows Firewall by Registry id: e78c408a-e2ea-43cd-b5ea-51975cf358c0 status: test description: Detect set EnableFirewall to 0 to disable the Windows firewall references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1562.004/T1562.004.md author: frack113 date: 2022-08-19 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1686.003 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: - \SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\EnableFirewall - \SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\EnableFirewall Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects deletion attempts of MacOS Time Machine backups via the native backup utility "tmutil". An adversary may perform. Logsource: macos / process_creation. Rule: title: Time Machine Backup Deletion Attempt Via Tmutil - MacOS id: 452df256-da78-427a-866f-49fa04417d74 status: test description: 'Detects deletion attempts of MacOS Time Machine backups via the native backup utility "tmutil". An adversary may perform this action before launching a ransonware attack to prevent the victim from restoring their files. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine - https://www.loobins.io/binaries/tmutil/ author: Pratinav Chandra date: 2024-05-29 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: macos detection: selection_img: - Image|endswith: /tmutil - CommandLine|contains: tmutil selection_cmd: CommandLine|contains: delete condition: all of selection_* falsepositives: - Legitimate activities level: medium
Query: Sigma YAML for macos / process_creation
Matching passage: Sigma rule: Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-ex. Logsource: macos / process_creation. Rule: title: System Integrity Protection (SIP) Disabled id: 3603f18a-ec15-43a1-9af2-d196c8a7fec6 status: test description: 'Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-exploit scenarios. ' references: - https://ss64.com/osx/csrutil.html - https://objective-see.org/blog/blog_0x6D.html - https://www.welivesecurity.com/2017/10/20/osx-proton-supply-chain-attack-elmedia/ - https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13caf9f60049760c312cd3/behavior author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2024-01-02 tags: - attack.discovery - attack.t1518.001 logsource: product: macos category: process_creation detection: selection: Image|endswith: /csrutil CommandLine|contains: disable condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is. Logsource: windows / taskscheduler. Rule: title: Scheduled Task Executed Uncommon LOLBIN id: f0767f15-0fb3-44b9-851e-e8d9a6d0005d status: test description: Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is an unusual program to be run from a Scheduled Task references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-05 modified: 2023-02-07 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.005 logsource: product: windows service: taskscheduler definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger' detection: selection: EventID: 129 Path|endswith: - \calc.exe - \cscript.exe - \mshta.exe - \mspaint.exe - \notepad.exe - \regsvr32.exe - \wscript.exe condition: selection falsepositives: - False positives may occur with some of the selected binaries if you have tasks using them (which could be very common in your environment). Exclude all the specific trusted tasks before using this rule level: medium
Query: CVE similar to CVE-2015-2982
Matching passage: CVE-2015-2982. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in jquery.lightbox-0.5.min.js in PHP Kobo Photo Gallery CMS for PC, smartphone and feature phone 1.0.1 Free and earlier allows remote authenticated users to inject arbitrary web script or HTML via unspecified input to admin.php.
Near-miss passage: CVE-2015-0156. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.6.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: Lateral movement indicators for Social Media
Matching passage: T1593.001 Social Media. Tactics: reconnaissance. Description: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. [Spearphishing Service](https://attack.mitre.org/techniques/T1598/001)).(Citation: Cyware Social Media) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).
Near-miss passage: T1593 Search Open Websites/Domains. Tactics: reconnaissance. Description: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.(Citation: Cyware Social Media)(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking) Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Phishing](https://attack.mitre.org/techniques/T1566)).
Query: threat report mentioning Network Service Discovery
Matching passage: T1046 Network Service Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.(Citation: CISA AR21-126A FIVEHANDS May 2021) Within cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well. Within macOS environments, adversaries may use the native Bonjour application to discover services running on other macOS hosts within a network. The Bonjour mDNSResponder daemon automatically registers and advertises a host’s registered services on the network. For example, adversaries can use a mDNS query (such as <code>dns-sd -B _ssh._tcp .</code>) to find other systems broadcasting the ssh service.(Citation: apple doco bonjour description)(Citation: macOS APT Activity Bradley)
Near-miss passage: T1614 System Location Discovery. Tactics: discovery. Description: Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from [System Location Discovery](https://attack.mitre.org/techniques/T1614) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.(Citation: FBI Ragnar Locker 2020)(Citation: Sophos Geolocation 2016)(Citation: Bleepingcomputer RAT malware 2020) Windows API functions such as <code>GetLocaleInfoW</code> can also be used to determine the locale of the host.(Citation: FBI Ragnar Locker 2020) In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.(Citation: AWS Instance Identity Documents)(Citation: Microsoft Azure Instance Metadata 2021) Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.(Citation: Securelist Trasparent Tribe 2020)(Citation: Sophos Geolocation 2016)
Query: write Sigma for An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities
Matching passage: Sigma rule: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities. Logsource: windows / process_creation. Rule: title: Compress Data and Lock With Password for Exfiltration With 7-ZIP id: 9fbf5927-5261-4284-a71d-f681029ea574 status: test description: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md author: frack113 date: 2021-07-27 modified: 2026-06-05 tags: - attack.collection - attack.t1560.001 logsource: category: process_creation product: windows detection: selection_img: - Description|contains: 7-Zip - Image|endswith: - \7z.exe - \7zr.exe - \7za.exe - OriginalFileName: - 7z.exe - 7za.exe - 7zr.exe selection_password: CommandLine|contains: ' -p' selection_action: CommandLine|contains: - ' a ' - ' u ' condition: all of selection_* falsepositives: - Legitimate activity is expected since compressing files with a password is common. level: medium
Near-miss passage: Sigma rule: Detects the process injection of a LittleCorporal generated Maldoc.. Logsource: windows / process_access. Rule: title: HackTool - LittleCorporal Generated Maldoc Injection id: 7bdde3bf-2a42-4c39-aa31-a92b3e17afac status: test description: Detects the process injection of a LittleCorporal generated Maldoc. references: - https://github.com/connormcgarr/LittleCorporal author: Christian Burkard (Nextron Systems) date: 2021-08-09 modified: 2023-11-28 tags: - attack.execution - attack.privilege-escalation - attack.stealth - attack.t1204.002 - attack.t1055.003 logsource: category: process_access product: windows detection: selection: SourceImage|endswith: \winword.exe CallTrace|contains|all: - :\Windows\Microsoft.NET\Framework64\v2. - UNKNOWN condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-3966
Matching passage: CVE-2015-3966. CWE: CWE-20. CVSS: 4.0. The IPsec SA establishment process on Innominate mGuard devices with firmware 8.x before 8.1.7 allows remote authenticated users to cause a denial of service (VPN service restart) by leveraging a peer relationship to send a crafted configuration with compression.
