alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detect use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file from a directory other than t
Matching passage: Sigma rule: Detect use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file from a directory other than t. Logsource: windows / process_creation. Rule: title: Ie4uinit Lolbin Use From Invalid Path id: d3bf399f-b0cf-4250-8bb4-dfc192ab81dc status: test description: Detect use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file from a directory other than the usual directories references: - https://lolbas-project.github.io/lolbas/Binaries/Ie4uinit/ - https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/ author: frack113 date: 2022-05-07 modified: 2022-05-16 tags: - attack.stealth - attack.t1218 logsource: product: windows category: process_creation detection: lolbin: - Image|endswith: \ie4uinit.exe - OriginalFileName: IE4UINIT.EXE filter_correct: CurrentDirectory: - c:\windows\system32\ - c:\windows\sysWOW64\ filter_missing: CurrentDirectory: null condition: lolbin and not 1 of filter_* falsepositives: - ViberPC updater calls this binary with the following commandline "ie4uinit.exe -ClearIconCache" level: medium
Near-miss passage: Sigma rule: Detects msdt.exe creating files in suspicious directories which could be a sign of exploitation of either Follina or Dog. Logsource: windows / file_event. Rule: title: File Creation In Suspicious Directory By Msdt.EXE id: 318557a5-150c-4c8d-b70e-a9910e199857 status: test description: Detects msdt.exe creating files in suspicious directories which could be a sign of exploitation of either Follina or Dogwalk vulnerabilities references: - https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd - https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/ author: Vadim Varganov, Florian Roth (Nextron Systems) date: 2022-08-24 modified: 2023-02-23 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 - cve.2022-30190 logsource: category: file_event product: windows detection: selection: Image|endswith: \msdt.exe TargetFilename|contains: - \Desktop\ - \Start Menu\Programs\Startup\ - C:\PerfLogs\ - C:\ProgramData\ - C:\Users\Public\ condition: selection falsepositives: - Unknown level: high
Query: vulnerability: Cross-site scripting (XSS) vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote authenticated users to inject arbitrary web scri
Matching passage: CVE-2015-2031. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-8010. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inject arbitrary web script or HTML via the query string to cgi-bin/status.cgi.
Query: rule covering The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules.
Matching passage: Sigma rule: The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules.. Logsource: windows / process_creation. Rule: title: Use of Wfc.exe id: 49be8799-7b4d-4fda-ad23-cafbefdebbc5 status: test description: The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules. references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wfc/ - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io date: 2022-06-01 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \wfc.exe - OriginalFileName: wfc.exe condition: selection falsepositives: - Legitimate use by a software developer level: medium
Near-miss passage: Sigma rule: Detects Silence EmpireDNSAgent as described in the Group-IP report. Logsource: windows / ps_script. Rule: title: Silence.EDA Detection id: 3ceb2083-a27f-449a-be33-14ec1b7cc973 status: test description: Detects Silence EmpireDNSAgent as described in the Group-IP report references: - https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf author: Alina Stepchenkova, Group-IB, oscd.community date: 2019-11-01 modified: 2023-04-03 tags: - attack.execution - attack.t1059.001 - attack.command-and-control - attack.t1071.004 - attack.t1572 - attack.impact - attack.t1529 - attack.g0091 - attack.s0363 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: empire: ScriptBlockText|contains|all: - System.Diagnostics.Process - Stop-Computer - Restart-Computer - Exception in execution - $cmdargs - Close-Dnscat2Tunnel dnscat: ScriptBlockText|contains|all: - set type=$LookupType`nserver - $Command | nslookup 2>&1 | Out-String - New-RandomDNSField - '[Convert]::ToString($SYNOptions, 16)' - $Session.Dead = $True - $Session["Driver"] -eq condition: empire and dnscat falsepositives: - Unknown level: critical
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22). Logsource: windows / process_creation. Rule: title: UAC Bypass Using Consent and Comctl32 - Process id: 1ca6bd18-0ba0-44ca-851c-92ed89a61085 status: test description: Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-23 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \consent.exe Image|endswith: \werfault.exe IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Enumerates Active Directory to determine computers that are joined to the domain. Logsource: windows / ps_script. Rule: title: DirectorySearcher Powershell Exploitation id: 1f6399cf-2c80-4924-ace1-6fcff3393480 status: test description: Enumerates Active Directory to determine computers that are joined to the domain references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md#atomic-test-15---enumerate-domain-computers-within-active-directory-using-directorysearcher author: frack113 date: 2022-02-12 tags: - attack.discovery - attack.t1018 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'New-Object ' - System.DirectoryServices.DirectorySearcher - .PropertiesToLoad.Add - .findall() - Properties.name condition: selection falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-4269
Matching passage: CVE-2015-4269. CWE: CWE-399. CVSS: 4.0. The Tomcat throttling feature in Cisco Unified Communications Manager 10.5(1.99995.9) allows remote authenticated users to cause a denial of service (management outage) by sending many requests, aka Bug ID CSCuu99709.
