alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-1983
Matching passage: CVE-2015-1983. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Projects page in IBM UrbanCode Build 6.1.x before 6.1.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-3368. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the administration user interface in the Classified Ads module before 6.x-3.1 and 7.x-3.x before 7.x-3.1 for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via a category name.
Query: risk of The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the a
Matching passage: CVE-2015-8960. CWE: CWE-295. CVSS: 8.100000381469727. The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the ability to compute the master secret in certain situations with a client secret key and server public key but not a server secret key, which makes it easier for man-in-the-middle attackers to spoof TLS servers by leveraging knowledge of the secret key for an arbitrary installed client X.509 certificate, aka the "Key Compromise Impersonation (KCI)" issue.
Near-miss passage: CVE-2015-7778. CWE: CWE-295. CVSS: 5.900000095367432. Gurunavi App for iOS before 6.0.0 does not verify SSL certificates which could allow remote attackers to perform man-in-the-middle attacks.
Query: detect Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS in logs
Matching passage: Sigma rule: Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS. Logsource: windows / process_creation. Rule: title: Dropping Of Password Filter DLL id: b7966f4a-b333-455b-8370-8ca53c229762 status: test description: Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS references: - https://pentestlab.blog/2020/02/10/credential-access-password-filter-dll/ - https://github.com/3gstudent/PasswordFilter/tree/master/PasswordFilter author: Sreeman date: 2020-10-29 modified: 2022-10-09 tags: - attack.persistence - attack.credential-access - attack.defense-impairment - attack.t1556.002 logsource: category: process_creation product: windows detection: selection_cmdline: CommandLine|contains|all: - HKLM\SYSTEM\CurrentControlSet\Control\Lsa - scecli\0* - reg add condition: selection_cmdline falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects REGSVR32.exe to execute DLL hosted on remote shares. Logsource: windows / process_creation. Rule: title: Suspicious Regsvr32 Execution From Remote Share id: 88a87a10-384b-4ad7-8871-2f9bf9259ce5 status: test description: Detects REGSVR32.exe to execute DLL hosted on remote shares references: - https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-31 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regsvr32.exe - OriginalFileName: \REGSVR32.EXE selection_cli: CommandLine|contains: ' \\\\' condition: all of selection_* falsepositives: - Unknown level: high
Query: risk of Unspecified vulnerability in the Oracle Telecommunications Billing Integrator component in Oracle E-Business Suite 11.5.10.2, 12.0.4, 12.0.5, 12.0.6, 12.1.1, 12.1.2, 12.1.3, 12.2.2
Matching passage: CVE-2015-0380. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Telecommunications Billing Integrator component in Oracle E-Business Suite 11.5.10.2, 12.0.4, 12.0.5, 12.0.6, 12.1.1, 12.1.2, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote attackers to affect integrity via unknown vectors related to OA Based UI for Bill Summary.
Near-miss passage: CVE-2015-0460. CWE: UNKNOWN. CVSS: 9.300000190734863. Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
Query: Persistence mechanism resembling Domains
Matching passage: T1583.001 Domains. Tactics: resource development. Description: Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free. Adversaries may use acquired domains for a variety of purposes, including for [Phishing](https://attack.mitre.org/techniques/T1566), [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), and Command and Control.(Citation: CISA MSS Sep 2020) Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD).(Citation: FireEye APT28)(Citation: PaypalScam) Typosquatting may be used to aid in delivery of payloads via [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute "IDN homograph attacks," creating visually similar lookalike domains used to deliver malware to victim machines.(Citation: CISA IDN ST05-016)(Citation: tt_httrack_fake_domains)(Citation: tt_obliqueRAT)(Citation: httrack_unhcr)(Citation: lazgroup_idn_phishing) Different URIs/URLs may also be dynamically generated to uniquely serve malicious content to victims (including one-time, single use domain names).(Citation: iOS URL Scheme)(Citation: URI)(Citation: URI Use)(Citation: URI Unique) Adversaries may also acquire and repurpose expired domains, which may be potentially already allowlisted/trusted by defenders based on an existing reputation/history.(Citation: Categorisation_not_boundary)(Citation: Domain_Steal_CC)(Citation: Redirectors_Domain_Fronting)(Citation: bypass_webproxy_filtering) Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain. Adversaries may use such pr
Near-miss passage: T1583.003 Virtual Private Server. Tactics: resource development. Description: Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. By utilizing a VPS, adversaries can make it difficult to physically tie back operations to them. The use of cloud infrastructure can also make it easier for adversaries to rapidly provision, modify, and shut down their infrastructure. Acquiring a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers. Adversaries may also acquire infrastructure from VPS service providers that are known for renting VPSs with minimal registration information, allowing for more anonymous acquisitions of infrastructure.(Citation: TrendmicroHideoutsLease)
Query: CVE similar to CVE-2015-0941
Matching passage: CVE-2015-0941. CWE: CWE-310. CVSS: 4.300000190734863. The Inetc plugin for Nullsoft Scriptable Install System (NSIS), as used in CERT/CC Failure Observation Engine (FOE) and other products, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and possibly execute arbitrary code by sending a crafted certificate in a download session for Windows executable files.
