alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Cross-site scripting (XSS) vulnerability in style-underground/search in Plain Black WebGUI 7.10.29 and earlier allows remote attackers to inject arbitrary web script or HTML via th
Matching passage: CVE-2015-1564. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in style-underground/search in Plain Black WebGUI 7.10.29 and earlier allows remote attackers to inject arbitrary web script or HTML via the Search field.
Near-miss passage: CVE-2015-3620. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1 and FortiManager 5.0.3 through 5.0.10 and 5.2.0 through 5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: rule covering Detects when the macOS Script Editor utility spawns an unusual child process.
Matching passage: Sigma rule: Detects when the macOS Script Editor utility spawns an unusual child process.. Logsource: macos / process_creation. Rule: title: Suspicious Execution via macOS Script Editor id: 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4 status: test description: Detects when the macOS Script Editor utility spawns an unusual child process. author: Tim Rauch (rule), Elastic (idea) references: - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-7f541fbc4a4a28a92970e8bf53effea5bd934604429112c920affb457f5b2685 - https://wojciechregula.blog/post/macos-red-teaming-initial-access-via-applescript-url/ date: 2022-10-21 modified: 2022-12-28 logsource: category: process_creation product: macos tags: - attack.defense-impairment - attack.t1566 - attack.t1566.002 - attack.initial-access - attack.t1059 - attack.t1059.002 - attack.t1204 - attack.t1204.001 - attack.execution - attack.persistence - attack.t1553 detection: selection_parent: ParentImage|endswith: /Script Editor selection_img: - Image|endswith: - /curl - /bash - /sh - /zsh - /dash - /fish - /osascript - /mktemp - /chmod - /php - /nohup - /openssl - /plutil - /PlistBuddy - /xattr - /sqlite - /funzip - /popen - Image|contains: - python - perl condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump th. Logsource: windows / process_creation. Rule: title: Process Access via TrolleyExpress Exclusion id: 4c0aaedc-154c-4427-ada0-d80ef9c9deb6 status: test description: Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump the lsass process memory references: - https://twitter.com/_xpn_/status/1491557187168178176 - https://www.youtube.com/watch?v=Ie831jF0bb0 author: Florian Roth (Nextron Systems) date: 2022-02-10 modified: 2022-05-13 tags: - attack.stealth - attack.t1218.011 - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - \TrolleyExpress 7 - \TrolleyExpress 8 - \TrolleyExpress 9 - \TrolleyExpress.exe 7 - \TrolleyExpress.exe 8 - \TrolleyExpress.exe 9 - '\TrolleyExpress.exe -ma ' renamed: Image|endswith: \TrolleyExpress.exe filter_renamed: OriginalFileName|contains: CtxInstall filter_empty: OriginalFileName: null condition: selection or ( renamed and not 1 of filter* ) falsepositives: - Unknown level: high
Query: weakness Improper Control of Resource Identifiers ('Resource Injection')
Matching passage: CWE-99 Improper Control of Resource Identifiers ('Resource Injection'). The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.
Near-miss passage: CWE-481 Assigning instead of Comparing. The code uses an operator for assignment when the intention was to perform a comparison.
