alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebe
Matching passage: Sigma rule: Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebe. Logsource: windows / process_creation. Rule: title: ImagingDevices Unusual Parent/Child Processes id: f11f2808-adb4-46c0-802a-8660db50fa99 status: test description: Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebee activity references: - https://thedfirreport.com/2022/09/26/bumblebee-round-two/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-27 modified: 2022-12-29 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \WmiPrvSE.exe - \svchost.exe - \dllhost.exe Image|endswith: \ImagingDevices.exe selection_child: ParentImage|endswith: \ImagingDevices.exe condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service. Logsource: windows / process_creation. Rule: title: Suspicious Child Process Of Manage Engine ServiceDesk id: cea2b7ea-792b-405f-95a1-b903ea06458f status: test description: Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service references: - https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/ - https://github.com/horizon3ai/CVE-2022-47966/blob/3a51c6b72ebbd87392babd955a8fbeaee2090b35/CVE-2022-47966.py - https://blog.viettelcybersecurity.com/saml-show-stopper/ author: Florian Roth (Nextron Systems) date: 2023-01-18 modified: 2023-08-29 tags: - attack.command-and-control - attack.t1102 logsource: category: process_creation product: windows detection: selection: ParentImage|contains|all: - \ManageEngine\ServiceDesk\ - \java.exe Image|endswith: - \AppVLP.exe - \bash.exe - \bitsadmin.exe - \calc.exe - \certutil.exe - \cscript.exe - \curl.exe - \forfiles.exe - \mftrace.exe - \mshta.exe - \net.exe - \net1.exe - \notepad.exe - \powershell.exe - \pwsh.exe - \query.exe - \reg.exe - \schtasks.exe - \scrcons.exe - \sh.exe - \systeminfo.exe - \whoami.exe - \wmic.exe - \wscript.exe filter_main_net: Image|endswith: - \net.exe - \net1.exe CommandLine|contains: ' stop' condition: selection and not 1 of filter_main_* falsepositives: - Legitimate sub processes started by Manage Engine ServiceDesk Pro level: high
Query: exploit Cross-site scripting (XSS) vulnerability in the qTranslate plugin 2.5.39 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the edit param
Matching passage: CVE-2015-5535. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the qTranslate plugin 2.5.39 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the edit parameter in the qtranslate page to wp-admin/options-general.php.
Near-miss passage: CVE-2015-1617. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Query: patch priority for CVE-2015-5282
Matching passage: CVE-2015-5282. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after.
Near-miss passage: CVE-2015-7879. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authenticated users with permission to create or edit a stickynote to inject arbitrary web script or HTML via note text on the admin listing page.
Query: exploit Microsoft Internet Explorer 11 and Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corrup
Matching passage: CVE-2015-2446. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 and Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2447.
Near-miss passage: CVE-2015-7673. CWE: CWE-119. CVSS: 6.800000190734863. io-tga.c in gdk-pixbuf before 2.32.0 uses heap memory after its allocation failed, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) and possibly execute arbitrary code via a crafted Truevision TGA (TARGA) file.
Query: risk of Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute
Matching passage: CVE-2015-4328. CWE: CWE-20. CVSS: 4.0. Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, as demonstrated by read or write operations on the Unified Communications lookup page, aka Bug ID CSCuv12552.
Near-miss passage: CVE-2015-1131. CWE: CWE-20. CVSS: 7.199999809265137. fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1132, CVE-2015-1133, CVE-2015-1134, and CVE-2015-1135.
Query: risk of The mysql-systemd-helper script in the mysql-community-server package before 5.6.28-2.17.1 in openSUSE 13.2 and before 5.6.28-13.1 in openSUSE Leap 42.1 and the mariadb package bef
Matching passage: CVE-2015-5969. CWE: CWE-200. CVSS: 6.199999809265137. The mysql-systemd-helper script in the mysql-community-server package before 5.6.28-2.17.1 in openSUSE 13.2 and before 5.6.28-13.1 in openSUSE Leap 42.1 and the mariadb package before 10.0.22-2.21.2 in openSUSE 13.2 and before 10.0.22-3.1 in SUSE Linux Enterprise (SLE) 12.1 and openSUSE Leap 42.1 allows local users to discover database credentials by listing a process and its arguments.
