alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: explain CWE-226
Matching passage: CWE-226 Sensitive Information in Resource Not Removed Before Reuse. The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or zeroize the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.
Near-miss passage: CWE-1325 Improperly Controlled Sequential Memory Allocation. The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.
Query: write Sigma for Detection use of the command "split" to split files into parts and possible transfer.
Matching passage: Sigma rule: Detection use of the command "split" to split files into parts and possible transfer.. Logsource: macos / process_creation. Rule: title: Split A File Into Pieces id: 7f2bb9d5-6395-4de5-969c-70c11fbe6b12 status: test description: Detection use of the command "split" to split files into parts and possible transfer. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1030/T1030.md author: Igor Fits, Mikhail Larin, oscd.community date: 2020-10-15 modified: 2021-11-27 tags: - attack.exfiltration - attack.t1030 logsource: product: macos category: process_creation detection: selection: Image|endswith: /split condition: selection falsepositives: - Legitimate administrative activity level: low
Near-miss passage: Sigma rule: Detects the execution of the hdiutil utility in order to mount disk images.. Logsource: macos / process_creation. Rule: title: Disk Image Mounting Via Hdiutil - MacOS id: bf241472-f014-4f01-a869-96f99330ca8c status: test description: Detects the execution of the hdiutil utility in order to mount disk images. references: - https://www.loobins.io/binaries/hdiutil/ - https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/ - https://ss64.com/mac/hdiutil.html author: Omar Khaled (@beacon_exe) date: 2024-08-10 tags: - attack.initial-access - attack.collection - attack.t1566.001 - attack.t1560.001 logsource: product: macos category: process_creation detection: selection: Image|endswith: /hdiutil CommandLine|contains: - 'attach ' - 'mount ' condition: selection falsepositives: - Legitimate usage of hdiutil by administrators and users. level: medium
Query: Sigma rule for Detects execution of Impacket's psexec.py.
Matching passage: Sigma rule: Detects execution of Impacket's psexec.py.. Logsource: windows / security. Rule: title: Impacket PsExec Execution id: 32d56ea1-417f-44ff-822b-882873f5f43b status: test description: Detects execution of Impacket's psexec.py. references: - https://web.archive.org/web/20230329171218/https://blog.menasec.net/2019/02/threat-hunting-3-detecting-psexec.html author: Bhabesh Raj date: 2020-12-14 modified: 2022-09-22 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure detection: selection1: EventID: 5145 ShareName: \\\\\*\\IPC$ RelativeTargetName|contains: - RemCom_stdin - RemCom_stdout - RemCom_stderr condition: selection1 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential access attempts to the PowerShell console history directly via history file (ConsoleHost_history.txt).. Logsource: windows / process_creation. Rule: title: Potential PowerShell Console History Access Attempt via History File id: f4ff7323-b5fc-4323-8b52-6b9408e15788 status: experimental description: 'Detects potential access attempts to the PowerShell console history directly via history file (ConsoleHost_history.txt). This can give access to plaintext passwords used in PowerShell commands or used for general reconnaissance. ' references: - https://0xdf.gitlab.io/2018/11/08/powershell-history-file.html author: Luc Génaux date: 2025-04-03 tags: - attack.credential-access - attack.t1552.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - ConsoleHost_history.txt - (Get-PSReadLineOption).HistorySavePath condition: selection falsepositives: - Legitimate access of the console history file is possible level: medium
Query: exploit Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc.
Matching passage: CVE-2015-3631. CWE: CWE-264. CVSS: 3.5999999046325684. Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc.
Near-miss passage: CVE-2015-6745. CWE: CWE-264. CVSS: 4.599999904632568. Basware Banking (Maksuliikenne) 8.90.07.X relies on the client to enforce account locking, which allows local users to bypass that security mechanism by deleting the entry from the locking table. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability type and different affected versions. NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-6744.
Query: describe CVE-2015-2958
Matching passage: CVE-2015-2958. CWE: CWE-264. CVSS: 6.400000095367432. Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to bypass intended access restrictions and modify settings via unspecified vectors, a different vulnerability than CVE-2015-2952 and CVE-2015-2953.
Near-miss passage: CVE-2015-0801. CWE: CWE-264. CVSS: 7.5. Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818.
Query: CVE similar to CVE-2015-7273
Matching passage: CVE-2015-7273. CWE: CWE-611. CVSS: 9.800000190734863. Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has XXE.
Near-miss passage: CVE-2015-8866. CWE: CWE-611. CVSS: 9.600000381469727. ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.
