alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attack
Matching passage: Sigma rule: Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attack. Logsource: windows / process_creation. Rule: title: Loaded Module Enumeration Via Tasklist.EXE id: 34275eb8-fa19-436b-b959-3d9ecd53fa1f status: test description: 'Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question. In order to dump the process memory or perform other nefarious actions. ' references: - https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/ - https://pentestlab.blog/tag/svchost/ author: Swachchhanda Shrawan Poudel date: 2024-02-12 modified: 2024-03-13 tags: - attack.t1003 - attack.credential-access logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \tasklist.exe - OriginalFileName: tasklist.exe selection_flags: CommandLine|contains|windash: -m selection_module: CommandLine|contains: rdpcorets.dll condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects a suspicious RDP session redirect using tscon.exe. Logsource: windows / process_creation. Rule: title: Suspicious RDP Redirect Using TSCON id: f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb status: test description: Detects a suspicious RDP session redirect using tscon.exe references: - http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html - https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6 - https://www.hackingarticles.in/rdp-session-hijacking-with-tscon/ author: Florian Roth (Nextron Systems) date: 2018-03-17 modified: 2023-05-16 tags: - attack.lateral-movement - attack.t1563.002 - attack.t1021.001 - car.2013-07-002 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: ' /dest:rdp-tcp#' condition: selection falsepositives: - Unknown level: high
Query: exploit Pydio (formerly AjaXplorer) before 6.0.7 allows remote attackers to execute arbitrary commands via unspecified vectors, aka "Pydio OS Command Injection Vulnerabilities."
Matching passage: CVE-2015-3431. CWE: CWE-78. CVSS: 9.800000190734863. Pydio (formerly AjaXplorer) before 6.0.7 allows remote attackers to execute arbitrary commands via unspecified vectors, aka "Pydio OS Command Injection Vulnerabilities."
Near-miss passage: CVE-2015-7698. CWE: CWE-78. CVSS: 9.0. icewind1991 SMB before 1.0.3 allows remote authenticated users to execute arbitrary SMB commands via shell metacharacters in the user argument in the (1) listShares function in Server.php or the (2) connect or (3) read function in Share.php.
Query: exploit The AirPDcapPacketProcess function in epan/crypt/airpdcap.c in the 802.11 dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the relationship betw
Matching passage: CVE-2015-8723. CWE: CWE-20. CVSS: 5.5. The AirPDcapPacketProcess function in epan/crypt/airpdcap.c in the 802.11 dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the relationship between the total length and the capture length, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet.
Near-miss passage: CVE-2015-4327. CWE: CWE-20. CVSS: 7.199999809265137. The CLI in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to obtain root privileges by writing script arguments to an unspecified file, aka Bug ID CSCuv12542.
Query: Sigma rule for Executes arbitrary PowerShell code using SyncAppvPublishingServer.vbs
Matching passage: Sigma rule: Executes arbitrary PowerShell code using SyncAppvPublishingServer.vbs. Logsource: windows / process_creation. Rule: title: SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code id: 36475a7d-0f6d-4dce-9b01-6aeb473bbaf1 status: test description: Executes arbitrary PowerShell code using SyncAppvPublishingServer.vbs references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1216/T1216.md - https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/ author: frack113 date: 2021-07-16 modified: 2022-06-22 tags: - attack.stealth - attack.t1218 - attack.t1216 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - \SyncAppvPublishingServer.vbs - ; condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module. Logsource: windows / process_creation. Rule: title: Rundll32 Execution Without Parameters id: 5bb68627-3198-40ca-b458-49f973db8752 status: test description: Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module references: - https://bczyz1.github.io/2021/01/30/psexec.html author: Bartlomiej Czyz, Relativity date: 2021-01-31 modified: 2023-02-28 tags: - attack.lateral-movement - attack.t1021.002 - attack.t1570 - attack.execution - attack.t1569.002 logsource: category: process_creation product: windows detection: selection: CommandLine: - rundll32.exe - rundll32 condition: selection falsepositives: - False positives may occur if a user called rundll32 from CLI with no options level: high
Query: CVE similar to CVE-2015-5327
Matching passage: CVE-2015-5327. CWE: CWE-125. CVSS: 6.5. Out-of-bounds memory read in the x509_decode_time function in x509_cert_parser.c in Linux kernels 4.3-rc1 and after.
