alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-3996
Matching passage: CVE-2015-3996. CWE: CWE-254. CVSS: 4.300000190734863. The default AFSecurityPolicy.validatesDomainName configuration for AFSSLPinningModeNone in the AFNetworking framework before 2.5.3, as used in the ownCloud iOS Library, disables verification of a server hostname against the domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Near-miss passage: CVE-2015-3755. CWE: CWE-254. CVSS: 4.300000190734863. WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, allows remote attackers to spoof the user interface via a malformed URL.
Query: patch priority for CVE-2015-5491
Matching passage: CVE-2015-5491. CWE: CWE-200. CVSS: 3.5. The Dynamic display block module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users to bypass intended access restrictions and read sensitive titles by leveraging the "administer ddblock" permission.
Near-miss passage: CVE-2015-4537. CWE: CWE-200. CVSS: 3.5. Lockbox in EMC Documentum D2 before 4.5 uses a hardcoded passphrase when a server lacks a D2.Lockbox file, which makes it easier for remote authenticated users to decrypt admin tickets by locating this passphrase in a decompiled D2 JAR archive.
Query: patch priority for CVE-2015-5219
Matching passage: CVE-2015-5219. CWE: CWE-704. CVSS: 7.5. The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.
Near-miss passage: CVE-2015-3120. CWE: CWE-704. CVSS: 10.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-3119, CVE-2015-3121, CVE-2015-3122, and CVE-2015-4433.
Query: write Sigma for Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SA
Matching passage: Sigma rule: Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SA. Logsource: windows / ps_script. Rule: title: Winlogon Helper DLL id: 851c506b-6b7c-4ce2-8802-c703009d03c0 status: test description: 'Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\Software[Wow6432Node]Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are used to manage additional helper programs and functionalities that support Winlogon. Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.004/T1547.004.md author: Timur Zinniatullin, oscd.community date: 2019-10-21 modified: 2022-07-07 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.004 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: CurrentVersion\Winlogon selection2: ScriptBlockText|contains: - Set-ItemProperty - New-Item condition: all of selection* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Identifies when secrets are modified or deleted in Azure.. Logsource: azure / activitylogs. Rule: title: Azure Keyvault Secrets Modified or Deleted id: b831353c-1971-477b-abb6-2828edc3bca1 status: test description: Identifies when secrets are modified or deleted in Azure. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-08-16 modified: 2022-08-23 tags: - attack.impact - attack.credential-access - attack.t1552 - attack.t1552.001 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KEYVAULT/VAULTS/SECRETS/WRITE - MICROSOFT.KEYVAULT/VAULTS/SECRETS/DELETE - MICROSOFT.KEYVAULT/VAULTS/SECRETS/BACKUP/ACTION - MICROSOFT.KEYVAULT/VAULTS/SECRETS/PURGE/ACTION - MICROSOFT.KEYVAULT/VAULTS/SECRETS/UPDATE/ACTION - MICROSOFT.KEYVAULT/VAULTS/SECRETS/RECOVER/ACTION - MICROSOFT.KEYVAULT/VAULTS/SECRETS/RESTORE/ACTION - MICROSOFT.KEYVAULT/VAULTS/SECRETS/SETSECRET/ACTION condition: selection falsepositives: - Secrets being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Secrets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: what is T1036
Matching passage: T1036 Masquerading. Tactics: stealth. Description: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site)
Near-miss passage: T1036.007 Double File Extension. Tactics: stealth. Description: Adversaries may abuse a double extension in the filename as a means of masquerading the true file type. A file name may include a secondary file type extension that may cause only the first extension to be displayed (ex: <code>File.txt.exe</code> may render in some views as just <code>File.txt</code>). However, the second extension is the true file type that determines how the file is opened and executed. The real file extension may be hidden by the operating system in the file browser (ex: explorer.exe), as well as in any software configured using or similar to the system’s policies.(Citation: PCMag DoubleExtension)(Citation: SOCPrime DoubleExtension) Adversaries may abuse double extensions to attempt to conceal dangerous file types of payloads. A very common usage involves tricking a user into opening what they think is a benign file type but is actually executable code. Such files often pose as email attachments and allow an adversary to gain [Initial Access](https://attack.mitre.org/tactics/TA0001) into a user’s system via [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) then [User Execution](https://attack.mitre.org/techniques/T1204). For example, an executable file attachment named <code>Evil.txt.exe</code> may display as <code>Evil.txt</code> to a user. The user may then view it as a benign text file and open it, inadvertently executing the hidden malware.(Citation: SOCPrime DoubleExtension) Common file types, such as text files (.txt, .doc, etc.) and image files (.jpg, .gif, etc.) are typically used as the first extension to appear benign. Executable extensions commonly regarded as dangerous, such as .exe, .lnk, .hta, and .scr, often appear as the second extension and true file type.
