alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe". Attack
Matching passage: Sigma rule: Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe". Attack. Logsource: windows / process_creation. Rule: title: Interesting Service Enumeration Via Sc.EXE id: e83e8899-c9b2-483b-b355-5decc942b959 status: test description: 'Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe". Attackers often try to enumerate the services currently running on a system in order to find different attack vectors. ' references: - https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/ - https://pentestlab.blog/tag/svchost/ author: Swachchhanda Shrawan Poudel date: 2024-02-12 tags: - attack.t1003 - attack.credential-access logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \sc.exe - OriginalFileName: sc.exe selection_cli: CommandLine|contains: query selection_cmd: CommandLine|contains: termservice condition: all of selection_* falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects instances where a REDIS service on an OpenCanary node has had an action command attempted.. Logsource: opencanary / application. Rule: title: OpenCanary - REDIS Action Command Attempt id: 547dfc53-ebf6-4afe-8d2e-793d9574975d status: test description: Detects instances where a REDIS service on an OpenCanary node has had an action command attempted. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.credential-access - attack.collection - attack.t1003 - attack.t1213 logsource: category: application product: opencanary detection: selection: logtype: 17001 condition: selection falsepositives: - Unlikely level: high
Query: exploit Cross-site scripting (XSS) vulnerability in the Cloudwords for Multilingual Drupal module before 7.x-2.3 for Drupal allows remote authenticated users to inject arbitrary web script
Matching passage: CVE-2015-3348. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Cloudwords for Multilingual Drupal module before 7.x-2.3 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a node title.
Near-miss passage: CVE-2015-2043. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Visualware MyConnection Server 8.2b allow remote attackers to inject arbitrary web script or HTML via the (1) bt, (2) variable, or (3) et parameter to myspeed/db/historyitem.
Query: describe CVE-2015-9122
Matching passage: CVE-2015-9122. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, and SD 835, possible buffer overflow if SIM card sends a response greater than 64KB of data for stream APDU command.
Near-miss passage: CVE-2015-2521. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: SIEM correlation: stealth activity consistent with Ignore Process Interrupts
Matching passage: T1564.011 Ignore Process Interrupts. Tactics: stealth. Description: Adversaries may evade defensive mechanisms by executing commands that hide from process interrupt signals. Many operating systems use signals to deliver messages to control process behavior. Command interpreters often include specific commands/flags that ignore errors and other hangups, such as when the user of the active session logs off.(Citation: Linux Signal Man) These interrupt signals may also be used by defensive tools and/or analysts to pause or terminate specified running processes. Adversaries may invoke processes using `nohup`, [PowerShell](https://attack.mitre.org/techniques/T1059/001) `-ErrorAction SilentlyContinue`, or similar commands that may be immune to hangups.(Citation: nohup Linux Man)(Citation: Microsoft PowerShell SilentlyContinue) This may enable malicious commands and malware to continue execution through system events that would otherwise terminate its execution, such as users logging off or the termination of its C2 network connection. Hiding from process interrupt signals may allow malware to continue execution, but unlike [Trap](https://attack.mitre.org/techniques/T1546/005) this does not establish [Persistence](https://attack.mitre.org/tactics/TA0003) since the process will not be re-invoked once actually terminated.
Near-miss passage: T1564.007 VBA Stomping. Tactics: stealth. Description: Adversaries may hide malicious Visual Basic for Applications (VBA) payloads embedded within MS Office documents by replacing the VBA source code with benign data.(Citation: FireEye VBA stomp Feb 2020) MS Office documents with embedded VBA content store source code inside of module streams. Each module stream has a <code>PerformanceCache</code> that stores a separate compiled version of the VBA source code known as p-code. The p-code is executed when the MS Office version specified in the <code>_VBA_PROJECT</code> stream (which contains the version-dependent description of the VBA project) matches the version of the host MS Office application.(Citation: Evil Clippy May 2019)(Citation: Microsoft _VBA_PROJECT Stream) An adversary may hide malicious VBA code by overwriting the VBA source code location with zero’s, benign code, or random bytes while leaving the previously compiled malicious p-code. Tools that scan for malicious VBA source code may be bypassed as the unwanted code is hidden in the compiled p-code. If the VBA source code is removed, some tools might even think that there are no macros present. If there is a version match between the <code>_VBA_PROJECT</code> stream and host MS Office application, the p-code will be executed, otherwise the benign VBA source code will be decompressed and recompiled to p-code, thus removing malicious p-code and potentially bypassing dynamic analysis.(Citation: Walmart Roberts Oct 2018)(Citation: FireEye VBA stomp Feb 2020)(Citation: pcodedmp Bontchev)
Query: describe CVE-2015-5826
Matching passage: CVE-2015-5826. CWE: CWE-284. CVSS: 4.300000190734863. WebKit in Apple iOS before 9 does not properly select the cases in which a Cascading Style Sheets (CSS) document is required to have the text/css content type, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Near-miss passage: CVE-2015-1336. CWE: CWE-284. CVSS: 7.800000190734863. The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to gain privileges via vectors involving insecure chown use.
Query: describe CVE-2015-5082
Matching passage: CVE-2015-5082. CWE: CWE-77. CVSS: 10.0. Endian Firewall before 3.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) NEW_PASSWORD_1 or (2) NEW_PASSWORD_2 parameter to cgi-bin/chpasswd.cgi.
Near-miss passage: CVE-2015-7841. CWE: CWE-77. CVSS: 9.800000190734863. The login page of the server on Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software before V100R003C00SPC602, RH1288 V3 with software before V100R003C00SPC602, RH2288A V2 with software before V100R002C00SPC701, RH1288A V2 with software before V100R002C00SPC502, RH8100 V3 with software before V100R003C00SPC110, CH222 V3 with software before V100R001C00SPC161, CH220 V3 with software before V100R001C00SPC161, and CH121 V3 with software before V100R001C00SPC161 allows remote attackers to bypass access restrictions and enter commands via unspecified parameters, as demonstrated by a "user creation command."
Query: detection rule: Alerts on trust record modification within the registry, indicating usage of macros
Matching passage: Sigma rule: Alerts on trust record modification within the registry, indicating usage of macros. Logsource: windows / registry_event. Rule: title: Windows Registry Trust Record Modification id: 295a59c1-7b79-4b47-a930-df12c15fc9c2 related: - id: a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd type: similar status: test description: Alerts on trust record modification within the registry, indicating usage of macros references: - https://outflank.nl/blog/2018/01/16/hunting-for-evil-detect-macros-being-executed/ - http://az4n6.blogspot.com/2016/02/more-on-trust-records-macros-and.html - https://twitter.com/inversecos/status/1494174785621819397 author: Antonlovesdnb, Trent Liffick (@tliffick) date: 2020-02-19 modified: 2023-06-21 tags: - attack.initial-access - attack.t1566.001 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: \Security\Trusted Documents\TrustRecords condition: selection falsepositives: - This will alert on legitimate macro usage as well, additional tuning is required level: medium
Near-miss passage: Sigma rule: Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from. Logsource: windows / file_event. Rule: title: ISO File Created Within Temp Folders id: 2f9356ae-bf43-41b8-b858-4496d83b2acb status: test description: Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022. references: - https://twitter.com/Sam0x90/status/1552011547974696960 - https://securityaffairs.co/wordpress/133680/malware/dll-sideloading-spread-qakbot.html - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image author: '@sam0x90' date: 2022-07-30 tags: - attack.initial-access - attack.t1566.001 logsource: category: file_event product: windows detection: selection_1: TargetFilename|contains|all: - \AppData\Local\Temp\ - .zip\ TargetFilename|endswith: .iso selection_2: TargetFilename|contains: \AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\ TargetFilename|endswith: .iso condition: 1 of selection* falsepositives: - Potential FP by sysadmin opening a zip file containing a legitimate ISO file level: high
Query: write Sigma for Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live p
Matching passage: Sigma rule: Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live p. Logsource: windows / process_creation. Rule: title: Php Inline Command Execution id: d81871ef-5738-47ab-9797-7a9c90cd4bfb status: test description: Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code. references: - https://www.php.net/manual/en/features.commandline.php - https://www.revshells.com/ - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-02 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \php.exe - OriginalFileName: php.exe selection_cli: CommandLine|contains: ' -r' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects Obfuscated use of Clip.exe to execute PowerShell. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation CLIP+ Launcher - PowerShell Module id: a136cde0-61ad-4a61-9b82-8dc490e60dd2 related: - id: 73e67340-0d25-11eb-adc1-0242ac120002 type: derived status: test description: Detects Obfuscated use of Clip.exe to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-13 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|re: cmd.{0,5}(?:/c|/r).+clip(?:\.exe)?.{0,4}&&.+clipboard]::\(\s\\"\{\d\}.+-f.+" condition: selection_4103 falsepositives: - Unknown level: high
Query: describe CVE-2015-2947
Matching passage: CVE-2015-2947. CWE: CWE-441. CVSS: 9.100000381469727. KanColleViewer versions 3.8.1 and earlier operates as an open proxy which allows remote attackers to trigger outbound network traffic.
Near-miss passage: CVE-2015-10003. CWE: CWE-441. CVSS: 4.300000190734863. A vulnerability, which was classified as problematic, was found in FileZilla Server up to 0.9.50. This affects an unknown part of the component PORT Handler. The manipulation leads to unintended intermediary. It is possible to initiate the attack remotely. Upgrading to version 0.9.51 is able to address this issue. It is recommended to upgrade the affected component.
Query: describe CVE-2015-4998
Matching passage: CVE-2015-4998. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF19, and 8.5.0 before CF08 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-4993.
Near-miss passage: CVE-2015-9319. CWE: CWE-79. CVSS: 6.099999904632568. The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.
Query: alert when Detects the use of Tor or Tor-Browser to connect to onion routing networks
Matching passage: Sigma rule: Detects the use of Tor or Tor-Browser to connect to onion routing networks. Logsource: windows / process_creation. Rule: title: Tor Client/Browser Execution id: 62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c status: test description: Detects the use of Tor or Tor-Browser to connect to onion routing networks references: - https://www.logpoint.com/en/blog/detecting-tor-use-with-logpoint/ author: frack113 date: 2022-02-20 modified: 2025-10-27 tags: - attack.command-and-control - attack.t1090.003 logsource: category: process_creation product: windows detection: selection: - Description: Tor Browser - Product: Tor Browser - Image|endswith: - \tor.exe - \Tor Browser\Browser\firefox.exe condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_tor_execution/info.yml
Near-miss passage: Sigma rule: Detects the use of powershell commands from headless ConHost window. The "--headless" flag hides the windows from the us. Logsource: windows / process_creation. Rule: title: Powershell Executed From Headless ConHost Process id: 056c7317-9a09-4bd4-9067-d051312752ea related: - id: 00ca75ab-d5ce-43be-b86c-55ff39c6abfc type: derived status: test description: 'Detects the use of powershell commands from headless ConHost window. The "--headless" flag hides the windows from the user upon execution. ' references: - https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software author: Matt Anderson (Huntress) date: 2024-07-23 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1059.003 - attack.t1564.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \conhost.exe - OriginalFileName: CONHOST.EXE selection_cli: CommandLine|contains|all: - --headless - powershell condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_conhost_headless_powershell/info.yml
Query: patch priority for CVE-2015-7934
Matching passage: CVE-2015-7934. CWE: CWE-200. CVSS: 8.600000381469727. The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to discover log-file pathnames via unspecified vectors.
Near-miss passage: CVE-2015-2505. CWE: CWE-200. CVSS: 5.0. Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to obtain sensitive stacktrace information via a crafted request, aka "Exchange Information Disclosure Vulnerability."
Query: vulnerability: Cross-site request forgery (CSRF) vulnerability in the CUCReports page in Cisco Unity Connection 11.0(0.98000.225) and 11.0(0.98000.332) allows remote attackers to hijack the authe
Matching passage: CVE-2015-0716. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the CUCReports page in Cisco Unity Connection 11.0(0.98000.225) and 11.0(0.98000.332) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut33659.
Near-miss passage: CVE-2015-1581. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Mobile Domain plugin 1.5.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2) domain, (3) text, (4) font, (5) fontcolor, (6) color, or (7) padding parameter in an add-domain action in the mobile-domain page to wp-admin/options-general.php.
Query: CVE similar to CVE-2015-1783
Matching passage: CVE-2015-1783. CWE: CWE-119. CVSS: 7.5. The prefix variable in the get_or_define_ns function in Lasso before commit 6d854cef4211cdcdbc7446c978f23ab859847cdd allows remote attackers to cause a denial of service (uninitialized memory access and application crash) via unspecified vectors.
Near-miss passage: CVE-2015-1954. CWE: CWE-119. CVSS: 7.800000190734863. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965.
Query: CVE similar to CVE-2015-3788
Matching passage: CVE-2015-3788. CWE: CWE-119. CVSS: 6.800000190734863. QuickTime 7 in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-3765, CVE-2015-3779, CVE-2015-3789, CVE-2015-3790, CVE-2015-3791, CVE-2015-3792, CVE-2015-5751, CVE-2015-5753, and CVE-2015-5779.
Near-miss passage: CVE-2015-5847. CWE: CWE-119. CVSS: 7.199999809265137. The Disk Images component in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
Query: describe CVE-2015-1064
Matching passage: CVE-2015-1064. CWE: CWE-200. CVSS: 1.899999976158142. Springboard in Apple iOS before 8.2 allows physically proximate attackers to bypass an intended activation requirement and read the home screen by leveraging an application crash during the activation process.
Near-miss passage: CVE-2015-6632. CWE: CWE-200. CVSS: 5.0. libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24346430.
Query: CWE for Reliance on IP Address for Authentication
Matching passage: CWE-291 Reliance on IP Address for Authentication. The product uses an IP address for authentication.
Near-miss passage: CWE-1235 Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations. The code uses boxed primitives, which may introduce inefficiencies into performance-critical operations.
Query: risk of The wp-polls plugin before 2.72 for WordPress has SQL injection.
Matching passage: CVE-2015-9352. CWE: CWE-89. CVSS: 9.800000190734863. The wp-polls plugin before 2.72 for WordPress has SQL injection.
Near-miss passage: CVE-2015-9449. CWE: CWE-89. CVSS: 7.199999809265137. The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter.
Query: patch priority for CVE-2015-10080
Matching passage: CVE-2015-10080. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in NREL api-umbrella-web 0.7.1. It has been classified as problematic. This affects an unknown part of the component Admin Data Table Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 0.8.0 is able to address this issue. The patch is named f53a9fb87e10c457f0f3dd4f2af24d3b2f21b3ca. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-221487.
Near-miss passage: CVE-2015-9297. CWE: CWE-79. CVSS: 6.099999904632568. The events-manager plugin before 5.6 for WordPress has XSS.
Query: describe CVE-2015-9238
Matching passage: CVE-2015-9238. CWE: CWE-697. CVSS: 5.300000190734863. secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.
Near-miss passage: CVE-2015-10129. CWE: CWE-697. CVSS: 5.900000095367432. A vulnerability was found in planet-freo up to 20150116 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/inc/auth.inc.php. The manipulation of the argument auth leads to incorrect comparison. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is 6ad38c58a45642eb8c7844e2f272ef199f59550d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-252716.
Query: patch priority for CVE-2015-7067
Matching passage: CVE-2015-7067. CWE: UNKNOWN. CVSS: 2.0999999046325684. IOThunderboltFamily in Apple OS X before 10.11.2 allows local users to cause a denial of service (NULL pointer dereference) via an unspecified userclient type.
Near-miss passage: CVE-2015-1042. CWE: UNKNOWN. CVSS: 5.800000190734863. The string_sanitize_url function in core/string_api.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allows remote attackers to conduct open redirect and phishing attacks via a URL with a ":/" (colon slash) separator in the return parameter to login_page.php, a different vulnerability than CVE-2014-6316.