alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects Octopus Scanner Malware.
Matching passage: Sigma rule: Detects Octopus Scanner Malware.. Logsource: windows / file_event. Rule: title: Octopus Scanner Malware id: 805c55d9-31e6-4846-9878-c34c75054fe9 status: test description: Detects Octopus Scanner Malware. references: - https://securitylab.github.com/research/octopus-scanner-malware-open-source-supply-chain author: NVISO date: 2020-06-09 modified: 2021-11-27 tags: - attack.initial-access - attack.t1195 - attack.t1195.001 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \AppData\Local\Microsoft\Cache134.dat - \AppData\Local\Microsoft\ExplorerSync.db condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a remote thread creation of Ttdinject.exe used as proxy. Logsource: windows / create_remote_thread. Rule: title: Remote Thread Creation Ttdinject.exe Proxy id: c15e99a3-c474-48ab-b9a7-84549a7a9d16 status: test description: Detects a remote thread creation of Ttdinject.exe used as proxy references: - https://lolbas-project.github.io/lolbas/Binaries/Ttdinject/ author: frack113 date: 2022-05-16 modified: 2022-06-02 tags: - attack.execution - attack.stealth - attack.t1127 logsource: product: windows category: create_remote_thread detection: selection: SourceImage|endswith: \ttdinject.exe condition: selection falsepositives: - Unknown level: high
Query: vulnerability: Cisco Unified Computing System (UCS) 2.2(3f)A on Fabric Interconnect 6200 devices allows remote attackers to cause a denial of service (CPU consumption or device outage) via a SYN 
Matching passage: CVE-2015-6415. CWE: CWE-399. CVSS: 7.099999904632568. Cisco Unified Computing System (UCS) 2.2(3f)A on Fabric Interconnect 6200 devices allows remote attackers to cause a denial of service (CPU consumption or device outage) via a SYN flood on the SSH port during the booting process, aka Bug ID CSCuu81757.
Near-miss passage: CVE-2015-2927. CWE: CWE-399. CVSS: 6.5. node 0.3.2 and URONode before 1.0.5r3 allows remote attackers to cause a denial of service (bandwidth consumption).
Query: detect Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new in logs
Matching passage: Sigma rule: Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new. Logsource: windows / security. Rule: title: Add or Remove Computer from DC id: 20d96d95-5a20-4cf1-a483-f3bda8a7c037 status: test description: Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new SPN. references: - https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4741 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4743 author: frack113 date: 2022-10-14 tags: - attack.defense-impairment - attack.t1207 logsource: service: security product: windows detection: selection: EventID: - 4741 - 4743 condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been. Logsource: macos / process_creation. Rule: title: Remote Access Tool - Team Viewer Session Started On MacOS Host id: f459ccb4-9805-41ea-b5b2-55e279e2424a related: - id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357 type: similar - id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d type: similar status: test description: 'Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder. ' references: - Internal Research author: Josh Nickels, Qi Nan date: 2024-03-11 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: process_creation product: macos detection: selection: ParentImage|endswith: /TeamViewer_Service Image|endswith: /TeamViewer_Desktop CommandLine|endswith: /TeamViewer_Desktop --IPCport 5939 --Module 1 condition: selection falsepositives: - Legitimate usage of TeamViewer level: low
Query: CVE similar to CVE-2015-7656
Matching passage: CVE-2015-7656. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted actionImplementsOp arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
Near-miss passage: CVE-2015-5558. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-5554, CVE-2015-5555, and CVE-2015-5562.
Query: CVE similar to CVE-2015-9264
Matching passage: CVE-2015-9264. CWE: CWE-20. CVSS: 9.800000190734863. Lansweeper 4.x through 6.x before 6.0.0.48 allows attackers to execute arbitrary code on the administrator's workstation via a crafted Windows service.
Near-miss passage: CVE-2015-9116. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 810, SD 820, and SD 820A, in a QTEE syscall handler, an untrusted pointer dereference can occur.
Query: detect Detects Obfuscated use of stdin to execute PowerShell in logs
Matching passage: Sigma rule: Detects Obfuscated use of stdin to execute PowerShell. Logsource: windows / system. Rule: title: Invoke-Obfuscation STDIN+ Launcher - System id: 72862bf2-0eb1-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of stdin to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: system detection: selection_main: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains|all: - cmd - powershell ImagePath|contains: - /c - /r selection_other: - ImagePath|contains: noexit - ImagePath|contains|all: - input - $ condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects user data export activity.. Logsource: bitbucket / audit. Rule: title: Bitbucket User Details Export Attempt Detected id: 5259cbf2-0a75-48bf-b57a-c54d6fabaef3 status: test description: Detects user data export activity. references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html - https://support.atlassian.com/security-and-access-policies/docs/export-user-accounts author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.collection - attack.reconnaissance - attack.discovery - attack.t1213 - attack.t1082 - attack.t1591.004 logsource: product: bitbucket service: audit definition: 'Requirements: "Advance" log level is required to receive these audit events.' detection: selection: auditType.category: Users and groups auditType.action: - User permissions export failed - User permissions export started - User permissions exported condition: selection falsepositives: - Legitimate user activity. level: medium
Query: vulnerability: Unspecified vulnerability in the PeopleSoft Enterprise FSCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via vectors rela
Matching passage: CVE-2015-4828. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the PeopleSoft Enterprise FSCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via vectors related to FIN Resource Management (Security).