Query: alert when Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.c
Matching passage: Sigma rule: Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.c. Logsource: zeek / http. Rule: title: Executable from Webdav id: aac2fd97-bcba-491b-ad66-a6edf89c71bf status: test description: Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/ references: - http://carnal0wnage.attackresearch.com/2012/06/webdav-server-to-download-custom.html - https://github.com/OTRF/detection-hackathon-apt29 author: SOC Prime, Adam Swan date: 2020-05-01 modified: 2021-11-27 tags: - attack.command-and-control - attack.t1105 logsource: product: zeek service: http detection: selection_webdav: - c-useragent|contains: WebDAV - c-uri|contains: webdav selection_executable: - resp_mime_types|contains: dosexec - c-uri|endswith: .exe condition: selection_webdav and selection_executable falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious shell commands used in various exploit codes (see references). Logsource: linux. Rule: title: Suspicious Activity in Shell Commands id: 2aa1440c-9ae9-4d92-84a7-a9e5f5e31695 status: test description: Detects suspicious shell commands used in various exploit codes (see references) references: - https://web.archive.org/web/20170319121015/http://www.threatgeek.com/2017/03/widespread-exploitation-attempts-using-cve-2017-5638.html - https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/exploits/multi/http/struts_code_exec_exception_delegator.rb - http://pastebin.com/FtygZ1cg - https://artkond.com/2017/03/23/pivoting-guide/ author: Florian Roth (Nextron Systems) date: 2017-08-21 modified: 2021-11-27 tags: - attack.execution - attack.t1059.004 logsource: product: linux detection: keywords: - wget * - http* | perl - wget * - http* | sh - wget * - http* | bash - python -m SimpleHTTPServer - -m http.server - import pty; pty.spawn* - socat exec:* - socat -O /tmp/* - socat tcp-connect* - '*echo binary >>*' - '*wget *; chmod +x*' - '*wget *; chmod 777 *' - '*cd /tmp || cd /var/run || cd /mnt*' - '*stop;service iptables stop;*' - '*stop;SuSEfirewall2 stop;*' - chmod 777 2020* - '*>>/etc/rc.local' - '*base64 -d /tmp/*' - '* | base64 -d *' - '*/chmod u+s *' - '*chmod +s /tmp/*' - '*chmod u+s /tmp/*' - '* /tmp/haxhax*' - '* /tmp/ns_sploit*' - nc -l -p * - cp /bin/ksh * - cp /bin/sh * - '* /tmp/*.b64 *' - '*/tmp/ysocereal.jar*' - '*/tmp/x *' - '*; chmod +x /tmp/*' - '*;chmod +x /tmp/*' condition: keywords falsepositives: - Unknown level: high
Query: describe CVE-2015-3136
Matching passage: CVE-2015-3136. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
Near-miss passage: CVE-2015-7042. CWE: UNKNOWN. CVSS: 4.300000190734863. The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to cause a denial of service via a crafted app, a different vulnerability than CVE-2015-7040, CVE-2015-7041, and CVE-2015-7043.