Near-miss passage: CVE-2015-1744. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1735, CVE-2015-1740, CVE-2015-1745, and CVE-2015-1766.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. It was seen used by BlackCat. Logsource: windows / process_creation. Rule: title: DirLister Execution id: b4dc61f5-6cce-468e-a608-b48b469feaa2 status: test description: Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. It was seen used by BlackCat ransomware to create a list of accessible directories and files. references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1083/T1083.md - https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/ author: frack113 date: 2022-08-20 modified: 2023-02-04 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: DirLister.exe - Image|endswith: \DirLister.exe condition: selection falsepositives: - Legitimate use by users level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_dirlister_execution/info.yml simulation: - type: atomic-red-team name: Launch DirLister Executable technique: T1083 atomic_guid: c5bec457-43c9-4a18-9a24-fe151d8971b7
Near-miss passage: Sigma rule: Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path. The. Logsource: windows / file_event. Rule: title: Registry Hive File Staged Outside Standard User Profile Path id: a7f3c891-2e4d-4b6a-9f8c-d5e2a1b04c73 status: experimental description: 'Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path. These files generally contain various user-specific registry settings and are typically located in the user''s profile directory. Staging these files outside of the standard path can be indicative of an attacker attempting to manipulate user registry settings for persistence, privilege escalation, or dump user registry hives for credential harvesting. ' references: - https://github.com/MSNightmare/LegacyHive - https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-23 tags: - attack.privilege-escalation - attack.t1548 - attack.credential-access - attack.t1003 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - \UsrClass.dat - \NTUSER.DAT filter_main_usrclass: TargetFilename|endswith: \AppData\Local\Microsoft\Windows\UsrClass.dat filter_main_ntuser: TargetFilename|re|i: ^C:\\Users\\[^\\]+\\NTUSER\.DAT$ filter_main_system: TargetFilename|startswith: - C:\Windows\System32\config\ - C:\Windows\SYSVOL\ - C:\Windows\ServiceProfiles\ condition: selection and not 1 of filter_main_* falsepositives: - Backup or profile migration software - Forensic acquisition tools level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_registry_hive_file_creation/info.yml
Query: exploit Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33, allows remote attackers to affect confidentiality via vectors related to JMX.
Matching passage: CVE-2015-2621. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33, allows remote attackers to affect confidentiality via vectors related to JMX.
Near-miss passage: CVE-2015-8833. CWE: UNKNOWN. CVSS: 9.800000190734863. Use-after-free vulnerability in the create_smp_dialog function in gtk-dialog.c in the Off-the-Record Messaging (OTR) pidgin-otr plugin before 4.0.2 for Pidgin allows remote attackers to execute arbitrary code via vectors related to the "Authenticate buddy" menu item.
Query: vulnerability: The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter.
Matching passage: CVE-2015-9467. CWE: CWE-89. CVSS: 9.800000190734863. The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter.
Near-miss passage: CVE-2015-6962. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the web application in Farol allows remote attackers to execute arbitrary SQL commands via the email parameter to tkmonitor/estrutura/login/Login.actions.php.
Query: CWE for Unsigned to Signed Conversion Error
Matching passage: CWE-196 Unsigned to Signed Conversion Error. The product uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value if the value of the unsigned primitive can not be represented using a signed primitive.
Near-miss passage: CWE-1266 Improper Scrubbing of Sensitive Data from Decommissioned Device. The product does not properly provide a capability for the product administrator to remove sensitive data at the time the product is decommissioned. A scrubbing capability could be missing, insufficient, or incorrect.
Query: CVE similar to CVE-2015-3877
Matching passage: CVE-2015-3877. CWE: CWE-119. CVSS: 10.0. Skia, as used in Android before 5.1.1 LMY48T, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 20723696.
Near-miss passage: CVE-2015-6599. CWE: CWE-119. CVSS: 10.0. libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23416608.
Query: adversary uses Authentication Package
Matching passage: T1547.002 Authentication Package. Tactics: persistence, privilege escalation. Description: Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system.(Citation: MSDN Authentication Packages) Adversaries can use the autostart mechanism provided by LSA authentication packages for persistence by placing a reference to a binary in the Windows Registry location <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\</code> with the key value of <code>"Authentication Packages"=&lt;target binary&gt;</code>. The binary will then be executed by the system when the authentication packages are loaded.
Near-miss passage: T1547 Boot or Logon Autostart Execution. Tactics: persistence, privilege escalation. Description: Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming) These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel. Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.
Query: vulnerability: Use-after-free vulnerability in content/browser/appcache/appcache_dispatcher_host.cc in the AppCache implementation in Google Chrome before 47.0.2526.73 allows remote attackers to 
Matching passage: CVE-2015-6767. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in content/browser/appcache/appcache_dispatcher_host.cc in the AppCache implementation in Google Chrome before 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect pointer maintenance associated with certain callbacks.