Near-miss passage: CVE-2015-7418. CWE: CWE-200. CVSS: 4.400000095367432. IBM WebSphere eXtreme Scale and the WebSphere DataPower XC10 Appliance allow some sensitive data to linger in memory instead of being overwritten which could allow a local user with administrator privileges to obtain sensitive information.
Query: Sigma YAML for windows / process_access
Matching passage: Sigma rule: Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz.. Logsource: windows / process_access. Rule: title: Credential Dumping Activity By Python Based Tool id: f8be3e82-46a3-4e4e-ada5-8e538ae8b9c9 related: - id: 4b9a8556-99c4-470b-a40c-9c8d02c77ed0 type: obsolete - id: 7186e989-4ed7-4f4e-a656-4674b9e3e48b type: obsolete status: stable description: Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz. references: - https://twitter.com/bh4b3sh/status/1303674603819081728 - https://github.com/skelsec/pypykatz author: Bhabesh Raj, Jonhnathan Ribeiro date: 2023-11-27 modified: 2023-11-29 tags: - attack.credential-access - attack.t1003.001 - attack.s0349 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe CallTrace|contains|all: - _ctypes.pyd+ - :\Windows\System32\KERNELBASE.dll+ - :\Windows\SYSTEM32\ntdll.dll+ CallTrace|contains: - python27.dll+ - python3*.dll+ GrantedAccess: '0x1FFFFF' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when an an application is removed from Google Workspace.. Logsource: gcp / google_workspace.admin. Rule: title: Google Workspace Application Removed id: ee2803f0-71c8-4831-b48b-a1fc57601ee4 status: test description: Detects when an an application is removed from Google Workspace. references: - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3 - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION_FROM_WHITELIST author: Austin Songer date: 2021-08-26 modified: 2023-10-11 tags: - attack.impact logsource: product: gcp service: google_workspace.admin detection: selection: eventService: admin.googleapis.com eventName: - REMOVE_APPLICATION - REMOVE_APPLICATION_FROM_WHITELIST condition: selection falsepositives: - Application being removed may be performed by a System Administrator. level: medium
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UA. Logsource: windows / process_creation. Rule: title: CMSTP UAC Bypass via COM Object Access id: 4b60e6f2-bf39-47b4-b4ea-398e33cfe253 status: stable description: Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65) references: - https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/ - https://twitter.com/hFireF0X/status/897640081053364225 - https://medium.com/falconforce/falconfriday-detecting-uac-bypasses-0xff16-86c2a9107abf - https://github.com/hfiref0x/UACME author: Nik Seetharaman, Christian Burkard (Nextron Systems) date: 2019-07-31 modified: 2024-12-01 tags: - attack.execution - attack.privilege-escalation - attack.stealth - attack.t1548.002 - attack.t1218.003 - attack.g0069 - car.2019-04-001 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \DllHost.exe ParentCommandLine|contains: - ' /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}' - ' /Processid:{3E000D72-A845-4CD9-BD83-80C07C3B881F}' - ' /Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41}' - ' /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}' - ' /Processid:{E9495B87-D950-4AB5-87A5-FF6D70BF3E90}' IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 condition: selection falsepositives: - Legitimate CMSTP use (unlikely in modern enterprise environments) level: high
Near-miss passage: Sigma rule: Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes. Logsource: windows / dns_query. Rule: title: DNS Query for Anonfiles.com Domain - Sysmon id: 065cceea-77ec-4030-9052-fc0affea7110 related: - id: 29f171d7-aa47-42c7-9c7b-3c87938164d9 type: similar status: test description: Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes references: - https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte author: pH-T (Nextron Systems) date: 2022-07-15 modified: 2023-01-16 tags: - attack.exfiltration - attack.t1567.002 logsource: product: windows category: dns_query detection: selection: QueryName|contains: .anonfiles.com condition: selection falsepositives: - Rare legitimate access to anonfiles.com level: high
Query: describe CVE-2015-5355
Matching passage: CVE-2015-5355. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.3.6 allow remote attackers to inject arbitrary web script or HTML via the (1) post-content or (2) post-title parameter to admin/edit.php.
