alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channel
Matching passage: Sigma rule: Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channel. Logsource: firewall. Rule: title: Cleartext Protocol Usage id: d7fb8f0e-bd5f-45c2-b467-19571c490d7e status: stable description: 'Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels. Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access. ' references: - https://www.cisecurity.org/controls/cis-controls-list/ - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf author: Alexandr Yampolskyi, SOC Prime, Tim Shelton date: 2019-03-26 modified: 2022-10-10 tags: - attack.credential-access logsource: category: firewall detection: selection: dst_port: - 8080 - 21 - 80 - 23 - 50000 - 1521 - 27017 - 3306 - 1433 - 11211 - 15672 - 5900 - 5901 - 5902 - 5903 - 5904 selection_allow1: action: - forward - accept - 2 selection_allow2: blocked: 'false' condition: selection and 1 of selection_allow* falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual. Logsource: azure / activitylogs. Rule: title: Azure Virtual Network Device Modified or Deleted id: 15ef3fac-f0f0-4dc4-ada0-660aa72980b3 status: test description: 'Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual appliance, virtual hub, or virtual router. ' references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-08-08 modified: 2022-08-23 tags: - attack.impact logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/WRITE - MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/DELETE - MICROSOFT.NETWORK/NETWORKINTERFACES/WRITE - MICROSOFT.NETWORK/NETWORKINTERFACES/JOIN/ACTION - MICROSOFT.NETWORK/NETWORKINTERFACES/DELETE - MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/DELETE - MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/WRITE - MICROSOFT.NETWORK/VIRTUALHUBS/DELETE - MICROSOFT.NETWORK/VIRTUALHUBS/WRITE - MICROSOFT.NETWORK/VIRTUALROUTERS/WRITE - MICROSOFT.NETWORK/VIRTUALROUTERS/DELETE condition: selection falsepositives: - Virtual Network Device being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Virtual Network Device modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: patch priority for CVE-2015-9330
Matching passage: CVE-2015-9330. CWE: CWE-89. CVSS: 9.800000190734863. The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.
Near-miss passage: CVE-2015-7714. CWE: CWE-89. CVSS: 7.199999809265137. Multiple SQL injection vulnerabilities in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allow remote administrators to execute arbitrary SQL commands via the (1) id, (2) copy_field in a data_copy action, (3) pshow in an update_field action, (4) css, (5) tip, (6) cat_id, (7) text_search, (8) plisting, or (9) pwizard parameter to administrator/index.php.
Query: CVE similar to CVE-2015-7989
Matching passage: CVE-2015-7989. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted e-mail address, a different vulnerability than CVE-2015-5714.
Near-miss passage: CVE-2015-4292. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the management interface in Cisco Prime Central for Hosted Collaboration Solution (PC4HCS) 10.6(2) allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCuv45818.
Query: alert when Detects Baby Shark C2 Framework default communication patterns
Matching passage: Sigma rule: Detects Baby Shark C2 Framework default communication patterns. Logsource: proxy. Rule: title: HackTool - BabyShark Agent Default URL Pattern id: 304810ed-8853-437f-9e36-c4975c3dfd7e status: test description: Detects Baby Shark C2 Framework default communication patterns references: - https://nasbench.medium.com/understanding-detecting-c2-frameworks-babyshark-641be4595845 author: Florian Roth (Nextron Systems) date: 2021-06-09 modified: 2024-02-15 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-uri|contains: momyshark\?key= condition: selection falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: Detects the execution of DeviceCredentialDeployment to hide a process from view.. Logsource: windows / process_creation. Rule: title: DeviceCredentialDeployment Execution id: b8b1b304-a60f-4999-9a6e-c547bde03ffd status: test description: 'Detects the execution of DeviceCredentialDeployment to hide a process from view. ' references: - https://github.com/LOLBAS-Project/LOLBAS/pull/147 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: Image|endswith: \DeviceCredentialDeployment.exe condition: selection falsepositives: - Unlikely level: medium
Query: detect Detects potential token impersonation and theft. Example, when using "DuplicateToken(Ex)" and "ImpersonateLoggedOnUser" in logs
