alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash
Matching passage: Sigma rule: Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash. Logsource: windows / create_stream_hash. Rule: title: Hidden Executable In NTFS Alternate Data Stream id: b69888d4-380c-45ce-9cf9-d9ce46e67821 status: test description: Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash references: - https://twitter.com/0xrawsec/status/1002478725605273600?s=21 author: Florian Roth (Nextron Systems), @0xrawsec date: 2018-06-03 modified: 2023-02-10 tags: - attack.stealth - attack.s0139 - attack.t1564.004 logsource: product: windows category: create_stream_hash definition: 'Requirements: Sysmon or equivalent configured with Imphash logging' detection: selection: Hash|contains: IMPHASH= filter_main_null: Hash|contains: IMPHASH=00000000000000000000000000000000 condition: selection and not 1 of filter_main_* falsepositives: - This rule isn't looking for any particular binary characteristics. As legitimate installers and programs were seen embedding hidden binaries in their ADS. Some false positives are expected from browser processes and similar. level: medium
Near-miss passage: Sigma rule: Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, msh. Logsource: windows / process_creation. Rule: title: Windows Shell/Scripting Processes Spawning Suspicious Programs id: 3a6586ad-127a-4d3b-a677-1e6eacdf8fde status: test description: Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc. references: - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html author: Florian Roth (Nextron Systems), Tim Shelton date: 2018-04-06 modified: 2023-05-23 tags: - attack.execution - attack.stealth - attack.t1059.005 - attack.t1059.001 - attack.t1218 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \mshta.exe - \powershell.exe - \pwsh.exe - \rundll32.exe - \cscript.exe - \wscript.exe - \wmiprvse.exe - \regsvr32.exe Image|endswith: - \schtasks.exe - \nslookup.exe - \certutil.exe - \bitsadmin.exe - \mshta.exe filter_ccmcache: CurrentDirectory|contains: \ccmcache\ filter_amazon: ParentCommandLine|contains: - \Program Files\Amazon\WorkSpacesConfig\Scripts\setup-scheduledtask.ps1 - \Program Files\Amazon\WorkSpacesConfig\Scripts\set-selfhealing.ps1 - \Program Files\Amazon\WorkSpacesConfig\Scripts\check-workspacehealth.ps1 - \nessus_ filter_nessus: CommandLine|contains: \nessus_ filter_sccm_install: ParentImage|endswith: \mshta.exe Image|endswith: \mshta.exe ParentCommandLine|contains|all: - C:\MEM_Configmgr_ - \splash.hta - '{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}' CommandLine|contains|all: - C:\MEM_Configmgr_ - \SMSSETUP\BIN\ - \autorun.hta - '{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}' condition: selection and not 1 of filter_* falsepositives: - Administrative scripts - Microsoft SCCM level: high
Query: vulnerability: WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application cras
Matching passage: CVE-2015-5799. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-0880. CWE: CWE-119. CVSS: 6.800000190734863. Buffer overflow in CREAR AL-Mail32 before 1.13d allows remote attackers to execute arbitrary code via a long filename of an attachment.
Query: Persistence mechanism resembling Verclsid
Matching passage: T1218.012 Verclsid. Tactics: stealth. Description: Adversaries may abuse verclsid.exe to proxy execution of malicious code. Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell.(Citation: WinOSBite verclsid.exe) Adversaries may abuse verclsid.exe to execute malicious payloads. This may be achieved by running <code>verclsid.exe /S /C {CLSID}</code>, where the file is referenced by a Class ID (CLSID), a unique identification number used to identify COM objects. COM payloads executed by verclsid.exe may be able to perform various malicious actions, such as loading and executing COM scriptlets (SCT) from remote servers (similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010)). Since the binary may be signed and/or native on Windows systems, proxying execution via verclsid.exe may bypass application control solutions that do not account for its potential abuse.(Citation: LOLBAS Verclsid)(Citation: Red Canary Verclsid.exe)(Citation: BOHOPS Abusing the COM Registry)(Citation: Nick Tyrer GitHub)
Near-miss passage: T1218.008 Odbcconf. Tactics: stealth. Description: Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) The Odbcconf.exe binary may be digitally signed by Microsoft. Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse. Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010), odbcconf.exe has a <code>REGSVR</code> flag that can be misused to execute DLLs (ex: <code>odbcconf.exe /S /A &lbrace;REGSVR "C:\Users\Public\file.dll"&rbrace;</code>). (Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017)
Query: detection rule: Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or u
Matching passage: Sigma rule: Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or u. Logsource: windows / security. Rule: title: Group Policy Abuse for Privilege Addition id: 1c480e10-7ee1-46d4-8ed2-85f9789e3ce4 status: test description: 'Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins. ' author: Elastic, Josh Nickels, Marius Rothenbücher references: - https://www.elastic.co/guide/en/security/current/group-policy-abuse-for-privilege-addition.html#_setup_275 date: 2024-09-04 tags: - attack.privilege-escalation - attack.defense-impairment - attack.t1484.001 logsource: product: windows service: security definition: 'Requirements: The "Audit Directory Service Changes" logging policy must be configured in order to receive events.' detection: selection: EventID: 5136 AttributeLDAPDisplayName: gPCMachineExtensionNames AttributeValue|contains: - 827D319E-6EAC-11D2-A4EA-00C04F79F83A - 803E14A0-B4FB-11D0-A0D0-00A0C90F574B condition: selection falsepositives: - Users allowed to perform these modifications (user found in field SubjectUserName) level: medium
Near-miss passage: Sigma rule: Detects usage of Dsacls to grant over permissive permissions. Logsource: windows / process_creation. Rule: title: Potentially Over Permissive Permissions Granted Using Dsacls.EXE id: 01c42d3c-242d-4655-85b2-34f1739632f7 status: test description: Detects usage of Dsacls to grant over permissive permissions references: - https://ss64.com/nt/dsacls.html - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771151(v=ws.11) author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-20 modified: 2023-02-04 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \dsacls.exe - OriginalFileName: DSACLS.EXE selection_flag: CommandLine|contains: ' /G ' selection_permissions: CommandLine|contains: - GR - GE - GW - GA - WP - WD condition: all of selection_* falsepositives: - Legitimate administrators granting over permissive permissions to users level: medium
Query: CWE for Insufficient Type Distinction
Matching passage: CWE-351 Insufficient Type Distinction. The product does not properly distinguish between different types of elements in a way that leads to insecure behavior.
