alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects the use of the filename DumpStack.log to evade Microsoft Defender
Matching passage: Sigma rule: Detects the use of the filename DumpStack.log to evade Microsoft Defender. Logsource: windows / process_creation. Rule: title: DumpStack.log Defender Evasion id: 4f647cfa-b598-4e12-ad69-c68dd16caef8 status: test description: Detects the use of the filename DumpStack.log to evade Microsoft Defender references: - https://twitter.com/mrd0x/status/1479094189048713219 author: Florian Roth (Nextron Systems) date: 2022-01-06 modified: 2022-06-17 tags: - attack.defense-impairment logsource: category: process_creation product: windows detection: selection: Image|endswith: \DumpStack.log selection_download: CommandLine|contains: ' -o DumpStack.log' condition: 1 of selection* falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects execution of Sysinternals tools via an AppX package. Attackers could install the Sysinternals Suite to get acces. Logsource: windows / appmodel-runtime. Rule: title: Sysinternals Tools AppX Versions Execution id: d29a20b2-be4b-4827-81f2-3d8a59eab5fc status: test description: 'Detects execution of Sysinternals tools via an AppX package. Attackers could install the Sysinternals Suite to get access to tools such as psexec and procdump to avoid detection based on System paths. ' references: - https://learn.microsoft.com/en-us/sysinternals/downloads/microsoft-store author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-16 modified: 2023-09-12 tags: - attack.execution - attack.stealth logsource: product: windows service: appmodel-runtime detection: selection: EventID: 201 ImageName: - procdump.exe - psloglist.exe - psexec.exe - livekd.exe - ADExplorer.exe condition: selection falsepositives: - Legitimate usage of sysinternals applications from the Windows Store will trigger this. Apply exclusions as needed. level: low
Query: risk of In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9615, MDM9625, MDM9640, MDM9650, MDM965
Matching passage: CVE-2015-9143. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9615, MDM9625, MDM9640, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 600, SD 615/16/SD 415, and SDX20, when reading CDT from eMMC with a very large meta offset (>size of default CDT-array compiled in bootloader) for one of the CDBs, a buffer overflow occurs.
Near-miss passage: CVE-2015-7199. CWE: CWE-119. CVSS: 7.5. The (1) AddWeightedPathSegLists and (2) SVGPathSegListSMILType::Interpolate functions in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 lack status checking, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted SVG document.
Query: exploit The GIF encoder in Byzanz allows remote attackers to cause a denial of service (out-of-bounds heap write and crash) or possibly execute arbitrary code via a crafted Byzanz debug da
Matching passage: CVE-2015-2785. CWE: CWE-119. CVSS: 7.5. The GIF encoder in Byzanz allows remote attackers to cause a denial of service (out-of-bounds heap write and crash) or possibly execute arbitrary code via a crafted Byzanz debug data recording (ByzanzRecording file) to the byzanz-playback command.
Near-miss passage: CVE-2015-9036. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, an incorrect length is used to clear a memory buffer resulting in adjacent memory getting corrupted.
Query: detection rule: Detects the creation of potentially suspicious files by OpenEDR's ITSMService process. The ITSMService is responsible fo
Matching passage: Sigma rule: Detects the creation of potentially suspicious files by OpenEDR's ITSMService process. The ITSMService is responsible fo. Logsource: windows / file_event. Rule: title: Potentially Suspicious File Creation by OpenEDR's ITSMService id: 9e4b7d3a-6f2c-4e9a-8d1b-3c5e7a9f2b4d status: experimental description: 'Detects the creation of potentially suspicious files by OpenEDR''s ITSMService process. The ITSMService is responsible for remote management operations and can create files on the system through the Process Explorer or file management features. While legitimate for IT operations, creation of executable or script files could indicate unauthorized file uploads, data staging, or malicious file deployment. ' author: '@kostastsale' date: 2026-02-19 references: - https://kostas-ts.medium.com/detecting-abuse-of-openedrs-permissive-edr-trial-a-security-researcher-s-perspective-fc55bf53972c tags: - attack.command-and-control - attack.t1105 - attack.lateral-movement - attack.t1570 - attack.t1219 logsource: product: windows category: file_event detection: selection_process: Image|endswith: \COMODO\Endpoint Manager\ITSMService.exe selection_suspicious_extensions: TargetFilename|endswith: - .7z - .bat - .cmd - .com - .dll - .exe - .hta - .js - .pif - .ps1 - .rar - .scr - .vbe - .vbs - .zip condition: all of selection_* falsepositives: - Legitimate OpenEDR file management operations - Authorized remote file uploads by IT administrators - Software deployment through OpenEDR console level: medium
Near-miss passage: Sigma rule: Detects changes to the "MaxMpxCt" registry value. MaxMpxCt specifies the maximum outstanding network requests for the se. Logsource: windows / registry_set. Rule: title: MaxMpxCt Registry Value Changed id: 0e6a9e62-627e-496c-aef5-bfa39da29b5e status: test description: 'Detects changes to the "MaxMpxCt" registry value. MaxMpxCt specifies the maximum outstanding network requests for the server per client, which is used when negotiating a Server Message Block (SMB) connection with a client. Note if the value is set beyond 125 older Windows 9x clients will fail to negotiate. Ransomware threat actors and operators (specifically BlackCat) were seen increasing this value in order to handle a higher volume of traffic. ' references: - https://www.huntress.com/blog/blackcat-ransomware-affiliate-ttps - https://securityscorecard.com/research/deep-dive-into-alphv-blackcat-ransomware - https://www.intrinsec.com/alphv-ransomware-gang-analysis/?cn-reloaded=1 - https://www.sentinelone.com/labs/blackcat-ransomware-highly-configurable-rust-driven-raas-on-the-prowl-for-victims/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-03-19 tags: - attack.stealth - attack.t1070.005 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Services\LanmanServer\Parameters\MaxMpxCt condition: selection falsepositives: - Unknown level: low
Query: vulnerability: The booking-system plugin before 2.1 for WordPress has DOPBSPBackEndTranslation::display SQL injection via the language parameter.