Near-miss passage: CVE-2015-6929. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Nokia Networks (formerly Nokia Solutions and Networks and Nokia Siemens Networks) @vantage Commander allow remote attackers to inject arbitrary web script or HTML via the (1) idFilter or (2) nameFilter parameter to cftraces/filter/fl_copy.jsp; the (3) flName parameter to cftraces/filter/fl_crea1.jsp; the (4) serchStatus, (5) refreshTime, or (6) serchNode parameter to cftraces/process/pr_show_process.jsp; the (7) MaxActivationTime, (8) NumberOfBytes, (9) NumberOfTracefiles, (10) SessionName, or (11) serchSessionkind parameter to cftraces/session/se_crea.jsp; the (12) serchSessionDescription parameter to cftraces/session/se_show.jsp; the (13) serchApplication or (14) serchApplicationkind parameter to cftraces/session/tr_crea_filter.jsp; the (15) columKeyUnique, (16) columParameter, (17) componentName, (18) criteria1, (19) criteria2, (20) criteria3, (21) description, (22) filter, (23) id, (24) pathName, (25) tableName, or (26) component parameter to cftraces/session/tr_create_tagg_para.jsp; or the (27) userid parameter to home/certificate_association.jsp.
Query: patch priority for CVE-2015-5432
Matching passage: CVE-2015-5432. CWE: UNKNOWN. CVSS: 7.5. HP Virtual Connect Enterprise Manager (VCEM) SDK before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote attackers to obtain sensitive information or modify data via unspecified vectors.
Near-miss passage: CVE-2015-2264. CWE: UNKNOWN. CVSS: 6.900000095367432. Multiple untrusted search path vulnerabilities in (1) EQATEC.Analytics.Monitor.Win32_vc100.dll and (2) EQATEC.Analytics.Monitor.Win32_vc100-x64.dll in Telerik Analytics Monitor Library before 3.2.125 allow local users to gain privileges via a Trojan horse (a) csunsapi.dll, (b) swift.dll, (c) nfhwcrhk.dll, or (d) surewarehook.dll file in an unspecified directory.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the Web Tracking Report page on Cisco Web Security Appliance (WSA) devices 8.5.0-497 allows remote attackers to inject arbitrary web scr
Matching passage: CVE-2015-0738. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Web Tracking Report page on Cisco Web Security Appliance (WSA) devices 8.5.0-497 allows remote attackers to inject arbitrary web script or HTML via an unspecified field, aka Bug ID CSCuu16008.
Near-miss passage: CVE-2015-1026. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web script or HTML via the (1) technicianSearchText parameter to the Help Desk Technician page or (2) rolesSearchText parameter to the Help Desk Roles.
Query: CVE similar to CVE-2015-5705
Matching passage: CVE-2015-5705. CWE: CWE-59. CVSS: 7.5. Argument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to arbitrary files via a crafted symlink and crafted filename.
Near-miss passage: CVE-2015-3147. CWE: CWE-59. CVSS: 6.5. daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local users to write to arbitrary files or possibly have other unspecified impact via a symlink attack on (1) /var/spool/abrt or (2) /var/tmp/abrt.
Query: risk of Siemens SIMATIC STEP 7 (TIA Portal) before 13 SP1 determines a user's privileges on the basis of project-file fields that lack integrity protection, which allows remote attackers t
Matching passage: CVE-2015-1356. CWE: CWE-264. CVSS: 4.400000095367432. Siemens SIMATIC STEP 7 (TIA Portal) before 13 SP1 determines a user's privileges on the basis of project-file fields that lack integrity protection, which allows remote attackers to establish arbitrary authorization data via a modified file.
Near-miss passage: CVE-2015-3458. CWE: CWE-264. CVSS: 6.5. The fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 does not restrict the stream wrapper used in a template path, which allows remote administrators to include and execute arbitrary PHP files via the phar:// stream wrapper, related to the setScriptPath function. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files.
Query: CVE similar to CVE-2015-1130
Matching passage: CVE-2015-1130. CWE: CWE-59. CVSS: 7.800000190734863. The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges via unspecified vectors.