Near-miss passage: CVE-2015-8743. CWE: CWE-125. CVSS: 7.099999904632568. QEMU (aka Quick Emulator) built with the NE2000 device emulation support is vulnerable to an OOB r/w access issue. It could occur while performing 'ioport' r/w operations. A privileged (CAP_SYS_RAWIO) user/process could use this flaw to leak or corrupt QEMU memory bytes.
Query: vulnerability: Improper handling of LDAP authentication in MongoDB Server versions 3.0.0 to 3.0.6 allows an unauthenticated client to gain unauthorized access.
Matching passage: CVE-2015-7882. CWE: CWE-287. CVSS: 8.100000381469727. Improper handling of LDAP authentication in MongoDB Server versions 3.0.0 to 3.0.6 allows an unauthenticated client to gain unauthorized access.
Near-miss passage: CVE-2015-2033. CWE: CWE-287. CVSS: 10.0. Anyterm Daemon in Infoblox Network Automation NetMRI before NETMRI-23483 allows remote attackers to execute arbitrary commands with root privileges via a crafted terminal/anyterm-module request.
Query: CVE similar to CVE-2015-1804
Matching passage: CVE-2015-1804. CWE: CWE-189. CVSS: 8.5. The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly perform type conversion for metrics values, which allows remote authenticated users to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via a crafted BDF font file.
Near-miss passage: CVE-2015-8891. CWE: CWE-189. CVSS: 7.800000190734863. Multiple integer overflows in app/aboot/aboot.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices allow attackers to bypass intended access restrictions via a crafted image, aka Android internal bug 28842418 and Qualcomm internal bug CR813930.
Query: risk of Siemens SIMATIC STEP 7 (TIA Portal) 12 and 13 before 13 SP1 Upd1 allows man-in-the-middle attackers to obtain sensitive information or modify transmitted data via unspecified vecto
Matching passage: CVE-2015-1601. CWE: CWE-254. CVSS: 6.800000190734863. Siemens SIMATIC STEP 7 (TIA Portal) 12 and 13 before 13 SP1 Upd1 allows man-in-the-middle attackers to obtain sensitive information or modify transmitted data via unspecified vectors.
Near-miss passage: CVE-2015-9331. CWE: CWE-254. CVSS: 7.5. The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.
Query: exploit Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."
Matching passage: CVE-2015-0227. CWE: CWE-264. CVSS: 5.0. Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."
Near-miss passage: CVE-2015-3181. CWE: CWE-264. CVSS: 4.0. files/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not consider the moodle/user:manageownfiles capability before approving a private-file upload, which allows remote authenticated users to bypass intended file-management restrictions by using web services to perform uploads after this capability has been revoked.
Query: CWE for Comparison Using Wrong Factors
Matching passage: CWE-1025 Comparison Using Wrong Factors. The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses.
Near-miss passage: CWE-304 Missing Critical Step in Authentication. The product implements an authentication technique, but it skips a step that weakens the technique.
Query: write Sigma for Detects an uncommon parent process of "LINK.EXE". Link.EXE in Microsoft incremental linker. Its a utility usually bundle
Matching passage: Sigma rule: Detects an uncommon parent process of "LINK.EXE". Link.EXE in Microsoft incremental linker. Its a utility usually bundle. Logsource: windows / process_creation. Rule: title: Uncommon Link.EXE Parent Process id: 6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6 status: test description: 'Detects an uncommon parent process of "LINK.EXE". Link.EXE in Microsoft incremental linker. Its a utility usually bundled with Visual Studio installation. Multiple utilities often found in the same folder (editbin.exe, dumpbin.exe, lib.exe, etc) have a hardcode call to the "LINK.EXE" binary without checking its validity. This would allow an attacker to sideload any binary with the name "link.exe" if one of the aforementioned tools get executed from a different location. By filtering the known locations of such utilities we can spot uncommon parent process of LINK.EXE that might be suspicious or malicious. ' references: - https://twitter.com/0gtweet/status/1560732860935729152 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-22 modified: 2024-06-27 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: Image|endswith: \link.exe CommandLine|contains: LINK / filter_main_visual_studio: ParentImage|startswith: - C:\Program Files\Microsoft Visual Studio\ - C:\Program Files (x86)\Microsoft Visual Studio\ ParentImage|contains: - \VC\bin\ - \VC\Tools\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects WebDav DownloadCradle. Logsource: proxy. Rule: title: Windows WebDAV User Agent id: e09aed7a-09e0-4c9a-90dd-f0d52507347e status: test description: Detects WebDav DownloadCradle references: - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html author: Florian Roth (Nextron Systems) date: 2018-04-06 modified: 2021-11-27 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent|startswith: Microsoft-WebDAV-MiniRedir/ cs-method: GET condition: selection falsepositives: - Administrative scripts that download files from the Internet - Administrative scripts that retrieve certain website contents - Legitimate WebDAV administration level: high
Query: exploit Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix4, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated 
Matching passage: CVE-2015-0128. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix4, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-0124.
