alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software in logs
Matching passage: Sigma rule: Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Via ClassicExplorer32.dll id: caa02837-f659-466f-bca6-48bde2826ab4 status: test description: Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software references: - https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets - https://app.any.run/tasks/6d8cabb0-dcda-44b6-8050-28d6ce281687/ author: frack113 date: 2022-12-13 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection_classicexplorer: ImageLoaded|endswith: \ClassicExplorer32.dll filter_classicexplorer: ImageLoaded|startswith: C:\Program Files\Classic Shell\ condition: selection_classicexplorer and not filter_classicexplorer falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Rule to detect the Hybrid Connection Manager service running on an endpoint.. Logsource: windows / microsoft-servicebus-client. Rule: title: HybridConnectionManager Service Running id: b55d23e5-6821-44ff-8a6e-67218891e49f status: test description: Rule to detect the Hybrid Connection Manager service running on an endpoint. references: - https://twitter.com/Cyb3rWard0g/status/1381642789369286662 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2021-04-12 modified: 2024-08-05 tags: - attack.persistence - attack.t1554 logsource: product: windows service: microsoft-servicebus-client detection: selection: EventID: - 40300 - 40301 - 40302 keywords: - HybridConnection - sb:// - servicebus.windows.net - HybridConnectionManage condition: selection and keywords falsepositives: - Legitimate use of Hybrid Connection Manager via Azure function apps. level: high
Query: SOC runbook when seeing Encoded PowerShell / command-line abuse matching Resource Forking
Matching passage: Playbook for T1564.009 Resource Forking. 1) Validate alert telemetry against T1564.009. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.(Citation: macOS Hierarchical File System Overview) Usage of a resource fork is identifiable when displaying a file’s extend
Near-miss passage: Playbook for T1564.008 Email Hiding Rules. Different response path focused on stealth.
Query: patch priority for CVE-2015-2534
Matching passage: CVE-2015-2534. CWE: CWE-284. CVSS: 1.899999976158142. Hyper-V in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows 10 improperly processes ACL settings, which allows local users to bypass intended network-traffic restrictions via a crafted application, aka "Hyper-V Security Feature Bypass Vulnerability."
Near-miss passage: CVE-2015-4034. CWE: CWE-284. CVSS: 7.900000095367432. The createFromParcel method in the com.absolute.android.persistence.MethodSpec class in Samsung Galaxy S5s allows remote attackers to execute arbitrary files via a crafted Parcelable object in a serialized MethodSpec object.
Query: vulnerability: In all Android releases from CAF using the Linux kernel, a DRM key was exposed to QTEE applications.
Matching passage: CVE-2015-9032. CWE: CWE-200. CVSS: 3.299999952316284. In all Android releases from CAF using the Linux kernel, a DRM key was exposed to QTEE applications.
Near-miss passage: CVE-2015-5898. CWE: CWE-200. CVSS: 2.0999999046325684. CFNetwork in Apple iOS before 9 relies on the hardware UID for its cache encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.
Query: describe CVE-2015-8805
Matching passage: CVE-2015-8805. CWE: CWE-310. CVSS: 9.800000190734863. The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8803.
Near-miss passage: CVE-2015-8989. CWE: CWE-310. CVSS: 8.800000190734863. Unsalted password vulnerability in the Enterprise Manager (web portal) component in Intel Security McAfee Vulnerability Manager (MVM) 7.5.8 and earlier allows attackers to more easily decrypt user passwords via brute force attacks against the database.
Query: describe CVE-2015-7247
Matching passage: CVE-2015-7247. CWE: CWE-200. CVSS: 9.800000190734863. D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 discloses usernames, passwords, keys, values, and web account hashes (super and admin) in plaintext when running a configuration backup, which allows remote attackers to obtain sensitive information.
Near-miss passage: CVE-2015-3171. CWE: CWE-200. CVSS: 5.5. sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive information by reading the contents of the archive.
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface (WebUI) in Fortinet FortiSandbox before 2.1 allow remote attackers to inject arbitrary web script or H
Matching passage: CVE-2015-7360. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface (WebUI) in Fortinet FortiSandbox before 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) serial parameter to alerts/summary/profile/; the (2) urlForCreatingReport parameter to csearch/report/export/; the (3) id parameter to analysis/detail/download/screenshot; or vectors related to (4) "Fortiview threats by users search filtered by vdom" or (5) "PCAP file download generated by the VM scan feature."