Query: explain T1027.001 Binary Padding
Matching passage: T1027.001 Binary Padding. Tactics: stealth. Description: Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations. Binary padding effectively changes the checksum of the file and can also be used to avoid hash-based blocklists and static anti-virus signatures.(Citation: ESET OceanLotus) The padding used is commonly generated by a function to create junk data and then appended to the end or applied to sections of malware.(Citation: Securelist Malware Tricks April 2017) Increasing the file size may decrease the effectiveness of certain tools and detection capabilities that are not designed or configured to scan large files. This may also reduce the likelihood of being collected for analysis. Public file scanning services, such as VirusTotal, limits the maximum size of an uploaded file to be analyzed.(Citation: VirusTotal FAQ)
Near-miss passage: T1027.006 HTML Smuggling. Tactics: stealth. Description: Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. HTML documents can store large binary objects known as JavaScript Blobs (immutable data that represents raw bytes) that can later be constructed into file-like objects. Data may also be stored in Data URLs, which enable embedding media type or MIME files inline of HTML documents. HTML5 also introduced a download attribute that may be used to initiate file downloads.(Citation: HTML Smuggling Menlo Security 2020)(Citation: Outlflank HTML Smuggling 2018) Adversaries may deliver payloads to victims that bypass security controls through HTML Smuggling by abusing JavaScript Blobs and/or HTML5 download attributes. Security controls such as web content filters may not identify smuggled malicious files inside of HTML/JS files, as the content may be based on typically benign MIME types such as <code>text/plain</code> and/or <code>text/html</code>. Malicious files or data can be obfuscated and hidden inside of HTML files through Data URLs and/or JavaScript Blobs and can be deobfuscated when they reach the victim (i.e. [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140)), potentially bypassing content filters. For example, JavaScript Blobs can be abused to dynamically generate malicious files in the victim machine and may be dropped to disk by abusing JavaScript functions such as <code>msSaveBlob</code>.(Citation: HTML Smuggling Menlo Security 2020)(Citation: MSTIC NOBELIUM May 2021)(Citation: Outlflank HTML Smuggling 2018)(Citation: nccgroup Smuggling HTA 2017)
Query: CVE similar to CVE-2015-0848
Matching passage: CVE-2015-0848. CWE: CWE-119. CVSS: 6.800000190734863. Heap-based buffer overflow in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image.
Near-miss passage: CVE-2015-3828. CWE: CWE-119. CVSS: 10.0. The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM), which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted 3GPP metadata, aka internal bug 20923261, a related issue to CVE-2015-3826.
Query: detection rule: Detects the execution of a renamed ProcDump executable. This often done by attackers or malware in order to evade defens
Matching passage: Sigma rule: Detects the execution of a renamed ProcDump executable. This often done by attackers or malware in order to evade defens. Logsource: windows / process_creation. Rule: title: Renamed ProcDump Execution id: 4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67 related: - id: 03795938-1387-481b-9f4c-3f6241e604fe type: obsolete status: test description: 'Detects the execution of a renamed ProcDump executable. This often done by attackers or malware in order to evade defensive mechanisms. ' references: - https://learn.microsoft.com/en-us/sysinternals/downloads/procdump author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2019-11-18 modified: 2026-06-29 tags: - attack.stealth - attack.t1036.003 logsource: product: windows category: process_creation detection: selection_ofn: OriginalFileName: procdump selection_cli_dump_flag: CommandLine|contains|windash: - ' -ma ' - ' -mp ' selection_cli_eula_flag: CommandLine|contains|windash: ' /accepteula' filter_main_known_names: Image|endswith: - \procdump.exe - \procdump64.exe - \procdump64a.exe condition: (selection_ofn or all of selection_cli_*) and not 1 of filter_main_* falsepositives: - Procdump illegally bundled with legitimate software. - Administrators who rename binaries (should be investigated). level: high
Near-miss passage: Sigma rule: Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting. Logsource: windows / process_creation. Rule: title: Windows Recall Feature Enabled Via Reg.EXE id: 817f252c-5143-4dae-b418-48c3e9f63728 related: - id: 5dfc1465-8f65-4fde-8eb5-6194380c6a62 type: similar - id: 75180c5f-4ea1-461a-a4f6-6e4700c065d4 type: similar status: test description: 'Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" value, or setting it to 0. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary. ' references: - https://learn.microsoft.com/en-us/windows/client-management/manage-recall - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis author: Sajid Nawaz Khan date: 2024-06-02 tags: - attack.collection - attack.t1113 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_value: CommandLine|contains|all: - Microsoft\Windows\WindowsAI - DisableAIDataAnalysis selection_action_add: CommandLine|contains: - add - '0' selection_action_delete: CommandLine|contains: delete condition: selection_img and selection_value and 1 of selection_action_* falsepositives: - Legitimate use/activation of Windows Recall level: medium
Query: CVE similar to CVE-2015-2051
Matching passage: CVE-2015-2051. CWE: CWE-77. CVSS: 8.800000190734863. The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.
