alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / application
Matching passage: Sigma rule: Detects backup catalog deletions. Logsource: windows / application. Rule: title: Backup Catalog Deleted id: 9703792d-fd9a-456d-a672-ff92efe4806a status: test description: Detects backup catalog deletions references: - https://technet.microsoft.com/en-us/library/cc742154(v=ws.11).aspx - https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100 author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection) date: 2017-05-12 modified: 2022-12-25 tags: - attack.stealth - attack.t1070.004 logsource: product: windows service: application detection: selection: EventID: 524 Provider_Name: Microsoft-Windows-Backup condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of regsvr32 where the DLL is located in a highly suspicious locations. Logsource: windows / process_creation. Rule: title: Regsvr32 Execution From Highly Suspicious Location id: 327ff235-94eb-4f06-b9de-aaee571324be status: test description: Detects execution of regsvr32 where the DLL is located in a highly suspicious locations references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-26 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regsvr32.exe - OriginalFileName: REGSVR32.EXE selection_path_1: CommandLine|contains: - :\PerfLogs\ - :\Temp\ - \Windows\Registration\CRMLog - \Windows\System32\com\dmp\ - \Windows\System32\FxsTmp\ - \Windows\System32\Microsoft\Crypto\RSA\MachineKeys\ - \Windows\System32\spool\drivers\color\ - \Windows\System32\spool\PRINTERS\ - \Windows\System32\spool\SERVERS\ - \Windows\System32\Tasks_Migrated\ - \Windows\System32\Tasks\Microsoft\Windows\SyncCenter\ - \Windows\SysWOW64\com\dmp\ - \Windows\SysWOW64\FxsTmp\ - \Windows\SysWOW64\Tasks\Microsoft\Windows\PLA\System\ - \Windows\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\ - \Windows\Tasks\ - \Windows\Tracing\ selection_path_2: CommandLine|contains: - ' "C:\' - ' C:\' - ' ''C:\' - D:\ selection_exclude_known_dirs: CommandLine|contains: - C:\Program Files (x86)\ - C:\Program Files\ - C:\ProgramData\ - C:\Users\ - ' C:\Windows\' - ' "C:\Windows\' - ' ''C:\Windows\' filter_main_empty: CommandLine: '' filter_main_null: CommandLine: null condition: selection_img and (selection_path_1 or (selection_path_2 and not selection_exclude_known_dirs)) and not 1 of filter_main_* falsepositives: - Unlikely level: high
Query: vulnerability: SQL injection vulnerability in index.php in CatBot 0.4.2 allows remote attackers to execute arbitrary SQL commands via the lastcatbot parameter.
Matching passage: CVE-2015-1367. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in index.php in CatBot 0.4.2 allows remote attackers to execute arbitrary SQL commands via the lastcatbot parameter.
Near-miss passage: CVE-2015-10038. CWE: CWE-89. CVSS: 8.0. A vulnerability was found in nym3r0s pplv2. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The patch is named 28f8b0550104044da09f04659797487c59f85b00. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218023.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects a suspicious child process of userinit. Logsource: windows / process_creation. Rule: title: Suspicious Userinit Child Process id: b655a06a-31c0-477a-95c2-3726b83d649d status: test description: Detects a suspicious child process of userinit references: - https://twitter.com/SBousseaden/status/1139811587760562176 author: Florian Roth (Nextron Systems), Samir Bousseaden (idea) date: 2019-06-17 modified: 2025-10-17 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \userinit.exe filter_main_netlogon: CommandLine|contains: \netlogon\ filter_main_explorer: - Image|endswith: \explorer.exe - OriginalFileName: explorer.exe - CommandLine: C:\Windows\Explorer.EXE filter_main_null: Image: null condition: selection and not 1 of filter_main_* falsepositives: - Administrative scripts level: medium
Near-miss passage: Sigma rule: Detects program executions in suspicious non-program folders related to malware or hacking activity. Logsource: linux / auditd. Rule: title: Program Executions in Suspicious Folders id: a39d7fa7-3fbd-4dc2-97e1-d87f546b1bbc status: test description: Detects program executions in suspicious non-program folders related to malware or hacking activity references: - Internal Research author: Florian Roth (Nextron Systems) date: 2018-01-23 modified: 2021-11-27 tags: - attack.t1587 - attack.t1584 - attack.resource-development logsource: product: linux service: auditd detection: selection: type: SYSCALL exe|startswith: - /tmp/ - /var/www/ - /home/*/public_html/ - /usr/local/apache2/ - /usr/local/httpd/ - /var/apache/ - /srv/www/ - /home/httpd/html/ - /srv/http/ - /usr/share/nginx/html/ - /var/lib/pgsql/data/ - /usr/local/mysql/data/ - /var/lib/mysql/ - /var/vsftpd/ - /etc/bind/ - /var/named/ condition: selection falsepositives: - Admin activity (especially in /tmp folders) - Crazy web applications level: medium
Query: rule covering Detects when there is a interruption in the authentication process.
