alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CWE for Mismatched Memory Management Routines
Matching passage: CWE-762 Mismatched Memory Management Routines. The product attempts to return a memory resource to the system, but it calls a release function that is not compatible with the function that was originally used to allocate that resource.
Near-miss passage: CWE-138 Improper Neutralization of Special Elements. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows remote attackers to inject arbitrary we
Matching passage: CVE-2015-3998. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows remote attackers to inject arbitrary web script or HTML via the query parameter to whois.php.
Near-miss passage: CVE-2015-2963. CWE: CWE-79. CVSS: 4.300000190734863. The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) attacks via a spoofed value, as demonstrated by image/jpeg.
Query: indicators of Search Open Websites/Domains
Matching passage: T1593 Search Open Websites/Domains. Tactics: reconnaissance. Description: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.(Citation: Cyware Social Media)(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking) Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Phishing](https://attack.mitre.org/techniques/T1566)).
Near-miss passage: T1593.003 Code Repositories. Tactics: reconnaissance. Description: Adversaries may search public code repositories for information about victims that can be used during targeting. Victims may store code in repositories on various third-party websites such as GitHub, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git. Adversaries may search various public code repositories for various information about a victim. Public code repositories can often be a source of various general information about victims, such as commonly used programming languages and libraries as well as the names of employees. Adversaries may also identify more sensitive data, including accidentally leaked credentials or API keys.(Citation: GitHub Cloud Service Credentials) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Valid Accounts](https://attack.mitre.org/techniques/T1078) or [Phishing](https://attack.mitre.org/techniques/T1566)). **Note:** This is distinct from [Code Repositories](https://attack.mitre.org/techniques/T1213/003), which focuses on [Collection](https://attack.mitre.org/tactics/TA0009) from private and internally hosted code repositories.
Query: secure coding against Remanent Data Readable after Memory Erase
Matching passage: CWE-1330 Remanent Data Readable after Memory Erase. Confidential information stored in memory circuits is readable or recoverable after being cleared or erased.
Near-miss passage: CWE-759 Use of a One-Way Hash without a Salt. The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.
Query: detection rule: Detects changes to the "MaxMpxCt" registry value. MaxMpxCt specifies the maximum outstanding network requests for the se
Matching passage: Sigma rule: Detects changes to the "MaxMpxCt" registry value. MaxMpxCt specifies the maximum outstanding network requests for the se. Logsource: windows / registry_set. Rule: title: MaxMpxCt Registry Value Changed id: 0e6a9e62-627e-496c-aef5-bfa39da29b5e status: test description: 'Detects changes to the "MaxMpxCt" registry value. MaxMpxCt specifies the maximum outstanding network requests for the server per client, which is used when negotiating a Server Message Block (SMB) connection with a client. Note if the value is set beyond 125 older Windows 9x clients will fail to negotiate. Ransomware threat actors and operators (specifically BlackCat) were seen increasing this value in order to handle a higher volume of traffic. ' references: - https://www.huntress.com/blog/blackcat-ransomware-affiliate-ttps - https://securityscorecard.com/research/deep-dive-into-alphv-blackcat-ransomware - https://www.intrinsec.com/alphv-ransomware-gang-analysis/?cn-reloaded=1 - https://www.sentinelone.com/labs/blackcat-ransomware-highly-configurable-rust-driven-raas-on-the-prowl-for-victims/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-03-19 tags: - attack.stealth - attack.t1070.005 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Services\LanmanServer\Parameters\MaxMpxCt condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques. Logsource: windows / system. Rule: title: Tap Driver Installation id: 8e4cf0e5-aa5d-4dc3-beff-dc26917744a9 status: test description: Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques references: - https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers author: Daniil Yugoslavskiy, Ian Davis, oscd.community date: 2019-10-24 modified: 2022-12-25 tags: - attack.exfiltration - attack.t1048 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains: tap0901 condition: selection falsepositives: - Legitimate OpenVPN TAP installation level: medium
Query: rule covering Detects the modification of an EC2 snapshot's permissions to enable access from another account
