alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote at
Matching passage: CVE-2015-1699. CWE: CWE-94. CVSS: 9.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1675, CVE-2015-1695, CVE-2015-1696, CVE-2015-1697, and CVE-2015-1698.
Near-miss passage: CVE-2015-0855. CWE: CWE-94. CVSS: 9.800000190734863. The _mediaLibraryPlayCb function in mainwindow.py in pitivi before 0.95 allows attackers to execute arbitrary code via shell metacharacters in a file path.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detection well-known mimikatz command line arguments. Logsource: windows / process_creation. Rule: title: HackTool - Mimikatz Execution id: a642964e-bead-4bed-8910-1bb4d63e3b4d status: test description: Detection well-known mimikatz command line arguments references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment - https://tools.thehacker.recipes/mimikatz/modules author: Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton date: 2019-10-22 modified: 2023-02-21 tags: - attack.credential-access - attack.t1003.001 - attack.t1003.002 - attack.t1003.004 - attack.t1003.005 - attack.t1003.006 logsource: category: process_creation product: windows detection: selection_tools_name: CommandLine|contains: - DumpCreds - mimikatz selection_function_names: CommandLine|contains: - ::aadcookie - ::detours - ::memssp - ::mflt - ::ncroutemon - ::ngcsign - ::printnightmare - ::skeleton - ::preshutdown - ::mstsc - ::multirdp selection_module_names: CommandLine|contains: - 'rpc::' - 'token::' - 'crypto::' - 'dpapi::' - 'sekurlsa::' - 'kerberos::' - 'lsadump::' - 'privilege::' - 'process::' - 'vault::' condition: 1 of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects usage of namp/zenmap. Adversaries may attempt to get a listing of services running on remote hosts, including th. Logsource: windows / process_creation. Rule: title: PUA - Nmap/Zenmap Execution id: f6ecd1cf-19b8-4488-97f6-00f0924991a3 status: test description: Detects usage of namp/zenmap. Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation references: - https://nmap.org/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-3---port-scan-nmap-for-windows author: frack113 date: 2021-12-10 modified: 2023-12-11 tags: - attack.discovery - attack.t1046 logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \nmap.exe - \zennmap.exe - OriginalFileName: - nmap.exe - zennmap.exe condition: selection falsepositives: - Legitimate administrator activity level: medium
Query: risk of Siemens SIMATIC HMI Comfort Panels before WinCC (TIA Portal) 13 SP1 Upd2 and SIMATIC WinCC Runtime Advanced before WinCC (TIA Portal) 13 SP1 Upd2 allow man-in-the-middle attackers 
Matching passage: CVE-2015-2822. CWE: CWE-20. CVSS: 4.300000190734863. Siemens SIMATIC HMI Comfort Panels before WinCC (TIA Portal) 13 SP1 Upd2 and SIMATIC WinCC Runtime Advanced before WinCC (TIA Portal) 13 SP1 Upd2 allow man-in-the-middle attackers to cause a denial of service via crafted packets on TCP port 102.
Near-miss passage: CVE-2015-9268. CWE: CWE-20. CVSS: 7.800000190734863. Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in which a wrapper function resolves the dependency at an appropriate time during runtime.
Query: describe CVE-2015-9173
Matching passage: CVE-2015-9173. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 410/12, SD 617, SD 650/52, SD 800, SD 808, and SD 810, missing of return value check in memscpy can cause memory corruption in TQS App.
Near-miss passage: CVE-2015-6145. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6146.
Query: write Sigma for Detects suspicious command line flags that let the user set a target user and command as e.g. seen in PsExec-like tools
Matching passage: Sigma rule: Detects suspicious command line flags that let the user set a target user and command as e.g. seen in PsExec-like tools. Logsource: windows / process_creation. Rule: title: Suspicious RunAs-Like Flag Combination id: 50d66fb0-03f8-4da0-8add-84e77d12a020 status: test description: Detects suspicious command line flags that let the user set a target user and command as e.g. seen in PsExec-like tools references: - https://www.trendmicro.com/en_us/research/22/k/hack-the-real-box-apt41-new-subgroup-earth-longzhi.html author: Florian Roth (Nextron Systems) date: 2022-11-11 tags: - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection_user: CommandLine|contains: - ' -u system ' - ' --user system ' - ' -u NT' - ' -u "NT' - ' -u ''NT' - ' --system ' - ' -u administrator ' selection_command: CommandLine|contains: - ' -c cmd' - ' -c "cmd' - ' -c powershell' - ' -c "powershell' - ' --command cmd' - ' --command powershell' - ' -c whoami' - ' -c wscript' - ' -c cscript' condition: all of selection* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this actio. Logsource: aws / cloudtrail. Rule: title: AWS Route 53 Domain Transfer Lock Disabled id: 3940b5f1-3f46-44aa-b746-ebe615b879e0 status: test description: Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar. references: - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/integrations/aws/persistence_route_53_domain_transfer_lock_disabled.toml - https://docs.aws.amazon.com/Route53/latest/APIReference/API_Operations_Amazon_Route_53.html - https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_DisableDomainTransferLock.html author: Elastic, Austin Songer @austinsonger date: 2021-07-22 modified: 2022-10-09 tags: - attack.persistence - attack.privilege-escalation - attack.credential-access - attack.t1098 logsource: product: aws service: cloudtrail detection: selection: eventSource: route53.amazonaws.com eventName: DisableDomainTransferLock condition: selection falsepositives: - A domain transfer lock may be disabled by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Activity from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Query: vulnerability: In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached due to an improper bound on a length
Matching passage: CVE-2015-9051. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached due to an improper bound on a length in a System Information message.
