alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detect use of X509Enrollment
Matching passage: Sigma rule: Detect use of X509Enrollment. Logsource: windows / ps_script. Rule: title: Suspicious X509Enrollment - Ps Script id: 504d63cb-0dba-4d02-8531-e72981aace2c related: - id: 114de787-4eb2-48cc-abdb-c0b449f93ea4 type: similar status: test description: Detect use of X509Enrollment references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=42 - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=41 - https://learn.microsoft.com/en-us/dotnet/api/microsoft.hpc.scheduler.store.cx509enrollmentwebclassfactoryclass?view=hpc-sdk-5.1.6115 author: frack113 date: 2022-12-23 tags: - attack.defense-impairment - attack.t1553.004 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - X509Enrollment.CBinaryConverter - 884e2002-217d-11da-b2a4-000e7bbb2b09 condition: selection falsepositives: - Legitimate administrative script level: medium
Near-miss passage: Sigma rule: Detects usage of the netsh command to open and allow connections to port 3389 (RDP). As seen used by Sarwent Malware. Logsource: windows / process_creation. Rule: title: RDP Connection Allowed Via Netsh.EXE id: 01aeb693-138d-49d2-9403-c4f52d7d3d62 status: test description: Detects usage of the netsh command to open and allow connections to port 3389 (RDP). As seen used by Sarwent Malware references: - https://labs.sentinelone.com/sarwent-malware-updates-command-detonation/ author: Sander Wiebing date: 2020-05-23 modified: 2023-12-11 tags: - attack.defense-impairment - attack.t1686.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: CommandLine|contains|all: - 'firewall ' - 'add ' - 'tcp ' - '3389' CommandLine|contains: - portopening - allow condition: all of selection_* falsepositives: - Legitimate administration activity level: high
Query: CVE similar to CVE-2015-5165
Matching passage: CVE-2015-5165. CWE: CWE-908. CVSS: 9.300000190734863. The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecified vectors.
Near-miss passage: CVE-2015-8390. CWE: CWE-908. CVSS: 9.800000190734863. PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Query: risk of Unspecified vulnerability in the Hyperion Installation Technology component in Oracle Hyperion 11.1.2.3 allows local users to affect confidentiality via unknown vectors related to 
Matching passage: CVE-2015-4823. CWE: UNKNOWN. CVSS: 1.2000000476837158. Unspecified vulnerability in the Hyperion Installation Technology component in Oracle Hyperion 11.1.2.3 allows local users to affect confidentiality via unknown vectors related to Essbase Rapid Deploy.
Near-miss passage: CVE-2015-3959. CWE: UNKNOWN. CVSS: 7.199999809265137. The firmware in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches has a hardcoded serial-console password for a privileged account, which might allow physically proximate attackers to obtain access by establishing a console session to a nonstandard installation on which this account is enabled, and leveraging knowledge of this password.
Query: risk of SQL injection vulnerability in a2billing/customer/iridium_threed.php in Elastix 2.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the transactionID pa
Matching passage: CVE-2015-1875. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in a2billing/customer/iridium_threed.php in Elastix 2.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the transactionID parameter.
Near-miss passage: CVE-2015-10100. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability, which was classified as critical, has been found in Dynamic Widgets Plugin up to 1.5.10 on WordPress. This issue affects some unknown processing of the file classes/dynwid_class.php. The manipulation leads to sql injection. The attack may be initiated remotely. Upgrading to version 1.5.11 is able to address this issue. The identifier of the patch is d0a19c6efcdc86d7093b369bc9e29a0629e57795. It is recommended to upgrade the affected component. The identifier VDB-225353 was assigned to this vulnerability.