Query: CVE similar to CVE-2015-7106
Matching passage: CVE-2015-7106. CWE: CWE-119. CVSS: 7.199999809265137. The Intel Graphics Driver component in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
Near-miss passage: CVE-2015-6695. CWE: CWE-119. CVSS: 6.800000190734863. Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted use of the value attribute, a different vulnerability than CVE-2015-6685, CVE-2015-6686, CVE-2015-6693, CVE-2015-6694, and CVE-2015-7622.
Query: CVE similar to CVE-2015-0652
Matching passage: CVE-2015-0652. CWE: CWE-20. CVSS: 7.800000190734863. The Session Description Protocol (SDP) implementation in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway before X8.2 and Cisco TelePresence Conductor before XC2.4 allows remote attackers to cause a denial of service (mishandled exception and device reload) via a crafted media description, aka Bug IDs CSCus96593 and CSCun73192.
Near-miss passage: CVE-2015-9415. CWE: CWE-20. CVSS: 7.5. The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion.
Query: risk of The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service (integer underflow, assertion failure, and application exit) via a sin
Matching passage: CVE-2015-7218. CWE: CWE-189. CVSS: 5.0. The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service (integer underflow, assertion failure, and application exit) via a single-byte header frame that triggers incorrect memory allocation.
Near-miss passage: CVE-2015-4496. CWE: CWE-189. CVSS: 9.300000190734863. Multiple integer overflows in libstagefright in Mozilla Firefox before 38.0 allow remote attackers to execute arbitrary code via crafted sample metadata in an MPEG-4 video file, a related issue to CVE-2015-1538.
Query: risk of Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.
Matching passage: CVE-2015-4866. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.
Near-miss passage: CVE-2015-4438. CWE: UNKNOWN. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-4435, CVE-2015-4441, CVE-2015-4445, CVE-2015-4447, CVE-2015-4451, CVE-2015-4452, CVE-2015-5085, and CVE-2015-5086.
Query: exploit Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary conf
Matching passage: CVE-2015-1835. CWE: CWE-20. CVSS: 5.300000190734863. Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables (preferences) via a crafted intent: URL.
Near-miss passage: CVE-2015-2672. CWE: CWE-20. CVSS: 5.5. The xsave/xrstor implementation in arch/x86/include/asm/xsave.h in the Linux kernel before 3.19.2 creates certain .altinstr_replacement pointers and consequently does not provide any protection against instruction faulting, which allows local users to cause a denial of service (panic) by triggering a fault, as demonstrated by an unaligned memory operand or a non-canonical address memory operand.
Query: SOC runbook when seeing Multiple failed authentications followed by Network Device Firewall
Matching passage: Playbook for T1686.002 Network Device Firewall. 1) Validate alert telemetry against T1686.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: defense impairment. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may disable network device-based firewall mechanisms entirely or add, delete, or modify particular rules in order to bypass controls limiting network usage. Adversaries may obtain access to devices such as routers, switches, or other perimeter/network devices and change access control lists (ACLs), security zones, or policy rules to permit otherwise blocked traffic. For example, advers
Near-miss passage: Playbook for T1686 Disable or Modify System Firewall. Different response path focused on defense impairment.
