alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1
Matching passage: CVE-2015-1833. CWE: CWE-20. CVSS: 6.400000095367432. XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.
Near-miss passage: CVE-2015-2202. CWE: CWE-20. CVSS: 7.199999809265137. Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows administrative users to escalate privileges to root on the underlying OS.
Query: risk of Wolf CMS before 0.8.3.1 allows unrestricted file upload and PHP Code Execution because admin/plugin/file_manager/browse/ (aka the filemanager) does not validate the parameter "file
Matching passage: CVE-2015-6567. CWE: CWE-20. CVSS: 8.800000190734863. Wolf CMS before 0.8.3.1 allows unrestricted file upload and PHP Code Execution because admin/plugin/file_manager/browse/ (aka the filemanager) does not validate the parameter "filename" properly. Exploitation requires a registered user who has access to upload functionality.
Near-miss passage: CVE-2015-7749. CWE: CWE-20. CVSS: 7.800000190734863. The PFE daemon in Juniper vSRX virtual firewalls with Junos OS before 15.1X49-D20 allows remote attackers to cause a denial of service via an unspecified connection request to the "host-OS."
Query: write Sigma for Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or
Matching passage: Sigma rule: Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or. Logsource: windows / process_creation. Rule: title: Suspicious Redirection to Local Admin Share id: ab9e3b40-0c85-4ba1-aede-455d226fd124 status: test description: Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or hacktool stagers references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html author: Florian Roth (Nextron Systems) date: 2022-01-16 modified: 2023-12-28 tags: - attack.exfiltration - attack.t1048 logsource: category: process_creation product: windows detection: selection_redirect: CommandLine|contains: '>' selection_share: CommandLine|contains: - \\\\127.0.0.1\\admin$\\ - \\\\localhost\\admin$\\ condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'. Logsource: windows / registry_event. Rule: title: Atbroker Registry Change id: 9577edbb-851f-4243-8c91-1d5b50c1a39b status: test description: Detects creation/modification of Assistive Technology applications and persistence with usage of 'at' references: - http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/ - https://lolbas-project.github.io/lolbas/Binaries/Atbroker/ author: Mateusz Wydra, oscd.community date: 2020-10-13 modified: 2023-01-19 tags: - attack.privilege-escalation - attack.stealth - attack.t1218 - attack.persistence - attack.t1547 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: - Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs - Software\Microsoft\Windows NT\CurrentVersion\Accessibility\Configuration filter_atbroker: Image: C:\Windows\system32\atbroker.exe TargetObject|contains: \Microsoft\Windows NT\CurrentVersion\Accessibility\Configuration Details: (Empty) filter_uninstallers: Image|startswith: C:\Windows\Installer\MSI TargetObject|contains: Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs condition: selection and not 1 of filter_* falsepositives: - Creation of non-default, legitimate at usage level: medium
Query: Encoded PowerShell / command-line abuse matching Unused/Unsupported Cloud Regions
Matching passage: T1535 Unused/Unsupported Cloud Regions. Tactics: stealth. Description: Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure. Cloud service providers often provide infrastructure throughout the world in order to improve performance, provide redundancy, and allow customers to meet compliance requirements. Oftentimes, a customer will only use a subset of the available regions and may not actively monitor other regions. If an adversary creates resources in an unused region, they may be able to operate undetected. A variation on this behavior takes advantage of differences in functionality across cloud regions. An adversary could utilize regions which do not support advanced detection services in order to avoid detection of their activity. An example of adversary use of unused AWS regions is to mine cryptocurrency through [Resource Hijacking](https://attack.mitre.org/techniques/T1496), which can cost organizations substantial amounts of money over time depending on the processing power used.(Citation: CloudSploit - Unused AWS Regions)