Query: rule covering Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0
Matching passage: Sigma rule: Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0. Logsource: windows / process_creation. Rule: title: Potential PowerShell Downgrade Attack id: b3512211-c67e-4707-bedc-66efc7848863 related: - id: 6331d09b-4785-4c13-980f-f96661356249 type: derived status: test description: Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0 references: - http://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/ - https://github.com/r00t-3xp10it/hacking-material-books/blob/43cb1e1932c16ff1f58b755bc9ab6b096046853f/obfuscation/simple_obfuscation.md#bypass-or-avoid-amsi-by-version-downgrade- author: Harish Segar (rule) date: 2020-03-20 modified: 2023-01-04 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: \powershell.exe CommandLine|contains: - ' -version 2 ' - ' -versio 2 ' - ' -versi 2 ' - ' -vers 2 ' - ' -ver 2 ' - ' -ve 2 ' - ' -v 2 ' condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExe. Logsource: windows / process_creation. Rule: title: HackTool - Impersonate Execution id: cf0c254b-22f1-4b2b-8221-e137b3c0af94 status: test description: Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively references: - https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/ - https://github.com/sensepost/impersonate author: Sai Prashanth Pulisetti @pulisettis date: 2022-12-21 modified: 2024-11-23 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.001 - attack.t1134.003 logsource: product: windows category: process_creation detection: selection_commandline_exe: CommandLine|contains: impersonate.exe selection_commandline_opt: CommandLine|contains: - ' list ' - ' exec ' - ' adduser ' selection_hash: Hashes|contains: - MD5=9520714AB576B0ED01D1513691377D01 - SHA256=E81CC96E2118DC4FBFE5BAD1604E0AC7681960143E2101E1A024D52264BB0A8A - IMPHASH=0A358FFC1697B7A07D0E817AC740DF62 condition: all of selection_commandline_* or selection_hash falsepositives: - Unknown level: medium
Query: describe CVE-2015-0699
Matching passage: CVE-2015-0699. CWE: CWE-89. CVSS: 5.0. SQL injection vulnerability in the Interactive Voice Response (IVR) component in Cisco Unified Communications Manager (UCM) 10.5(1.98991.13) allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCut21563.
Near-miss passage: CVE-2015-1434. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in my little forum before 2.3.4 allow remote administrators to execute arbitrary SQL commands via the (1) letter parameter in a user action or (2) edit_category parameter to index.php.
Query: write Sigma for Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat a
Matching passage: Sigma rule: Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat a. Logsource: windows / ps_script. Rule: title: AADInternals PowerShell Cmdlets Execution - PsScript id: 91e69562-2426-42ce-a647-711b8152ced6 related: - id: c86500e9-a645-4680-98d7-f882c70c1ea3 type: similar status: test description: Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365. references: - https://o365blog.com/aadinternals/ - https://github.com/Gerenios/AADInternals author: Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2022-12-23 modified: 2025-02-06 tags: - attack.execution - attack.reconnaissance - attack.discovery - attack.credential-access - attack.impact logsource: product: windows category: ps_script definition: Script Block Logging must be enable detection: selection: ScriptBlockText|contains: - Add-AADInt - ConvertTo-AADInt - Disable-AADInt - Enable-AADInt - Export-AADInt - Find-AADInt - Get-AADInt - Grant-AADInt - Initialize-AADInt - Install-AADInt - Invoke-AADInt - Join-AADInt - New-AADInt - Open-AADInt - Read-AADInt - Register-AADInt - Remove-AADInt - Reset-AADInt - Resolve-AADInt - Restore-AADInt - Save-AADInt - Search-AADInt - Send-AADInt - Set-AADInt - Start-AADInt - Unprotect-AADInt - Update-AADInt condition: selection falsepositives: - Legitimate use of the library for administrative activity level: high
Near-miss passage: Sigma rule: Detects execution of "AdPlus.exe", a binary that is part of the Windows SDK that can be used as a LOLBIN in order to dum. Logsource: windows / process_creation. Rule: title: Potential Adplus.EXE Abuse id: 2f869d59-7f6a-4931-992c-cce556ff2d53 status: test description: Detects execution of "AdPlus.exe", a binary that is part of the Windows SDK that can be used as a LOLBIN in order to dump process memory and execute arbitrary commands. references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Adplus/ - https://twitter.com/nas_bench/status/1534916659676422152 - https://twitter.com/nas_bench/status/1534915321856917506 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-09 modified: 2023-06-23 tags: - attack.execution - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \adplus.exe - OriginalFileName: Adplus.exe selection_cli: CommandLine|contains: - ' -hang ' - ' -pn ' - ' -pmn ' - ' -p ' - ' -po ' - ' -c ' - ' -sc ' condition: all of selection_* falsepositives: - Legitimate usage of Adplus for debugging purposes level: high
Query: patch priority for CVE-2015-0044
Matching passage: CVE-2015-0044. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-8967 and CVE-2015-0050.