Matching passage: Sigma rule: Detects the modification of an EC2 snapshot's permissions to enable access from another account. Logsource: aws / cloudtrail. Rule: title: AWS Snapshot Backup Exfiltration id: abae8fec-57bd-4f87-aff6-6e3db989843d status: test description: Detects the modification of an EC2 snapshot's permissions to enable access from another account references: - https://www.justice.gov/file/1080281/download author: Darin Smith date: 2021-05-17 modified: 2021-08-19 tags: - attack.exfiltration - attack.t1537 logsource: product: aws service: cloudtrail detection: selection_source: eventSource: ec2.amazonaws.com eventName: ModifySnapshotAttribute condition: selection_source falsepositives: - Valid change to a snapshot's permissions level: medium
Near-miss passage: Sigma rule: Detects when the password policy is enumerated.. Logsource: windows / security. Rule: title: Password Policy Enumerated id: 12ba6a38-adb3-4d6b-91ba-a7fb248e3199 status: test description: Detects when the password policy is enumerated. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4661 - https://github.com/jpalanco/alienvault-ossim/blob/f74359c0c027e42560924b5cff25cdf121e5505a/os-sim/agent/src/ParserUtil.py#L951 author: Zach Mathis date: 2023-05-19 tags: - attack.discovery - attack.t1201 logsource: product: windows service: security definition: dfd8c0f4-e6ad-4e07-b91b-f2fca0ddef64 detection: selection: EventID: 4661 AccessList|contains: '%%5392' ObjectServer: Security Account Manager condition: selection level: medium
Query: Sigma rule for Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch
Matching passage: Sigma rule: Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch. Logsource: windows / process_creation. Rule: title: Suspicious ShellExec_RunDLL Call Via Ordinal id: 8823e85d-31d8-473e-b7f4-92da070f0fc6 related: - id: d87bd452-6da1-456e-8155-7dc988157b7d type: derived status: test description: 'Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch other commands. Adversary might only use the ordinal number in order to bypass existing detection that alert on usage of ShellExec_RunDLL on CommandLine. ' references: - https://redcanary.com/blog/raspberry-robin/ - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - https://github.com/SigmaHQ/sigma/issues/1009 - https://strontic.github.io/xcyclopedia/library/shell32.dll-65DA072F25DE83D9F83653E3FEA3644D.html author: Swachchhanda Shrawan Poudel date: 2024-12-01 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection_parent_img: ParentCommandLine|contains: SHELL32.DLL selection_parent_ordinal: ParentCommandLine|contains: - '#568' - '#570' - '#572' - '#576' selection_susp_cli_parent: - ParentCommandLine|contains: - comspec - iex - Invoke- - msiexec - odbcconf - regsvr32 - ParentCommandLine|contains: - \Desktop\ - \ProgramData\ - \Temp\ - \Users\Public\ selection_susp_child_img: Image|endswith: - \bash.exe - \bitsadmin.exe - \cmd.exe - \cscript.exe - \curl.exe - \mshta.exe - \msiexec.exe - \msxsl.exe - \odbcconf.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \schtasks.exe - \wmic.exe - \wscript.exe condition: all of selection_parent_* and 1 of selection_susp_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects some Empire PowerShell UAC bypass methods. Logsource: windows / process_creation. Rule: title: HackTool - Empire PowerShell UAC Bypass id: 3268b746-88d8-4cd3-bffc-30077d02c787 status: stable description: Detects some Empire PowerShell UAC bypass methods references: - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-EventVwrBypass.ps1#L64 - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-FodHelperBypass.ps1#L64 author: Ecco date: 2019-08-30 modified: 2023-02-21 tags: - attack.privilege-escalation - attack.t1548.002 - car.2019-04-001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - ' -NoP -NonI -w Hidden -c $x=$((gp HKCU:Software\Microsoft\Windows Update).Update)' - ' -NoP -NonI -c $x=$((gp HKCU:Software\Microsoft\Windows Update).Update);' condition: selection falsepositives: - Unknown level: critical
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects creation of a file named "ntds.dit" (Active Directory Database). Logsource: windows / file_event. Rule: title: NTDS.DIT Created id: 0b8baa3f-575c-46ee-8715-d6f28cc7d33c status: test description: Detects creation of a file named "ntds.dit" (Active Directory Database) references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-05 tags: - attack.credential-access - attack.t1003.003 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: ntds.dit condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects Bitbucket global secret scanning rule deletion activity.. Logsource: bitbucket / audit. Rule: title: Bitbucket Global Secret Scanning Rule Deleted id: e16cf0f0-ee88-4901-bd0b-4c8d13d9ee05 status: test description: Detects Bitbucket global secret scanning rule deletion activity. references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html - https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.defense-impairment - attack.t1685 logsource: product: bitbucket service: audit definition: 'Requirements: "Basic" log level is required to receive these audit events.' detection: selection: auditType.category: Global administration auditType.action: Global secret scanning rule deleted condition: selection falsepositives: - Legitimate user activity. level: medium
Query: patch priority for CVE-2015-9405
Matching passage: CVE-2015-9405. CWE: CWE-79. CVSS: 6.099999904632568. The wp-piwik plugin before 1.0.5 for WordPress has XSS.