Near-miss passage: CVE-2015-5720. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in the template-creation feature in Malware Information Sharing Platform (MISP) before 2.3.90 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) add.ctp, (2) edit.ctp, and (3) ajaxification.js.
Query: Outbound C2 pattern associated with Startup Items
Matching passage: T1037.005 Startup Items. Tactics: persistence, privilege escalation. Description: Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.(Citation: Startup Items) This is technically a deprecated technology (superseded by [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)), and thus the appropriate folder, <code>/Library/StartupItems</code> isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. A startup item is a directory whose executable and configuration property list (plist), <code>StartupParameters.plist</code>, reside in the top-level directory. An adversary can create the appropriate folders/files in the StartupItems directory to register their own persistence mechanism.(Citation: Methods of Mac Malware Persistence) Additionally, since StartupItems run during the bootup phase of macOS, they will run as the elevated root user.
Near-miss passage: T1037.002 Login Hook. Tactics: persistence, privilege escalation. Description: Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that points to a specific script to execute with root privileges upon user logon. The plist file is located in the <code>/Library/Preferences/com.apple.loginwindow.plist</code> file and can be modified using the <code>defaults</code> command-line utility. This behavior is the same for logout hooks where a script can be executed upon user logout. All hooks require administrator permissions to modify or create hooks.(Citation: Login Scripts Apple Dev)(Citation: LoginWindowScripts Apple Dev) Adversaries can add or insert a path to a malicious script in the <code>com.apple.loginwindow.plist</code> file, using the <code>LoginHook</code> or <code>LogoutHook</code> key-value pair. The malicious script is executed upon the next user login. If a login hook already exists, adversaries can add additional commands to an existing login hook. There can be only one login and logout hook on a system at a time.(Citation: S1 macOs Persistence)(Citation: Wardle Persistence Chapter) **Note:** Login hooks were deprecated in 10.11 version of macOS in favor of [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001)
Query: risk of The Adways Party Track SDK before 1.6.6 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive 
Matching passage: CVE-2015-5655. CWE: CWE-310. CVSS: 5.800000190734863. The Adways Party Track SDK before 1.6.6 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Near-miss passage: CVE-2015-0941. CWE: CWE-310. CVSS: 4.300000190734863. The Inetc plugin for Nullsoft Scriptable Install System (NSIS), as used in CERT/CC Failure Observation Engine (FOE) and other products, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and possibly execute arbitrary code by sending a crafted certificate in a download session for Windows executable files.
Query: describe CVE-2015-8358
Matching passage: CVE-2015-8358. CWE: CWE-22. CVSS: 9.0. Directory traversal vulnerability in the bitrix.mpbuilder module before 1.0.12 for Bitrix allows remote administrators to include and execute arbitrary local files via a .. (dot dot) in the element name of the "work" array parameter to admin/bitrix.mpbuilder_step2.php.
Near-miss passage: CVE-2015-7669. CWE: CWE-22. CVSS: 9.800000190734863. Multiple directory traversal vulnerabilities in (1) includes/MapImportCSV2.php and (2) includes/MapImportCSV.php in the Easy2Map plugin before 1.3.0 for WordPress allow remote attackers to include and execute arbitrary files via the csvfile parameter related to "upload file functionality."
