alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process usin
Matching passage: Sigma rule: Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process usin. Logsource: windows / image_load. Rule: title: Aruba Network Service Potential DLL Sideloading id: 90ae0469-0cee-4509-b67f-e5efcef040f7 status: test description: Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process using DLL Search Order Hijacking references: - https://twitter.com/wdormann/status/1616581559892545537?t=XLCBO9BziGzD7Bmbt8oMEQ&s=09 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-22 modified: 2023-03-15 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: Image|endswith: \arubanetsvc.exe ImageLoaded|endswith: - \wtsapi32.dll - \msvcr100.dll - \msvcp100.dll - \dbghelp.dll - \dbgcore.dll - \wininet.dll - \iphlpapi.dll - \version.dll - \cryptsp.dll - \cryptbase.dll - \wldp.dll - \profapi.dll - \sspicli.dll - \winsta.dll - \dpapi.dll filter: ImageLoaded|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of the "Get-AdGroup" cmdlet to enumerate Groups within Active Directory. Logsource: windows / ps_script. Rule: title: Active Directory Group Enumeration With Get-AdGroup id: 8c3a6607-b7dc-4f0d-a646-ef38c00b76ee status: test description: Detects usage of the "Get-AdGroup" cmdlet to enumerate Groups within Active Directory references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md author: frack113 date: 2022-03-17 modified: 2022-11-17 tags: - attack.discovery - attack.t1069.002 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'Get-AdGroup ' - -Filter condition: selection falsepositives: - Unknown level: low
Query: describe CVE-2015-3365
Matching passage: CVE-2015-3365. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the nodeauthor module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a Profile2 field in a provided block.
Near-miss passage: CVE-2015-2148. CWE: CWE-79. CVSS: 4.800000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.2 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects suspicious launch of a renamed version of the PSEXESVC service with, which is not often used by legitimate admin. Logsource: windows / process_creation. Rule: title: Renamed PsExec Service Execution id: 51ae86a2-e2e1-4097-ad85-c46cb6851de4 status: test description: Detects suspicious launch of a renamed version of the PSEXESVC service with, which is not often used by legitimate administrators references: - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec - https://www.youtube.com/watch?v=ro2QuZTIMBM author: Florian Roth (Nextron Systems) date: 2022-07-21 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: OriginalFileName: psexesvc.exe filter: Image: C:\Windows\PSEXESVC.exe condition: selection and not filter falsepositives: - Legitimate administrative tasks level: high
Near-miss passage: Sigma rule: Detects the execution of a renamed "jusched.exe" as seen used by the cobalt group. Logsource: windows / process_creation. Rule: title: Renamed Jusched.EXE Execution id: edd8a48c-1b9f-4ba1-83aa-490338cd1ccb status: test description: Detects the execution of a renamed "jusched.exe" as seen used by the cobalt group references: - https://www.bitdefender.com/files/News/CaseStudies/study/262/Bitdefender-WhitePaper-An-APT-Blueprint-Gaining-New-Visibility-into-Financial-Threats-interactive.pdf author: Markus Neis, Swisscom date: 2019-06-04 modified: 2023-02-03 tags: - attack.execution - attack.stealth - attack.t1036.003 logsource: category: process_creation product: windows detection: selection: Description: - Java Update Scheduler - Java(TM) Update Scheduler filter: Image|endswith: \jusched.exe condition: selection and not filter falsepositives: - Unknown level: high
Query: campaign using Network Service Discovery
Matching passage: T1046 Network Service Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.(Citation: CISA AR21-126A FIVEHANDS May 2021) Within cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well. Within macOS environments, adversaries may use the native Bonjour application to discover services running on other macOS hosts within a network. The Bonjour mDNSResponder daemon automatically registers and advertises a host’s registered services on the network. For example, adversaries can use a mDNS query (such as <code>dns-sd -B _ssh._tcp .</code>) to find other systems broadcasting the ssh service.(Citation: apple doco bonjour description)(Citation: macOS APT Activity Bradley)
Near-miss passage: T1613 Container and Resource Discovery. Tactics: discovery. Description: Adversaries may attempt to discover containers and other resources that are available within a containers environment. Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster. These resources can be viewed within web applications such as the Kubernetes dashboard or can be queried via the Docker and Kubernetes APIs.(Citation: Docker API)(Citation: Kubernetes API) In Docker, logs may leak information about the environment, such as the environment’s configuration, which services are available, and what cloud provider the victim may be utilizing. The discovery of these resources may inform an adversary’s next steps in the environment, such as how to perform lateral movement and which methods to utilize for execution.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the PDF functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7 allows remote attackers to inject a
Matching passage: CVE-2015-3660. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the PDF functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL in embedded PDF content.
