alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects execution of ruby with the "-e" flag and calls to "socket" related functions. This could be an indication of a p
Matching passage: Sigma rule: Detects execution of ruby with the "-e" flag and calls to "socket" related functions. This could be an indication of a p. Logsource: linux / process_creation. Rule: title: Potential Ruby Reverse Shell id: b8bdac18-c06e-4016-ac30-221553e74f59 status: test description: Detects execution of ruby with the "-e" flag and calls to "socket" related functions. This could be an indication of a potential attempt to setup a reverse shell references: - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet - https://www.revshells.com/ author: '@d4ns4n_' date: 2023-04-07 tags: - attack.execution logsource: category: process_creation product: linux detection: selection: Image|contains: ruby CommandLine|contains|all: - ' -e' - rsocket - TCPSocket CommandLine|contains: - ' ash' - ' bash' - ' bsh' - ' csh' - ' ksh' - ' pdksh' - ' sh' - ' tcsh' condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the change of user type from "Guest" to "Member" for potential elevation of privilege.. Logsource: azure / auditlogs. Rule: title: User State Changed From Guest To Member id: 8dee7a0d-43fd-4b3c-8cd1-605e189d195e status: test description: Detects the change of user type from "Guest" to "Member" for potential elevation of privilege. references: - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts#monitoring-external-user-sign-ins author: MikeDuddington, '@dudders1' date: 2022-06-30 tags: - attack.persistence - attack.privilege-escalation - attack.initial-access - attack.stealth - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: Category: UserManagement OperationName: Update user properties.message: '"displayName":"UserType","oldValue":"[\"Guest\"]","newValue":"[\"Member\"]"' condition: selection falsepositives: - If this was approved by System Administrator. level: medium
Query: exploit Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrary web script or HTML
Matching passage: CVE-2015-3438. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrary web script or HTML via a (1) four-byte UTF-8 character or (2) invalid character that reaches the database layer, as demonstrated by a crafted character in a comment.
Near-miss passage: CVE-2015-6475. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in IBC Solar ServeMaster TLP+ and Danfoss TLX Pro+ allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: Encoded PowerShell / command-line abuse matching Network Trust Dependencies
Matching passage: T1590.003 Network Trust Dependencies. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's network trust dependencies that can be used during targeting. Information about network trusts may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about network trusts may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: Pentesting AD Forests) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Near-miss passage: T1590.004 Network Topology. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's network topology that can be used during targeting. Information about network topologies may include a variety of details, including the physical and/or logical arrangement of both external-facing and internal network environments. This information may also include specifics regarding network devices (gateways, routers, etc.) and other infrastructure. Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about network topologies may also be exposed to adversaries via online or other accessible data sets (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: DNS Dumpster) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Query: vulnerability: The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a heap-use-after-free bug.
Matching passage: CVE-2015-8659. CWE: CWE-119. CVSS: 10.0. The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a heap-use-after-free bug.
Near-miss passage: CVE-2015-7939. CWE: CWE-119. CVSS: 9.600000381469727. Heap-based buffer overflow in Unitronics VisiLogic OPLC IDE before 9.8.09 allows remote attackers to execute arbitrary code via a long vlp filename.
Query: CVE similar to CVE-2015-2217
Matching passage: CVE-2015-2217. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Ultimate PHP Board (aka myUPB) before 2.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) q parameter to search.php or (2) avatar parameter to profile.php.
Near-miss passage: CVE-2015-4552. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the quick edit function in xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the content of a post.
Query: patch priority for CVE-2015-9287
Matching passage: CVE-2015-9287. CWE: CWE-22. CVSS: 9.800000190734863. Directory Traversal was discovered in University of Cambridge mod_ucam_webauth before 2.0.2. The key identification field ("kid") of the IdP's HTTP response message ("WLS-Response") can be manipulated by an attacker. The "kid" field is not signed like the rest of the message, and manipulation is therefore trivial. The "kid" field should only ever represent an integer. However, it is possible to provide any string value. An attacker could use this to their advantage to force the application agent to load the RSA public key required for message integrity checking from an unintended location.
Near-miss passage: CVE-2015-1003. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in IniNet embeddedWebServer (aka eWebServer) before 2.02 allows remote attackers to read arbitrary files via a crafted pathname.
Query: secure coding against Generation of Predictable IV with CBC Mode
Matching passage: CWE-329 Generation of Predictable IV with CBC Mode. The product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key.
Near-miss passage: CWE-115 Misinterpretation of Input. The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.