Matching passage: Sigma rule: Detects potential token impersonation and theft. Example, when using "DuplicateToken(Ex)" and "ImpersonateLoggedOnUser". Logsource: windows / security. Rule: title: Potential Access Token Abuse id: 02f7c9c1-1ae8-4c6a-8add-04693807f92f status: test description: Detects potential token impersonation and theft. Example, when using "DuplicateToken(Ex)" and "ImpersonateLoggedOnUser" with the "LOGON32_LOGON_NEW_CREDENTIALS flag". references: - https://www.elastic.co/fr/blog/how-attackers-abuse-access-token-manipulation - https://www.manageengine.com/log-management/cyber-security/access-token-manipulation.html author: Michaela Adams, Zach Mathis date: 2022-11-06 modified: 2023-04-26 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.001 - stp.4u logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 9 LogonProcessName: Advapi AuthenticationPackageName: Negotiate ImpersonationLevel: '%%1833' condition: selection falsepositives: - Anti-Virus level: medium
Near-miss passage: Sigma rule: Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.. Logsource: opencanary / application. Rule: title: OpenCanary - MSSQL Login Attempt Via Windows Authentication id: 6e78f90f-0043-4a01-ac41-f97681613a66 status: test description: 'Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication. ' references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.credential-access - attack.collection - attack.t1003 - attack.t1213 logsource: category: application product: opencanary detection: selection: logtype: 9002 condition: selection falsepositives: - Unlikely level: high
Query: Sigma rule for Detects successful authentication from potential clients using legacy authentication via user agent strings. This could
Matching passage: Sigma rule: Detects successful authentication from potential clients using legacy authentication via user agent strings. This could. Logsource: azure / signinlogs. Rule: title: Potential MFA Bypass Using Legacy Client Authentication id: 53bb4f7f-48a8-4475-ac30-5a82ddfdf6fc status: test description: Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack. references: - https://web.archive.org/web/20230217071802/https://blooteem.com/march-2022 - https://www.microsoft.com/en-us/security/blog/2021/10/26/protect-your-business-from-password-sprays-with-microsoft-dart-recommendations/ author: Harjot Singh, '@cyb3rjy0t' date: 2023-03-20 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.credential-access - attack.stealth - attack.t1078.004 - attack.t1110 logsource: product: azure service: signinlogs detection: selection: Status: Success userAgent|contains: - BAV2ROPC - CBAinPROD - CBAinTAR condition: selection falsepositives: - Known Legacy Accounts level: high
Near-miss passage: Sigma rule: Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "re. Logsource: windows / process_creation. Rule: title: Scripting/CommandLine Process Spawned Regsvr32 id: ab37a6ec-6068-432b-a64e-2c7bf95b1d22 related: - id: 8e2b24c9-4add-46a0-b4bb-0057b4e6187d type: obsolete status: test description: Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "regsvr32" instance. references: - https://web.archive.org/web/20171001085340/https://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html - https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-05-26 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - \wscript.exe Image|endswith: \regsvr32.exe filter_main_rpcproxy: ParentImage: C:\Windows\System32\cmd.exe CommandLine|endswith: ' /s C:\Windows\System32\RpcProxy\RpcProxy.dll' condition: selection and not 1 of filter_main_* falsepositives: - Legitimate ".bat", ".hta", ".ps1" or ".vbs" scripts leverage legitimately often. Apply additional filter and exclusions as necessary - Some legitimate Windows services level: medium
Query: exploit Cross-site scripting (XSS) vulnerability in IBM Content Navigator 2.0.2 before 2.0.2-ICN-FP007 and 2.0.3 before 2.0.3-ICN-FP003, as used in Content Manager, FileNet Content Manager
Matching passage: CVE-2015-1888. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Content Navigator 2.0.2 before 2.0.2-ICN-FP007 and 2.0.3 before 2.0.3-ICN-FP003, as used in Content Manager, FileNet Content Manager, Content Foundation, Content Manager OnDemand, and other products, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-1402. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: secure coding against Expected Behavior Violation
Matching passage: CWE-440 Expected Behavior Violation. A feature, API, or function does not perform according to its specification.
Near-miss passage: CWE-1037 Processor Optimization Removal or Modification of Security-critical Code. The developer builds a security-critical protection mechanism into the software, but the processor optimizes the execution of the program such that the mechanism is removed or modified.
