alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-9249
Matching passage: CVE-2015-9249. CWE: CWE-89. CVSS: 9.800000190734863. An issue was discovered in Skybox Platform before 7.5.201. SQL Injection exists in /skyboxview/webservice/services/VersionWebService via a soapenv:Body element.
Near-miss passage: CVE-2015-9323. CWE: CWE-89. CVSS: 9.800000190734863. The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.
Query: Sigma YAML for windows / image_load
Matching passage: Sigma rule: Detects potential DLL sideloading of "edputil.dll". Logsource: windows / image_load. Rule: title: Potential Edputil.DLL Sideloading id: e4903324-1a10-4ed3-981b-f6fe3be3a2c2 status: test description: Detects potential DLL sideloading of "edputil.dll" references: - https://alternativeto.net/news/2023/5/cybercriminals-use-wordpad-vulnerability-to-spread-qbot-malware/ author: X__Junior (Nextron Systems) date: 2023-06-09 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \edputil.dll filter_main_generic: ImageLoaded|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects Netsh command execution that whitelists a program located in a suspicious location in the Windows Firewall. Logsource: windows / process_creation. Rule: title: Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE id: a35f5a72-f347-4e36-8895-9869b0d5fc6d status: test description: Detects Netsh command execution that whitelists a program located in a suspicious location in the Windows Firewall references: - https://www.virusradar.com/en/Win32_Kasidet.AD/description - https://www.hybrid-analysis.com/sample/07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f?environmentId=100 author: Sander Wiebing, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community date: 2020-05-25 modified: 2023-12-11 tags: - attack.defense-impairment - attack.t1686.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: - CommandLine|contains|all: - firewall - add - allowedprogram - CommandLine|contains|all: - advfirewall - firewall - add - rule - action=allow - program= selection_paths: CommandLine|contains: - :\$Recycle.bin\ - :\RECYCLER.BIN\ - :\RECYCLERS.BIN\ - :\SystemVolumeInformation\ - :\Temp\ - :\Users\Default\ - :\Users\Desktop\ - :\Users\Public\ - :\Windows\addins\ - :\Windows\cursors\ - :\Windows\debug\ - :\Windows\drivers\ - :\Windows\fonts\ - :\Windows\help\ - :\Windows\system32\tasks\ - :\Windows\Tasks\ - :\Windows\Temp\ - \Downloads\ - \Local Settings\Temporary Internet Files\ - \Temporary Internet Files\Content.Outlook\ - '%Public%\' - '%TEMP%' - '%TMP%' condition: all of selection_* falsepositives: - Unknown level: high
Query: telemetry for T1669
Matching passage: T1669 Wi-Fi Networks. Tactics: initial access. Description: Adversaries may gain initial access to target systems by connecting to wireless networks. They may accomplish this by exploiting open Wi-Fi networks used by target devices or by accessing secured Wi-Fi networks — requiring [Valid Accounts](https://attack.mitre.org/techniques/T1078) — belonging to a target organization.(Citation: DOJ GRU Charges 2018)(Citation: Nearest Neighbor Volexity) Establishing a connection to a Wi-Fi access point requires a certain level of proximity to both discover and maintain a stable network connection. Adversaries may establish a wireless connection through various methods, such as by physically positioning themselves near a Wi-Fi network to conduct close access operations. To bypass the need for physical proximity, adversaries may attempt to remotely compromise nearby third-party systems that have both wired and wireless network connections available (i.e., dual-homed systems). These third-party compromised devices can then serve as a bridge to connect to a target’s Wi-Fi network.(Citation: Nearest Neighbor Volexity) Once an initial wireless connection is achieved, adversaries may leverage this access for follow-on activities in the victim network or further targeting of specific devices on the network. Adversaries may perform [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) activities for [Credential Access](https://attack.mitre.org/tactics/TA0006) or [Discovery](https://attack.mitre.org/tactics/TA0007).