Matching passage: CVE-2015-9460. CWE: CWE-89. CVSS: 8.800000190734863. The booking-system plugin before 2.1 for WordPress has DOPBSPBackEndTranslation::display SQL injection via the language parameter.
Near-miss passage: CVE-2015-1397. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set.
Query: vulnerability: The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than int
Matching passage: CVE-2015-3276. CWE: UNKNOWN. CVSS: 7.5. The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.
Near-miss passage: CVE-2015-4797. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.3 allows remote authenticated users to affect integrity via unknown vectors related to Security.
Query: vulnerability: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, A
Matching passage: CVE-2015-7644. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, and CVE-2015-7643.
Near-miss passage: CVE-2015-4782. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790.
Query: detect Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from t in logs
Matching passage: Sigma rule: Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from t. Logsource: windows / process_creation. Rule: title: Forfiles.EXE Child Process Masquerading id: f53714ec-5077-420e-ad20-907ff9bb2958 status: test description: 'Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory. ' references: - https://www.hexacorn.com/blog/2023/12/31/1-little-known-secret-of-forfiles-exe/ author: Nasreddine Bencherchali (Nextron Systems), Anish Bogati date: 2024-01-05 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: ParentCommandLine|endswith: - .exe - .exe" Image|endswith: \cmd.exe CommandLine|startswith: /c echo " filter_main_parent_not_sys: ParentImage|contains: - :\Windows\System32\ - :\Windows\SysWOW64\ ParentImage|endswith: \forfiles.exe Image|contains: - :\Windows\System32\ - :\Windows\SysWOW64\ Image|endswith: \cmd.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects disabling Windows Defender PUA protection. Logsource: windows / registry_set. Rule: title: Disable PUA Protection on Windows Defender id: 8ffc5407-52e3-478f-9596-0a7371eafe13 status: test description: Detects disabling Windows Defender PUA protection references: - https://www.tenforums.com/tutorials/32236-enable-disable-microsoft-defender-pua-protection-windows-10-a.html author: Austin Songer @austinsonger date: 2021-08-04 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Policies\Microsoft\Windows Defender\PUAProtection Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: high
Query: exploit Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explo
Matching passage: CVE-2015-1733. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2389 and CVE-2015-2411.
Near-miss passage: CVE-2015-7021. CWE: CWE-119. CVSS: 7.199999809265137. The Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to gain privileges or cause a denial of service (kernel memory corruption) via unspecified vectors.
Query: vulnerability: ImageIO in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vi
Matching passage: CVE-2015-5935. CWE: CWE-119. CVSS: 6.800000190734863. ImageIO in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted metadata in an image, a different vulnerability than CVE-2015-5936, CVE-2015-5937, and CVE-2015-5939.
Near-miss passage: CVE-2015-6776. CWE: CWE-119. CVSS: 6.800000190734863. The opj_dwt_decode_1* functions in dwt.c in OpenJPEG, as used in PDFium in Google Chrome before 47.0.2526.73, allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data that is mishandled during a discrete wavelet transform.
Query: vulnerability: Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. (dot do
Matching passage: CVE-2015-4425. CWE: CWE-22. CVSS: 4.900000095367432. Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. (dot dot) in the dir parameter to admin/asset/add-asset-compatibility.
Near-miss passage: CVE-2015-6914. CWE: CWE-22. CVSS: 7.800000190734863. Absolute path traversal vulnerability in SiteFactory CMS 5.5.9 allows remote attackers to read arbitrary files via a full pathname in the file parameter to assets/download.aspx.
Query: describe CVE-2015-5266
Matching passage: CVE-2015-5266. CWE: CWE-264. CVSS: 6.800000190734863. The enrol_meta_sync function in enrol/meta/locallib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to obtain manager privileges in opportunistic circumstances by leveraging incorrect role processing during a long-running sync script.
Near-miss passage: CVE-2015-8482. CWE: CWE-264. CVSS: 2.0999999046325684. Blue Coat Unified Agent before 4.6.2 does not prevent modification of its configuration files when running in local enforcement mode, which allows local administrators to unblock categories or disable the agent via unspecified vectors.