Near-miss passage: CVE-2015-0321. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0329, and CVE-2015-0330.
Query: vulnerability: Honda Moto LINC 1.6.1 does not verify SSL certificates.
Matching passage: CVE-2015-2943. CWE: CWE-295. CVSS: 5.900000095367432. Honda Moto LINC 1.6.1 does not verify SSL certificates.
Near-miss passage: CVE-2015-2674. CWE: CWE-295. CVSS: 5.900000095367432. Restkit allows man-in-the-middle attackers to spoof TLS servers by leveraging use of the ssl.wrap_socket function in Python with the default CERT_NONE value for the cert_reqs argument.
Query: detection rule: Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.
Matching passage: Sigma rule: Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.. Logsource: windows / security. Rule: title: Suspicious Scheduled Task Creation id: 3a734d25-df5c-4b99-8034-af1ddb5883a4 status: test description: Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-05 modified: 2022-12-07 tags: - attack.execution - attack.privilege-escalation - attack.persistence - attack.t1053.005 logsource: product: windows service: security definition: The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data. detection: selection_eid: EventID: 4698 selection_paths: TaskContent|contains: - \AppData\Local\Temp\ - \AppData\Roaming\ - \Users\Public\ - \WINDOWS\Temp\ - C:\Temp\ - \Desktop\ - \Downloads\ - \Temporary Internet - C:\ProgramData\ - C:\Perflogs\ selection_commands: TaskContent|contains: - regsvr32 - rundll32 - cmd.exe</Command> - cmd</Command> - '<Arguments>/c ' - '<Arguments>/k ' - '<Arguments>/r ' - powershell - pwsh - mshta - wscript - cscript - certutil - bitsadmin - bash.exe - 'bash ' - scrcons - 'wmic ' - wmic.exe - forfiles - scriptrunner - hh.exe condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detect file time attribute change to hide new or changes to existing files.. Logsource: linux / auditd. Rule: title: File Time Attribute Change - Linux id: b3cec4e7-6901-4b0d-a02d-8ab2d8eb818b status: test description: Detect file time attribute change to hide new or changes to existing files. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md author: Igor Fits, oscd.community date: 2020-10-15 modified: 2022-11-28 tags: - attack.stealth - attack.t1070.006 logsource: product: linux service: auditd detection: execve: type: EXECVE touch: - touch selection2: - -t - -acmr - -d - -r condition: execve and touch and selection2 falsepositives: - Unknown level: medium simulation: - type: atomic-red-team name: Set a file's access timestamp technique: T1070.006 atomic_guid: 5f9113d5-ed75-47ed-ba23-ea3573d05810 - type: atomic-red-team name: Set a file's modification timestamp technique: T1070.006 atomic_guid: 20ef1523-8758-4898-b5a2-d026cc3d2c52 - type: atomic-red-team name: Modify file timestamps using reference file technique: T1070.006 atomic_guid: 631ea661-d661-44b0-abdb-7a7f3fc08e50
Query: risk of The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x befor
Matching passage: CVE-2015-7945. CWE: CWE-200. CVSS: 7.5. The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2 allows remote attackers to obtain the DRBD secret via instance information job results.
Near-miss passage: CVE-2015-8669. CWE: CWE-200. CVSS: 5.300000190734863. libraries/config/messages.inc.php in phpMyAdmin 4.0.x before 4.0.10.12, 4.4.x before 4.4.15.2, and 4.5.x before 4.5.3.1 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
Query: patch priority for CVE-2015-5085
Matching passage: CVE-2015-5085. CWE: UNKNOWN. CVSS: 6.800000190734863. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-4435, CVE-2015-4438, CVE-2015-4441, CVE-2015-4445, CVE-2015-4447, CVE-2015-4451, CVE-2015-4452, and CVE-2015-5086.