Near-miss passage: CVE-2015-7756. CWE: CWE-310. CVSS: 5.0. The encryption implementation in Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 makes it easier for remote attackers to discover the plaintext content of VPN sessions by sniffing the network for ciphertext data and conducting an unspecified decryption attack.
Query: risk of Cisco FireSIGHT Management Center allows remote attackers to bypass the HTTP attack detection feature and avoid triggering Snort IDS rules via an SSL session that is mishandled aft
Matching passage: CVE-2015-6427. CWE: CWE-254. CVSS: 5.0. Cisco FireSIGHT Management Center allows remote attackers to bypass the HTTP attack detection feature and avoid triggering Snort IDS rules via an SSL session that is mishandled after decryption, aka Bug ID CSCux53437.
Near-miss passage: CVE-2015-1674. CWE: CWE-254. CVSS: 4.599999904632568. The kernel in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly validate an unspecified address, which allows local users to bypass the KASLR protection mechanism, and consequently discover the cng.sys base address, via a crafted application, aka "Windows Kernel Security Feature Bypass Vulnerability."
Query: rule covering Detects potential suspicious winget package installation from a suspicious source.
Matching passage: Sigma rule: Detects potential suspicious winget package installation from a suspicious source.. Logsource: windows / create_stream_hash. Rule: title: Potential Suspicious Winget Package Installation id: a3f5c081-e75b-43a0-9f5b-51f26fe5dba2 status: test description: Detects potential suspicious winget package installation from a suspicious source. references: - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-18 tags: - attack.persistence - attack.stealth logsource: product: windows category: create_stream_hash detection: selection: Contents|startswith: '[ZoneTransfer] ZoneId=3' Contents|contains: - ://1 - ://2 - ://3 - ://4 - ://5 - ://6 - ://7 - ://8 - ://9 TargetFilename|endswith: :Zone.Identifier TargetFilename|contains: \AppData\Local\Temp\WinGet\ condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when an account makes changes to the ingress or egress rules of a security group. This can indicate that an atta. Logsource: aws / cloudtrail. Rule: title: Ingress/Egress Security Group Modification id: 6fb77778-040f-4015-9440-572aa9b6b580 status: test description: 'Detects when an account makes changes to the ingress or egress rules of a security group. This can indicate that an attacker is attempting to open up new attack vectors in the account, that they are trying to exfiltrate data over the network, or that they are trying to allow machines in that VPC/Subnet to contact a C&C server. ' references: - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/ author: jamesc-grafana date: 2024-07-11 tags: - attack.initial-access - attack.t1190 logsource: product: aws service: cloudtrail detection: selection: eventSource: ec2.amazonaws.com eventName: - AuthorizeSecurityGroupEgress - AuthorizeSecurityGroupIngress - RevokeSecurityGroupEgress - RevokeSecurityGroupIngress condition: selection falsepositives: - New VPCs and Subnets being setup requiring a different security profile to those already defined - A single port being opened for a new service that is known to be deploying - Administrators closing unused ports to reduce the attack surface level: medium
Query: common weakness: Uncaught Exception in Servlet
Matching passage: CWE-600 Uncaught Exception in Servlet. The Servlet does not catch all exceptions, which may reveal sensitive debugging information.
Near-miss passage: CWE-131 Incorrect Calculation of Buffer Size. The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
Query: Sigma rule for Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".
Matching passage: Sigma rule: Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".. Logsource: windows / process_creation. Rule: title: User Added to Local Administrators Group id: ad720b90-25ad-43ff-9b5e-5c841facc8e5 related: - id: ffa28e60-bdb1-46e0-9f82-05f7a61cc06e type: similar - id: 10fb649c-3600-4d37-b1e6-56ea90bb7e09 type: similar status: test description: Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember". references: - https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-08-12 modified: 2023-03-02 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: category: process_creation product: windows detection: selection_main: - CommandLine|contains|all: - 'localgroup ' - ' /add' - CommandLine|contains|all: - 'Add-LocalGroupMember ' - ' -Group ' selection_group: CommandLine|contains: - ' administrators ' - ' administrateur' condition: all of selection_* falsepositives: - Administrative activity level: medium