Query: rule covering Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in com
Matching passage: Sigma rule: Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in com. Logsource: windows / image_load. Rule: title: DLL Sideloading Of ShellChromeAPI.DLL id: ee4c5d06-3abc-48cc-8885-77f1c20f4451 related: - id: e173ad47-4388-4012-ae62-bd13f71c18a8 type: similar status: test description: 'Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter ' references: - https://mobile.twitter.com/0gtweet/status/1564131230941122561 - https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-01 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \ShellChromeAPI.dll condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This te. Logsource: windows / registry_set. Rule: title: Potentially Suspicious Command Executed Via Run Dialog Box - Registry id: a7df0e9e-91a5-459a-a003-4cde67c2ff5d related: - id: f9d091f6-f1c7-4873-a24f-050b4a02b4dd type: derived status: test description: 'Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps. ' references: - https://medium.com/@ahmed.moh.farou2/fake-captcha-campaign-on-arabic-pirated-movie-sites-delivers-lumma-stealer-4f203f7adabf - https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71 - https://www.forensafe.com/blogs/runmrukey.html - https://redcanary.com/blog/threat-intelligence/intelligence-insights-october-2024/ author: Ahmed Farouk, Nasreddine Bencherchali date: 2024-11-01 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: registry_set detection: selection_key: TargetObject|contains: \Microsoft\Windows\CurrentVersion\Explorer\RunMRU selection_powershell_command: Details|contains: - powershell - pwsh selection_powershell_susp_keywords: Details|contains: - ' -e ' - ' -ec ' - ' -en ' - ' -enc ' - ' -enco' - ftp - Hidden - http - iex - Invoke- selection_wmic_command: Details|contains: wmic selection_wmic_susp_keywords: Details|contains: - shadowcopy - process call create condition: selection_key and (all of selection_powershell_* or all of selection_wmic_*) falsepositives: - Unknown level: high
Query: exploit The DHCPv4 server in Cisco IOS XR 5.2.2 on ASR 9000 devices allows remote attackers to cause a denial of service (service outage) via a flood of crafted DHCP packets, aka Bug ID CS
Matching passage: CVE-2015-0672. CWE: CWE-399. CVSS: 5.0. The DHCPv4 server in Cisco IOS XR 5.2.2 on ASR 9000 devices allows remote attackers to cause a denial of service (service outage) via a flood of crafted DHCP packets, aka Bug ID CSCup67822.
Near-miss passage: CVE-2015-8345. CWE: CWE-399. CVSS: 6.5. The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list.
Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\SYSTEM\CurrentControlSet. Logsource: windows / registry_set. Rule: title: Wdigest Enable UseLogonCredential id: d6a9b252-c666-4de6-8806-5561bbbd3bdc status: test description: Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to enable clear-text credentials references: - https://threathunterplaybook.com/hunts/windows/190510-RegModWDigestDowngrade/notebook.html - https://support.microsoft.com/en-us/topic/microsoft-security-advisory-update-to-improve-credentials-protection-and-management-may-13-2014-93434251-04ac-b7f3-52aa-9f951c14b649 - https://github.com/redcanaryco/atomic-red-team/blob/73fcfa1d4863f6a4e17f90e54401de6e30a312bb/atomics/T1112/T1112.md#atomic-test-3---modify-registry-to-store-logon-credentials author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2019-09-12 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: WDigest\UseLogonCredential Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: Wow6432Node Windows NT CurrentVersion Autorun Keys Modification id: 480421f9-417f-4d3b-9552-fd2728443ec8 related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: obsolete status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2025-10-22 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection_wow_nt_current_version_base: TargetObject|contains: \SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion selection_wow_nt_current_version: TargetObject|contains: - \Windows\Appinit_Dlls - \Image File Execution Options - \Drivers32 filter_main_empty: Details: (Empty) filter_main_null: Details: null filter_main_file_exec_options: Details|endswith: \Microsoft\Windows NT\CurrentVersion\Image File Execution Options condition: all of selection_* and not 1 of filter_main_* falsepositives: - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason - Legitimate administrator sets up autorun keys for legitimate reason level: medium
Query: CVE similar to CVE-2015-5318
Matching passage: CVE-2015-5318. CWE: CWE-352. CVSS: 6.800000190734863. Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF protection mechanism via a brute force attack.
Near-miss passage: CVE-2015-7364. CWE: CWE-352. CVSS: 6.800000190734863. The HTML_Quickform library, as used in Revive Adserver before 3.2.2, allows remote attackers to bypass the CSRF protection mechanism via an empty token.
Query: exploit HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to gain privileges and obtain sensitive information via unspecified vectors.
Matching passage: CVE-2015-5413. CWE: CWE-264. CVSS: 4.0. HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to gain privileges and obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-8966. CWE: CWE-264. CVSS: 7.800000190734863. arch/arm/kernel/sys_oabi-compat.c in the Linux kernel before 4.4 allows local users to gain privileges via a crafted (1) F_OFD_GETLK, (2) F_OFD_SETLK, or (3) F_OFD_SETLKW command in an fcntl64 system call.
Query: Multiple failed authentications followed by Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
Matching passage: T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Asymmetric encryption algorithms are those that use different keys on each end of the channel. Also known as public-key cryptography, this requires pairs of cryptographic keys that can encrypt/decrypt data from the corresponding key. Each end of the communication channels requires a private key (only in the procession of that entity) and the public key of the other entity. The public keys of each entity are exchanged before encrypted communications begin. Network protocols that use asymmetric encryption (such as HTTPS/TLS/SSL) often utilize symmetric encryption once keys are exchanged. Adversaries may opt to use these encrypted mechanisms that are baked into a protocol.