Near-miss passage: CVE-2015-4939. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in IBM Emptoris Supplier Lifecycle Management and Emptoris Program Management 10.x before 10.0.1.4_iFix3, 10.0.2.x before 10.0.2.7_iFix1, 10.0.3.x before 10.0.3.2, and 10.0.4.x before 10.0.4.0_iFix1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Query: vulnerability: Race condition in the prepare_binprm function in fs/exec.c in the Linux kernel before 3.19.6 allows local users to gain privileges by executing a setuid program at a time instant w
Matching passage: CVE-2015-3339. CWE: CWE-362. CVSS: 6.199999809265137. Race condition in the prepare_binprm function in fs/exec.c in the Linux kernel before 3.19.6 allows local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress, and the ownership is changed but the setuid bit is not yet stripped.
Near-miss passage: CVE-2015-7543. CWE: CWE-362. CVSS: 7.0. aRts 1.5.10 and kdelibs3 3.5.10 and earlier do not properly create temporary directories, which allows local users to hijack the IPC by pre-creating the temporary directory.
Query: Sigma rule for Detects attempts to enumerate file shares, printer shares and sessions using "net.exe" with the "view" flag.
Matching passage: Sigma rule: Detects attempts to enumerate file shares, printer shares and sessions using "net.exe" with the "view" flag.. Logsource: windows / process_creation. Rule: title: Share And Session Enumeration Using Net.EXE id: 62510e69-616b-4078-b371-847da438cc03 status: stable description: Detects attempts to enumerate file shares, printer shares and sessions using "net.exe" with the "view" flag. references: - https://eqllib.readthedocs.io/en/latest/analytics/b8a94d2f-dc75-4630-9d73-1edc6bd26fff.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md author: Endgame, JHasenbusch (ported for oscd.community) date: 2018-10-30 modified: 2023-02-21 tags: - attack.discovery - attack.t1018 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: CommandLine|contains: view filter: CommandLine|contains: \\\\ condition: all of selection_* and not filter falsepositives: - Legitimate use of net.exe utility by legitimate user level: low
Near-miss passage: Sigma rule: Detects non-sysinternals tools setting the "accepteula" key which normally is set on sysinternals tool execution. Logsource: windows / registry_set. Rule: title: Usage of Renamed Sysinternals Tools - RegistrySet id: 8023f872-3f1d-4301-a384-801889917ab4 related: - id: 25ffa65d-76d8-4da5-a832-3f2b0136e133 type: derived - id: f50f3c09-557d-492d-81db-9064a8d4e211 type: similar status: test description: Detects non-sysinternals tools setting the "accepteula" key which normally is set on sysinternals tool execution references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-24 modified: 2026-06-29 tags: - attack.resource-development - attack.t1588.002 logsource: product: windows category: registry_set detection: selection: TargetObject|contains: - \PsExec - \ProcDump - \Handle - \LiveKd - \Process Explorer - \PsLoglist - \PsPasswd - \Active Directory Explorer TargetObject|endswith: \EulaAccepted filter_main_image_names: Image|endswith: - \PsExec.exe - \PsExec64.exe - \PsExec64a.exe - \procdump.exe - \procdump64.exe - \procdump64a.exe - \handle.exe - \handle64.exe - \handle64a.exe - \livekd.exe - \livekd64.exe - \procexp.exe - \procexp64.exe - \procexp64a.exe - \psloglist.exe - \psloglist64.exe - \psloglist64a.exe - \pspasswd.exe - \pspasswd64.exe - \pspasswd64a.exe - \ADExplorer.exe - \ADExplorer64.exe - \ADExplorer64a.exe filter_optional_null: Image: null condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unlikely level: high
Query: common weakness: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Matching passage: CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes. The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Near-miss passage: CWE-922 Insecure Storage of Sensitive Information. The product stores sensitive information without properly limiting read or write access by unauthorized actors.
Query: explain CWE-509
Matching passage: CWE-509 Replicating Malicious Code (Virus or Worm). Replicating malicious code, including viruses and worms, will attempt to attack other systems once it has successfully compromised the target system or the product.
Near-miss passage: CWE-506 Embedded Malicious Code. The product contains code that appears to be malicious in nature.