Near-miss passage: CVE-2015-3830. CWE: CWE-20. CVSS: 6.5. The stock Android browser address bar in all Android operating systems suffers from Address Bar Spoofing, which allows remote attackers to trick a victim by displaying a malicious page for legitimate domain names.
Query: vulnerability: The kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to cause a denial of service (out-of-bounds memory access) or obtain sensiti
Matching passage: CVE-2015-1100. CWE: CWE-119. CVSS: 5.400000095367432. The kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to cause a denial of service (out-of-bounds memory access) or obtain sensitive memory-content information via a crafted app.
Near-miss passage: CVE-2015-6146. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6145.
Query: CWE for Improper Authentication
Matching passage: CWE-287 Improper Authentication. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Near-miss passage: CWE-640 Weak Password Recovery Mechanism for Forgotten Password. The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Query: ATT&CK technique for Encrypted Channel
Matching passage: T1573 Encrypted Channel. Tactics: command and control. Description: Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Near-miss passage: T1573.001 Symmetric Cryptography. Tactics: command and control. Description: Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.
Query: exploit coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (CPU consumption) via a crafted DDS file.
Matching passage: CVE-2015-8959. CWE: CWE-399. CVSS: 6.5. coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (CPU consumption) via a crafted DDS file.
Near-miss passage: CVE-2015-1752. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1741.
Query: vulnerability: WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application cras
Matching passage: CVE-2015-5817. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-8047. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, and CVE-2015-8455.
Query: detect Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are in logs
Matching passage: Sigma rule: Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are. Logsource: windows / process_creation. Rule: title: Detected Windows Software Discovery id: e13f668e-7f95-443d-98d2-1816a7648a7b related: - id: 2650dd1a-eb2a-412d-ac36-83f06c4f2282 type: derived status: test description: Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518/T1518.md - https://github.com/harleyQu1nn/AggressorScripts author: Nikita Nazarov, oscd.community date: 2020-10-16 modified: 2022-10-09 tags: - attack.discovery - attack.t1518 logsource: category: process_creation product: windows detection: selection: Image|endswith: \reg.exe CommandLine|contains|all: - query - \software\ - /v - svcversion condition: selection falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects a tscon.exe start as LOCAL SYSTEM. Logsource: windows / process_creation. Rule: title: Suspicious TSCON Start as SYSTEM id: 9847f263-4a81-424f-970c-875dab15b79b status: test description: Detects a tscon.exe start as LOCAL SYSTEM references: - http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html - https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6 - https://www.ired.team/offensive-security/lateral-movement/t1076-rdp-hijacking-for-lateral-movement author: Florian Roth (Nextron Systems) date: 2018-03-17 modified: 2022-05-27 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: User|contains: - AUTHORI - AUTORI Image|endswith: \tscon.exe condition: selection falsepositives: - Unknown level: high
Query: risk of Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and file disclosure by administrative users.
Matching passage: CVE-2015-2201. CWE: CWE-78. CVSS: 7.199999809265137. Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and file disclosure by administrative users.
Near-miss passage: CVE-2015-2979. CWE: CWE-78. CVSS: 7.5. Webservice-DIC yoyaku_v41 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Query: playbook for alert: SIEM correlation: resource development activity consistent with Malvertising
Matching passage: Playbook for T1583.008 Malvertising. 1) Validate alert telemetry against T1583.008. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: resource development. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may purchase online advertisements that can be abused to distribute malware to victims. Ads can be purchased to plant as well as favorably position artifacts in specific locations online, such as prominently placed within search engine results. These ads may make it more difficult for users to distinguish between actual search results and advertisements.(Citation: spamhaus-malvertising
Near-miss passage: Playbook for T1583.005 Botnet. Different response path focused on resource development.
Query: CVE similar to CVE-2015-1652
Matching passage: CVE-2015-1652. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1666.