Near-miss passage: CVE-2015-0477. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity via unknown vectors related to Beans.
Query: vulnerability: The IPTables-Parse module before 1.6 for Perl allows local users to write to arbitrary files owned by the current user.
Matching passage: CVE-2015-8326. CWE: CWE-59. CVSS: 5.5. The IPTables-Parse module before 1.6 for Perl allows local users to write to arbitrary files owned by the current user.
Near-miss passage: CVE-2015-1335. CWE: CWE-59. CVSS: 7.199999809265137. lxc-start in lxc before 1.0.8 and 1.1.x before 1.1.4 allows local container administrators to escape AppArmor confinement via a symlink attack on a (1) mount target or (2) bind mount source.
Query: vulnerability: Use-after-free vulnerability in the StyleAnimationValue class in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 allows remote attackers to hav
Matching passage: CVE-2015-4488. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in the StyleAnimationValue class in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 allows remote attackers to have an unspecified impact by leveraging a StyleAnimationValue::operator self assignment.
Near-miss passage: CVE-2015-2247. CWE: UNKNOWN. CVSS: 8.300000190734863. Unspecified vulnerability in Boosted Boards skateboards allows physically proximate attackers to modify skateboard movement, cause human injury, or cause physical damage via vectors related to an "injection attack" that blocks and hijacks a Bluetooth signal.
Query: patch priority for CVE-2015-1910
Matching passage: CVE-2015-1910. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Reference Data Management component in the server in IBM InfoSphere Master Data Management (MDM) 10.1 before IF1, 11.0 before FP3, and 11.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-1179. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in data_point_details.shtm in Mango Automation 2.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dpid, (2) dpxid, or (3) pid parameter.
Query: vulnerability: The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensiti
Matching passage: CVE-2015-3983. CWE: CWE-310. CVSS: 4.300000190734863. The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. NOTE: this issue was SPLIT from CVE-2015-1848 per ADT2 due to different vulnerability types.
Near-miss passage: CVE-2015-1848. CWE: CWE-310. CVSS: 6.800000190734863. The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2015-3983 is for the issue with not setting the HTTPOnly flag.
Query: rule covering Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.
Matching passage: Sigma rule: Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.. Logsource: windows / process_creation. Rule: title: File Download Using Notepad++ GUP Utility id: 44143844-0631-49ab-97a0-96387d6b2d7c status: test description: Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files. references: - https://twitter.com/nas_bench/status/1535322182863179776 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-10 modified: 2023-03-02 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \GUP.exe - OriginalFileName: gup.exe selection_cli: CommandLine|contains|all: - ' -unzipTo ' - http filter: ParentImage|endswith: \notepad++.exe condition: all of selection* and not filter falsepositives: - Other parent processes other than notepad++ using GUP that are not currently identified level: high
Near-miss passage: Sigma rule: Show when private keys are being exported from the device, or when new certificates are installed. Logsource: cisco / aaa. Rule: title: Cisco Crypto Commands id: 1f978c6a-4415-47fb-aca5-736a44d7ca3d status: test description: Show when private keys are being exported from the device, or when new certificates are installed references: - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-cr-book/sec-a1-cr-book_chapter_0111.html author: Austin Clark date: 2019-08-12 modified: 2023-01-04 tags: - attack.credential-access - attack.defense-impairment - attack.t1553.004 - attack.t1552.004 logsource: product: cisco service: aaa detection: keywords: - crypto pki export - crypto pki import - crypto pki trustpoint condition: keywords falsepositives: - Not commonly run by administrators. Also whitelist your known good certificates level: high
Query: patch priority for CVE-2015-5315
Matching passage: CVE-2015-5315. CWE: CWE-119. CVSS: 5.900000095367432. The eap_pwd_process function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6 does not validate that the reassembly buffer is large enough for the final fragment when EAP-pwd is enabled in a network configuration profile, which allows remote attackers to cause a denial of service (process termination) via a large final fragment in an EAP-pwd message.
Near-miss passage: CVE-2015-2666. CWE: CWE-119. CVSS: 6.900000095367432. Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to the initrd.
Query: risk of Directory traversal vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.4 allows remote administrators to read arbitrary files via unspecified vectors.
Matching passage: CVE-2015-1551. CWE: CWE-264. CVSS: 4.0. Directory traversal vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.4 allows remote administrators to read arbitrary files via unspecified vectors.
Near-miss passage: CVE-2015-7031. CWE: CWE-264. CVSS: 5.0. The Web Service component in Apple OS X Server before 5.0.15 omits an unspecified HTTP header configuration, which allows remote attackers to bypass intended access restrictions via unknown vectors.
Query: vulnerability: Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before
Matching passage: CVE-2015-8126. CWE: CWE-120. CVSS: 7.5. Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.
Near-miss passage: CVE-2015-7854. CWE: CWE-120. CVSS: 8.800000190734863. Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted key file.