Near-miss passage: T1200 Hardware Additions. Tactics: initial access. Description: Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091)), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused. While public references of usage by threat actors are scarce, many red teams/penetration testers leverage hardware additions for initial access. Commercial and open source products can be leveraged with capabilities such as passive network tapping, network traffic modification (i.e. [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557)), keystroke injection, kernel memory reading via DMA, addition of new wireless access points to an existing network, and others.(Citation: Ossmann Star Feb 2011)(Citation: Aleks Weapons Nov 2015)(Citation: Frisk DMA August 2016)(Citation: McMillan Pwn March 2012)
Query: explain T1559 Inter-Process Communication
Matching passage: T1559 Inter-Process Communication. Tactics: execution. Description: Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern. Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002) or [Component Object Model](https://attack.mitre.org/techniques/T1559/001). Linux environments support several different IPC mechanisms, two of which being sockets and pipes.(Citation: Linux IPC) Higher level execution mediums, such as those of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s, may also leverage underlying IPC mechanisms. Adversaries may also use [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) to facilitate remote IPC execution.(Citation: Fireeye Hunting COM June 2019)
Near-miss passage: T1559.001 Component Object Model. Tactics: execution. Description: Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) Remote COM execution is facilitated by [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) (DCOM).(Citation: Fireeye Hunting COM June 2019) Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).(Citation: Microsoft COM) Specific COM objects also exist to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.(Citation: Fireeye Hunting COM June 2019)(Citation: ProjectZero File Write EoP Apr 2018)
Query: describe CVE-2015-7797
Matching passage: CVE-2015-7797. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7796, CVE-2015-7798, CVE-2016-1149, and CVE-2016-1150.
Near-miss passage: CVE-2015-7786. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the NTT DATA Smart Sourcing JavaScript module 2003-11-26 through 2013-07-09 for Web Analytics Service allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: detect Detects attempts to remove Windows Defender configuration using the 'MpPreference' cmdlet in logs
Matching passage: Sigma rule: Detects attempts to remove Windows Defender configuration using the 'MpPreference' cmdlet. Logsource: windows / ps_script. Rule: title: Tamper Windows Defender Remove-MpPreference - ScriptBlockLogging id: ae2bdd58-0681-48ac-be7f-58ab4e593458 related: - id: 07e3cb2c-0608-410d-be4b-1511cb1a0448 type: similar status: test description: Detects attempts to remove Windows Defender configuration using the 'MpPreference' cmdlet references: - https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-controlled-folder-access-event-search/ba-p/2326088 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_remove: ScriptBlockText|contains: Remove-MpPreference selection_tamper: ScriptBlockText|contains: - '-ControlledFolderAccessProtectedFolders ' - '-AttackSurfaceReductionRules_Ids ' - '-AttackSurfaceReductionRules_Actions ' - '-CheckForSignaturesBeforeRunningScan ' condition: all of selection_* falsepositives: - Legitimate PowerShell scripts level: high
Near-miss passage: Sigma rule: Detects successful logon attempts performed with WMI. Logsource: windows / security. Rule: title: Successful Account Login Via WMI id: 5af54681-df95-4c26-854f-2565e13cfab0 status: stable description: Detects successful logon attempts performed with WMI references: - Internal Research author: Thomas Patzke date: 2019-12-04 modified: 2024-01-17 tags: - attack.execution - attack.t1047 logsource: product: windows service: security detection: selection: EventID: 4624 ProcessName|endswith: \WmiPrvSE.exe condition: selection falsepositives: - Monitoring tools - Legitimate system administration level: low
Query: describe CVE-2015-5749
Matching passage: CVE-2015-5749. CWE: CWE-200. CVSS: 4.300000190734863. The Sandbox_profiles component in Apple iOS before 8.4.1 allows attackers to bypass the third-party app-sandbox protection mechanism and read arbitrary managed preferences via a crafted app.
Near-miss passage: CVE-2015-7846. CWE: CWE-200. CVSS: 4.599999904632568. Huawei S7700, S9700, S9300 before V200R07C00SPC500, and AR200, AR1200, AR2200, AR3200 before V200R005C20SPC200 allows attackers with physical access to the CF card to obtain sensitive information.
Query: patch priority for CVE-2015-7425
Matching passage: CVE-2015-7425. CWE: CWE-264. CVSS: 10.0. The Data Protection component in the VMware vSphere GUI in IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual Environments) 6.3 before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before 7.1.4 and Tivoli Storage FlashCopy Manager for VMware (aka Spectrum Protect Snapshot) 3.1 before 3.1.1.3, 3.2 before 3.2.0.6, and 4.1 before 4.1.4 allows remote attackers to obtain administrative privileges via a crafted URL that triggers back-end function execution.