Query: vulnerability: Directory traversal vulnerability in the replay server in IBM Tealeaf Customer Experience before 8.7.1.8818, 8.8 before 8.8.0.9026, 9.0.0, 9.0.0A, 9.0.1 before 9.0.1.1083, 9.0.1A b
Matching passage: CVE-2015-4988. CWE: CWE-22. CVSS: 8.600000381469727. Directory traversal vulnerability in the replay server in IBM Tealeaf Customer Experience before 8.7.1.8818, 8.8 before 8.8.0.9026, 9.0.0, 9.0.0A, 9.0.1 before 9.0.1.1083, 9.0.1A before 9.0.1.5073, 9.0.2 before 9.0.2.1095, and 9.0.2A before 9.0.2.5144 allows remote attackers to read arbitrary files via unspecified vectors.
Near-miss passage: CVE-2015-4031. CWE: CWE-22. CVSS: 10.0. Directory traversal vulnerability in saveFile.jsp in the development installation in Visual Mining NetChart allows remote attackers to write to arbitrary files via unspecified vectors.
Query: write Sigma for Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework
Matching passage: Sigma rule: Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework. Logsource: windows / process_creation. Rule: title: HackTool - Potential Impacket Lateral Movement Activity id: 10c14723-61c7-4c75-92ca-9af245723ad2 related: - id: e31f89f7-36fb-4697-8ab6-48823708353b type: obsolete status: stable description: Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework references: - https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/wmiexec.py - https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/atexec.py - https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/smbexec.py - https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/dcomexec.py - https://www.elastic.co/guide/en/security/current/suspicious-cmd-execution-via-wmi.html author: Ecco, oscd.community, Jonhnathan Ribeiro, Tim Rauch date: 2019-09-03 modified: 2023-02-21 tags: - attack.execution - attack.t1047 - attack.lateral-movement - attack.t1021.003 logsource: category: process_creation product: windows detection: selection_other: ParentImage|endswith: - \wmiprvse.exe - \mmc.exe - \explorer.exe - \services.exe CommandLine|contains|all: - cmd.exe - /Q - /c - \\\\127.0.0.1\\ - '&1' selection_atexec: ParentCommandLine|contains: - svchost.exe -k netsvcs - taskeng.exe CommandLine|contains|all: - cmd.exe - /C - Windows\Temp\ - '&1' condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of "RegAsm.exe" without a commandline flag or file, which might indicate potential process injecti. Logsource: windows / process_creation. Rule: title: RegAsm.EXE Execution Without CommandLine Flags or Files id: 651f87f7-12db-47f9-84c5-f27b081b94b6 status: experimental description: 'Detects the execution of "RegAsm.exe" without a commandline flag or file, which might indicate potential process injection activity. Usually "RegAsm.exe" should point to a dedicated DLL file or call the help with the "/?" flag. ' references: - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/agent-teslas-unique-approach-vbs-and-steganography-for-delivery-and-intrusion/ - https://www.zscaler.fr/blogs/security-research/threat-actors-exploit-cve-2017-11882-deliver-agent-tesla - https://learn.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool - https://app.any.run/tasks/ea944b89-69d8-49c8-ac1f-5c76ad300db2 - https://www.joesandbox.com/analysis/1467354/0/html author: frack113 date: 2025-06-04 tags: - attack.stealth - attack.t1218.009 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \RegAsm.exe - OriginalFileName: RegAsm.exe selection_cli: CommandLine|endswith: - RegAsm - RegAsm.exe - RegAsm.exe" - RegAsm.exe' condition: all of selection_* falsepositives: - Legitimate use of Regasm by developers. level: low
Query: what is T1218.002
Matching passage: T1218.002 Control Panel. Tactics: stealth. Description: Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings. Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a <code>CPlApplet</code> function.(Citation: Microsoft Implementing CPL)(Citation: TrendMicro CPL Malware Jan 2014) For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel.(Citation: Microsoft Implementing CPL) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.(Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013) Malicious Control Panel items can be delivered via [Phishing](https://attack.mitre.org/techniques/T1566) campaigns(Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware.(Citation: Palo Alto Reaver Nov 2017) Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists. Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to <code>HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls</code>. Even when these registered DLLs do not comply with the CPL file specification and do not export <code>CPlApplet</code> functions, they are loaded and executed through its <code>DllEntryPoint</code> when Control Panel is executed. CPL files not exporting <code>CPlApplet</code> are not directly executable.(Citation: ESET InvisiMole June 2020)
Near-miss passage: T1218.001 Compiled HTML File. Tactics: stealth. Description: Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program) A custom CHM file containing embedded payloads could be delivered to a victim then triggered by [User Execution](https://attack.mitre.org/techniques/T1204). CHM execution may also bypass application application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe. (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017)
Query: vulnerability: Race condition in the administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows remote attackers 
Matching passage: CVE-2015-7820. CWE: CWE-362. CVSS: 7.099999904632568. Race condition in the administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows remote attackers to obtain privileged-account access, and consequently provide ZipDownload.jsp input containing directory traversal sequences to read arbitrary files, via a request to port 40080 or 40443.