Near-miss passage: CVE-2015-2857. CWE: CWE-77. CVSS: 9.800000190734863. Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metacharacters in the oauth_token parameter.
Query: vulnerability: Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 12.1.0.2 allows remote attackers to affect confidentiality via unknown vectors.
Matching passage: CVE-2015-4755. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 12.1.0.2 allows remote attackers to affect confidentiality via unknown vectors.
Near-miss passage: CVE-2015-2595. CWE: UNKNOWN. CVSS: 6.5. Unspecified vulnerability in the Oracle OLAP component in Oracle Database Server 12.1.0.1 and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
Query: explain CWE-838
Matching passage: CWE-838 Inappropriate Encoding for Output Context. The product uses or specifies an encoding when generating output to a downstream component, but the specified encoding is not the same as the encoding that is expected by the downstream component.
Near-miss passage: CWE-1124 Excessively Deep Nesting. The code contains a callable or other code grouping in which the nesting / branching is too deep.
Query: explain T1134.005 SID-History Injection
Matching passage: T1134.005 SID-History Injection. Tactics: stealth, privilege escalation. Description: Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. (Citation: Microsoft SID) An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens). With Domain Administrator (or equivalent) rights, harvested or well-known SID values (Citation: Microsoft Well Known SIDs Jun 2017) may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators. This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as [Remote Services](https://attack.mitre.org/techniques/T1021), [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002), or [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006).
Near-miss passage: T1134.003 Make and Impersonate Token. Tactics: stealth, privilege escalation. Description: Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function.(Citation: LogonUserW function) The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread. This behavior is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) in that this refers to creating a new user token instead of stealing or duplicating an existing one.
Query: telemetry for T1546.007
Matching passage: T1546.007 Netsh Helper DLL. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility.(Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at <code>HKLM\SOFTWARE\Microsoft\Netsh</code>. Adversaries can use netsh.exe helper DLLs to trigger execution of arbitrary code in a persistent manner. This execution would take place anytime netsh.exe is executed, which could happen automatically, with another persistence technique, or if other software (ex: VPN) is present on the system that executes netsh.exe as part of its normal functionality.(Citation: Github Netsh Helper CS Beacon)(Citation: Demaske Netsh Persistence)
Near-miss passage: T1546.015 Component Object Model Hijacking. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system.(Citation: Microsoft Component Object Model) References to various COM objects are stored in the Registry. Adversaries may use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead.(Citation: GDATA COM Hijacking) An adversary is likely to hijack objects that are used frequently enough to maintain a consistent level of persistence, but are unlikely to break noticeable functionality within the system as to avoid system instability that could lead to detection. One variation of COM hijacking involves abusing Type Libraries (TypeLibs), which provide metadata about COM objects, such as their interfaces and methods. Adversaries may modify Registry keys associated with TypeLibs to redirect legitimate COM object functionality to malicious scripts or payloads. Unlike traditional COM hijacking, which commonly uses local DLLs, this variation may leverage the "script:" moniker to execute remote scripts hosted on external servers.(Citation: RELIAQUEST) This approach enables stealthy execution of code while maintaining persistence, as the remote payload would be automatically downloaded whenever the hijacked COM object is accessed.
