alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for azure / riskdetection
Matching passage: Sigma rule: Indicates sign-in from a malicious IP address based on high failure rates.. Logsource: azure / riskdetection. Rule: title: Malicious IP Address Sign-In Failure Rate id: a3f55ebd-0c01-4ed6-adc0-8fb76d8cd3cd status: test description: Indicates sign-in from a malicious IP address based on high failure rates. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malicious-ip-address - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-07 tags: - attack.t1090 - attack.command-and-control logsource: product: azure service: riskdetection detection: selection: riskEventType: maliciousIPAddress condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Near-miss passage: Sigma rule: Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic ev. Logsource: windows / file_delete. Rule: title: Exchange PowerShell Cmdlet History Deleted id: a55349d8-9588-4c5a-8e3b-1925fe2a4ffe status: test description: Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence references: - https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-26 modified: 2022-12-30 tags: - attack.stealth - attack.t1070 logsource: category: file_delete product: windows detection: selection: TargetFilename|startswith: \Logging\CmdletInfra\LocalPowerShell\Cmdlet\ TargetFilename|contains: _Cmdlet_ condition: selection falsepositives: - Possible FP during log rotation level: high
Query: vulnerability: Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.
Matching passage: CVE-2015-1923. CWE: CWE-119. CVSS: 7.800000190734863. Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.
Near-miss passage: CVE-2015-0292. CWE: CWE-119. CVSS: 7.5. Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow.
Query: risk of The Secure Meeting (Pulse Collaboration) in Pulse Connect Secure (formerly Juniper Junos Pulse) before 7.1R22.1, 7.4, 8.0 before 8.0R11, and 8.1 before 8.1R3 allows remote authenti
Matching passage: CVE-2015-7323. CWE: CWE-264. CVSS: 3.5. The Secure Meeting (Pulse Collaboration) in Pulse Connect Secure (formerly Juniper Junos Pulse) before 7.1R22.1, 7.4, 8.0 before 8.0R11, and 8.1 before 8.1R3 allows remote authenticated users to bypass intended access restrictions and log into arbitrary meetings by leveraging a meeting id and meetingAppSun.jar.
Near-miss passage: CVE-2015-0692. CWE: CWE-264. CVSS: 7.199999809265137. Cisco Web Security Appliance (WSA) devices with software 8.5.0-ise-147 do not properly restrict use of the pickle Python module during certain tunnel-status checks, which allows local users to execute arbitrary Python code and gain privileges via crafted serialized objects, aka Bug ID CSCut39230.
Query: weakness Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element
Matching passage: CWE-1058 Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element. The code contains a function or method that operates in a multi-threaded environment but owns an unsafe non-final static storable or member data element.
Near-miss passage: CWE-64 Windows Shortcut Following (.LNK). The product, when opening a file or directory, does not sufficiently handle when the file is a Windows shortcut (.LNK) whose target is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
Query: explain CWE-555
Matching passage: CWE-555 J2EE Misconfiguration: Plaintext Password in Configuration File. The J2EE application stores a plaintext password in a configuration file.
Near-miss passage: CWE-1312 Missing Protection for Mirrored Regions in On-Chip Fabric Firewall. The firewall in an on-chip fabric protects the main addressed region, but it does not protect any mirrored memory or memory-mapped-IO (MMIO) regions.