Query: patch priority for CVE-2015-7195
Matching passage: CVE-2015-7195. CWE: CWE-200. CVSS: 5.0. The URL parsing implementation in Mozilla Firefox before 42.0 improperly recognizes escaped characters in hostnames within Location headers, which allows remote attackers to obtain sensitive information via vectors involving a redirect.
Near-miss passage: CVE-2015-4989. CWE: CWE-200. CVSS: 3.700000047683716. The portal in IBM Tealeaf Customer Experience before 8.7.1.8814, 8.8 before 8.8.0.9026, 9.0.0, 9.0.0A, 9.0.1 before 9.0.1.1083, 9.0.1A before 9.0.1.5073, 9.0.2 before 9.0.2.1095, and 9.0.2A before 9.0.2.5144 allows remote attackers to read arbitrary charts by specifying an internal chart name.
Query: explain CWE-1046
Matching passage: CWE-1046 Creation of Immutable Text Using String Concatenation. The product creates an immutable text string using string concatenation operations.
Near-miss passage: CWE-1055 Multiple Inheritance from Concrete Classes. The product contains a class with inheritance from more than one concrete class.
Query: vulnerability: index.php in LEMON-S PHP Simple Oekaki BBS before 1.21 allows remote attackers to delete arbitrary files via the oekakis parameter.
Matching passage: CVE-2015-2970. CWE: CWE-22. CVSS: 6.400000095367432. index.php in LEMON-S PHP Simple Oekaki BBS before 1.21 allows remote attackers to delete arbitrary files via the oekakis parameter.
Near-miss passage: CVE-2015-5313. CWE: CWE-22. CVSS: 2.5. Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are in effect, allows local users with storage_vol:create ACL but not domain:write permission to write to arbitrary files via a .. (dot dot) in a volume name.
Query: explain CWE-1236
Matching passage: CWE-1236 Improper Neutralization of Formula Elements in a CSV File. The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Near-miss passage: CWE-1069 Empty Exception Block. An invokable code block contains an exception handling block that does not contain any code, i.e. is empty.
Query: risk of The enrol_meta_sync function in enrol/meta/locallib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users 
Matching passage: CVE-2015-5266. CWE: CWE-264. CVSS: 6.800000190734863. The enrol_meta_sync function in enrol/meta/locallib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to obtain manager privileges in opportunistic circumstances by leveraging incorrect role processing during a long-running sync script.
Near-miss passage: CVE-2015-8482. CWE: CWE-264. CVSS: 2.0999999046325684. Blue Coat Unified Agent before 4.6.2 does not prevent modification of its configuration files when running in local enforcement mode, which allows local administrators to unblock categories or disable the agent via unspecified vectors.
Query: indicators of Data Encoding
Matching passage: T1132 Data Encoding. Tactics: command and control. Description: Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.(Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.
Near-miss passage: T1132.001 Standard Encoding. Tactics: command and control. Description: Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system that adheres to existing protocol specifications. Common data encoding schemes include ASCII, Unicode, hexadecimal, Base64, and MIME.(Citation: Wikipedia Binary-to-text Encoding)(Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.
Query: hunt for Steal or Forge Kerberos Tickets activity
Matching passage: T1558 Steal or Forge Kerberos Tickets. Tactics: credential access. Description: Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder) Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access. On Windows, the built-in <code>klist</code> utility can be used to list and analyze cached Kerberos tickets.(Citation: Microsoft Klist)
Near-miss passage: T1558.002 Silver Ticket. Tactics: credential access. Description: Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets.(Citation: ADSecurity Silver Tickets) Silver tickets are more limited in scope in than golden tickets in that they only enable adversaries to access a particular resource (e.g. MSSQL) and the system that hosts the resource; however, unlike golden tickets, adversaries with the ability to forge silver tickets are able to create TGS tickets without interacting with the Key Distribution Center (KDC), potentially making detection more difficult.(Citation: ADSecurity Detecting Forged Tickets) Password hashes for target services may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).
Query: describe CVE-2015-5167
Matching passage: CVE-2015-5167. CWE: CWE-264. CVSS: 6.5. The Policy Admin Tool in Apache Ranger before 0.5.1 allows remote authenticated users to bypass intended access restrictions via the REST API.