Query: Sigma YAML for windows / ps_classic_start
Matching passage: Sigma rule: Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class. T. Logsource: windows / ps_classic_start. Rule: title: PowerShell Download Via Net.WebClient - PowerShell Classic id: 3236fcd0-b7e3-4433-b4f8-86ad61a9af2d related: - id: 65531a81-a694-4e31-ae04-f8ba5bc33759 type: derived status: test description: 'Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class. This technique is often abused by attackers to download additional payloads. ' references: - https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html author: Florian Roth (Nextron Systems) date: 2017-03-05 modified: 2026-04-28 tags: - attack.execution - attack.command-and-control - attack.t1059.001 - attack.t1105 logsource: product: windows category: ps_classic_start detection: selection_webclient: Data|contains: Net.WebClient selection_download: Data|contains: - .DownloadFile( - .DownloadString( condition: all of selection_* falsepositives: - This activity may be used by legitimate software, such as patch management tools or software updaters. Investigate any such activity and apply the necessary filter. level: low
Near-miss passage: Sigma rule: Loading unsigned image (DLL, EXE) into LSASS process. Logsource: windows / image_load. Rule: title: Unsigned Image Loaded Into LSASS Process id: 857c8db3-c89b-42fb-882b-f681c7cf4da2 status: test description: Loading unsigned image (DLL, EXE) into LSASS process references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Teymur Kheirkhabarov, oscd.community date: 2019-10-22 modified: 2021-11-27 tags: - attack.credential-access - attack.t1003.001 logsource: category: image_load product: windows detection: selection: Image|endswith: \lsass.exe Signed: 'false' condition: selection falsepositives: - Valid user connecting using RDP level: medium
Query: patch priority for CVE-2015-7939
Matching passage: CVE-2015-7939. CWE: CWE-119. CVSS: 9.600000381469727. Heap-based buffer overflow in Unitronics VisiLogic OPLC IDE before 9.8.09 allows remote attackers to execute arbitrary code via a long vlp filename.
Near-miss passage: CVE-2015-3874. CWE: CWE-119. CVSS: 10.0. The Sonivox components in Android before 5.1.1 LMY48T allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 23335715, 23307276, and 23286323.
Query: alert when Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.
Matching passage: Sigma rule: Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.. Logsource: windows / file_event. Rule: title: Process Monitor Driver Creation By Non-Sysinternals Binary id: a05baa88-e922-4001-bc4d-8738135f27de status: test description: Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself. references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-05 modified: 2026-06-29 tags: - attack.persistence - attack.privilege-escalation - attack.t1068 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \procmon TargetFilename|endswith: .sys filter_main_process_explorer: Image|endswith: - \procmon.exe - \procmon64.exe - \procmon64a.exe condition: selection and not 1 of filter_main_* falsepositives: - Some false positives may occur with legitimate renamed process monitor binaries level: medium
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via VAR++ LAUNCHER. Logsource: windows / system. Rule: title: Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System id: 14bcba49-a428-42d9-b943-e2ce0f0f7ae6 status: test description: Detects Obfuscated Powershell via VAR++ LAUNCHER references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-13 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains|all: - '&&set' - cmd - /c - -f ImagePath|contains: - '{0}' - '{1}' - '{2}' - '{3}' - '{4}' - '{5}' condition: selection falsepositives: - Unknown level: high
Query: explain CWE-1233
Matching passage: CWE-1233 Security-Sensitive Hardware Controls with Missing Lock Bit Protection. The product uses a register lock bit protection mechanism, but it does not ensure that the lock bit prevents modification of system registers or controls that perform changes to important hardware system configuration.
Near-miss passage: CWE-1303 Non-Transparent Sharing of Microarchitectural Resources. Hardware structures shared across execution contexts (e.g., caches and branch predictors) can violate the expected architecture isolation between contexts.
Query: risk of The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.
Matching passage: CVE-2015-9323. CWE: CWE-89. CVSS: 9.800000190734863. The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.
Near-miss passage: CVE-2015-2199. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow (1) remote authenticated users to execute arbitrary SQL commands via the item[id] parameter in a wonderplugin_audio_save_item action to wp-admin/admin-ajax.php or remote administrators to execute arbitrary SQL commands via the itemid parameter in the (2) wonderplugin_audio_show_item, (3) wonderplugin_audio_show_items, or (4) wonderplugin_audio_edit_item page to wp-admin/admin.php.