Near-miss passage: CVE-2015-7553. CWE: CWE-362. CVSS: 4.699999809265137. Race condition in the kernel in Red Hat Enterprise Linux 7, kernel-rt and Red Hat Enterprise MRG 2, when the nfnetlink_log module is loaded, allows local users to cause a denial of service (panic) by creating netlink sockets.
Query: risk of IOKit in the kernel in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a d
Matching passage: CVE-2015-5845. CWE: CWE-119. CVSS: 9.300000190734863. IOKit in the kernel in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-5844 and CVE-2015-5846.
Near-miss passage: CVE-2015-8865. CWE: CWE-119. CVSS: 7.300000190734863. The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles continuation-level jumps, which allows context-dependent attackers to cause a denial of service (buffer overflow and application crash) or possibly execute arbitrary code via a crafted magic file.
Query: alert when Detects execution of "TroubleshootingPack" cmdlets to leverage CVE-2022-30190 or action similar to "msdt" lolbin (as des
Matching passage: Sigma rule: Detects execution of "TroubleshootingPack" cmdlets to leverage CVE-2022-30190 or action similar to "msdt" lolbin (as des. Logsource: windows / ps_script. Rule: title: Troubleshooting Pack Cmdlet Execution id: 03409c93-a7c7-49ba-9a4c-a00badf2a153 status: test description: Detects execution of "TroubleshootingPack" cmdlets to leverage CVE-2022-30190 or action similar to "msdt" lolbin (as described in LOLBAS) references: - https://twitter.com/nas_bench/status/1537919885031772161 - https://lolbas-project.github.io/lolbas/Binaries/Msdt/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-21 tags: - attack.stealth - attack.t1202 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Invoke-TroubleshootingPack - C:\Windows\Diagnostics\System\PCW - -AnswerFile - -Unattended condition: selection falsepositives: - Legitimate usage of "TroubleshootingPack" cmdlet for troubleshooting purposes level: medium
Near-miss passage: Sigma rule: Detects usage of "IMEWDBLD.exe" to download arbitrary files. Logsource: windows / process_creation. Rule: title: Arbitrary File Download Via IMEWDBLD.EXE id: 863218bd-c7d0-4c52-80cd-0a96c09f54af related: - id: 8d7e392e-9b28-49e1-831d-5949c6281228 type: derived status: test description: Detects usage of "IMEWDBLD.exe" to download arbitrary files references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-10---windows---powershell-download - https://lolbas-project.github.io/lolbas/Binaries/IMEWDBLD/ author: Swachchhanda Shrawan Poudel date: 2023-11-09 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \IMEWDBLD.exe - OriginalFileName: imewdbld.exe selection_cli: CommandLine|contains: - http:// - https:// condition: all of selection_* falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-9343
Matching passage: CVE-2015-9343. CWE: CWE-352. CVSS: 8.800000190734863. The wp-rollback plugin before 1.2.3 for WordPress has CSRF.
Near-miss passage: CVE-2015-5534. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Oxwall before 1.8 allow remote attackers to hijack the authentication of administrators for requests that (1) put the website under maintenance via the maintenance_enable parameter or (2) conduct cross-site scripting (XSS) attacks via the maintenance_text parameter to admin/pages/maintenance.