Near-miss passage: T1036.008 Masquerade File Type. Tactics: stealth. Description: Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type. For example, the header of a JPEG file, is <code> 0xFF 0xD8</code> and the file extension is either `.JPE`, `.JPEG` or `.JPG`. Adversaries may edit the header’s hex code and/or the file extension of a malicious payload in order to bypass file validation checks and/or input sanitization. This behavior is commonly used when payload files are transferred (e.g., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and stored (e.g., [Upload Malware](https://attack.mitre.org/techniques/T1608/001)) so that adversaries may move their malware without triggering detections. Common non-executable file types and extensions, such as text files (`.txt`) and image files (`.jpg`, `.gif`, etc.) may be typically treated as benign. Based on this, adversaries may use a file extension to disguise malware, such as naming a PHP backdoor code with a file name of <code>test.gif</code>. A user may not know that a file is malicious due to the benign appearance and file extension. Polyglot files, which are files that have multiple different file types and that function differently based on the application that will execute them, may also be used to disguise malicious malware and capabilities.(Citation: polygot_icedID)
Query: vulnerability: PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service (buf
Matching passage: CVE-2015-8385. CWE: CWE-119. CVSS: 7.5. PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Near-miss passage: CVE-2015-5794. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Query: detection rule: Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or
Matching passage: Sigma rule: Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or. Logsource: windows / process_creation. Rule: title: Suspicious Redirection to Local Admin Share id: ab9e3b40-0c85-4ba1-aede-455d226fd124 status: test description: Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or hacktool stagers references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html author: Florian Roth (Nextron Systems) date: 2022-01-16 modified: 2023-12-28 tags: - attack.exfiltration - attack.t1048 logsource: category: process_creation product: windows detection: selection_redirect: CommandLine|contains: '>' selection_share: CommandLine|contains: - \\\\127.0.0.1\\admin$\\ - \\\\localhost\\admin$\\ condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately. Logsource: azure / auditlogs. Rule: title: Azure Subscription Permission Elevation Via AuditLogs id: ca9bf243-465e-494a-9e54-bf9fc239057d status: test description: 'Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn''t planned. This setting could allow an attacker access to Azure subscriptions in your environment. ' references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#assignment-and-elevation author: Austin Songer @austinsonger date: 2021-11-26 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 logsource: product: azure service: auditlogs detection: selection: Category: Administrative OperationName: Assigns the caller to user access admin condition: selection falsepositives: - If this was approved by System Administrator. level: high
Query: patch priority for CVE-2015-7286
Matching passage: CVE-2015-7286. CWE: CWE-310. CVSS: 6.400000095367432. CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 rely on a polyalphabetic substitution cipher with hardcoded keys, which makes it easier for remote attackers to defeat a cryptographic protection mechanism by capturing IP or V.22bis PSTN protocol traffic.
Near-miss passage: CVE-2015-8329. CWE: CWE-310. CVSS: 5.0. SAP Manufacturing Integration and Intelligence (aka MII, formerly xMII) uses weak encryption (Base64 and DES), which allows attackers to conduct downgrade attacks and decrypt passwords via unspecified vectors, aka SAP Security Note 2240274.
Query: weakness Transmission of Private Resources into a New Sphere ('Resource Leak')
Matching passage: CWE-402 Transmission of Private Resources into a New Sphere ('Resource Leak'). The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product.
Near-miss passage: CWE-1315 Improper Setting of Bus Controlling Capability in Fabric End-point. The bus controller enables bits in the fabric end-point to allow responder devices to control transactions on the fabric.
Query: risk of Multiple stack-based buffer overflows in the SafeShellExecute method in the NetIQExecObject.NetIQExec.1 ActiveX control in NetIQExec.dll in NetIQ Security Solutions for iSeries 8.1
Matching passage: CVE-2015-0795. CWE: CWE-119. CVSS: 6.800000190734863. Multiple stack-based buffer overflows in the SafeShellExecute method in the NetIQExecObject.NetIQExec.1 ActiveX control in NetIQExec.dll in NetIQ Security Solutions for iSeries 8.1 allow remote attackers to execute arbitrary code via long arguments, aka ZDI-CAN-2699.