Near-miss passage: Sigma rule: Detects disabling security tools. Logsource: linux / process_creation. Rule: title: Disabling Security Tools id: e3a8a052-111f-4606-9aee-f28ebeb76776 status: test description: Detects disabling security tools references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md author: Ömer Günal, Alejandro Ortuno, oscd.community date: 2020-06-17 modified: 2022-10-09 tags: - attack.defense-impairment - attack.t1686 logsource: category: process_creation product: linux detection: selection_iptables_1: Image|endswith: /service CommandLine|contains|all: - iptables - stop selection_iptables_2: Image|endswith: /service CommandLine|contains|all: - ip6tables - stop selection_iptables_3: Image|endswith: /chkconfig CommandLine|contains|all: - iptables - stop selection_iptables_4: Image|endswith: /chkconfig CommandLine|contains|all: - ip6tables - stop selection_firewall_1: Image|endswith: /systemctl CommandLine|contains|all: - firewalld - stop selection_firewall_2: Image|endswith: /systemctl CommandLine|contains|all: - firewalld - disable selection_carbonblack_1: Image|endswith: /service CommandLine|contains|all: - cbdaemon - stop selection_carbonblack_2: Image|endswith: /chkconfig CommandLine|contains|all: - cbdaemon - 'off' selection_carbonblack_3: Image|endswith: /systemctl CommandLine|contains|all: - cbdaemon - stop selection_carbonblack_4: Image|endswith: /systemctl CommandLine|contains|all: - cbdaemon - disable selection_selinux: Image|endswith: /setenforce CommandLine|contains: '0' selection_crowdstrike_1: Image|endswith: /systemctl CommandLine|contains|all: - stop - falcon-sensor selection_crowdstrike_2: Image|endswith: /systemctl CommandLine|contains|all: - disable - falcon-sensor condition: 1 of selection* falsepositives: - Legitimate administration activities level: medium
Query: write Sigma for Detects the pattern of a pipe name as used by the hack tool EfsPotato
Matching passage: Sigma rule: Detects the pattern of a pipe name as used by the hack tool EfsPotato. Logsource: windows / pipe_created. Rule: title: HackTool - EfsPotato Named Pipe Creation id: 637f689e-b4a5-4a86-be0e-0100a0a33ba2 status: test description: Detects the pattern of a pipe name as used by the hack tool EfsPotato references: - https://twitter.com/SBousseaden/status/1429530155291193354?s=20 - https://github.com/zcgonvh/EfsPotato author: Florian Roth (Nextron Systems) date: 2021-08-23 modified: 2023-12-21 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName|contains: - \pipe\ - \pipe\srvsvc filter_optional_ctx: PipeName|contains: \CtxShare filter_optional_default: PipeName|startswith: \pipe\ condition: selection and not 1 of filter_optional_* falsepositives: - \pipe\LOCAL\Monitorian level: high
Near-miss passage: Sigma rule: Identifies when a VPN connection is modified or deleted.. Logsource: azure / activitylogs. Rule: title: Azure VPN Connection Modified or Deleted id: 61171ffc-d79c-4ae5-8e10-9323dba19cd3 status: test description: Identifies when a VPN connection is modified or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-08-08 modified: 2022-08-23 tags: - attack.impact logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.NETWORK/VPNGATEWAYS/VPNCONNECTIONS/WRITE - MICROSOFT.NETWORK/VPNGATEWAYS/VPNCONNECTIONS/DELETE condition: selection falsepositives: - VPN Connection being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - VPN Connection modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: CVE similar to CVE-2015-5916
Matching passage: CVE-2015-5916. CWE: CWE-200. CVSS: 4.300000190734863. The Apple Pay component in Apple iOS before 9 allows remote terminals to obtain sensitive recent-transaction information during payments by leveraging the transaction-log feature.
Near-miss passage: CVE-2015-3912. CWE: CWE-200. CVSS: 5.0. Huawei E355s Mobile WiFi with firmware before 22.158.45.02.625 and WEBUI before 13.100.04.01.625 allows remote attackers to obtain sensitive configuration information by sniffing the network or sending unspecified commands.
Query: rule covering Detects the execution of CSharp interactive console by PowerShell
Matching passage: Sigma rule: Detects the execution of CSharp interactive console by PowerShell. Logsource: windows / process_creation. Rule: title: Suspicious Use of CSharp Interactive Console id: a9e416a8-e613-4f8b-88b8-a7d1d1af2f61 status: test description: Detects the execution of CSharp interactive console by PowerShell references: - https://redcanary.com/blog/detecting-attacks-leveraging-the-net-framework/ author: Michael R. (@nahamike01) date: 2020-03-08 modified: 2022-07-14 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection: Image|endswith: \csi.exe ParentImage|endswith: - \powershell.exe - \pwsh.exe - \powershell_ise.exe OriginalFileName: csi.exe condition: selection falsepositives: - Possible depending on environment. Pair with other factors such as net connections, command-line args, etc. level: high
Near-miss passage: Sigma rule: Detects changes to service startup type to 'disabled' or 'manual' using the WMIC command-line utility.. Logsource: windows / process_creation. Rule: title: Service Startup Type Change Via Wmic.EXE id: c0514f28-fdae-42df-b886-06e2b2bc5b37 status: experimental description: 'Detects changes to service startup type to ''disabled'' or ''manual'' using the WMIC command-line utility. ' references: - https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-04-27 tags: - attack.execution - attack.defense-impairment - attack.t1047 - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WMIC.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains|all: - ' service ' - ChangeStartMode CommandLine|contains: - Manual - Disabled condition: all of selection_* falsepositives: - Legitimate administrative changes to service startup types using WMIC, investigate accordingly. level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_service_startup_change/info.yml
Query: describe CVE-2015-7581
Matching passage: CVE-2015-7581. CWE: CWE-399. CVSS: 7.5. actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application's use of a wildcard controller route.
Near-miss passage: CVE-2015-5470. CWE: CWE-399. CVSS: 7.800000190734863. The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.