Query: detection rule: It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious pr
Matching passage: Sigma rule: It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious pr. Logsource: windows / process_creation. Rule: title: Suspect Svchost Activity id: 16c37b52-b141-42a5-a3ea-bbe098444397 status: test description: It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space. references: - https://web.archive.org/web/20180718061628/https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2 author: David Burkett, @signalblur date: 2019-12-28 modified: 2022-06-27 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: category: process_creation product: windows detection: selection: CommandLine|endswith: svchost.exe Image|endswith: \svchost.exe filter: - ParentImage|endswith: - \rpcnet.exe - \rpcnetp.exe - CommandLine: null condition: selection and not filter falsepositives: - Rpcnet.exe / rpcnetp.exe which is a lojack style software. https://www.blackhat.com/docs/us-14/materials/us-14-Kamlyuk-Kamluk-Computrace-Backdoor-Revisited.pdf level: high
Near-miss passage: Sigma rule: Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system. Logsource: windows / process_creation. Rule: title: Set Suspicious Files as System Files Using Attrib.EXE id: efec536f-72e8-4656-8960-5e85d091345b related: - id: bb19e94c-59ae-4c15-8c12-c563d23fe52b type: derived status: test description: 'Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system files to hide them from users and make them unable to be deleted with simple rights. The rule limits the search to specific extensions and directories to avoid FPs ' references: - https://app.any.run/tasks/c28cabc8-a19f-40f3-a78b-cae506a5c0d4 - https://app.any.run/tasks/cfc8870b-ccd7-4210-88cf-a8087476a6d0 - https://unit42.paloaltonetworks.com/unit42-sure-ill-take-new-combojack-malware-alters-clipboards-steal-cryptocurrency/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-28 modified: 2023-03-14 tags: - attack.stealth - attack.t1564.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \attrib.exe - OriginalFileName: ATTRIB.EXE selection_cli: CommandLine|contains: ' +s' selection_paths: CommandLine|contains: - ' %' - \Users\Public\ - \AppData\Local\ - \ProgramData\ - \Downloads\ - \Windows\Temp\ selection_ext: CommandLine|contains: - .bat - .dll - .exe - .hta - .ps1 - .vbe - .vbs filter_optional_installer: CommandLine|contains|all: - \Windows\TEMP\ - .exe condition: all of selection* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Query: weakness Only Filtering Special Elements at an Absolute Position
Matching passage: CWE-797 Only Filtering Special Elements at an Absolute Position. The product receives data from an upstream component, but only accounts for special elements at an absolute position (e.g. byte number 10), thereby missing remaining special elements that may exist before sending it to a downstream component.
Near-miss passage: CWE-170 Improper Null Termination. The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.
Query: describe CVE-2015-2068
Matching passage: CVE-2015-2068. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allow remote attackers to inject arbitrary web script or HTML via the (1) profile parameter to web/magmi.php or (2) QUERY_STRING to web/magmi_import_run.php.
Near-miss passage: CVE-2015-4392. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Display Suite module 7.x-2.7 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to field display settings.
Query: patch priority for CVE-2015-8309
Matching passage: CVE-2015-8309. CWE: CWE-22. CVSS: 4.300000190734863. Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download."
Near-miss passage: CVE-2015-9277. CWE: CWE-22. CVSS: 9.100000381469727. MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/.. /" are mishandled.
Query: CWE for Improper Verification of Cryptographic Signature
Matching passage: CWE-347 Improper Verification of Cryptographic Signature. The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Near-miss passage: CWE-274 Improper Handling of Insufficient Privileges. The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.
Query: CVE similar to CVE-2015-6237
Matching passage: CVE-2015-6237. CWE: CWE-287. CVSS: 9.800000190734863. The RPC service in Tripwire (formerly nCircle) IP360 VnE Manager 7.2.2 before 7.2.6 allows remote attackers to bypass authentication and (1) enumerate users, (2) reset passwords, or (3) manipulate IP filter restrictions via crafted "privileged commands."
Near-miss passage: CVE-2015-3442. CWE: CWE-287. CVSS: 9.800000190734863. Soreco Xpert.Line 3.0 allows local users to spoof users and consequently gain privileges by intercepting a Windows API call.
Query: risk of Cross-site scripting (XSS) vulnerability in the administrative backend in Sefrengo before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the searchterm pa
Matching passage: CVE-2015-0918. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the administrative backend in Sefrengo before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the searchterm parameter to backend/main.php.