Near-miss passage: CVE-2015-7243. CWE: CWE-119. CVSS: 7.5. Buffer overflow in Boxoft WAV to MP3 Converter allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted WAV file.
Query: alert when Detects the attack technique pass the hash which is used to move laterally inside the network
Matching passage: Sigma rule: Detects the attack technique pass the hash which is used to move laterally inside the network. Logsource: windows / security. Rule: title: Pass the Hash Activity 2 id: 8eef149c-bd26-49f2-9e5a-9b00e3af499b status: stable description: Detects the attack technique pass the hash which is used to move laterally inside the network references: - https://github.com/iadgov/Event-Forwarding-Guidance/tree/master/Events - https://web.archive.org/web/20170909091934/https://blog.binarydefense.com/reliably-detecting-pass-the-hash-through-event-log-analysis - https://blog.stealthbits.com/how-to-detect-pass-the-hash-attacks/ author: Dave Kennedy, Jeff Warren (method) / David Vassallo (rule) date: 2019-06-14 modified: 2022-10-05 tags: - attack.lateral-movement - attack.t1550.002 logsource: product: windows service: security definition: The successful use of PtH for lateral movement between workstations would trigger event ID 4624 detection: selection_logon3: EventID: 4624 SubjectUserSid: S-1-0-0 LogonType: 3 LogonProcessName: NtLmSsp KeyLength: 0 selection_logon9: EventID: 4624 LogonType: 9 LogonProcessName: seclogo filter: TargetUserName: ANONYMOUS LOGON condition: 1 of selection_* and not filter falsepositives: - Administrator activity level: medium
Near-miss passage: Sigma rule: Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SA. Logsource: windows / ps_script. Rule: title: Winlogon Helper DLL id: 851c506b-6b7c-4ce2-8802-c703009d03c0 status: test description: 'Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\Software[Wow6432Node]Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are used to manage additional helper programs and functionalities that support Winlogon. Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.004/T1547.004.md author: Timur Zinniatullin, oscd.community date: 2019-10-21 modified: 2022-07-07 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.004 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: CurrentVersion\Winlogon selection2: ScriptBlockText|contains: - Set-ItemProperty - New-Item condition: all of selection* falsepositives: - Unknown level: medium
Query: describe CVE-2015-3622
Matching passage: CVE-2015-3622. CWE: CWE-119. CVSS: 4.300000190734863. The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted certificate.
Near-miss passage: CVE-2015-1714. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Query: vulnerability: Buffer overflow in Microsoft Visio 2007 SP3 and 2010 SP2 allows remote attackers to execute arbitrary code via crafted UML data in an Office document, aka "Microsoft Office Memory 
Matching passage: CVE-2015-2557. CWE: CWE-119. CVSS: 9.300000190734863. Buffer overflow in Microsoft Visio 2007 SP3 and 2010 SP2 allows remote attackers to execute arbitrary code via crafted UML data in an Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-7392. CWE: CWE-119. CVSS: 7.5. Heap-based buffer overflow in the parse_string function in libs/esl/src/esl_json.c in FreeSWITCH before 1.4.23 and 1.6.x before 1.6.2 allows remote attackers to execute arbitrary code via a trailing \u in a json string to cJSON_Parse.
Query: Suspicious Traffic Signaling execution detected on endpoint
Matching passage: T1205 Traffic Signaling. Tactics: stealth, persistence, command and control. Description: Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control. Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task. This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control. Usually this series of packets consists of attempted connections to a predefined sequence of closed ports (i.e. [Port Knocking](https://attack.mitre.org/techniques/T1205/001)), but can involve unusual flags, specific strings, or other unique characteristics. After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software. Adversaries may also communicate with an already open port, but the service listening on that port will only respond to commands or trigger other malicious functionality if passed the appropriate magic value(s). The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs. On network devices, adversaries may use crafted packets to enable [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004) for standard services offered by the device such as telnet. Such signaling may also be used to open a closed service port such as telnet, or to trigger module modification of malware implants on the device, adding, removing, or changing malicious capabilities. Adversaries may use crafted packets to attempt to connect to one or more (open or closed) ports, but may also
Near-miss passage: T1205.001 Port Knocking. Tactics: stealth, persistence, command and control. Description: Adversaries may use port knocking to hide open ports used for persistence or command and control. To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports. After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software. This technique has been observed both for the dynamic opening of a listening port as well as the initiating of a connection to a listening server on a different system. The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.