Near-miss passage: CVE-2015-1575. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in u5CMS before 3.9.4 allow remote attackers to inject arbitrary web script or HTML via the (1) c, (2) i, (3) l, or (4) p parameter to index.php; the (5) a or (6) b parameter to u5admin/cookie.php; the name parameter to (7) copy.php or (8) delete.php in u5admin/; the (9) f or (10) typ parameter to u5admin/deletefile.php; the (11) n parameter to u5admin/done.php; the (12) c parameter to u5admin/editor.php; the (13) uri parameter to u5admin/meta2.php; the (14) n parameter to u5admin/notdone.php; the (15) newname parameter to u5admin/rename2.php; the (16) l parameter to u5admin/sendfile.php; the (17) s parameter to u5admin/characters.php; the (18) page parameter to u5admin/savepage.php; or the (19) name parameter to u5admin/new2.php.
Query: risk of Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1.
Matching passage: CVE-2015-7316. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1.
Near-miss passage: CVE-2015-6909. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the "Create download task via file upload" feature in Synology Download Station before 3.5-2962 allows remote attackers to inject arbitrary web script or HTML via the name element in the Info dictionary in a torrent file.
Query: vulnerability: The USAA Mobile Banking application before 7.10.1 for Android displays the most recently-used screen before prompting the user for login, which might allow physically proximate use
Matching passage: CVE-2015-1314. CWE: CWE-200. CVSS: 2.0999999046325684. The USAA Mobile Banking application before 7.10.1 for Android displays the most recently-used screen before prompting the user for login, which might allow physically proximate users to obtain banking account numbers and balances.
Near-miss passage: CVE-2015-6127. CWE: CWE-200. CVSS: 4.300000190734863. Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows remote attackers to read arbitrary files via a crafted .mcl file, aka "Windows Media Center Information Disclosure Vulnerability."
Query: patch priority for CVE-2015-5781
Matching passage: CVE-2015-5781. CWE: CWE-200. CVSS: 4.300000190734863. ImageIO in Apple iOS before 8.4.1 and OS X before 10.10.5 does not properly initialize an unspecified data structure, which allows remote attackers to obtain sensitive information from process memory via a crafted PNG image.
Near-miss passage: CVE-2015-2413. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to determine the existence of local files via a crafted module-resource request, aka "Internet Explorer Information Disclosure Vulnerability."
Query: exploit Multiple cross-site scripting (XSS) vulnerabilities in the Quick Edit module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject a
Matching passage: CVE-2015-6753. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in the Quick Edit module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an (1) entity title, related to in-place editing, or a (2) node title.
Near-miss passage: CVE-2015-10032. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in HealthMateWeb. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file createaccount.php. The manipulation of the argument username/password/first_name/last_name/company/phone leads to cross site scripting. The attack can be launched remotely. The patch is named 472776c25b1046ecaf962c46fed7c713c72c28e3. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217663.