Matching passage: Sigma rule: Detects when there is a interruption in the authentication process.. Logsource: azure / signinlogs. Rule: title: Azure Unusual Authentication Interruption id: 8366030e-7216-476b-9927-271d79f13cf3 status: test description: Detects when there is a interruption in the authentication process. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts author: Austin Songer @austinsonger date: 2021-11-26 modified: 2022-12-18 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 logsource: product: azure service: signinlogs detection: selection_50097: ResultType: 50097 ResultDescription: Device authentication is required selection_50155: ResultType: 50155 ResultDescription: DeviceAuthenticationFailed selection_50158: ResultType: 50158 ResultDescription: ExternalSecurityChallenge - External security challenge was not satisfied condition: 1 of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects service installation of different remote access tools software. These software are often abused by threat actors. Logsource: windows / system. Rule: title: Remote Access Tool Services Have Been Installed - System id: 1a31b18a-f00c-4061-9900-f735b96c99fc related: - id: c8b00925-926c-47e3-beea-298fd563728e type: similar status: test description: Detects service installation of different remote access tools software. These software are often abused by threat actors to perform references: - https://redcanary.com/blog/misbehaving-rats/ author: Connor Martin, Nasreddine Bencherchali date: 2022-12-23 modified: 2023-06-22 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1543.003 - attack.t1569.002 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: - 7045 - 7036 ServiceName|contains: - AmmyyAdmin - Atera - BASupportExpressSrvcUpdater - BASupportExpressStandaloneService - chromoting - GoToAssist - GoToMyPC - jumpcloud - LMIGuardianSvc - LogMeIn - monblanking - Parsec - RManService - RPCPerformanceService - RPCService - SplashtopRemoteService - SSUService - TeamViewer - TightVNC - vncserver - Zoho condition: selection falsepositives: - Unknown level: medium
Query: risk of Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1, when the Saxon XSLT parser is used, allows remote attackers to execute arbitrary code via a cra
Matching passage: CVE-2015-0931. CWE: CWE-74. CVSS: 6.800000190734863. Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1, when the Saxon XSLT parser is used, allows remote attackers to execute arbitrary code via a crafted XSLT document, related to a "resource injection" issue.
Near-miss passage: CVE-2015-8800. CWE: CWE-74. CVSS: 7.300000190734863. Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0 before MP1, Critical System Protection (SCSP) before 5.2.9 MP6, Data Center Security: Server Advanced Server (DCS:SA) 6.x before 6.5 MP1 and 6.6 before MP1, and Data Center Security: Server Advanced Server and Agents (DCS:SA) through 6.6 MP1 allow remote authenticated users to conduct argument-injection attacks by leveraging certain named-pipe access.
Query: common weakness: Power-On of Untrusted Execution Core Before Enabling Fabric Access Control
Matching passage: CWE-1193 Power-On of Untrusted Execution Core Before Enabling Fabric Access Control. The product enables components that contain untrusted firmware before memory and fabric access controls have been enabled.