Near-miss passage: CWE-583 finalize() Method Declared Public. The product violates secure coding principles for mobile code by declaring a finalize() method public.
Query: explain CWE-342
Matching passage: CWE-342 Predictable Exact Value from Previous Values. An exact value or random number can be precisely predicted by observing previous values.
Near-miss passage: CWE-382 J2EE Bad Practices: Use of System.exit(). A J2EE application uses System.exit(), which also shuts down its container.
Query: risk of ICZ MATCHA SNS before 1.3.7 allows remote authenticated users to obtain administrative privileges via unspecified vectors.
Matching passage: CVE-2015-5645. CWE: CWE-264. CVSS: 6.5. ICZ MATCHA SNS before 1.3.7 allows remote authenticated users to obtain administrative privileges via unspecified vectors.
Near-miss passage: CVE-2015-2830. CWE: CWE-264. CVSS: 1.899999976158142. arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrated by an attack against seccomp before 3.16.
Query: detect Detects execution of "reg.exe" commands with the "delete" flag on safe boot registry keys. Often used by attacker to pre in logs
Matching passage: Sigma rule: Detects execution of "reg.exe" commands with the "delete" flag on safe boot registry keys. Often used by attacker to pre. Logsource: windows / process_creation. Rule: title: SafeBoot Registry Key Deleted Via Reg.EXE id: fc0e89b5-adb0-43c1-b749-c12a10ec37de related: - id: d7662ff6-9e97-4596-a61d-9839e32dee8d type: similar status: test description: Detects execution of "reg.exe" commands with the "delete" flag on safe boot registry keys. Often used by attacker to prevent safeboot execution of security products references: - https://www.trendmicro.com/en_us/research/22/e/avoslocker-ransomware-variant-abuses-driver-file-to-disable-anti-Virus-scans-log4shell.html author: Nasreddine Bencherchali (Nextron Systems), Tim Shelton date: 2022-08-08 modified: 2023-02-04 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: reg.exe - OriginalFileName: reg.exe selection_delete: CommandLine|contains|all: - ' delete ' - \SYSTEM\CurrentControlSet\Control\SafeBoot condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can ha. Logsource: azure / auditlogs. Rule: title: Change to Authentication Method id: 4d78a000-ab52-4564-88a5-7ab5242b20c7 status: test description: Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts author: AlertIQ date: 2021-10-10 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.credential-access - attack.defense-impairment - attack.t1556 - attack.persistence - attack.t1098 logsource: product: azure service: auditlogs detection: selection: LoggedByService: Authentication Methods Category: UserManagement OperationName: User registered security info condition: selection falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-3742
Matching passage: CVE-2015-3742. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Near-miss passage: CVE-2015-3622. CWE: CWE-119. CVSS: 4.300000190734863. The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted certificate.
Query: CVE similar to CVE-2015-4255
Matching passage: CVE-2015-4255. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence IP Gateway devices with software 2.0(3.34) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu90734.
Near-miss passage: CVE-2015-1583. CWE: CWE-352. CVSS: 8.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account via a request to mods/_core/users/admins/create.php or (2) create a user account via a request to mods/_core/users/create_user.php.
Query: vulnerability: The web administration interface on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 has a default password of 1234 for the admin account, which allows remote attackers to obtai
Matching passage: CVE-2015-7283. CWE: CWE-255. CVSS: 8.100000381469727. The web administration interface on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 has a default password of 1234 for the admin account, which allows remote attackers to obtain administrative privileges by leveraging a LAN session.
Near-miss passage: CVE-2015-4400. CWE: CWE-255. CVSS: 4.599999904632568. Ring (formerly DoorBot) video doorbells allow remote attackers to obtain sensitive information about the wireless network configuration by pressing the set up button and leveraging an API in the GainSpan Wi-Fi module.