Near-miss passage: CVE-2015-10101. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability classified as problematic was found in Google Analytics Top Content Widget Plugin up to 1.5.6 on WordPress. Affected by this vulnerability is an unknown functionality of the file class-tgm-plugin-activation.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.5.7 is able to address this issue. The identifier of the patch is 25bb1dea113716200a6f0f3135801d84a7a65540. It is recommended to upgrade the affected component. The identifier VDB-226117 was assigned to this vulnerability.
Query: CVE similar to CVE-2015-2739
Matching passage: CVE-2015-2739. CWE: CWE-119. CVSS: 10.0. The ArrayBufferBuilder::append function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which has unspecified impact and attack vectors.
Near-miss passage: CVE-2015-1689. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1705.
Query: exploit Util.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.15, 4.3.x and 4.4.x before 4.4.10, and 5.x before 5.0.1 mishandles long e-mail addresses during account registration, which allows 
Matching passage: CVE-2015-4499. CWE: CWE-20. CVSS: 7.5. Util.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.15, 4.3.x and 4.4.x before 4.4.10, and 5.x before 5.0.1 mishandles long e-mail addresses during account registration, which allows remote attackers to obtain the default privileges for an arbitrary domain name by placing that name in a substring of an address, as demonstrated by truncation of an @mozilla.com.example.com address to an @mozilla.com address.
Near-miss passage: CVE-2015-2918. CWE: CWE-20. CVSS: 6.099999904632568. The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
Query: patch priority for CVE-2015-5573
Matching passage: CVE-2015-5573. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion."
Near-miss passage: CVE-2015-6707. CWE: UNKNOWN. CVSS: 6.800000190734863. The ANSendForReview method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Query: patch priority for CVE-2015-1496
Matching passage: CVE-2015-1496. CWE: CWE-264. CVSS: 7.199999809265137. Motorola Scanner SDK uses weak permissions for (1) CoreScanner.exe, (2) rsmdriverproviderservice.exe, and (3) ScannerService.exe, which allows local users to gain privileges via unspecified vectors.
Near-miss passage: CVE-2015-9015. CWE: CWE-264. CVSS: 7.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36714120.
Query: write Sigma for Detects issues with Windows Defender Real-Time Protection features
Matching passage: Sigma rule: Detects issues with Windows Defender Real-Time Protection features. Logsource: windows / windefend. Rule: title: Windows Defender Real-Time Protection Failure/Restart id: dd80db93-6ec2-4f4c-a017-ad40da6ffe81 status: stable description: Detects issues with Windows Defender Real-Time Protection features references: - Internal Research - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ - https://gist.github.com/nasbench/33732d6705cbdc712fae356f07666346 author: Nasreddine Bencherchali (Nextron Systems), Christopher Peacock '@securepeacock' (Update) date: 2023-03-28 modified: 2023-05-05 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: - 3002 - 3007 filter_optional_network_inspection: Feature_Name: '%%886' Reason: - '%%892' - '%%858' condition: selection and not 1 of filter_optional_* falsepositives: - Some crashes can occur sometimes and the event doesn't provide enough information to tune out these cases. Manual exception is required level: medium
Near-miss passage: Sigma rule: Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These. Logsource: windows / process_creation. Rule: title: XBAP Execution From Uncommon Locations Via PresentationHost.EXE id: d22e2925-cfd8-463f-96f6-89cec9d9bc5f status: test description: 'Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These files can be abused to run malicious ".xbap" files any bypass AWL ' references: - https://lolbas-project.github.io/lolbas/Binaries/Presentationhost/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-01 modified: 2023-11-09 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \presentationhost.exe - OriginalFileName: PresentationHost.exe selection_cli: CommandLine|contains: .xbap filter_main_generic: CommandLine|contains: - ' C:\Windows\' - ' C:\Program Files' condition: all of selection* and not 1 of filter_main_* falsepositives: - Legitimate ".xbap" being executed via "PresentationHost" level: medium