Near-miss passage: CVE-2015-0634. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the administrative interface in Cisco WebEx Meetings Server 2.5 and 2.5.0.997 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuq86310.
Query: describe CVE-2015-1428
Matching passage: CVE-2015-1428. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1) remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or (2) remote authenticated users to execute arbitrary SQL commands via the value_id parameter in a save_value action to backend/main.php.
Near-miss passage: CVE-2015-10068. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability classified as critical was found in danynab movify-j. This vulnerability affects the function getByMovieId of the file app/business/impl/ReviewServiceImpl.java. The manipulation of the argument movieId/username leads to sql injection. The name of the patch is c3085e01936a4d7eff1eda3093f25d56cc4d2ec5. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218476.
Query: risk of Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Browser ASLR Bypas
Matching passage: CVE-2015-6088. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Browser ASLR Bypass."
Near-miss passage: CVE-2015-3195. CWE: CWE-200. CVSS: 5.300000190734863. The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.
Query: risk of Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 11.1.1.7 allows remote attackers to affect confidentiality via unknown 
Matching passage: CVE-2015-0362. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 11.1.1.7 allows remote attackers to affect confidentiality via unknown vectors related to BI Publisher Security.
Near-miss passage: CVE-2015-4952. CWE: UNKNOWN. CVSS: 8.800000190734863. The on-demand plugin in IBM Endpoint Manager for Remote Control 9.0.1 and 9.1.0 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors. IBM X-Force ID: 105196.
Query: describe CVE-2015-8410
Matching passage: CVE-2015-8410. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-4838. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.4.0, 12.1.2.0.0, and 12.1.3.0.0 allows remote authenticated users to affect confidentiality via vectors related to ADF Faces.
Query: rule covering Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the
Matching passage: Sigma rule: Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the. Logsource: windows / registry_set. Rule: title: Potential Credential Dumping Attempt Using New NetworkProvider - REG id: 0442defa-b4a2-41c9-ae2c-ea7042fc4701 related: - id: baef1ec6-2ca9-47a3-97cc-4cf2bda10b77 type: similar status: test description: Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it references: - https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/network-provider-settings-removed-in-place-upgrade - https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-23 modified: 2023-08-17 tags: - attack.credential-access - attack.t1003 logsource: category: registry_set product: windows detection: selection: TargetObject|contains|all: - \System\CurrentControlSet\Services\ - \NetworkProvider filter: TargetObject|contains: - \System\CurrentControlSet\Services\WebClient\NetworkProvider - \System\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider - \System\CurrentControlSet\Services\RDPNP\NetworkProvider filter_valid_procs: Image: C:\Windows\System32\poqexec.exe condition: selection and not 1 of filter* falsepositives: - Other legitimate network providers used and not filtred in this rule level: medium
Near-miss passage: Sigma rule: Detects PowerShell download and execution cradles.. Logsource: windows / process_creation. Rule: title: PowerShell Download and Execution Cradles id: 85b0b087-eddf-4a2b-b033-d771fa2b9775 status: test description: Detects PowerShell download and execution cradles. references: - https://github.com/VirtualAlllocEx/Payload-Download-Cradles/blob/88e8eca34464a547c90d9140d70e9866dcbc6a12/Download-Cradles.cmd - https://labs.withsecure.com/publications/fin7-target-veeam-servers author: Florian Roth (Nextron Systems) date: 2022-03-24 modified: 2025-07-18 tags: - attack.execution - attack.t1059 logsource: product: windows category: process_creation detection: selection_download: CommandLine|contains: - .DownloadString( - .DownloadFile( - 'Invoke-WebRequest ' - 'iwr ' - 'Invoke-RestMethod ' - 'irm ' selection_iex: CommandLine|contains: - ;iex $ - '| IEX' - '|IEX ' - I`E`X - I`EX - IE`X - 'iex ' - IEX ( - IEX( - Invoke-Expression condition: all of selection_* falsepositives: - Some PowerShell installers were seen using similar combinations. Apply filters accordingly level: high
Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects when an attacker adds a new "Debugger" value to the "Hangs" key in order to achieve persistence which will get i. Logsource: windows / registry_set. Rule: title: Add Debugger Entry To Hangs Key For Persistence id: 833ef470-fa01-4631-a79b-6f291c9ac498 status: test description: Detects when an attacker adds a new "Debugger" value to the "Hangs" key in order to achieve persistence which will get invoked when an application crashes references: - https://persistence-info.github.io/Data/wer_debugger.html - https://www.hexacorn.com/blog/2019/09/20/beyond-good-ol-run-key-part-116/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2023-08-17 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SOFTWARE\Microsoft\Windows\Windows Error Reporting\Hangs\Debugger condition: selection falsepositives: - This value is not set by default but could be rarly used by administrators level: high
Near-miss passage: Sigma rule: Detects process connections to a Monero crypto mining pool. Logsource: linux / network_connection. Rule: title: Linux Crypto Mining Pool Connections id: a46c93b7-55ed-4d27-a41b-c259456c4746 status: stable description: Detects process connections to a Monero crypto mining pool references: - https://www.poolwatch.io/coin/monero author: Florian Roth (Nextron Systems) date: 2021-10-26 tags: - attack.impact - attack.t1496 logsource: product: linux category: network_connection detection: selection: DestinationHostname: - pool.minexmr.com - fr.minexmr.com - de.minexmr.com - sg.minexmr.com - ca.minexmr.com - us-west.minexmr.com - pool.supportxmr.com - mine.c3pool.com - xmr-eu1.nanopool.org - xmr-eu2.nanopool.org - xmr-us-east1.nanopool.org - xmr-us-west1.nanopool.org - xmr-asia1.nanopool.org - xmr-jp1.nanopool.org - xmr-au1.nanopool.org - xmr.2miners.com - xmr.hashcity.org - xmr.f2pool.com - xmrpool.eu - pool.hashvault.pro - moneroocean.stream - monerocean.stream condition: selection falsepositives: - Legitimate use of crypto miners level: high
Query: CVE similar to CVE-2015-8757
Matching passage: CVE-2015-8757. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the Extension Manager in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to extension data during an extension installation.
Near-miss passage: CVE-2015-1565. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the online help in Hitachi Device Manager, Tiered Storage Manager, Replication Manager, and Global Link Manager before 8.1.2-00, and Compute Systems Manager before 7.6.1-08 and 8.x before 8.1.2-00, as used in Hitachi Command Suite, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: Sigma YAML for macos / process_creation
Matching passage: Sigma rule: Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors an. Logsource: macos / process_creation. Rule: title: System Information Discovery Using System_Profiler id: 4809c683-059b-4935-879d-36835986f8cf status: test description: 'Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information. This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes. ' references: - https://www.trendmicro.com/en_za/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html - https://www.sentinelone.com/wp-content/uploads/pdf-gen/1630910064/20-common-tools-techniques-used-by-macos-threat-actors-malware.pdf - https://ss64.com/mac/system_profiler.html - https://objective-see.org/blog/blog_0x62.html - https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/ - https://gist.github.com/nasbench/9a1ba4bc7094ea1b47bc42bf172961af author: Stephen Lincoln `@slincoln_aiq` (AttackIQ) date: 2024-01-02 tags: - attack.discovery - attack.stealth - attack.t1082 - attack.t1497.001 logsource: product: macos category: process_creation detection: selection_img: - Image|endswith: /system_profiler - CommandLine|contains: system_profiler selection_cmd: CommandLine|contains: - SPApplicationsDataType - SPHardwareDataType - SPNetworkDataType - SPUSBDataType condition: all of selection_* falsepositives: - Legitimate administrative activities level: medium
Near-miss passage: Sigma rule: Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.. Logsource: windows / process_creation. Rule: title: File Download Using Notepad++ GUP Utility id: 44143844-0631-49ab-97a0-96387d6b2d7c status: test description: Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files. references: - https://twitter.com/nas_bench/status/1535322182863179776 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-10 modified: 2023-03-02 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \GUP.exe - OriginalFileName: gup.exe selection_cli: CommandLine|contains|all: - ' -unzipTo ' - http filter: ParentImage|endswith: \notepad++.exe condition: all of selection* and not filter falsepositives: - Other parent processes other than notepad++ using GUP that are not currently identified level: high
Query: risk of Palo Alto Networks Panorama VM Appliance with PAN-OS before 6.0.1 might allow remote attackers to execute arbitrary Python code via a crafted firmware image file.