Near-miss passage: CWE-563 Assignment to Variable without Use. The variable's value is assigned but never used, making it a dead store.
Query: describe CVE-2015-1559
Matching passage: CVE-2015-1559. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in administrator.php in Epignosis eFront Open Source Edition before 3.6.15.3 build 18022 allow remote attackers to hijack the authentication of administrators for requests that (1) delete modules via the delete_module parameter, (2) deactivate modules via the deactivate_module parameter, (3) activate modules via the activate_module parameter, (4) delete users via the delete_user parameter, (5) deactivate users via the deactivate_user parameter, (6) activate users via the activate_user parameter, (7) activate themes via the set_theme parameter, (8) deactivate themes via the set_theme parameter, (9) delete themes via the delete parameter, (10) deactivate events (user registration or email activation) via the deactivate_notification parameter, (11) activate events via the activate_notification parameter, (12) delete events via the delete_notification parameter, (13) deactivate language settings via the deactivate_language parameter, (14) activate language settings via the activate_language parameter, (15) delete language settings via the delete_language parameter, or (16) activate or deactivate the autologin feature for a user via a crafted maintenance request.
Near-miss passage: CVE-2015-0218. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in auth/shibboleth/logout.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout.
Query: risk of Integer overflow in the native_handle_create function in libcutils/native_handle.c in Android before 5.1.1 LMY48M allows attackers to obtain a different application's privileges or
Matching passage: CVE-2015-1528. CWE: CWE-189. CVSS: 9.300000190734863. Integer overflow in the native_handle_create function in libcutils/native_handle.c in Android before 5.1.1 LMY48M allows attackers to obtain a different application's privileges or cause a denial of service (Binder heap memory corruption) via a crafted application, aka internal bug 19334482.
Near-miss passage: CVE-2015-7674. CWE: CWE-189. CVSS: 6.800000190734863. Integer overflow in the pixops_scale_nearest function in pixops/pixops.c in gdk-pixbuf before 2.32.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted GIF image file, which triggers a heap-based buffer overflow.
Query: Encoded PowerShell / command-line abuse matching Asymmetric Cryptography
Matching passage: T1573.002 Asymmetric Cryptography. Tactics: command and control. Description: Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal. For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002).
Near-miss passage: T1573 Encrypted Channel. Tactics: command and control. Description: Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Query: vulnerability: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Ex
Matching passage: CVE-2015-0038. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0042 and CVE-2015-0046.
Near-miss passage: CVE-2015-1741. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1752.
Query: vulnerability: Stack-based buffer overflow in GSM SIM Utility (aka SIM Card Editor) 6.6 allows remote attackers to execute arbitrary code via a long entry in a .sms file.
Matching passage: CVE-2015-1171. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in GSM SIM Utility (aka SIM Card Editor) 6.6 allows remote attackers to execute arbitrary code via a long entry in a .sms file.
Near-miss passage: CVE-2015-7272. CWE: CWE-119. CVSS: 9.800000190734863. Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long SSH username or input.
Query: explain CWE-152
Matching passage: CWE-152 Improper Neutralization of Macro Symbols. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as macro symbols when they are sent to a downstream component.
Near-miss passage: CWE-164 Improper Neutralization of Internal Special Elements. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes internal special elements that could be interpreted in unexpected ways when they are sent to a downstream component.
Query: vulnerability: Open redirect vulnerability in Blue Coat ProxySG 6.5 before 6.5.8.8 and 6.6 and Advanced Secure Gateway (ASG) 6.6 might allow remote attackers to redirect users to arbitrary web si
Matching passage: CVE-2015-8597. CWE: UNKNOWN. CVSS: 7.400000095367432. Open redirect vulnerability in Blue Coat ProxySG 6.5 before 6.5.8.8 and 6.6 and Advanced Secure Gateway (ASG) 6.6 might allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a base64-encoded URL in conjunction with a "clear text" one in a coaching page, as demonstrated by "http://www.%humbug-URL%.local/bluecoat-splash-API?%BASE64-URL%."
