alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is
Matching passage: Sigma rule: Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is. Logsource: windows / taskscheduler. Rule: title: Scheduled Task Executed Uncommon LOLBIN id: f0767f15-0fb3-44b9-851e-e8d9a6d0005d status: test description: Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is an unusual program to be run from a Scheduled Task references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-05 modified: 2023-02-07 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.005 logsource: product: windows service: taskscheduler definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger' detection: selection: EventID: 129 Path|endswith: - \calc.exe - \cscript.exe - \mshta.exe - \mspaint.exe - \notepad.exe - \regsvr32.exe - \wscript.exe condition: selection falsepositives: - False positives may occur with some of the selected binaries if you have tasks using them (which could be very common in your environment). Exclude all the specific trusted tasks before using this rule level: medium
Near-miss passage: Sigma rule: Detects the execution of "hh.exe" to open ".chm" files.. Logsource: windows / process_creation. Rule: title: HH.EXE Execution id: 68c8acb4-1b60-4890-8e82-3ddf7a6dba84 status: test description: Detects the execution of "hh.exe" to open ".chm" files. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.001/T1218.001.md - https://eqllib.readthedocs.io/en/latest/analytics/b25aa548-7937-11e9-8f5c-d46d6d62a49e.html - https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37 author: E.M. Anhaus (originally from Atomic Blue Detections, Dan Beavin), oscd.community date: 2019-10-24 modified: 2023-12-11 tags: - attack.stealth - attack.t1218.001 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: HH.exe - Image|endswith: \hh.exe selection_cli: CommandLine|contains: .chm condition: all of selection_* falsepositives: - False positives are expected with legitimate ".CHM" level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hh_chm_execution/info.yml
Query: exploit Memory leak in the embedded web server in the WebVPN subsystem in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to cause a denial of service (memory cons
Matching passage: CVE-2015-0619. CWE: CWE-399. CVSS: 5.0. Memory leak in the embedded web server in the WebVPN subsystem in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to cause a denial of service (memory consumption and SSL outage) via multiple crafted HTTP requests, aka Bug ID CSCue05458.
Near-miss passage: CVE-2015-0202. CWE: CWE-399. CVSS: 7.800000190734863. The mod_dav_svn server in Subversion 1.8.0 through 1.8.11 allows remote attackers to cause a denial of service (memory consumption) via a large number of REPORT requests, which trigger the traversal of FSFS repository nodes.
Query: exploit IBM Maximo Asset Management 7.5 before 7.5.0.9 FP9 and 7.6 before 7.6.0.3 FP3 and Maximo Asset Management 7.5 before 7.5.0.9 FP9, 7.5.1, and 7.6 before 7.6.0.3 FP3 for SmartCloud C
Matching passage: CVE-2015-7452. CWE: CWE-200. CVSS: 4.300000190734863. IBM Maximo Asset Management 7.5 before 7.5.0.9 FP9 and 7.6 before 7.6.0.3 FP3 and Maximo Asset Management 7.5 before 7.5.0.9 FP9, 7.5.1, and 7.6 before 7.6.0.3 FP3 for SmartCloud Control Desk allow remote authenticated users to obtain sensitive information via the REST API.
Near-miss passage: CVE-2015-7488. CWE: CWE-200. CVSS: 5.900000095367432. IBM Spectrum Scale 4.1.1.x before 4.1.1.4 and 4.2.x before 4.2.0.1, in certain LDAP File protocol configurations, allows remote attackers to discover an LDAP password via unspecified vectors.
Query: patch priority for CVE-2015-7310
Matching passage: CVE-2015-7310. CWE: CWE-78. CVSS: 6.5. McAfee Enterprise Security Manager (ESM), Enterprise Security Manager/Log Manager (ESMLM), and Enterprise Security Manager/Receiver (ESMREC) before 9.3.2MR18, 9.4.x before 9.4.2MR8, and 9.5.x before 9.5.0MR7 allow remote authenticated users to execute arbitrary OS commands via a crafted filename, which is not properly handled when downloading the file.
Near-miss passage: CVE-2015-2279. CWE: CWE-78. CVSS: 9.800000190734863. cgi_test.cgi in AirLive BU-2015 with firmware 1.03.18, BU-3026 with firmware 1.43, and MD-3025 with firmware 1.81 allows remote attackers to execute arbitrary OS commands via shell metacharacters after an "&" (ampersand) in the write_mac write_pid, write_msn, write_tan, or write_hdv parameter.
Query: weakness Authentication Bypass Using an Alternate Path or Channel
Matching passage: CWE-288 Authentication Bypass Using an Alternate Path or Channel. The product requires authentication, but the product has an alternate path or channel that does not require authentication.
Near-miss passage: CWE-400 Uncontrolled Resource Consumption. The product does not properly control the allocation and maintenance of a limited resource.
Query: exploit PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by sending a password packet before a startup packet.
Matching passage: CVE-2015-4054. CWE: CWE-476. CVSS: 7.5. PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by sending a password packet before a startup packet.