Near-miss passage: CVE-2015-4191. CWE: CWE-399. CVSS: 5.0. Cisco IOS XR 5.2.1 allows remote attackers to cause a denial of service (ipv6_io service reload) via a malformed IPv6 packet, aka Bug ID CSCuq95565.
Query: CVE similar to CVE-2015-4173
Matching passage: CVE-2015-4173. CWE: CWE-428. CVSS: 6.900000095367432. Unquoted Windows search path vulnerability in the autorun value in Dell SonicWall NetExtender before 7.5.227 and 8.0.x before 8.0.238, as used in the SRA firmware before 7.5.1.2-40sv and 8.x before 8.0.0.3-23sv, allows local users to gain privileges via a Trojan horse program in the %SYSTEMDRIVE% folder.
Near-miss passage: CVE-2015-6647. CWE: CWE-264. CVSS: 7.800000190734863. The Widevine QSEE TrustZone application in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted application that leverages QSEECOM access, aka internal bug 24441554.
Query: Sigma YAML for gcp / gcp.audit
Matching passage: Sigma rule: Detects when storage bucket is enumerated in Google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud Storage Buckets Enumeration id: e2feb918-4e77-4608-9697-990a1aaf74c3 status: test description: Detects when storage bucket is enumerated in Google Cloud. references: - https://cloud.google.com/storage/docs/json_api/v1/buckets author: Austin Songer @austinsonger date: 2021-08-14 modified: 2022-10-09 tags: - attack.discovery logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name: - storage.buckets.list - storage.buckets.listChannels condition: selection falsepositives: - Storage Buckets being enumerated may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Storage Buckets enumerated from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Near-miss passage: Sigma rule: Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence st. Logsource: windows / registry_set. Rule: title: Potential PSFactoryBuffer COM Hijacking id: 243380fa-11eb-4141-af92-e14925e77c1b status: test description: Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence storing a malicious DLL. references: - https://blogs.blackberry.com/en/2023/06/romcom-resurfaces-targeting-ukraine - https://strontic.github.io/xcyclopedia/library/clsid_C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6.html - https://www.virustotal.com/gui/file/6d3ab9e729bb03ae8ae3fcd824474c5052a165de6cb4c27334969a542c7b261d/detection - https://www.trendmicro.com/en_us/research/23/e/void-rabisu-s-use-of-romcom-backdoor-shows-a-growing-shift-in-th.html author: BlackBerry Threat Research and Intelligence Team - @Joseliyo_Jstnk date: 2023-06-07 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \CLSID\{c90250f3-4d7d-4991-9b69-a5c5bc1c2ae6}\InProcServer32\(Default) filter_main: Details: - '%windir%\System32\ActXPrxy.dll' - C:\Windows\System32\ActXPrxy.dll condition: selection and not filter_main falsepositives: - Unknown level: high
Query: alert when Detects registry modifications that disable internal tools or functions in explorer (malware like Agent Tesla uses this
Matching passage: Sigma rule: Detects registry modifications that disable internal tools or functions in explorer (malware like Agent Tesla uses this. Logsource: windows / registry_set. Rule: title: Registry Explorer Policy Modification id: 1c3121ed-041b-4d97-a075-07f54f20fb4a status: test description: Detects registry modifications that disable internal tools or functions in explorer (malware like Agent Tesla uses this technique) references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md author: frack113 date: 2022-03-18 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection_set_1: TargetObject|endswith: - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogOff - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileMenu - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetTaskbar - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyDocuments - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu Details: DWORD (0x00000001) condition: selection_set_1 falsepositives: - Legitimate admin script level: medium
Near-miss passage: Sigma rule: Detects the malicious use of a control panel item. Logsource: windows / process_creation. Rule: title: Control Panel Items id: 0ba863e6-def5-4e50-9cea-4dd8c7dc46a4 status: test description: Detects the malicious use of a control panel item references: - https://ired.team/offensive-security/code-execution/code-execution-through-control-panel-add-ins author: Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_) date: 2020-06-22 modified: 2023-10-11 tags: - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1218.002 - attack.persistence - attack.t1546 logsource: product: windows category: process_creation detection: selection_reg_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_reg_cli: CommandLine|contains|all: - add - CurrentVersion\Control Panel\CPLs selection_cpl: CommandLine|endswith: .cpl filter_cpl_sys: CommandLine|contains: - \System32\ - '%System%' - '|C:\Windows\system32|' filter_cpl_igfx: CommandLine|contains|all: - 'regsvr32 ' - ' /s ' - igfxCPL.cpl condition: all of selection_reg_* or (selection_cpl and not 1 of filter_cpl_*) falsepositives: - Unknown level: high