Query: alert when Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secre
Matching passage: Sigma rule: Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secre. Logsource: zeek / smb_files. Rule: title: Possible Impacket SecretDump Remote Activity - Zeek id: 92dae1ed-1c9d-4eff-a567-33acbd95b00e status: test description: Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml references: - https://web.archive.org/web/20230329153811/https://blog.menasec.net/2019/02/threat-huting-10-impacketsecretdump.html author: Samir Bousseaden, @neu5ron date: 2020-03-19 modified: 2021-11-27 tags: - attack.credential-access - attack.t1003.002 - attack.t1003.004 - attack.t1003.003 logsource: product: zeek service: smb_files detection: selection: path|contains|all: - \ - ADMIN$ name|contains: SYSTEM32\ name|endswith: .tmp condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detect changes to the "LegalNoticeCaption" or "LegalNoticeText" registry values where the message set contains keywords. Logsource: windows / registry_set. Rule: title: Potential Ransomware Activity Using LegalNotice Message id: 8b9606c9-28be-4a38-b146-0e313cc232c1 status: test description: Detect changes to the "LegalNoticeCaption" or "LegalNoticeText" registry values where the message set contains keywords often used in ransomware ransom messages references: - https://github.com/redcanaryco/atomic-red-team/blob/5c1e6f1b4fafd01c8d1ece85f510160fc1275fbf/atomics/T1491.001/T1491.001.md author: frack113 date: 2022-12-11 modified: 2023-08-17 tags: - attack.impact - attack.t1491.001 logsource: product: windows category: registry_set detection: selection: TargetObject|contains: - \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeCaption - \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeText Details|contains: - encrypted - Unlock-Password - paying condition: selection falsepositives: - Unknown level: high
Query: vulnerability: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to cause a denial of service (memo
Matching passage: CVE-2015-4500. CWE: CWE-119. CVSS: 7.5. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Near-miss passage: CVE-2015-5805. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Query: Sigma rule for Detects when an user account is locked or suspended.
Matching passage: Sigma rule: Detects when an user account is locked or suspended.. Logsource: onelogin / onelogin.events. Rule: title: OneLogin User Account Locked id: a717c561-d117-437e-b2d9-0118a7035d01 status: test description: Detects when an user account is locked or suspended. references: - https://developers.onelogin.com/api-docs/1/events/event-resource/ author: Austin Songer @austinsonger date: 2021-10-12 modified: 2022-12-25 tags: - attack.impact logsource: product: onelogin service: onelogin.events detection: selection1: event_type_id: 532 selection2: event_type_id: 553 selection3: event_type_id: 551 condition: 1 of selection* falsepositives: - System may lock or suspend user accounts. level: low
Near-miss passage: Sigma rule: Detects suspicious DNS queries using base64 encoding. Logsource: dns. Rule: title: Suspicious DNS Query with B64 Encoded String id: 4153a907-2451-4e4f-a578-c52bb6881432 status: test description: Detects suspicious DNS queries using base64 encoding references: - https://github.com/krmaxwell/dns-exfiltration author: Florian Roth (Nextron Systems) date: 2018-05-10 modified: 2022-10-09 tags: - attack.exfiltration - attack.t1048.003 - attack.command-and-control - attack.t1071.004 logsource: category: dns detection: selection: query|contains: ==. condition: selection falsepositives: - Unknown level: medium