Near-miss passage: CVE-2015-3118. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
Query: write Sigma for Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name locate
Matching passage: Sigma rule: Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name locate. Logsource: windows / system. Rule: title: Critical Hive In Suspicious Location Access Bits Cleared id: 39f919f3-980b-4e6f-a975-8af7e507ef2b related: - id: 839dd1e8-eda8-4834-8145-01beeee33acd type: obsolete status: test description: 'Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name located in the temp directory have been reset. This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default). Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior. ' references: - https://github.com/nasbench/Misc-Research/blob/b20da2336de0f342d31ef4794959d28c8d3ba5ba/ETW/Microsoft-Windows-Kernel-General.md author: Florian Roth (Nextron Systems) date: 2017-05-15 modified: 2024-01-18 tags: - attack.credential-access - attack.t1003.002 logsource: product: windows service: system detection: selection: EventID: 16 Provider_Name: Microsoft-Windows-Kernel-General HiveName|contains: - \Temp\SAM - \Temp\SECURITY condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of a new bits job by Bitsadmin. Logsource: windows / bits-client. Rule: title: New BITS Job Created Via Bitsadmin id: 1ff315dc-2a3a-4b71-8dde-873818d25d39 status: test description: Detects the creation of a new bits job by Bitsadmin references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md author: frack113 date: 2022-03-01 modified: 2023-03-27 tags: - attack.persistence - attack.execution - attack.stealth - attack.t1197 logsource: product: windows service: bits-client detection: selection: EventID: 3 processPath|endswith: \bitsadmin.exe condition: selection falsepositives: - Many legitimate applications or scripts could leverage "bitsadmin". This event is best correlated with EID 16403 via the JobID field level: low
Query: describe CVE-2015-2653
Matching passage: CVE-2015-2653. CWE: UNKNOWN. CVSS: 6.400000095367432. Unspecified vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce Platform 3.1.1, 3.1.2, 11.0, and 11.1 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Content Acquisition System.
Near-miss passage: CVE-2015-7069. CWE: UNKNOWN. CVSS: 9.300000190734863. Mobile Replayer in GPUTools Framework in Apple iOS before 9.2 allows attackers to execute arbitrary code in a privileged context via an app that provides a crafted pathname, a different vulnerability than CVE-2015-7070.
Query: CVE similar to CVE-2015-3646
Matching passage: CVE-2015-3646. CWE: CWE-200. CVSS: 4.0. OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.
Near-miss passage: CVE-2015-7322. CWE: CWE-200. CVSS: 5.0. The Secure Meeting (Pulse Collaboration) in Pulse Connect Secure (formerly Juniper Junos Pulse) before 7.1R22.1, 7.4, 8.0 before 8.0R11, and 8.1 before 8.1R3 provides different messages for attempts to join a meeting depending on the status of the meeting, which allows remote attackers to enumerate valid meeting ids via a series of requests.
Query: patch priority for CVE-2015-0901
Matching passage: CVE-2015-0901. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the duwasai flashy theme 1.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-7771. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the runtime engine in the Newphoria applican framework before 1.13.0 for Android and iOS allows remote attackers to inject arbitrary web script or HTML via a crafted SSID that is encountered by an applican application, a different vulnerability than CVE-2015-7772.
Query: describe CVE-2015-5850
Matching passage: CVE-2015-5850. CWE: CWE-254. CVSS: 2.0999999046325684. AppleKeyStore in Apple iOS before 9 allows physically proximate attackers to reset the count of incorrect passcode attempts via a device backup.
Near-miss passage: CVE-2015-1266. CWE: CWE-254. CVSS: 5.0. content/browser/webui/content_web_ui_controller_factory.cc in Google Chrome before 43.0.2357.130 does not properly consider the scheme in determining whether a URL is associated with a WebUI SiteInstance, which allows remote attackers to bypass intended access restrictions via a similar URL, as demonstrated by use of http://gpu when there is a WebUI class for handling chrome://gpu requests.