Query: rule covering Detects potential process patterns related to Cobalt Strike beacon activity
Matching passage: Sigma rule: Detects potential process patterns related to Cobalt Strike beacon activity. Logsource: windows / process_creation. Rule: title: Potential CobaltStrike Process Patterns id: f35c5d71-b489-4e22-a115-f003df287317 status: test description: Detects potential process patterns related to Cobalt Strike beacon activity references: - https://hausec.com/2021/07/26/cobalt-strike-and-tradecraft/ - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-07-27 modified: 2023-03-29 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_generic_1: CommandLine|endswith: cmd.exe /C whoami ParentImage|startswith: C:\Temp\ selection_generic_2: ParentImage|endswith: - \runonce.exe - \dllhost.exe CommandLine|contains|all: - cmd.exe /c echo - '> \\\\.\\pipe' selection_conhost_1: ParentCommandLine|contains|all: - cmd.exe /C echo - ' > \\\\.\\pipe' CommandLine|endswith: conhost.exe 0xffffffff -ForceV1 selection_conhost_2: ParentCommandLine|endswith: /C whoami CommandLine|endswith: conhost.exe 0xffffffff -ForceV1 condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation. Logsource: windows / process_creation. Rule: title: Powershell Token Obfuscation - Process Creation id: deb9b646-a508-44ee-b7c9-d8965921c6b6 related: - id: f3a98ce4-6164-4dd4-867c-4d83de7eca51 type: similar status: test description: Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation references: - https://github.com/danielbohannon/Invoke-Obfuscation author: frack113 date: 2022-12-27 modified: 2026-03-16 tags: - attack.stealth - attack.t1027.009 logsource: category: process_creation product: windows detection: selection: - CommandLine|re: \w+`(?:\w+|-|.)`[\w+|\s] - CommandLine|re: '"(?:\{\d\})+"\s*-f' - CommandLine|re: (?i)\$\{`?e`?n`?v`?:`?p`?a`?t`?h`?\} filter_main_envpath: CommandLine|contains: ${env:path} condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-9422
Matching passage: CVE-2015-9422. CWE: CWE-352. CVSS: 6.5. The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load plugnedit_width, pnemedcount, PlugneditBGColor, PlugneditEditorMargin, or plugneditcontent parameters.
Near-miss passage: CVE-2015-1391. CWE: CWE-352. CVSS: 8.800000190734863. Aruba AirWave before 8.0.7 allows bypass of a CSRF protection mechanism.
Query: risk of conntrackd in conntrack-tools 1.4.2 and earlier does not ensure that the optional kernel modules are loaded before using them, which allows remote attackers to cause a denial of se
Matching passage: CVE-2015-6496. CWE: CWE-17. CVSS: 5.0. conntrackd in conntrack-tools 1.4.2 and earlier does not ensure that the optional kernel modules are loaded before using them, which allows remote attackers to cause a denial of service (crash) via a (1) DCCP, (2) SCTP, or (3) ICMPv6 packet.
Near-miss passage: CVE-2015-5605. CWE: CWE-17. CVSS: 5.0. The regular-expression implementation in Google V8, as used in Google Chrome before 44.0.2403.89, mishandles interrupts, which allows remote attackers to cause a denial of service (application crash) via crafted JavaScript code, as demonstrated by an error in garbage collection during allocation of a stack-overflow exception message.
Query: exploit Cross-site scripting (XSS) vulnerability in Nucleus CMS allows remote attackers to inject arbitrary web script or HTML via the title parameter when adding a new item.
Matching passage: CVE-2015-5454. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Nucleus CMS allows remote attackers to inject arbitrary web script or HTML via the title parameter when adding a new item.
Near-miss passage: CVE-2015-1422. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) horder[], (2) jak_catid, (3) jak_content, (4) jak_css, (5) jak_delete_log[], (6) jak_email, (7) jak_extfile, (8) jak_file, (9) jak_hookshow[], (10) jak_img, (11) jak_javascript, (12) jak_lcontent, (13) jak_name, (14) jak_password, (15) jak_showcontact, (16) jak_tags, (17) jak_title, (18) jak_url, (19) jak_username, (20) real_hook_id[], (21) sp, (22) sreal_plugin_id[], (23) ssp, or (24) sssp parameter to admin/index.php or the (25) editor, (26) field_id, (27) fldr, (28) lang, (29) popup, (30) subfolder, or (31) type parameter to js/editor/plugins/filemanager/dialog.php.
Query: patch priority for CVE-2015-10106
Matching passage: CVE-2015-10106. CWE: CWE-89. CVSS: 8.800000190734863. ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in mback2k mh_httpbl Extension up to 1.1.7 on TYPO3. This vulnerability affects the function moduleContent of the file mod1/index.php. The manipulation leads to sql injection. The attack can be initiated remotely. Upgrading to version 1.1.8 is able to address this issue. The patch is identified as 429f50f4e4795b20dae06735b41fb94f010722bf. It is recommended to upgrade the affected component. VDB-230086 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Near-miss passage: CVE-2015-1441. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Piwigo before 2.5.6, 2.6.x before 2.6.5, and 2.7.x before 2.7.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.