Near-miss passage: CVE-2015-5287. CWE: CWE-59. CVSS: 6.900000095367432. The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.
Query: risk of The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.
Matching passage: CVE-2015-9331. CWE: CWE-254. CVSS: 7.5. The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.
Near-miss passage: CVE-2015-7914. CWE: CWE-254. CVSS: 8.100000381469727. Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows remote attackers to bypass authentication by leveraging knowledge of a password hash without knowledge of the associated password.
Query: alert when Detects potential web shell execution from the ScreenConnect server process.
Matching passage: Sigma rule: Detects potential web shell execution from the ScreenConnect server process.. Logsource: windows / process_creation. Rule: title: Remote Access Tool - ScreenConnect Server Web Shell Execution id: b19146a3-25d4-41b4-928b-1e2a92641b1b status: test description: Detects potential web shell execution from the ScreenConnect server process. references: - https://blackpointcyber.com/resources/blog/breaking-through-the-screen/ - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8 author: Jason Rathbun (Blackpoint Cyber) date: 2024-02-26 tags: - attack.initial-access - attack.t1190 logsource: product: windows category: process_creation detection: selection: ParentImage|endswith: \ScreenConnect.Service.exe Image|endswith: - \cmd.exe - \csc.exe condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects suspicious requests to Telegram API without the usual Telegram User-Agent. Logsource: proxy. Rule: title: Telegram API Access id: b494b165-6634-483d-8c47-2026a6c52372 status: test description: Detects suspicious requests to Telegram API without the usual Telegram User-Agent references: - https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/ - https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/ - https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/ author: Florian Roth (Nextron Systems) date: 2018-06-05 modified: 2023-05-18 tags: - attack.command-and-control - attack.t1071.001 - attack.t1102.002 logsource: category: proxy detection: selection: cs-host: api.telegram.org filter: c-useragent|contains: - Telegram - Bot condition: selection and not filter falsepositives: - Legitimate use of Telegram bots in the company level: medium
Query: risk of The Web Dispatcher service in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to read web dispatcher and security trace files and possibly obtain passwords via
Matching passage: CVE-2015-7991. CWE: CWE-200. CVSS: 5.0. The Web Dispatcher service in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to read web dispatcher and security trace files and possibly obtain passwords via unspecified vectors, aka SAP Security Note 2148854.
Near-miss passage: CVE-2015-6086. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."
Query: exploit packages/Keyguard/res/layout/keyguard_password_view.xml in Lockscreen in Android 5.x before 5.1.1 LMY48M does not restrict the number of characters in the passwordEntry input field
Matching passage: CVE-2015-3860. CWE: CWE-284. CVSS: 7.199999809265137. packages/Keyguard/res/layout/keyguard_password_view.xml in Lockscreen in Android 5.x before 5.1.1 LMY48M does not restrict the number of characters in the passwordEntry input field, which allows physically proximate attackers to bypass intended access restrictions via a long password that triggers a SystemUI crash, aka internal bug 22214934.
Near-miss passage: CVE-2015-10057. CWE: CWE-284. CVSS: 9.800000190734863. A vulnerability was found in Little Apps Little Software Stats. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file inc/class.securelogin.php of the component Password Reset Handler. The manipulation leads to improper access controls. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.2 is able to address this issue. The identifier of the patch is 07ba8273a9311d1383f3686ac7cb32f20770ab1e. It is recommended to upgrade the affected component. The identifier VDB-218401 was assigned to this vulnerability.
Query: exploit Integer overflow in the ljpeg_start function in dcraw 7.00 and earlier allows remote attackers to cause a denial of service (crash) via a crafted image, which triggers a buffer ove
Matching passage: CVE-2015-3885. CWE: CWE-189. CVSS: 4.300000190734863. Integer overflow in the ljpeg_start function in dcraw 7.00 and earlier allows remote attackers to cause a denial of service (crash) via a crafted image, which triggers a buffer overflow, related to the len variable.
Near-miss passage: CVE-2015-3239. CWE: CWE-189. CVSS: 3.299999952316284. Off-by-one error in the dwarf_to_unw_regnum function in include/dwarf_i.h in libunwind 1.1 allows local users to have unspecified impact via invalid dwarf opcodes.