Near-miss passage: T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.(Citation: copy_cmd_cisco) Adversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted (such as HTTP, FTP, or DNS). This may include custom or publicly available encoding/compression algorithms (such as base64) as well as embedding data within protocol headers and fields.
Query: exploit Unspecified vulnerability in Oracle Java SE 7u80 and 8u45, JavaFX 2.2.80, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via unknown vectors r
Matching passage: CVE-2015-2619. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 7u80 and 8u45, JavaFX 2.2.80, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via unknown vectors related to 2D.
Near-miss passage: CVE-2015-4764. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790.
Query: alert when Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\
Matching passage: Sigma rule: Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\. Logsource: windows / file_event. Rule: title: Suspicious Creation with Colorcpl id: e15b518d-b4ce-4410-a9cd-501f23ce4a18 status: test description: Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\ references: - https://twitter.com/eral4m/status/1480468728324231172?s=20 author: frack113 date: 2022-01-21 modified: 2023-01-05 tags: - attack.stealth - attack.t1564 logsource: product: windows category: file_event detection: selection: Image|endswith: \colorcpl.exe filter_ext: TargetFilename|endswith: - .icm - .gmmp - .cdmp - .camp condition: selection and not 1 of filter_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of LiveKD with the "-m" flag to potentially dump the kernel memory. Logsource: windows / process_creation. Rule: title: Kernel Memory Dump Via LiveKD id: c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2 status: test description: Detects execution of LiveKD with the "-m" flag to potentially dump the kernel memory references: - https://learn.microsoft.com/en-us/sysinternals/downloads/livekd - https://4sysops.com/archives/creating-a-complete-memory-dump-without-a-blue-screen/ - https://kb.acronis.com/content/60892 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-16 modified: 2024-03-13 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \livekd.exe - \livekd64.exe - OriginalFileName: livekd.exe selection_cli: CommandLine|contains|windash: ' -m' condition: all of selection_* falsepositives: - Unlikely in production environment level: high
Query: describe CVE-2015-2012
Matching passage: CVE-2015-2012. CWE: CWE-200. CVSS: 4.0. The MQXR service in WMQ Telemetry in IBM WebSphere MQ 7.1 before 7.1.0.7, 7.5 through 7.5.0.5, and 8.0 before 8.0.0.4 uses world-readable permissions for a cleartext file containing the SSL keystore password, which allows local users to obtain sensitive information by reading this file.
Near-miss passage: CVE-2015-8669. CWE: CWE-200. CVSS: 5.300000190734863. libraries/config/messages.inc.php in phpMyAdmin 4.0.x before 4.0.10.12, 4.4.x before 4.4.15.2, and 4.5.x before 4.5.3.1 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
Query: write Sigma for Detects creation of a new service (kernel driver) with the type "kernel"
Matching passage: Sigma rule: Detects creation of a new service (kernel driver) with the type "kernel". Logsource: windows / process_creation. Rule: title: New Kernel Driver Via SC.EXE id: 431a1fdb-4799-4f3b-91c3-a683b003fc49 status: test description: Detects creation of a new service (kernel driver) with the type "kernel" references: - https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-14 modified: 2025-10-07 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: category: process_creation product: windows detection: selection: Image|endswith: \sc.exe CommandLine|contains: - create - config CommandLine|contains|all: - binPath - type - kernel filter_optional_avira_driver: - CommandLine|contains|all: - create netprotection_network_filter - 'type= kernel start= ' - binPath= System32\drivers\netprotection_network_filter - DisplayName= netprotection_network_filter - group= PNP_TDI tag= yes - CommandLine|contains|all: - create avelam binpath=C:\Windows\system32\drivers\avelam.sys - type=kernel start=boot error=critical group=Early-Launch condition: selection and not 1 of filter_optional_* falsepositives: - Rare legitimate installation of kernel drivers via sc.exe level: medium
Near-miss passage: Sigma rule: Detects Bitbucket global secret scanning rule deletion activity.. Logsource: bitbucket / audit. Rule: title: Bitbucket Global Secret Scanning Rule Deleted id: e16cf0f0-ee88-4901-bd0b-4c8d13d9ee05 status: test description: Detects Bitbucket global secret scanning rule deletion activity. references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html - https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.defense-impairment - attack.t1685 logsource: product: bitbucket service: audit definition: 'Requirements: "Basic" log level is required to receive these audit events.' detection: selection: auditType.category: Global administration auditType.action: Global secret scanning rule deleted condition: selection falsepositives: - Legitimate user activity. level: medium
Query: patch priority for CVE-2015-7076
Matching passage: CVE-2015-7076. CWE: UNKNOWN. CVSS: 7.199999809265137. The Intel Graphics Driver component in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.
Near-miss passage: CVE-2015-5200. CWE: UNKNOWN. CVSS: 6.300000190734863. The trace functionality in libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to write to arbitrary files via unspecified vectors.