Near-miss passage: CVE-2015-9175. CWE: CWE-476. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, lack of input validation could lead to an untrusted pointer dereference in wv_dash_core_generic_verify().
Query: vulnerability: Directory traversal vulnerability in BisonWare BisonFTP 3.5 allows remote attackers to read arbitrary files via a ../ (dot dot slash) in a RETR command.
Matching passage: CVE-2015-7602. CWE: CWE-22. CVSS: 7.800000190734863. Directory traversal vulnerability in BisonWare BisonFTP 3.5 allows remote attackers to read arbitrary files via a ../ (dot dot slash) in a RETR command.
Near-miss passage: CVE-2015-5322. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in the Jenkins servlet resources via directory traversal sequences in a request to jnlpJars/.
Query: alert when Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or
Matching passage: Sigma rule: Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or. Logsource: windows / process_creation. Rule: title: Suspicious Redirection to Local Admin Share id: ab9e3b40-0c85-4ba1-aede-455d226fd124 status: test description: Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or hacktool stagers references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html author: Florian Roth (Nextron Systems) date: 2022-01-16 modified: 2023-12-28 tags: - attack.exfiltration - attack.t1048 logsource: category: process_creation product: windows detection: selection_redirect: CommandLine|contains: '>' selection_share: CommandLine|contains: - \\\\127.0.0.1\\admin$\\ - \\\\localhost\\admin$\\ condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects attempts to create and/or add an account to the admin group, thus granting admin privileges.. Logsource: macos / process_creation. Rule: title: User Added To Admin Group Via DseditGroup id: 5d0fdb62-f225-42fb-8402-3dfe64da468a status: test description: Detects attempts to create and/or add an account to the admin group, thus granting admin privileges. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-5---add-a-newexisting-user-to-the-admin-group-using-dseditgroup-utility---macos - https://ss64.com/osx/dseditgroup.html author: Sohan G (D4rkCiph3r) date: 2023-08-22 tags: - attack.persistence - attack.initial-access - attack.privilege-escalation - attack.stealth - attack.t1078.003 logsource: category: process_creation product: macos detection: selection: Image|endswith: /dseditgroup CommandLine|contains|all: - ' -o edit ' - ' -a ' - ' -t user' - admin condition: selection falsepositives: - Legitimate administration activities level: medium
Query: describe CVE-2015-6817
Matching passage: CVE-2015-6817. CWE: CWE-287. CVSS: 8.100000381469727. PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.
Near-miss passage: CVE-2015-7746. CWE: CWE-287. CVSS: 9.800000190734863. NetApp Data ONTAP before 8.2.4, when operating in 7-Mode, allows remote attackers to bypass authentication and (1) obtain sensitive information from or (2) modify volumes via vectors related to UTF-8 in the volume language.
Query: Sigma rule for Detects activity when a security-enabled global group is deleted
Matching passage: Sigma rule: Detects activity when a security-enabled global group is deleted. Logsource: windows / security. Rule: title: A Security-Enabled Global Group Was Deleted id: b237c54b-0f15-4612-a819-44b735e0de27 related: - id: 9cf01b6c-e723-4841-a868-6d7f8245ca6e type: obsolete status: stable description: Detects activity when a security-enabled global group is deleted references: - https://www.cisecurity.org/controls/cis-controls-list/ - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4730 - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=634 author: Alexandr Yampolskyi, SOC Prime date: 2023-04-26 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: windows service: security detection: selection: EventID: - 4730 - 634 condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Files with well-known filenames (sensitive files with credential data) copying. Logsource: windows / process_creation. Rule: title: Copying Sensitive Files with Credential Data id: e7be6119-fc37-43f0-ad4f-1f3f99be2f9f status: test description: Files with well-known filenames (sensitive files with credential data) copying references: - https://room362.com/post/2013/2013-06-10-volume-shadow-copy-ntdsdit-domain-hashes-remotely-part-1/ - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment - https://dfironthemountain.wordpress.com/2018/12/06/locked-file-access-using-esentutl-exe/ - https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Esentutl.yml author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community date: 2019-10-22 modified: 2024-06-04 tags: - attack.credential-access - attack.t1003.002 - attack.t1003.003 - car.2013-07-001 - attack.s0404 logsource: category: process_creation product: windows detection: selection_esent_img: - Image|endswith: \esentutl.exe - OriginalFileName: \esentutl.exe selection_esent_cli: CommandLine|contains|windash: - vss - ' /m ' - ' /y ' selection_susp_paths: CommandLine|contains: - \config\RegBack\sam - \config\RegBack\security - \config\RegBack\system - \config\sam - \config\security - '\config\system ' - \repair\sam - \repair\security - \repair\system - \windows\ntds\ntds.dit condition: all of selection_esent_* or selection_susp_paths falsepositives: - Copying sensitive files for legitimate use (eg. backup) or forensic investigation by legitimate incident responder or forensic investigator. level: high
Query: exploit WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corrupt
Matching passage: CVE-2015-1068. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Near-miss passage: CVE-2015-0885. CWE: CWE-399. CVSS: 5.0. checkpw 1.02 and earlier allows remote attackers to cause a denial of service (infinite loop) via a -- (dash dash) in a username.