Query: write Sigma for Detects default file names outputted by the BloodHound collection tool SharpHound
Matching passage: Sigma rule: Detects default file names outputted by the BloodHound collection tool SharpHound. Logsource: windows / file_event. Rule: title: BloodHound Collection Files id: 02773bed-83bf-469f-b7ff-e676e7d78bab status: test description: Detects default file names outputted by the BloodHound collection tool SharpHound references: - https://academy.hackthebox.com/course/preview/active-directory-bloodhound/bloodhound--data-collection author: C.J. May date: 2022-08-09 modified: 2026-02-19 tags: - attack.discovery - attack.t1087.001 - attack.t1087.002 - attack.t1482 - attack.t1069.001 - attack.t1069.002 - attack.execution - attack.t1059.001 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - BloodHound.zip - _computers.json - _containers.json - _gpos.json - _groups.json - _ous.json - _users.json filter_optional_ms_winapps: Image|endswith: \svchost.exe TargetFilename|startswith: C:\Program Files\WindowsApps\Microsoft. TargetFilename|endswith: \pocket_containers.json condition: selection and not 1 of filter_optional_* falsepositives: - Some false positives may arise in some environment and this may require some tuning. Add additional filters or reduce level depending on the level of noise level: high
Near-miss passage: Sigma rule: Detects the execution of powershell scripts with calls to the "Start-NetEventSession" cmdlet. Which allows an attacker t. Logsource: windows / ps_script. Rule: title: Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock id: da34e323-1e65-42db-83be-a6725ac2caa3 status: test description: 'Detects the execution of powershell scripts with calls to the "Start-NetEventSession" cmdlet. Which allows an attacker to start event and packet capture for a network event session. Adversaries may attempt to capture network to gather information over the course of an operation. Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/5f866ca4517e837c4ea576e7309d0891e78080a8/atomics/T1040/T1040.md#atomic-test-16---powershell-network-sniffing - https://github.com/0xsyr0/Awesome-Cybersecurity-Handbooks/blob/7b8935fe4c82cb64d61343de1a8b2e38dd968534/handbooks/10_post_exploitation.md - https://github.com/forgottentq/powershell/blob/9e616363d497143dc955c4fdce68e5c18d28a6cb/captureWindows-Endpoint.ps1#L13 author: frack113 date: 2024-05-12 tags: - attack.credential-access - attack.discovery - attack.t1040 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: Start-NetEventSession condition: selection falsepositives: - Legitimate network diagnostic scripts. level: medium
Query: Sigma YAML for macos / process_creation
Matching passage: Sigma rule: Detects macOS Gatekeeper bypass via xattr utility. Logsource: macos / process_creation. Rule: title: Gatekeeper Bypass via Xattr id: f5141b6d-9f42-41c6-a7bf-2a780678b29b status: test description: Detects macOS Gatekeeper bypass via xattr utility references: - https://github.com/redcanaryco/atomic-red-team/blob/1fed40dc7e48f16ed44dcdd9c73b9222a70cca85/atomics/T1553.001/T1553.001.md - https://www.loobins.io/binaries/xattr/ author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2024-04-18 tags: - attack.defense-impairment - attack.t1553.001 logsource: category: process_creation product: macos detection: selection: Image|endswith: /xattr CommandLine|contains|all: - -d - com.apple.quarantine condition: selection falsepositives: - Legitimate activities level: low
Near-miss passage: Sigma rule: Detects a BITS transfer job downloading file(s) from a direct IP address.. Logsource: windows / bits-client. Rule: title: BITS Transfer Job Download From Direct IP id: 90f138c1-f578-4ac3-8c49-eecfd847c8b7 related: - id: 99c840f2-2012-46fd-9141-c761987550ef type: similar status: test description: Detects a BITS transfer job downloading file(s) from a direct IP address. references: - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin - https://isc.sans.edu/diary/22264 - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ - https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-11 modified: 2023-03-27 tags: - attack.persistence - attack.execution - attack.stealth - attack.t1197 logsource: product: windows service: bits-client detection: selection: EventID: 16403 RemoteName|contains: - http://1 - http://2 - http://3 - http://4 - http://5 - http://6 - http://7 - http://8 - http://9 - https://1 - https://2 - https://3 - https://4 - https://5 - https://6 - https://7 - https://8 - https://9 filter_optional_local_networks: RemoteName|contains: - ://10. - ://192.168. - ://172.16. - ://172.17. - ://172.18. - ://172.19. - ://172.20. - ://172.21. - ://172.22. - ://172.23. - ://172.24. - ://172.25. - ://172.26. - ://172.27. - ://172.28. - ://172.29. - ://172.30. - ://172.31. - ://127. - ://169.254. filter_optional_seven_zip: RemoteName|contains: - https://7- - http://7- condition: selection and not 1 of filter_optional_* falsepositives: - Unknown level: high
Query: vulnerability: WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption an
Matching passage: CVE-2015-5816. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-4485. CWE: CWE-119. CVSS: 10.0. Heap-based buffer overflow in the resize_context_buffers function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via malformed WebM video data.