Query: Sigma YAML for windows / security
Matching passage: Sigma rule: Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has. Logsource: windows / security. Rule: title: Password Protected ZIP File Opened (Email Attachment) id: 571498c8-908e-40b4-910b-d2369159a3da status: test description: Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened. references: - https://twitter.com/sbousseaden/status/1523383197513379841 author: Florian Roth (Nextron Systems) date: 2022-05-09 tags: - attack.initial-access - attack.stealth - attack.t1027 - attack.t1566.001 logsource: product: windows service: security detection: selection: EventID: 5379 TargetName|contains|all: - Microsoft_Windows_Shell_ZipFolder:filename - \Temporary Internet Files\Content.Outlook condition: selection falsepositives: - Legitimate used of encrypted ZIP files level: high
Near-miss passage: Sigma rule: Detects plugged/unplugged USB devices. Logsource: windows / driver-framework. Rule: title: USB Device Plugged id: 1a4bd6e3-4c6e-405d-a9a3-53a116e341d4 status: test description: Detects plugged/unplugged USB devices references: - https://df-stream.com/2014/01/the-windows-7-event-log-and-usb-device/ - https://www.techrepublic.com/article/how-to-track-down-usb-flash-drive-usage-in-windows-10s-event-viewer/ author: Florian Roth (Nextron Systems) date: 2017-11-09 modified: 2021-11-30 tags: - attack.initial-access - attack.t1200 logsource: product: windows service: driver-framework definition: Requires enabling and collection of the Microsoft-Windows-DriverFrameworks-UserMode/Operational eventlog detection: selection: EventID: - 2003 - 2100 - 2102 condition: selection falsepositives: - Legitimate administrative activity level: low
Query: containment actions for Persistence mechanism resembling Exploit Public-Facing Application
Matching passage: Playbook for T1190 Exploit Public-Facing Application. 1) Validate alert telemetry against T1190. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: initial access. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (li
Near-miss passage: Playbook for T1669 Wi-Fi Networks. Different response path focused on initial access.
Query: vulnerability: Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X a
Matching passage: CVE-2015-0301. CWE: CWE-20. CVSS: 10.0. Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 do not properly validate files, which has unspecified impact and attack vectors.
Near-miss passage: CVE-2015-8489. CWE: CWE-20. CVSS: 6.5. customapp in Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to cause a denial of service (excessive database locking) via a crafted CSV file, a different vulnerability than CVE-2016-1153.
Query: exploit The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ PATH_SELF.
Matching passage: CVE-2015-9444. CWE: CWE-79. CVSS: 6.099999904632568. The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ PATH_SELF.
Near-miss passage: CVE-2015-4706. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path.
Query: CVE similar to CVE-2015-1737
Matching passage: CVE-2015-1737. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1731, CVE-2015-1736, and CVE-2015-1755.
Near-miss passage: CVE-2015-1080. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Query: patch priority for CVE-2015-8989
Matching passage: CVE-2015-8989. CWE: CWE-310. CVSS: 8.800000190734863. Unsalted password vulnerability in the Enterprise Manager (web portal) component in Intel Security McAfee Vulnerability Manager (MVM) 7.5.8 and earlier allows attackers to more easily decrypt user passwords via brute force attacks against the database.
Near-miss passage: CVE-2015-4288. CWE: CWE-310. CVSS: 4.300000190734863. The LDAP implementation on the Cisco Web Security Appliance (WSA) 8.5.0-000, Email Security Appliance (ESA) 8.5.7-042, and Content Security Management Appliance (SMA) 8.3.6-048 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, aka Bug IDs CSCuo29561, CSCuv40466, and CSCuv40470.
Query: explain CWE-42
Matching passage: CWE-42 Path Equivalence: 'filename.' (Trailing Dot). The product accepts path input in the form of trailing dot ('filedir.') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Near-miss passage: CWE-792 Incomplete Filtering of One or More Instances of Special Elements. The product receives data from an upstream component, but does not completely filter one or more instances of special elements before sending it to a downstream component.
Query: Sigma rule for Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.
Matching passage: Sigma rule: Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.. Logsource: windows / wmi. Rule: title: WMI Persistence id: 0b7889b4-5577-4521-a60a-3376ee7f9f7b status: test description: Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs. references: - https://twitter.com/mattifestation/status/899646620148539397 - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ author: Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community date: 2017-08-22 modified: 2022-02-10 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.003 logsource: product: windows service: wmi definition: WMI Namespaces Auditing and SACL should be configured, EventID 5861 and 5859 detection requires Windows 10, 2012 and higher detection: wmi_filter_to_consumer_binding: EventID: 5861 consumer_keywords: - ActiveScriptEventConsumer - CommandLineEventConsumer - CommandLineTemplate wmi_filter_registration: EventID: 5859 filter_scmevent: Provider: SCM Event Provider Query: select * from MSFT_SCMEventLogEvent User: S-1-5-32-544 PossibleCause: Permanent condition: ( (wmi_filter_to_consumer_binding and consumer_keywords) or (wmi_filter_registration) ) and not filter_scmevent falsepositives: - Unknown (data set is too small; further testing needed) level: medium
Near-miss passage: Sigma rule: Detects potential execution of MeshAgent which is a tool used for remote access. Historical data shows that threat actor. Logsource: windows / process_creation. Rule: title: Remote Access Tool - Potential MeshAgent Execution - Windows id: 2fbbe9ff-0afc-470b-bdc0-592198339968 related: - id: 22c45af6-f590-4d44-bab3-b5b2d2a2b6d9 type: similar status: experimental description: 'Detects potential execution of MeshAgent which is a tool used for remote access. Historical data shows that threat actors rename MeshAgent binary to evade detection. Matching command lines with the ''--meshServiceName'' argument can indicate that the MeshAgent is being used for remote access. ' references: - https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access - https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/ - https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/ - https://www.security.com/threat-intelligence/medusa-ransomware-attacks author: Norbert Jaśniewicz (AlphaSOC) date: 2025-05-19 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: --meshServiceName condition: selection falsepositives: - Environments that legitimately use MeshAgent level: medium
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote auth
Matching passage: CVE-2015-5336. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey answer.