Near-miss passage: CVE-2015-5989. CWE: CWE-264. CVSS: 9.800000190734863. Belkin F9K1102 2 devices with firmware 2.10.17 rely on client-side JavaScript code for authorization, which allows remote attackers to obtain administrative privileges via certain changes to LockStatus and Login_Success values.
Query: alert when Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing
Matching passage: Sigma rule: Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing. Logsource: windows / registry_set. Rule: title: Suspicious Space Characters in RunMRU Registry Path - ClickFix id: 7a1b4c5e-8f3d-4b9a-7c2e-1f4a5b8c6d9e related: - id: 3ae9974a-eb09-4044-8e70-8980a50c12c8 type: similar status: experimental description: 'Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing lures using clickfix techniques to hide malicious commands in the Windows Run dialog box from naked eyes. ' references: - https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/ - https://github.com/JohnHammond/recaptcha-phish author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-04 tags: - attack.execution - attack.stealth - attack.t1204.004 - attack.t1027.010 logsource: category: registry_set product: windows detection: selection_key: TargetObject|contains: \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\ Details|contains: '#' selection_space_variation: Details|contains: - - - - - - - - - - - - - ' ' condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Download and compress a remote file and store it in a cab file on local machine.. Logsource: windows / process_creation. Rule: title: Suspicious Diantz Download and Compress Into a CAB File id: 185d7418-f250-42d0-b72e-0c8b70661e93 status: test description: Download and compress a remote file and store it in a cab file on local machine. references: - https://lolbas-project.github.io/lolbas/Binaries/Diantz/ author: frack113 date: 2021-11-26 modified: 2022-08-13 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - diantz.exe - ' \\\\' - .cab condition: selection falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-5230
Matching passage: CVE-2015-5230. CWE: CWE-20. CVSS: 7.5. The DNS packet parsing/generation code in PowerDNS (aka pdns) Authoritative Server 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via crafted query packets.
Near-miss passage: CVE-2015-1142. CWE: CWE-20. CVSS: 2.0999999046325684. LaunchServices in Apple OS X before 10.10.3 allows local users to cause a denial of service (Finder crash) via crafted localization data.
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat a. Logsource: windows / ps_script. Rule: title: AADInternals PowerShell Cmdlets Execution - PsScript id: 91e69562-2426-42ce-a647-711b8152ced6 related: - id: c86500e9-a645-4680-98d7-f882c70c1ea3 type: similar status: test description: Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365. references: - https://o365blog.com/aadinternals/ - https://github.com/Gerenios/AADInternals author: Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2022-12-23 modified: 2025-02-06 tags: - attack.execution - attack.reconnaissance - attack.discovery - attack.credential-access - attack.impact logsource: product: windows category: ps_script definition: Script Block Logging must be enable detection: selection: ScriptBlockText|contains: - Add-AADInt - ConvertTo-AADInt - Disable-AADInt - Enable-AADInt - Export-AADInt - Find-AADInt - Get-AADInt - Grant-AADInt - Initialize-AADInt - Install-AADInt - Invoke-AADInt - Join-AADInt - New-AADInt - Open-AADInt - Read-AADInt - Register-AADInt - Remove-AADInt - Reset-AADInt - Resolve-AADInt - Restore-AADInt - Save-AADInt - Search-AADInt - Send-AADInt - Set-AADInt - Start-AADInt - Unprotect-AADInt - Update-AADInt condition: selection falsepositives: - Legitimate use of the library for administrative activity level: high
Near-miss passage: Sigma rule: Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary pro. Logsource: windows / image_load. Rule: title: Unsigned Mfdetours.DLL Sideloading id: 948a0953-f287-4806-bbcb-3b2e396df89f related: - id: d2605a99-2218-4894-8fd3-2afb7946514d type: similar status: test description: Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution. references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-11 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \mfdetours.dll filter_main_legit_path: ImageLoaded|contains: :\Program Files (x86)\Windows Kits\10\bin\ SignatureStatus: Valid condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Query: CVE similar to CVE-2015-6095
Matching passage: CVE-2015-6095. CWE: CWE-255. CVSS: 4.900000095367432. Kerberos in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandles password changes, which allows physically proximate attackers to bypass authentication, and conduct decryption attacks against certain BitLocker configurations, by connecting to an unintended Key Distribution Center (KDC), aka "Windows Kerberos Security Feature Bypass."