Near-miss passage: CVE-2015-8951. CWE: CWE-264. CVSS: 7.800000190734863. Multiple use-after-free vulnerabilities in sound/soc/msm/qdsp6v2/msm-lsm-client.c in the Qualcomm sound driver in Android before 2016-10-05 on Nexus 5X, Nexus 6P, and Android One devices allow attackers to gain privileges via a crafted application, aka Android internal bug 30142668 and Qualcomm internal bug CR 948902.
Query: patch priority for CVE-2015-3253
Matching passage: CVE-2015-3253. CWE: CWE-74. CVSS: 9.800000190734863. The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
Near-miss passage: CVE-2015-3154. CWE: CWE-74. CVSS: 6.099999904632568. CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
Query: detection rule: Detects strings used in command execution in DNS TXT Answer
Matching passage: Sigma rule: Detects strings used in command execution in DNS TXT Answer. Logsource: dns. Rule: title: DNS TXT Answer with Possible Execution Strings id: 8ae51330-899c-4641-8125-e39f2e07da72 status: test description: Detects strings used in command execution in DNS TXT Answer references: - https://twitter.com/stvemillertime/status/1024707932447854592 - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Backdoors/DNS_TXT_Pwnage.ps1 author: Markus Neis date: 2018-08-08 modified: 2021-11-27 tags: - attack.command-and-control - attack.t1071.004 logsource: category: dns detection: selection: record_type: TXT answer|contains: - IEX - Invoke-Expression - cmd.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting. Logsource: windows / process_creation. Rule: title: Windows Recall Feature Enabled Via Reg.EXE id: 817f252c-5143-4dae-b418-48c3e9f63728 related: - id: 5dfc1465-8f65-4fde-8eb5-6194380c6a62 type: similar - id: 75180c5f-4ea1-461a-a4f6-6e4700c065d4 type: similar status: test description: 'Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" value, or setting it to 0. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary. ' references: - https://learn.microsoft.com/en-us/windows/client-management/manage-recall - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis author: Sajid Nawaz Khan date: 2024-06-02 tags: - attack.collection - attack.t1113 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_value: CommandLine|contains|all: - Microsoft\Windows\WindowsAI - DisableAIDataAnalysis selection_action_add: CommandLine|contains: - add - '0' selection_action_delete: CommandLine|contains: delete condition: selection_img and selection_value and 1 of selection_action_* falsepositives: - Legitimate use/activation of Windows Recall level: medium
Query: describe CVE-2015-8536
Matching passage: CVE-2015-8536. CWE: CWE-352. CVSS: 8.800000190734863. MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was discovered (fixed and publicly disclosed in 2015) in Lenovo Solution Center (LSC) prior to version 3.3.002 that could allow cross-site request forgery.
Near-miss passage: CVE-2015-9445. CWE: CWE-352. CVSS: 8.800000190734863. The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation.
Query: patch priority for CVE-2015-5892
Matching passage: CVE-2015-5892. CWE: CWE-200. CVSS: 2.0999999046325684. Siri in Apple iOS before 9 allows physically proximate attackers to bypass an intended client-side protection mechanism and obtain sensitive content-notification information by listening to a device in the lock-screen state.
Near-miss passage: CVE-2015-3711. CWE: CWE-200. CVSS: 4.300000190734863. The NTFS implementation in Apple OS X before 10.10.4 allows attackers to obtain sensitive memory-layout information for the kernel via a crafted app.
Query: exploit Use-after-free vulnerability in Decoder.cpp in libpgf before 6.15.32.
Matching passage: CVE-2015-6673. CWE: CWE-416. CVSS: 9.800000190734863. Use-after-free vulnerability in Decoder.cpp in libpgf before 6.15.32.
Near-miss passage: CVE-2015-6042. CWE: CWE-416. CVSS: 9.300000190734863. Use-after-free vulnerability in the CWindow object implementation in Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Query: risk of Cisco WebEx Meeting Center does not properly restrict the content of URLs, which allows remote attackers to obtain sensitive information via vectors related to file: URIs, aka Bug 
Matching passage: CVE-2015-0583. CWE: CWE-200. CVSS: 5.0. Cisco WebEx Meeting Center does not properly restrict the content of URLs, which allows remote attackers to obtain sensitive information via vectors related to file: URIs, aka Bug ID CSCus18281.
Near-miss passage: CVE-2015-1828. CWE: CWE-200. CVSS: 5.900000095367432. The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.