Near-miss passage: CVE-2015-5307. CWE: CWE-399. CVSS: 4.900000095367432. The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #AC (aka Alignment Check) exceptions, related to svm.c and vmx.c.
Query: SOC alert related to Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
Matching passage: T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Asymmetric encryption algorithms are those that use different keys on each end of the channel. Also known as public-key cryptography, this requires pairs of cryptographic keys that can encrypt/decrypt data from the corresponding key. Each end of the communication channels requires a private key (only in the procession of that entity) and the public key of the other entity. The public keys of each entity are exchanged before encrypted communications begin. Network protocols that use asymmetric encryption (such as HTTPS/TLS/SSL) often utilize symmetric encryption once keys are exchanged. Adversaries may opt to use these encrypted mechanisms that are baked into a protocol.
Near-miss passage: T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.(Citation: copy_cmd_cisco) Adversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted (such as HTTP, FTP, or DNS). This may include custom or publicly available encoding/compression algorithms (such as base64) as well as embedding data within protocol headers and fields.
Query: vulnerability: SQL injection vulnerability in the login form in GSI WiNPAT Portal 3.2.0.1001 through 3.6.1.0 allows remote attackers to execute arbitrary SQL commands via the username field.
Matching passage: CVE-2015-5376. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in the login form in GSI WiNPAT Portal 3.2.0.1001 through 3.6.1.0 allows remote attackers to execute arbitrary SQL commands via the username field.
Near-miss passage: CVE-2015-9098. CWE: CWE-89. CVSS: 9.800000190734863. In Redgate SQL Monitor before 3.10 and 4.x before 4.2, a remote attacker can gain unauthenticated access to the Base Monitor, resulting in the ability to execute arbitrary SQL commands on any monitored Microsoft SQL Server machines. If the Base Monitor is connecting to these machines using an account with SQL admin privileges, then code execution on the operating system can result in full system compromise (if Microsoft SQL Server is running with local administrator privileges).
Query: detect Detects inline execution of PowerShell code from a file in logs
Matching passage: Sigma rule: Detects inline execution of PowerShell code from a file. Logsource: windows / process_creation. Rule: title: Powershell Inline Execution From A File id: ee218c12-627a-4d27-9e30-d6fb2fe22ed2 status: test description: Detects inline execution of PowerShell code from a file references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=50 author: frack113 date: 2022-12-25 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: process_creation detection: selection_exec: CommandLine|contains: - 'iex ' - 'Invoke-Expression ' - 'Invoke-Command ' - 'icm ' selection_read: CommandLine|contains: - 'cat ' - 'get-content ' - 'type ' selection_raw: CommandLine|contains: ' -raw' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects instances where a GIT service on an OpenCanary node has had Git Clone request.. Logsource: opencanary / application. Rule: title: OpenCanary - GIT Clone Request id: 4fe17521-aef3-4e6a-9d6b-4a7c8de155a8 status: test description: Detects instances where a GIT service on an OpenCanary node has had Git Clone request. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.collection - attack.t1213 logsource: category: application product: opencanary detection: selection: logtype: 16001 condition: selection falsepositives: - Unlikely level: high
Query: alert when Detects creation of a container with a hostPath mount. A hostPath volume mounts a directory or a file from the node to t
Matching passage: Sigma rule: Detects creation of a container with a hostPath mount. A hostPath volume mounts a directory or a file from the node to t. Logsource: kubernetes / application / audit. Rule: title: Container With A hostPath Mount Created id: 402b955c-8fe0-4a8c-b635-622b4ac5f902 status: test description: 'Detects creation of a container with a hostPath mount. A hostPath volume mounts a directory or a file from the node to the container. Attackers who have permissions to create a new pod in the cluster may create one with a writable hostPath volume and chroot to escape to the underlying node. ' references: - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Writable%20hostPath%20mount/ - https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216 author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.t1611 - attack.privilege-escalation logsource: category: application product: kubernetes service: audit detection: selection: verb: create objectRef.resource: pods hostPath: '*' condition: selection falsepositives: - The DaemonSet controller creates pods with hostPath volumes within the kube-system namespace. level: low
Near-miss passage: Sigma rule: Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the. Logsource: windows / process_creation. Rule: title: Potential Credential Dumping Attempt Using New NetworkProvider - CLI id: baef1ec6-2ca9-47a3-97cc-4cf2bda10b77 related: - id: 0442defa-b4a2-41c9-ae2c-ea7042fc4701 type: similar status: test description: Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it references: - https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/network-provider-settings-removed-in-place-upgrade - https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-23 modified: 2023-02-02 tags: - attack.credential-access - attack.t1003 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - \System\CurrentControlSet\Services\ - \NetworkProvider condition: selection falsepositives: - Other legitimate network providers used and not filtred in this rule level: high
Query: describe CVE-2015-9416
Matching passage: CVE-2015-9416. CWE: CWE-79. CVSS: 6.099999904632568. The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header.