Query: exploit In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached due to an improper bound on the size
Matching passage: CVE-2015-9044. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached due to an improper bound on the size of a frequency list.
Near-miss passage: CVE-2015-7374. CWE: CWE-20. CVSS: 7.5. The Remote Agent component in Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-2649.
Query: vulnerability: A design flaw in the Trane ComfortLink II SCC firmware version 2.0.2 service allows remote attackers to take complete control of the system.
Matching passage: CVE-2015-2867. CWE: CWE-798. CVSS: 9.800000190734863. A design flaw in the Trane ComfortLink II SCC firmware version 2.0.2 service allows remote attackers to take complete control of the system.
Near-miss passage: CVE-2015-2887. CWE: CWE-798. CVSS: 9.800000190734863. iBaby M3S has a password of admin for the backdoor admin account.
Query: detect Detects the installation of RTCore service. Which could be an indication of Micro-Star MSI Afterburner vulnerable driver in logs
Matching passage: Sigma rule: Detects the installation of RTCore service. Which could be an indication of Micro-Star MSI Afterburner vulnerable driver. Logsource: windows / system. Rule: title: RTCore Suspicious Service Installation id: 91c49341-e2ef-40c0-ac45-49ec5c3fe26c status: test description: Detects the installation of RTCore service. Which could be an indication of Micro-Star MSI Afterburner vulnerable driver abuse references: - https://github.com/br-sn/CheekyBlinder/blob/e1764a8a0e7cda8a3716aefa35799f560686e01c/CheekyBlinder/CheekyBlinder.cpp author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-30 tags: - attack.persistence logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ServiceName: RTCore64 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery. Logsource: linux / process_creation. Rule: title: Docker Container Discovery Via Dockerenv Listing id: 11701de9-d5a5-44aa-8238-84252f131895 status: test description: Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery references: - https://blog.skyplabs.net/posts/container-detection/ - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker tags: - attack.discovery - attack.t1082 author: Seth Hanford date: 2023-08-23 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /cat - /dir - /find - /ls - /stat - /test - grep CommandLine|endswith: .dockerenv condition: selection falsepositives: - Legitimate system administrator usage of these commands - Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered level: low
Query: risk of The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitrary code or cause a denial of service (cr
Matching passage: CVE-2015-7853. CWE: CWE-120. CVSS: 9.800000190734863. The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a negative input value.
Near-miss passage: CVE-2015-7512. CWE: CWE-120. CVSS: 9.0. Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet.
Query: CVE similar to CVE-2015-7627
Matching passage: CVE-2015-7627. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7625, CVE-2015-7626, CVE-2015-7630, CVE-2015-7633, and CVE-2015-7634.
Near-miss passage: CVE-2015-3685. CWE: CWE-119. CVSS: 6.800000190734863. CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3686, CVE-2015-3687, CVE-2015-3688, and CVE-2015-3689.
Query: detect Container Administration Command
Matching passage: T1609 Container Administration Command. Tactics: execution. Description: Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.(Citation: Docker Daemon CLI)(Citation: Kubernetes API)(Citation: Kubernetes Kubelet) In Docker, adversaries may specify an entrypoint during container deployment that executes a script or command, or they may use a command such as <code>docker exec</code> to execute a command within a running container.(Citation: Docker Entrypoint)(Citation: Docker Exec) In Kubernetes, if an adversary has sufficient permissions, they may gain remote execution in a container in the cluster via interaction with the Kubernetes API server, the kubelet, or by running a command such as <code>kubectl exec</code>.(Citation: Kubectl Exec Get Shell)
Near-miss passage: T1175 Component Object Model and Distributed COM. Tactics: lateral movement, execution. Description: **This technique has been deprecated. Please use [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) and [Component Object Model](https://attack.mitre.org/techniques/T1559/001).** Adversaries may use the Windows Component Object Model (COM) and Distributed Component Object Model (DCOM) for local code execution or to execute on remote systems as part of lateral movement. COM is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) DCOM is transparent middleware that extends the functionality of Component Object Model (COM) (Citation: Microsoft COM) beyond a local computer using remote procedure call (RPC) technology.(Citation: Fireeye Hunting COM June 2019) Permissions to interact with local and remote server COM objects are specified by access control lists (ACL) in the Registry. (Citation: Microsoft COM ACL)(Citation: Microsoft Process Wide Com Keys)(Citation: Microsoft System Wide Com Keys) By default, only Administrators may remotely activate and launch COM objects through DCOM. Adversaries may abuse COM for local command and/or payload execution. Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and VBScript.(Citation: Microsoft COM) Specific COM objects also exists to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors such as Privilege Escalation and Persistence.(Citation: Fireeye Hunting COM June 2019)(Citation: ProjectZero File Write EoP Apr 2018) Adversaries may use DC
Query: describe CVE-2015-0415
Matching passage: CVE-2015-0415. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.1.3 allows remote authenticated users to affect integrity via unknown vectors related to Session Management.
Near-miss passage: CVE-2015-2629. CWE: UNKNOWN. CVSS: 9.0. Unspecified vulnerability in the Java VM component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0457.