Matching passage: CVE-2015-6531. CWE: CWE-94. CVSS: 7.800000190734863. Palo Alto Networks Panorama VM Appliance with PAN-OS before 6.0.1 might allow remote attackers to execute arbitrary Python code via a crafted firmware image file.
Near-miss passage: CVE-2015-1675. CWE: CWE-94. CVSS: 9.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1695, CVE-2015-1696, CVE-2015-1697, CVE-2015-1698, and CVE-2015-1699.
Query: weakness Use of a One-Way Hash without a Salt
Matching passage: CWE-759 Use of a One-Way Hash without a Salt. The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.
Near-miss passage: CWE-1048 Invokable Control Element with Large Number of Outward Calls. The code contains callable control elements that contain an excessively large number of references to other application objects external to the context of the callable, i.e. a Fan-Out value that is excessively large.
Query: describe CVE-2015-3812
Matching passage: CVE-2015-3812. CWE: CWE-399. CVSS: 7.800000190734863. Multiple memory leaks in the x11_init_protocol function in epan/dissectors/packet-x11.c in the X11 dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 allow remote attackers to cause a denial of service (memory consumption) via a crafted packet.
Near-miss passage: CVE-2015-1846. CWE: CWE-399. CVSS: 7.800000190734863. unzoo allows remote attackers to cause a denial of service (infinite loop and resource consumption) via unspecified vectors to the (1) ExtrArch or (2) ListArch function, related to pointer handling.
Query: vulnerability: The IPv6 snooping functionality in the first-hop security subsystem in Cisco IOS 12.2, 15.0, 15.1, 15.2, 15.3, 15.4, and 15.5 and IOS XE 3.2SE, 3.3SE, 3.3XO, 3.4SG, 3.5E, and 3.6E 
Matching passage: CVE-2015-6279. CWE: CWE-20. CVSS: 7.800000190734863. The IPv6 snooping functionality in the first-hop security subsystem in Cisco IOS 12.2, 15.0, 15.1, 15.2, 15.3, 15.4, and 15.5 and IOS XE 3.2SE, 3.3SE, 3.3XO, 3.4SG, 3.5E, and 3.6E before 3.6.3E; 3.7E before 3.7.2E; 3.9S and 3.10S before 3.10.6S; 3.11S before 3.11.4S; 3.12S and 3.13S before 3.13.3S; and 3.14S before 3.14.2S allows remote attackers to cause a denial of service (device reload) via a malformed ND packet with the Cryptographically Generated Address (CGA) option, aka Bug ID CSCuo04400.
Near-miss passage: CVE-2015-0725. CWE: CWE-20. CVSS: 7.800000190734863. Cisco Videoscape Distribution Suite Service Broker (aka VDS-SB), when a VDSM configuration on UCS is used, and Videoscape Distribution Suite for Internet Streaming (aka VDS-IS or CDS-IS) before 3.3.1 R7 and 4.x before 4.0.0 R4 allow remote attackers to cause a denial of service (device reload) via a crafted HTTP request, aka Bug IDs CSCus79834 and CSCuu63409.