Query: detect Detects suspicious connections from Microsoft Sync Center to non-private IPs. in logs
Matching passage: Sigma rule: Detects suspicious connections from Microsoft Sync Center to non-private IPs.. Logsource: windows / network_connection. Rule: title: Microsoft Sync Center Suspicious Network Connections id: 9f2cc74d-78af-4eb2-bb64-9cd1d292b87b status: test description: Detects suspicious connections from Microsoft Sync Center to non-private IPs. references: - https://redcanary.com/blog/intelligence-insights-november-2021/ author: elhoim date: 2022-04-28 modified: 2024-03-12 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 - attack.t1218 - attack.execution logsource: product: windows category: network_connection detection: selection: Image|endswith: \mobsync.exe filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the recovery of files from backups via "wbadmin.exe". Attackers can restore sensitive files such as NTDS.DIT or. Logsource: windows / process_creation. Rule: title: File Recovery From Backup Via Wbadmin.EXE id: 6fe4aa1e-0531-4510-8be2-782154b73b48 related: - id: 84972c80-251c-4c3a-9079-4f00aad93938 type: derived status: test description: 'Detects the recovery of files from backups via "wbadmin.exe". Attackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials. ' references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery - https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/ author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2024-05-10 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wbadmin.exe - OriginalFileName: WBADMIN.EXE selection_cli: CommandLine|contains|all: - ' recovery' - recoveryTarget - itemtype:File condition: all of selection_* falsepositives: - Unknown level: medium
Query: detection rule: Detects cmstp loading "dll" or "ocx" files from suspicious locations
Matching passage: Sigma rule: Detects cmstp loading "dll" or "ocx" files from suspicious locations. Logsource: windows / image_load. Rule: title: DLL Loaded From Suspicious Location Via Cmspt.EXE id: 75e508f7-932d-4ebc-af77-269237a84ce1 status: test description: Detects cmstp loading "dll" or "ocx" files from suspicious locations references: - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/TTPs/Defense%20Evasion/T1218%20-%20Signed%20Binary%20Proxy%20Execution/T1218.003%20-%20CMSTP/Procedures.yaml author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-30 modified: 2023-02-17 tags: - attack.stealth - attack.t1218.003 logsource: category: image_load product: windows detection: selection: Image|endswith: \cmstp.exe ImageLoaded|contains: - \PerfLogs\ - \ProgramData\ - \Users\ - \Windows\Temp\ - C:\Temp\ ImageLoaded|endswith: - .dll - .ocx condition: selection falsepositives: - Unikely level: high
Near-miss passage: Sigma rule: Identifies when a Firewall Policy is Modified or Deleted.. Logsource: azure / activitylogs. Rule: title: Azure Network Firewall Policy Modified or Deleted id: 83c17918-746e-4bd9-920b-8e098bf88c23 status: test description: Identifies when a Firewall Policy is Modified or Deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-09-02 modified: 2022-08-23 tags: - attack.impact - attack.defense-impairment - attack.t1686.001 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.NETWORK/FIREWALLPOLICIES/WRITE - MICROSOFT.NETWORK/FIREWALLPOLICIES/JOIN/ACTION - MICROSOFT.NETWORK/FIREWALLPOLICIES/CERTIFICATES/ACTION - MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE condition: selection falsepositives: - Firewall Policy being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Firewall Policy modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: Sigma rule for Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the
Matching passage: Sigma rule: Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the. Logsource: proxy. Rule: title: F5 BIG-IP iControl Rest API Command Execution - Proxy id: b59c98c6-95e8-4d65-93ee-f594dfb96b17 related: - id: 85254a62-22be-4239-b79c-2ec17e566c37 type: similar status: test description: Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP references: - https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash - https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029 - https://community.f5.com/t5/technical-forum/running-bash-commands-via-rest-api/td-p/272516 author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo date: 2023-11-08 tags: - attack.initial-access - attack.t1190 logsource: category: proxy detection: selection: cs-method: POST c-uri|endswith: /mgmt/tm/util/bash condition: selection falsepositives: - Legitimate usage of the BIG IP REST API to execute command for administration purposes level: medium
Near-miss passage: Sigma rule: Detects an attempt to execute code or create service on remote host via winrm.vbs.. Logsource: windows / process_creation. Rule: title: Remote Code Execute via Winrm.vbs id: 9df0dd3a-1a5c-47e3-a2bc-30ed177646a0 status: test description: Detects an attempt to execute code or create service on remote host via winrm.vbs. references: - https://twitter.com/bohops/status/994405551751815170 - https://redcanary.com/blog/lateral-movement-winrm-wmi/ - https://lolbas-project.github.io/lolbas/Scripts/Winrm/ author: Julia Fomina, oscd.community date: 2020-10-07 modified: 2023-03-03 tags: - attack.stealth - attack.t1216 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cscript.exe - OriginalFileName: cscript.exe selection_cli: CommandLine|contains|all: - winrm - invoke Create wmicimv2/Win32_ - -r:http condition: all of selection* falsepositives: - Unknown level: medium