Near-miss passage: CVE-2015-8675. CWE: CWE-255. CVSS: 6.199999809265137. Huawei S5300 Campus Series switches with software before V200R005SPH008 do not mask the password when uploading files, which allows physically proximate attackers to obtain sensitive password information by reading the display.
Query: detect Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task in logs
Matching passage: Sigma rule: Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task. Logsource: windows / process_creation. Rule: title: Discovery of a System Time id: b243b280-65fe-48df-ba07-6ddea7646427 status: test description: Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task or to discover the time zone of a target system. references: - https://eqllib.readthedocs.io/en/latest/analytics/fcdb99c2-ac3c-4bde-b664-4b336329bed2.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1124/T1124.md author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community date: 2019-10-24 modified: 2022-06-28 tags: - attack.discovery - attack.t1124 logsource: category: process_creation product: windows detection: selection_time: Image|endswith: - \net.exe - \net1.exe CommandLine|contains: time selection_w32tm: Image|endswith: \w32tm.exe CommandLine|contains: tz condition: 1 of selection_* falsepositives: - Legitimate use of the system utilities to discover system time for legitimate reason level: low
Near-miss passage: Sigma rule: Detects both of CVE-2022-30190 (Follina) and DogWalk vulnerabilities exploiting msdt.exe binary to load the "sdiageng.dl. Logsource: windows / image_load. Rule: title: Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE id: ec8c4047-fad9-416a-8c81-0f479353d7f6 status: test description: Detects both of CVE-2022-30190 (Follina) and DogWalk vulnerabilities exploiting msdt.exe binary to load the "sdiageng.dll" library references: - https://www.securonix.com/blog/detecting-microsoft-msdt-dogwalk/ author: Greg (rule) date: 2022-06-17 modified: 2023-02-17 tags: - attack.stealth - attack.t1202 - cve.2022-30190 logsource: category: image_load product: windows detection: selection: Image|endswith: \msdt.exe ImageLoaded|endswith: \sdiageng.dll condition: selection falsepositives: - Unknown level: high
Query: alert when Detects SILENTTRINITY stager use via PE metadata
Matching passage: Sigma rule: Detects SILENTTRINITY stager use via PE metadata. Logsource: windows / process_creation. Rule: title: HackTool - SILENTTRINITY Stager Execution id: 03552375-cc2c-4883-bbe4-7958d5a980be related: - id: 75c505b1-711d-4f68-a357-8c3fe37dbf2d type: derived status: test description: Detects SILENTTRINITY stager use via PE metadata references: - https://github.com/byt3bl33d3r/SILENTTRINITY author: Aleksey Potapov, oscd.community date: 2019-10-22 modified: 2023-02-13 tags: - attack.command-and-control - attack.t1071 logsource: category: process_creation product: windows detection: selection: Description|contains: st2stager condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects potential DLL side loading of DLLs that are part of the Wazuh security platform. Logsource: windows / image_load. Rule: title: Potential Wazuh Security Platform DLL Sideloading id: db77ce78-7e28-4188-9337-cf30e2b3ba9f status: test description: Detects potential DLL side loading of DLLs that are part of the Wazuh security platform references: - https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html author: X__Junior (Nextron Systems) date: 2023-03-13 modified: 2023-05-12 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: - \libwazuhshared.dll - \libwinpthread-1.dll filter_main_generic: ImageLoaded|startswith: - C:\Program Files\ - C:\Program Files (x86)\ filter_optional_mingw64: ImageLoaded|contains: - \AppData\Local\ - \ProgramData\ ImageLoaded|endswith: \mingw64\bin\libwinpthread-1.dll condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Many legitimate applications leverage this DLL. (Visual Studio, JetBrains, Ruby, Anaconda, GithubDesktop, etc.) level: medium
Query: CVE similar to CVE-2015-9034
Matching passage: CVE-2015-9034. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a string can fail to be null-terminated in SIP leading to a buffer overflow.
Near-miss passage: CVE-2015-9262. CWE: CWE-119. CVSS: 9.800000190734863. _XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow.
Query: exploit edx-platform before 2015-08-17 allows XSS in the Studio listing of courses.
Matching passage: CVE-2015-6253. CWE: CWE-79. CVSS: 5.400000095367432. edx-platform before 2015-08-17 allows XSS in the Studio listing of courses.
Near-miss passage: CVE-2015-5622. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php.