Near-miss passage: CVE-2015-8713. CWE: CWE-20. CVSS: 5.5. epan/dissectors/packet-umts_fp.c in the UMTS FP dissector in Wireshark 1.12.x before 1.12.9 does not properly reserve memory for channel ID mappings, which allows remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted packet.
Query: detect Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location in logs
Matching passage: Sigma rule: Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location. Logsource: windows / bits-client. Rule: title: BITS Transfer Job Download To Potential Suspicious Folder id: f8a56cb7-a363-44ed-a82f-5926bb44cd05 status: test description: Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md author: Florian Roth (Nextron Systems) date: 2022-06-28 modified: 2023-03-27 tags: - attack.persistence - attack.execution - attack.stealth - attack.t1197 logsource: product: windows service: bits-client detection: selection: EventID: 16403 LocalName|contains: - \Desktop\ - C:\Users\Public\ - C:\PerfLogs\ condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: load malicious registered COM objects. Logsource: windows / process_creation. Rule: title: Rundll32 Registered COM Objects id: f1edd233-30b5-4823-9e6a-c4171b24d316 status: test description: load malicious registered COM objects references: - https://nasbench.medium.com/a-deep-dive-into-rundll32-exe-642344b41e90 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.015/T1546.015.md author: frack113 date: 2022-02-13 modified: 2023-02-09 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|contains: - '-sta ' - '-localserver ' CommandLine|contains|all: - '{' - '}' condition: all of selection_* falsepositives: - Legitimate use level: high
Query: detect File and Directory Discovery
Matching passage: T1083 File and Directory Discovery. Tactics: discovery. Description: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Many command shell utilities can be used to obtain this information. Examples include <code>dir</code>, <code>tree</code>, <code>ls</code>, <code>find</code>, and <code>locate</code>.(Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the [Native API](https://attack.mitre.org/techniques/T1106). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather file and directory information (e.g. <code>dir</code>, <code>show flash</code>, and/or <code>nvram</code>).(Citation: US-CERT-TA18-106A) Some files and directories may require elevated or specific user permissions to access.
Near-miss passage: T1016 System Network Configuration Discovery. Tactics: discovery. Description: Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include [Arp](https://attack.mitre.org/software/S0099), [ipconfig](https://attack.mitre.org/software/S0100)/[ifconfig](https://attack.mitre.org/software/S0101), [nbtstat](https://attack.mitre.org/software/S0102), and [route](https://attack.mitre.org/software/S0103). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather information about configurations and settings, such as IP addresses of configured interfaces and static/dynamic routes (e.g. <code>show ip route</code>, <code>show ip interface</code>).(Citation: US-CERT-TA18-106A)(Citation: Mandiant APT41 Global Intrusion ) On ESXi, adversaries may leverage esxcli to gather network configuration information. For example, the command `esxcli network nic list` will retrieve the MAC address, while `esxcli network ip interface ipv4 get` will retrieve the local IPv4 address.(Citation: Trellix Rnasomhouse 2024) Adversaries may use the information from [System Network Configuration Discovery](https://attack.mitre.org/techniques/T1016) during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.
Query: CVE similar to CVE-2015-4230
Matching passage: CVE-2015-4230. CWE: CWE-399. CVSS: 7.800000190734863. Memory leak in Cisco Headend System Release allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, aka Bug ID CSCus91854.
Near-miss passage: CVE-2015-0722. CWE: CWE-399. CVSS: 7.800000190734863. The network drivers in Cisco TelePresence T, Cisco TelePresence TE, and Cisco TelePresence TC before 7.3.2 allow remote attackers to cause a denial of service (process restart or device reload) via a flood of crafted IP packets, aka Bug ID CSCuj68952.
Query: vulnerability: kextd in kext tools in Apple OS X before 10.10.4 allows attackers to write to arbitrary files via a crafted app that conducts a symlink attack.
Matching passage: CVE-2015-3708. CWE: UNKNOWN. CVSS: 8.800000190734863. kextd in kext tools in Apple OS X before 10.10.4 allows attackers to write to arbitrary files via a crafted app that conducts a symlink attack.
Near-miss passage: CVE-2015-0369. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to AX/HI Web UI.