Query: exploit Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability via unknown vectors related to Libc.
Matching passage: CVE-2015-0378. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability via unknown vectors related to Libc.
Near-miss passage: CVE-2015-1764. CWE: UNKNOWN. CVSS: 4.300000190734863. The web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allow remote attackers to bypass the Same Origin Policy and send HTTP traffic to intranet servers via a crafted request, related to a Server-Side Request Forgery (SSRF) issue, aka "Exchange Server-Side Request Forgery Vulnerability."
Query: alert when Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or M
Matching passage: Sigma rule: Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or M. Logsource: m365 / threat_management. Rule: title: Suspicious OAuth App File Download Activities id: ee111937-1fe7-40f0-962a-0eb44d57d174 status: test description: Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user. references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: Austin Songer @austinsonger date: 2021-08-23 modified: 2022-10-09 tags: - attack.exfiltration logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: Suspicious OAuth app file download activities status: success condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".. Logsource: windows / process_creation. Rule: title: User Added to Local Administrators Group id: ad720b90-25ad-43ff-9b5e-5c841facc8e5 related: - id: ffa28e60-bdb1-46e0-9f82-05f7a61cc06e type: similar - id: 10fb649c-3600-4d37-b1e6-56ea90bb7e09 type: similar status: test description: Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember". references: - https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-08-12 modified: 2023-03-02 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: category: process_creation product: windows detection: selection_main: - CommandLine|contains|all: - 'localgroup ' - ' /add' - CommandLine|contains|all: - 'Add-LocalGroupMember ' - ' -Group ' selection_group: CommandLine|contains: - ' administrators ' - ' administrateur' condition: all of selection_* falsepositives: - Administrative activity level: medium
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_int_message_list.inc.php in the Payment F
Matching passage: CVE-2015-7666. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_int_message_list.inc.php in the Payment Form for PayPal Pro plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the cal parameter.
Near-miss passage: CVE-2015-1512. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in FancyFon FAMOC before 3.17.4 allow remote attackers to inject arbitrary web script or HTML via the (1) LoginForm[username] to ui/system/login or the (2) order or (3) myorgs to index.php.
Query: exploit Open redirect vulnerability in the Content Construction Kit (CCK) 6.x-2.x before 6.x-2.10 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct ph
Matching passage: CVE-2015-5510. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the Content Construction Kit (CCK) 6.x-2.x before 6.x-2.10 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the destinations parameter, related to administration pages.
Near-miss passage: CVE-2015-4863. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in the Portable Clusterware component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Query: exploit The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-compu
Matching passage: CVE-2015-0837. CWE: CWE-203. CVSS: 5.900000095367432. The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a "Last-Level Cache Side-Channel Attack."
Near-miss passage: CVE-2015-8313. CWE: CWE-203. CVSS: 5.900000095367432. GnuTLS incorrectly validates the first byte of padding in CBC modes
Query: risk of The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial o
Matching passage: CVE-2015-4602. CWE: UNKNOWN. CVSS: 9.800000190734863. The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue.
Near-miss passage: CVE-2015-7642. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7643, and CVE-2015-7644.
Query: exploit XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.
Matching passage: CVE-2015-7241. CWE: CWE-611. CVSS: 9.800000190734863. XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.
Near-miss passage: CVE-2015-0194. CWE: CWE-611. CVSS: 6.5. XML External Entity (XXE) vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and IBM Sterling File Gateway 2.1 and 2.2 allows remote attackers to read arbitrary files via a crafted XML data.
Query: weakness Return Inside Finally Block
Matching passage: CWE-584 Return Inside Finally Block. The code has a return statement inside a finally block, which will cause any thrown exception in the try block to be discarded.
Near-miss passage: CWE-763 Release of Invalid Pointer or Reference. The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.
Query: describe CVE-2015-1251
Matching passage: CVE-2015-1251. CWE: UNKNOWN. CVSS: 6.800000190734863. Use-after-free vulnerability in the SpeechRecognitionClient implementation in the Speech subsystem in Google Chrome before 43.0.2357.65 allows remote attackers to execute arbitrary code via a crafted document.
Near-miss passage: CVE-2015-2594. CWE: UNKNOWN. CVSS: 6.599999904632568. Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.0.32, 4.1.40, 4.2.32, and 4.3.30 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core.
Query: patch priority for CVE-2015-2637
Matching passage: CVE-2015-2637. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via unknown vectors related to 2D.
Near-miss passage: CVE-2015-0388. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Portal Framework, a different vulnerability than CVE-2015-0417.
Query: vulnerability: CoreMedia Playback in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and applicati
Matching passage: CVE-2015-5777. CWE: CWE-119. CVSS: 6.800000190734863. CoreMedia Playback in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-5778.
Near-miss passage: CVE-2015-3794. CWE: CWE-119. CVSS: 6.800000190734863. The Speech UI in Apple OS X before 10.10.5, when speech alerts are enabled, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Unicode string.