Query: write Sigma for Detects scheduled task creation events that include suspicious actions, and is run once at 00:00
Matching passage: Sigma rule: Detects scheduled task creation events that include suspicious actions, and is run once at 00:00. Logsource: windows / process_creation. Rule: title: Uncommon One Time Only Scheduled Task At 00:00 id: 970823b7-273b-460a-8afc-3a6811998529 status: test description: Detects scheduled task creation events that include suspicious actions, and is run once at 00:00 references: - https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte author: pH-T (Nextron Systems) date: 2022-07-15 modified: 2023-02-03 tags: - attack.execution - attack.persistence - attack.privilege-escalation - attack.t1053.005 logsource: category: process_creation product: windows detection: selection_img: - Image|contains: \schtasks.exe - OriginalFileName: schtasks.exe selection_cli: CommandLine|contains: - wscript - vbscript - cscript - 'wmic ' - wmic.exe - regsvr32.exe - powershell - \AppData\ selection_time: CommandLine|contains|all: - once - 00:00 condition: all of selection_* falsepositives: - Software installation level: high
Near-miss passage: Sigma rule: This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of. Logsource: windows / process_creation. Rule: title: Detection of PowerShell Execution via Sqlps.exe id: 0152550d-3a26-4efd-9f0e-54a0b28ae2f3 status: test description: 'This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs. ' references: - https://learn.microsoft.com/en-us/sql/tools/sqlps-utility?view=sql-server-ver15 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqlps/ - https://twitter.com/bryon_/status/975835709587075072 author: Agro (@agro_sev) oscd.community date: 2020-10-10 modified: 2022-12-09 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1127 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \sqlps.exe selection_image: - Image|endswith: \sqlps.exe - OriginalFileName: sqlps.exe filter_image: ParentImage|endswith: \sqlagent.exe condition: selection_parent or (selection_image and not filter_image) falsepositives: - Direct PS command execution through SQLPS.exe is uncommon, childprocess sqlps.exe spawned by sqlagent.exe is a legitimate action. level: medium
Query: alert when Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikat
Matching passage: Sigma rule: Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikat. Logsource: windows / process_access. Rule: title: Remote LSASS Process Access Through Windows Remote Management id: aa35a627-33fb-4d04-a165-d33b4afca3e8 status: stable description: Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz. references: - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/ author: Patryk Prauze - ING Tech date: 2019-05-20 modified: 2023-11-29 tags: - attack.credential-access - attack.execution - attack.t1003.001 - attack.t1059.001 - attack.lateral-movement - attack.t1021.006 - attack.s0002 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe SourceImage|endswith: :\Windows\system32\wsmprovhost.exe filter_main_access: GrantedAccess: '0x80000000' condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Via ClassicExplorer32.dll id: caa02837-f659-466f-bca6-48bde2826ab4 status: test description: Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software references: - https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets - https://app.any.run/tasks/6d8cabb0-dcda-44b6-8050-28d6ce281687/ author: frack113 date: 2022-12-13 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection_classicexplorer: ImageLoaded|endswith: \ClassicExplorer32.dll filter_classicexplorer: ImageLoaded|startswith: C:\Program Files\Classic Shell\ condition: selection_classicexplorer and not filter_classicexplorer falsepositives: - Unknown level: medium
Query: describe CVE-2015-0199
Matching passage: CVE-2015-0199. CWE: CWE-399. CVSS: 4.900000095367432. The mmfslinux kernel module in IBM General Parallel File System (GPFS) 3.4 before 3.4.0.32, 3.5 before 3.5.0.24, and 4.1 before 4.1.0.7 allows local users to cause a denial of service (memory corruption) via unspecified character-device ioctl calls.
Near-miss passage: CVE-2015-6269. CWE: CWE-399. CVSS: 7.800000190734863. Cisco IOS XE before 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted (1) IPv4 or (2) IPv6 packet, aka Bug ID CSCsw69990.