Near-miss passage: CVE-2015-8410. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: detect Detects Obfuscated use of Environment Variables to execute PowerShell in logs
Matching passage: Sigma rule: Detects Obfuscated use of Environment Variables to execute PowerShell. Logsource: windows / security. Rule: title: Invoke-Obfuscation VAR+ Launcher - Security id: dcf2db1f-f091-425b-a821-c05875b8925a related: - id: 8ca7004b-e620-4ecb-870e-86129b5b8e75 type: derived status: test description: Detects Obfuscated use of Environment Variables to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceFileName|contains|all: - cmd - '"set' - -f ServiceFileName|contains: - /c - /r condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Shadow Copies deletion using operating systems utilities via PowerShell. Logsource: windows / ps_classic_start. Rule: title: Delete Volume Shadow Copies Via WMI With PowerShell id: 87df9ee1-5416-453a-8a08-e8d4a51e9ce1 status: stable description: Shadow Copies deletion using operating systems utilities via PowerShell references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md - https://www.fortinet.com/blog/threat-research/stomping-shadow-copies-a-second-look-into-deletion-methods author: frack113 date: 2021-06-03 modified: 2023-10-27 tags: - attack.impact - attack.t1490 logsource: product: windows category: ps_classic_start detection: selection: Data|contains|all: - Get-WmiObject - Win32_ShadowCopy Data|contains: - Delete() - Remove-WmiObject condition: selection falsepositives: - Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason level: high
Query: adversary uses Asymmetric Cryptography
Matching passage: T1573.002 Asymmetric Cryptography. Tactics: command and control. Description: Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal. For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002).
Near-miss passage: T1573.001 Symmetric Cryptography. Tactics: command and control. Description: Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.
Query: vulnerability: The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=get_soundcloud_player id parameter.
Matching passage: CVE-2015-9420. CWE: CWE-79. CVSS: 6.099999904632568. The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=get_soundcloud_player id parameter.
Near-miss passage: CVE-2015-4679. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the web interface in Airties RT-210 allow remote attackers to inject arbitrary web script or HTML via the (1) ddns_domainame or (2) ddns_account parameter to ddns.stm.
Query: describe CVE-2015-7514
Matching passage: CVE-2015-7514. CWE: CWE-200. CVSS: 6.5. OpenStack Ironic 4.2.0 through 4.2.1 does not "clean" the disk after use, which allows remote authenticated users to obtain sensitive information.
Near-miss passage: CVE-2015-8470. CWE: CWE-200. CVSS: 6.5. The console in Puppet Enterprise 3.7.x, 3.8.x, and 2015.2.x does not set the secure flag for the JSESSIONID cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.
Query: explain CWE-1326
Matching passage: CWE-1326 Missing Immutable Root of Trust in Hardware. A missing immutable root of trust in the hardware results in the ability to bypass secure boot or execute untrusted or adversarial boot code.
Near-miss passage: CWE-1298 Hardware Logic Contains Race Conditions. A race condition in the hardware logic results in undermining security guarantees of the system.
Query: detection rule: Detects suspicious Plink tunnel port forwarding to a local port
Matching passage: Sigma rule: Detects suspicious Plink tunnel port forwarding to a local port. Logsource: windows / process_creation. Rule: title: Suspicious Plink Port Forwarding id: 48a61b29-389f-4032-b317-b30de6b95314 status: test description: Detects suspicious Plink tunnel port forwarding to a local port references: - https://www.real-sec.com/2019/04/bypassing-network-restrictions-through-rdp-tunneling/ - https://medium.com/@informationsecurity/remote-ssh-tunneling-with-plink-exe-7831072b3d7d author: Florian Roth (Nextron Systems) date: 2021-01-19 modified: 2022-10-09 tags: - attack.command-and-control - attack.t1572 - attack.lateral-movement - attack.t1021.001 logsource: category: process_creation product: windows detection: selection: Description: Command-line SSH, Telnet, and Rlogin client CommandLine|contains: ' -R ' condition: selection falsepositives: - Administrative activity using a remote port forwarding to a local port level: high
Near-miss passage: Sigma rule: Detects the PowerShell command lines with special characters. Logsource: windows / process_creation. Rule: title: Potential PowerShell Command Line Obfuscation id: d7bcd677-645d-4691-a8d4-7a5602b780d1 status: test description: Detects the PowerShell command lines with special characters references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=64 author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp) date: 2020-10-15 modified: 2024-04-15 tags: - attack.execution - attack.stealth - attack.t1027 - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_re: - CommandLine|re: \+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+ - CommandLine|re: \{.*\{.*\{.*\{.*\{.*\{.*\{.*\{.*\{.*\{ - CommandLine|re: \^.*\^.*\^.*\^.*\^ - CommandLine|re: '`.*`.*`.*`.*`' filter_optional_amazonSSM: ParentImage: C:\Program Files\Amazon\SSM\ssm-document-worker.exe filter_optional_defender_atp: CommandLine|contains: - new EventSource("Microsoft.Windows.Sense.Client.Management" - public static extern bool InstallELAMCertificateInfo(SafeFileHandle handle); condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Amazon SSM Document Worker - Windows Defender ATP level: high