Near-miss passage: CVE-2015-2315. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the target parameter in a reminder_popup action to the default URI.
Query: Sigma rule for Detects the pattern of UAC Bypass using Event Viewer RecentViews
Matching passage: Sigma rule: Detects the pattern of UAC Bypass using Event Viewer RecentViews. Logsource: windows / process_creation. Rule: title: UAC Bypass Using Event Viewer RecentViews id: 30fc8de7-d833-40c4-96b6-28319fbc4f6c related: - id: 63e4f530-65dc-49cc-8f80-ccfa95c69d43 type: similar status: test description: Detects the pattern of UAC Bypass using Event Viewer RecentViews references: - https://twitter.com/orange_8361/status/1518970259868626944 - https://lolbas-project.github.io/lolbas/Binaries/Eventvwr/#execute author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-22 tags: - attack.privilege-escalation - attack.stealth logsource: category: process_creation product: windows detection: selection_path: CommandLine|contains: - \Event Viewer\RecentViews - \EventV~1\RecentViews selection_redirect: CommandLine|contains: '>' condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the recovery of files from backups via "wbadmin.exe". Attackers can restore sensitive files such as NTDS.DIT or. Logsource: windows / process_creation. Rule: title: File Recovery From Backup Via Wbadmin.EXE id: 6fe4aa1e-0531-4510-8be2-782154b73b48 related: - id: 84972c80-251c-4c3a-9079-4f00aad93938 type: derived status: test description: 'Detects the recovery of files from backups via "wbadmin.exe". Attackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials. ' references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery - https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/ author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2024-05-10 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wbadmin.exe - OriginalFileName: WBADMIN.EXE selection_cli: CommandLine|contains|all: - ' recovery' - recoveryTarget - itemtype:File condition: all of selection_* falsepositives: - Unknown level: medium
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects potential evasion or obfuscation attempts using bogus path traversal via the commandline. Logsource: windows / process_creation. Rule: title: Potential Command Line Path Traversal Evasion Attempt id: 1327381e-6ab0-4f38-b583-4c1b8346a56b status: test description: Detects potential evasion or obfuscation attempts using bogus path traversal via the commandline references: - https://twitter.com/hexacorn/status/1448037865435320323 - https://twitter.com/Gal_B1t/status/1062971006078345217 author: Christian Burkard (Nextron Systems) date: 2021-10-26 modified: 2023-03-29 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection_1: Image|contains: \Windows\ CommandLine|contains: - \..\Windows\ - \..\System32\ - \..\..\ selection_2: CommandLine|contains: .exe\..\ filter_optional_google_drive: CommandLine|contains: \Google\Drive\googledrivesync.exe\..\ filter_optional_citrix: CommandLine|contains: \Citrix\Virtual Smart Card\Citrix.Authentication.VirtualSmartcard.Launcher.exe\..\ condition: 1 of selection_* and not 1 of filter_optional_* falsepositives: - Google Drive - Citrix level: medium
Near-miss passage: Sigma rule: Detects potential DLL injection and execution using "Tracker.exe". Logsource: windows / process_creation. Rule: title: Potential DLL Injection Or Execution Using Tracker.exe id: 148431ce-4b70-403d-8525-fcc2993f29ea status: test description: Detects potential DLL injection and execution using "Tracker.exe" references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Tracker/ author: Avneet Singh @v3t0_, oscd.community date: 2020-10-18 modified: 2023-01-09 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \tracker.exe - Description: Tracker selection_cli: CommandLine|contains: - ' /d ' - ' /c ' filter_msbuild1: CommandLine|contains: ' /ERRORREPORT:PROMPT ' filter_msbuild2: ParentImage|endswith: - \Msbuild\Current\Bin\MSBuild.exe - \Msbuild\Current\Bin\amd64\MSBuild.exe condition: all of selection_* and not 1 of filter_* falsepositives: - Unknown level: medium