Near-miss passage: CVE-2015-1394. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) sort_by, (2) sort_order, (3) items_view, (4) dir, (5) clipboard_task, (6) clipboard_files, (7) clipboard_src, or (8) clipboard_dest parameters in an addImages action to wp-admin/admin-ajax.php.
Query: risk of SceneKit in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vecto
Matching passage: CVE-2015-3783. CWE: CWE-119. CVSS: 7.5. SceneKit in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.
Near-miss passage: CVE-2015-2327. CWE: CWE-119. CVSS: 7.5. PCRE before 8.36 mishandles the /(((a\2)|(a*)\g<-1>))*/ pattern and related patterns with certain internal recursive back references, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Query: CVE similar to CVE-2015-0713
Matching passage: CVE-2015-0713. CWE: CWE-264. CVSS: 9.0. The web framework in Cisco TelePresence Advanced Media Gateway Series Software before 1.1(1.40), Cisco TelePresence IP Gateway Series Software, Cisco TelePresence IP VCR Series Software before 3.0(1.27), Cisco TelePresence ISDN Gateway Software before 2.2(1.94), Cisco TelePresence MCU Software before 4.4(3.54) and 4.5 before 4.5(1.45), Cisco TelePresence MSE Supervisor Software before 2.3(1.38), Cisco TelePresence Serial Gateway Series Software before 1.0(1.42), Cisco TelePresence Server Software for Hardware before 3.1(1.98), and Cisco TelePresence Server Software for Virtual Machine before 4.1(1.79) allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors, aka Bug IDs CSCul55968, CSCur08993, CSCur15803, CSCur15807, CSCur15825, CSCur15832, CSCur15842, CSCur15850, and CSCur15855.
Near-miss passage: CVE-2015-2430. CWE: CWE-264. CVSS: 9.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow attackers to bypass an application sandbox protection mechanism and perform unspecified filesystem actions via a crafted application, aka "Windows Filesystem Elevation of Privilege Vulnerability."
Query: write Sigma for Detects potential DLL sideloading of "SolidPDFCreator.dll"
Matching passage: Sigma rule: Detects potential DLL sideloading of "SolidPDFCreator.dll". Logsource: windows / image_load. Rule: title: Potential SolidPDFCreator.DLL Sideloading id: a2edbce1-95c8-4291-8676-0d45146862b3 status: test description: Detects potential DLL sideloading of "SolidPDFCreator.dll" references: - https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/ author: X__Junior (Nextron Systems) date: 2023-05-07 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \SolidPDFCreator.dll filter_main_path: Image|endswith: \SolidPDFCreator.exe ImageLoaded|startswith: - C:\Program Files (x86)\SolidDocuments\SolidPDFCreator\ - C:\Program Files\SolidDocuments\SolidPDFCreator\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting. Logsource: windows / registry_delete. Rule: title: Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted id: 5dfc1465-8f65-4fde-8eb5-6194380c6a62 related: - id: 75180c5f-4ea1-461a-a4f6-6e4700c065d4 type: similar - id: 817f252c-5143-4dae-b418-48c3e9f63728 type: similar status: test description: 'Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" registry value. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary. ' references: - https://learn.microsoft.com/en-us/windows/client-management/manage-recall - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis author: Sajid Nawaz Khan date: 2024-06-02 tags: - attack.collection - attack.t1113 logsource: category: registry_delete product: windows detection: selection: EventType: DeleteValue TargetObject|endswith: \Microsoft\Windows\WindowsAI\DisableAIDataAnalysis condition: selection falsepositives: - Legitimate use/activation of Windows Recall level: medium