Query: patch priority for CVE-2015-9207
Matching passage: CVE-2015-9207. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, and SD 810, lack of input validation in playready_getadditional_responsedata could lead to a buffer overread.
Near-miss passage: CVE-2015-5195. CWE: CWE-20. CVSS: 7.5. ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.
Query: Sigma rule for Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload abo
Matching passage: Sigma rule: Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload abo. Logsource: linux / process_creation. Rule: title: Linux Base64 Encoded Shebang In CLI id: fe2f9663-41cb-47e2-b954-8a228f3b9dff status: test description: Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload about to be decoded references: - https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html - https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-15 tags: - attack.stealth - attack.t1140 logsource: product: linux category: process_creation detection: selection: CommandLine|contains: - IyEvYmluL2Jhc2 - IyEvYmluL2Rhc2 - IyEvYmluL3pza - IyEvYmluL2Zpc2 - IyEvYmluL3No condition: selection falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects when an account is disabled or blocked for sign in but tried to log in. Logsource: azure / signinlogs. Rule: title: Account Disabled or Blocked for Sign in Attempts id: 4afac85c-224a-4dd7-b1af-8da40e1c60bd status: test description: Detects when an account is disabled or blocked for sign in but tried to log in references: - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-privileged-accounts author: Yochana Henderson, '@Yochana-H' date: 2022-06-17 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078.004 logsource: product: azure service: signinlogs detection: selection: ResultType: 50057 ResultDescription: Failure condition: selection falsepositives: - Account disabled or blocked in error - Automation account has been blocked or disabled level: medium
Query: describe CVE-2015-6863
Matching passage: CVE-2015-6863. CWE: CWE-20. CVSS: 7.300000190734863. HPE ArcSight Logger before 6.1P1 allows remote attackers to execute arbitrary code via unspecified input to the (1) Intellicus or (2) client-certificate upload component.
Near-miss passage: CVE-2015-5234. CWE: CWE-20. CVSS: 6.800000190734863. IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.
Query: CVE similar to CVE-2015-6149
Matching passage: CVE-2015-6149. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6147.
Near-miss passage: CVE-2015-5919. CWE: CWE-119. CVSS: 7.199999809265137. GasGauge in Apple watchOS before 2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5918.
Query: CVE similar to CVE-2015-9111
Matching passage: CVE-2015-9111. CWE: CWE-476. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, in a QTEE syscall handler, an untrusted pointer dereference can occur.
Near-miss passage: CVE-2015-0003. CWE: CWE-476. CVSS: 6.900000095367432. win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Query: vulnerability: The Data Protection extension in the VMware GUI in IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual Environments) 7
Matching passage: CVE-2015-7426. CWE: CWE-78. CVSS: 10.0. The Data Protection extension in the VMware GUI in IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual Environments) 7.1 before 7.1.3.0 and Tivoli Storage FlashCopy Manager for VMware (aka Spectrum Protect Snapshot) 4.1 before 4.1.3.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Near-miss passage: CVE-2015-2980. CWE: CWE-78. CVSS: 6.800000190734863. The Yodobashi application 1.2.1.0 and earlier for Android allows remote attackers to execute arbitrary Java methods, and consequently obtain sensitive information or execute OS commands, via a crafted HTML document.
Query: vulnerability: WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption an
Matching passage: CVE-2015-5822. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-1859. CWE: CWE-119. CVSS: 6.800000190734863. Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted ICO image.
Query: intelligence brief on T1585
Matching passage: T1585 Establish Accounts. Tactics: resource development. Description: Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) For operations incorporating social engineering, the utilization of an online persona may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, GitHub, Docker Hub, etc.). Establishing a persona may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) Establishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) In addition, establishing accounts may allow adversaries to abuse free services, such as registering for trial periods to [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) for malicious purposes.(Citation: Free Trial PurpleUrchin)
Near-miss passage: T1585.003 Cloud Accounts. Tactics: resource development. Description: Adversaries may create accounts with cloud providers that can be used during targeting. Adversaries can use cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, MEGA, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s. Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure. Establishing cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud) Creating [Cloud Accounts](https://attack.mitre.org/techniques/T1585/003) may also require adversaries to establish [Email Accounts](https://attack.mitre.org/techniques/T1585/002) to register with the cloud provider.
Query: risk of In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Small Cell SoC FSM9055, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD
Matching passage: CVE-2015-9132. CWE: CWE-476. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Small Cell SoC FSM9055, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 800, and SD 810, possible arbitrary memory read due to untrusted pointer dereference when handling HLOS controlled values passed to the QSEE syscall helper.
Near-miss passage: CVE-2015-4047. CWE: CWE-476. CVSS: 7.800000190734863. racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests.