alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects enumeration of local network configuration
Matching passage: Sigma rule: Detects enumeration of local network configuration. Logsource: macos / process_creation. Rule: title: System Network Discovery - macOS id: 58800443-f9fc-4d55-ae0c-98a3966dfb97 status: test description: Detects enumeration of local network configuration references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md author: remotephone, oscd.community date: 2020-10-06 modified: 2024-08-29 tags: - attack.discovery - attack.t1016 logsource: product: macos category: process_creation detection: selection_1: Image|endswith: - /arp - /ifconfig - /netstat - /networksetup - /socketfilterfw selection_2: Image: /usr/bin/defaults CommandLine|contains|all: - /Library/Preferences/com.apple.alf - read filter_main_wifivelocityd: ParentImage|endswith: /wifivelocityd condition: 1 of selection_* and not 1 of filter_main_* falsepositives: - Legitimate administration activities level: informational
Near-miss passage: Sigma rule: Detects potentially suspicious child processes launched via the ScreenConnect client service.. Logsource: windows / process_creation. Rule: title: Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution id: 7b582f1a-b318-4c6a-bf4e-66fe49bf55a5 related: - id: d1a401ab-8c47-4e86-a7d8-2460b6a53e4a type: derived status: test description: 'Detects potentially suspicious child processes launched via the ScreenConnect client service. ' references: - https://www.mandiant.com/resources/telegram-malware-iranian-espionage - https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Host_client/View_menu/Backstage_mode - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708 - https://www.trendmicro.com/en_us/research/24/b/threat-actor-groups-including-black-basta-are-exploiting-recent-.html author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @Kostastsale date: 2022-02-25 modified: 2024-02-28 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows category: process_creation detection: selection: ParentCommandLine|contains|all: - :\Windows\TEMP\ScreenConnect\ - run.cmd Image|endswith: - \bitsadmin.exe - \cmd.exe - \curl.exe - \dllhost.exe - \net.exe - \nltest.exe - \powershell.exe - \pwsh.exe - \rundll32.exe - \wevtutil.exe condition: selection falsepositives: - If the script being executed make use of any of the utilities mentioned in the detection then they should filtered out or allowed. level: medium
Query: describe CVE-2015-2718
Matching passage: CVE-2015-2718. CWE: CWE-200. CVSS: 4.300000190734863. The WebChannel.jsm module in Mozilla Firefox before 38.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive webchannel-response data via a crafted web site containing an IFRAME element referencing a different web site that is intended to read this data.
Near-miss passage: CVE-2015-6557. CWE: CWE-200. CVSS: 2.0999999046325684. IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 5.5 before 5.5.6.1, 6.3 before 6.3.1.5, 6.4 before 6.4.1.7, and 7.1 before 7.1.2; Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 5.5 before 5.5.1.1, 6.1 before 6.1.3.7, 6.3 before 6.3.1.5, 6.4 before 6.4.1.7, and 7.1 before 7.1.2; and Tivoli Storage FlashCopy Manager 3.1 before 3.1.1.5, 3.2 before 3.2.1.7, and 4.1 before 4.1.2, when application tracing is used, place cleartext passwords in exception messages, which allows physically proximate attackers to obtain sensitive information by reading trace output, a different vulnerability than CVE-2015-4949.
Query: vulnerability: The string-translate* procedure in the data-structures unit in CHICKEN before 4.10.0 allows remote attackers to cause a denial of service (crash).
Matching passage: CVE-2015-4556. CWE: CWE-20. CVSS: 7.5. The string-translate* procedure in the data-structures unit in CHICKEN before 4.10.0 allows remote attackers to cause a denial of service (crash).
Near-miss passage: CVE-2015-9208. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 800, and SD 810, the function tzbsp_pil_verify_sig() does not strictly check that the pointer to ELF and program headers and hash segment is within secure memory. It only checks that the address is not in non-secure memory. A given address range can overlap with both secure and non-secure regions - hence if such an address is passed in, it would not pass the non-secure range check, and would be considered valid by the function, even though that memory area could be modified by the non-secure side.
Query: risk of An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393101.
Matching passage: CVE-2015-9010. CWE: CWE-264. CVSS: 9.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393101.
Near-miss passage: CVE-2015-1292. CWE: CWE-264. CVSS: 5.0. The NavigatorServiceWorker::serviceWorker function in modules/serviceworkers/NavigatorServiceWorker.cpp in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy by accessing a Service Worker.
Query: CVE similar to CVE-2015-3246
Matching passage: CVE-2015-3246. CWE: CWE-264. CVSS: 7.199999809265137. libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.
Near-miss passage: CVE-2015-7751. CWE: CWE-264. CVSS: 6.900000095367432. Juniper Junos OS before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R9, 12.3X48 before 12.3X48-D15, 13.2 before 13.2R7, 13.2X51 before 13.2X51-D35, 13.3 before 13.3R6, 14.1 before 14.1R5, 14.1X50 before 14.1X50-D105, 14.1X51 before 14.1X51-D70, 14.1X53 before 14.1X53-D25, 14.1X55 before 14.1X55-D20, 14.2 before 14.2R1, 15.1 before 15.1F2 or 15.1R1, and 15.1X49 before 15.1X49-D10 does not require a password for the root user when pam.conf is "corrupted," which allows local users to gain root privileges by modifying the file.
Query: exploit Cross-site request forgery (CSRF) vulnerability in Vesta Control Panel before 0.9.8-14 allows remote attackers to hijack the authentication of arbitrary users.
Matching passage: CVE-2015-2861. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Vesta Control Panel before 0.9.8-14 allows remote attackers to hijack the authentication of arbitrary users.
Near-miss passage: CVE-2015-2701. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in CS-Cart 4.2.4 allows remote attackers to hijack the authentication of users for requests that change a user password via a request to profiles-update/.
Query: exploit In TrustZone a buffer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel while loading an ELF file.
Matching passage: CVE-2015-8999. CWE: CWE-119. CVSS: 7.800000190734863. In TrustZone a buffer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel while loading an ELF file.
Near-miss passage: CVE-2015-7089. CWE: CWE-119. CVSS: 6.599999904632568. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
Query: describe CVE-2015-7604
Matching passage: CVE-2015-7604. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.2.x before 6.2.6 and Splunk Light 6.2.x before 6.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-8795. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in the Admin UI in Apache Solr before 5.1 allow remote attackers to inject arbitrary web script or HTML via crafted fields that are mishandled during the rendering of the (1) Analysis page, related to webapp/web/js/scripts/analysis.js or (2) Schema-Browser page, related to webapp/web/js/scripts/schema-browser.js.
Query: exploit Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corr
Matching passage: CVE-2015-2492. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486, CVE-2015-2487, CVE-2015-2490, CVE-2015-2494, CVE-2015-2498, and CVE-2015-2499.
Near-miss passage: CVE-2015-1333. CWE: CWE-119. CVSS: 4.900000095367432. Memory leak in the __key_link_end function in security/keys/keyring.c in the Linux kernel before 4.1.4 allows local users to cause a denial of service (memory consumption) via many add_key system calls that refer to existing keys.
Query: exploit Open redirect vulnerability in the Field UI module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL
Matching passage: CVE-2015-3232. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the Field UI module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destinations parameter.
Near-miss passage: CVE-2015-0492. CWE: UNKNOWN. CVSS: 9.300000190734863. Unspecified vulnerability in Oracle Java SE 7u76 and 8u40, and JavaFX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0484.
Query: patch priority for CVE-2015-9424
Matching passage: CVE-2015-9424. CWE: CWE-352. CVSS: 6.5. The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.php global_url or admin_url parameter.
Near-miss passage: CVE-2015-9434. CWE: CWE-352. CVSS: 6.5. The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or tab_flags_order parameter.
Query: Persistence mechanism resembling Container API
Matching passage: T1552.007 Container API. Tactics: credential access. Description: Adversaries may gather credentials via APIs within a containers environment. APIs in these environments, such as the Docker API and Kubernetes APIs, allow a user to remotely manage their container resources and cluster components.(Citation: Docker API)(Citation: Kubernetes API) An adversary may access the Docker API to collect logs that contain credentials to cloud, container, and various other resources in the environment.(Citation: Unit 42 Unsecured Docker Daemons) An adversary with sufficient permissions, such as via a pod's service account, may also use the Kubernetes API to retrieve credentials from the Kubernetes API server. These credentials may include those needed for Docker API authentication or secrets from Kubernetes cluster components.
Near-miss passage: T1552.005 Cloud Instance Metadata API. Tactics: credential access. Description: Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data. Most cloud service providers support a Cloud Instance Metadata API which is a service provided to running virtual instances that allows applications to access information about the running virtual instance. Available information generally includes name, security group, and additional metadata including sensitive data such as credentials and UserData scripts that may contain additional secrets. The Instance Metadata API is provided as a convenience to assist in managing applications and is accessible by anyone who can access the instance.(Citation: AWS Instance Metadata API) A cloud metadata API has been used in at least one high profile compromise.(Citation: Krebs Capital One August 2019) If adversaries have a presence on the running virtual instance, they may query the Instance Metadata API directly to identify credentials that grant access to additional resources. Additionally, adversaries may exploit a Server-Side Request Forgery (SSRF) vulnerability in a public facing web proxy that allows them to gain access to the sensitive information via a request to the Instance Metadata API.(Citation: RedLock Instance Metadata API 2018) The de facto standard across cloud service providers is to host the Instance Metadata API at <code>http[:]//169.254.169.254</code>.
Query: alert when Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool.
Matching passage: Sigma rule: Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool.. Logsource: windows / file_event. Rule: title: ADSI-Cache File Creation By Uncommon Tool id: 75bf09fa-1dd7-4d18-9af9-dd9e492562eb status: test description: Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool. references: - https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961 - https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/ - https://github.com/fox-it/LDAPFragger author: xknow @xknow_infosec, Tim Shelton date: 2019-03-24 modified: 2023-10-18 tags: - attack.t1001.003 - attack.command-and-control logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \Local\Microsoft\Windows\SchCache\ TargetFilename|endswith: .sch filter_main_generic: - Image|endswith: - :\Program Files\Cylance\Desktop\CylanceSvc.exe - :\Windows\CCM\CcmExec.exe - :\windows\system32\dllhost.exe - :\Windows\system32\dsac.exe - :\Windows\system32\efsui.exe - :\windows\system32\mmc.exe - :\windows\system32\svchost.exe - :\Windows\System32\wbem\WmiPrvSE.exe - :\windows\system32\WindowsPowerShell\v1.0\powershell.exe - Image|contains: - :\Windows\ccmsetup\autoupgrade\ccmsetup - :\Program Files\SentinelOne\Sentinel Agent filter_main_office: Image|contains|all: - :\Program Files\ - \Microsoft Office Image|endswith: \OUTLOOK.EXE filter_optional_ldapwhoami: Image|endswith: \LANDesk\LDCLient\ldapwhoami.exe filter_optional_citrix: Image|endswith: :\Program Files\Citrix\Receiver StoreFront\Services\DefaultDomainServices\Citrix.DeliveryServices.DomainServices.ServiceHost.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Other legimate tools, which do ADSI (LDAP) operations, e.g. any remoting activity by MMC, Powershell, Windows etc. level: medium
Near-miss passage: Sigma rule: Detects the abuse of custom file open handler, executing powershell. Logsource: windows / registry_set. Rule: title: Custom File Open Handler Executes PowerShell id: 7530b96f-ad8e-431d-a04d-ac85cc461fdc status: test description: Detects the abuse of custom file open handler, executing powershell references: - https://news.sophos.com/en-us/2022/02/01/solarmarker-campaign-used-novel-registry-changes-to-establish-persistence/?cmp=30728 author: CD_R0M_ date: 2022-06-11 modified: 2023-08-17 tags: - attack.stealth - attack.t1202 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: shell\open\command\ Details|contains|all: - powershell - -command condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-2786
Matching passage: CVE-2015-2786. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in MyBB (aka MyBulletinBoard) before 1.8.4 has unknown attack vectors related to "Group join request notifications sent to wrong group leaders."
Near-miss passage: CVE-2015-0431. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0 6.3.1, 6.3.2, 6.3.4, and 6.3.5 allows remote attackers to affect integrity via unknown vectors related to UI Infrastructure.
Query: vulnerability: SafeNet Authentication Service for NPS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifyi
Matching passage: CVE-2015-7964. CWE: CWE-264. CVSS: 7.800000190734863. SafeNet Authentication Service for NPS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
Near-miss passage: CVE-2015-1878. CWE: CWE-264. CVSS: 6.800000190734863. Thales nShield Connect hardware models 500, 1500, 6000, 500+, 1500+, and 6000+ before 11.72 allows physically proximate attackers to sign arbitrary data with previously loaded signing keys, extract the device identification key [KNETI] and impersonate the nShield Connect device on a network, affect the integrity and confidentiality of newly created keys, and potentially cause other unspecified impacts using previously loaded keys by connecting to the USB port on the front panel.
Query: write Sigma for Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution
Matching passage: Sigma rule: Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution. Logsource: windows / system. Rule: title: Important Windows Eventlog Cleared id: 100ef69e-3327-481c-8e5c-6d80d9507556 related: - id: a62b37e0-45d3-48d9-a517-90c1a1b0186b type: derived status: test description: Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution references: - https://twitter.com/deviouspolack/status/832535435960209408 - https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100 author: Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems) date: 2022-05-17 modified: 2023-11-15 tags: - attack.defense-impairment - attack.t1685.005 - car.2016-04-002 logsource: product: windows service: system detection: selection: EventID: 104 Provider_Name: Microsoft-Windows-Eventlog Channel: - Microsoft-Windows-PowerShell/Operational - Microsoft-Windows-Sysmon/Operational - PowerShellCore/Operational - Security - System - Windows PowerShell condition: selection falsepositives: - Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog) - System provisioning (system reset before the golden image creation) level: high
Near-miss passage: Sigma rule: Detects when a Container Registry is created or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Container Registry Created or Deleted id: 93e0ef48-37c8-49ed-a02c-038aab23628e status: test description: Detects when a Container Registry is created or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1 author: Austin Songer @austinsonger date: 2021-08-07 modified: 2022-08-23 tags: - attack.impact - attack.t1485 - attack.t1496 - attack.t1489 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.CONTAINERREGISTRY/REGISTRIES/WRITE - MICROSOFT.CONTAINERREGISTRY/REGISTRIES/DELETE condition: selection falsepositives: - Container Registry being created or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Container Registry created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Query: CWE for Cleartext Transmission of Sensitive Information
Matching passage: CWE-319 Cleartext Transmission of Sensitive Information. The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Near-miss passage: CWE-626 Null Byte Interaction Error (Poison Null Byte). The product does not properly handle null bytes or NUL characters when passing data between different representations or components.
Query: exploit The bidirectional text-display and text-selection implementations in Terminal in Apple OS X before 10.11 interpret directional override formatting characters differently, which all
Matching passage: CVE-2015-5883. CWE: CWE-20. CVSS: 5.0. The bidirectional text-display and text-selection implementations in Terminal in Apple OS X before 10.11 interpret directional override formatting characters differently, which allows remote attackers to spoof the content of a text document via a crafted character sequence.
Near-miss passage: CVE-2015-9069. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, the Secure File System can become corrupted.