alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / image_load
Matching passage: Sigma rule: Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScript. Logsource: windows / image_load. Rule: title: WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load id: b439f47d-ef52-4b29-9a2f-57d8a96cb6b8 status: test description: Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity. references: - https://twitter.com/HunterPlaybook/status/1301207718355759107 - https://www.mdsec.co.uk/2020/09/i-like-to-move-it-windows-lateral-movement-part-1-wmi-event-subscription/ - https://threathunterplaybook.com/hunts/windows/200902-RemoteWMIActiveScriptEventConsumers/notebook.html author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-09-02 modified: 2023-02-22 tags: - attack.lateral-movement - attack.privilege-escalation - attack.persistence - attack.t1546.003 logsource: category: image_load product: windows detection: selection: Image|endswith: \scrcons.exe ImageLoaded|endswith: - \vbscript.dll - \wbemdisp.dll - \wshom.ocx - \scrrun.dll condition: selection falsepositives: - Legitimate event consumers - Dell computers on some versions register an event consumer that is known to cause false positives when brightness is changed by the corresponding keyboard button level: medium
Near-miss passage: Sigma rule: Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a OneNote atta. Logsource: windows / process_creation. Rule: title: OneNote.EXE Execution of Malicious Embedded Scripts id: 84b1706c-932a-44c4-ae28-892b28a25b94 status: test description: 'Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a OneNote attachment and then on the malicious link inside the ".one" file, it exports and executes the malicious embedded script from specific directories. ' references: - https://bazaar.abuse.ch/browse/tag/one/ author: '@kostastsale' date: 2023-02-02 tags: - attack.stealth - attack.t1218.001 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \onenote.exe Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \wscript.exe CommandLine|contains: - \exported\ - \onenoteofflinecache_files\ condition: selection falsepositives: - Unlikely level: high
Query: weakness Incorrect Register Defaults or Module Parameters
Matching passage: CWE-1221 Incorrect Register Defaults or Module Parameters. Hardware description language code incorrectly defines register defaults or hardware Intellectual Property (IP) parameters to insecure values.
Near-miss passage: CWE-837 Improper Enforcement of a Single, Unique Action. The product requires that an actor should only be able to perform an action once, or to have only one unique action, but the product does not enforce or improperly enforces this restriction.
Query: exploit The NavigatorServiceWorker::serviceWorker function in modules/serviceworkers/NavigatorServiceWorker.cpp in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attack
Matching passage: CVE-2015-1292. CWE: CWE-264. CVSS: 5.0. The NavigatorServiceWorker::serviceWorker function in modules/serviceworkers/NavigatorServiceWorker.cpp in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy by accessing a Service Worker.
Near-miss passage: CVE-2015-0864. CWE: CWE-264. CVSS: 8.0. Samsung Account (AKA com.osp.app.signin) before 1.6.0069 and 2.x before 2.1.0069 allows man-in-the-middle attackers to obtain sensitive information and execute arbitrary code.
Query: common weakness: Trust of System Event Data
Matching passage: CWE-360 Trust of System Event Data. Security based on event locations are insecure and can be spoofed.
Near-miss passage: CWE-313 Cleartext Storage in a File or on Disk. The product stores sensitive information in cleartext in a file, or on disk.
Query: vulnerability: The administration UI in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 133.9, 10.5 before Build 58.11, and 10.5.e before Build 56.1
Matching passage: CVE-2015-7998. CWE: CWE-200. CVSS: 5.0. The administration UI in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 133.9, 10.5 before Build 58.11, and 10.5.e before Build 56.1505.e on NetScaler Service Delivery Appliance Service VM (SVM) devices allows attackers to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-1000007. CWE: CWE-200. CVSS: 7.5. Remote file download vulnerability in wptf-image-gallery v1.03
Query: describe CVE-2015-1139
Matching passage: CVE-2015-1139. CWE: CWE-20. CVSS: 6.800000190734863. ImageIO in Apple OS X before 10.10.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .sgi file.
Near-miss passage: CVE-2015-2776. CWE: CWE-20. CVSS: 4.300000190734863. The parse_SST function in FreeXL before 1.0.0i allows remote attackers to cause a denial of service (memory consumption) via a crafted shared strings table in a workbook.
Query: CVE similar to CVE-2015-5409
Matching passage: CVE-2015-5409. CWE: CWE-119. CVSS: 7.5. Buffer overflow in HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to modify data or cause a denial of service via unspecified vectors.
Near-miss passage: CVE-2015-3664. CWE: CWE-119. CVSS: 6.800000190734863. QT Media Foundation in Apple QuickTime before 7.7.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3665 and CVE-2015-3669.
Query: vulnerability: Cross-site scripting (XSS) vulnerability on ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allows remote attackers to inject arbitrary web script or HTML via unspecifie
Matching passage: CVE-2015-7790. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability on ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-9304. CWE: CWE-79. CVSS: 6.099999904632568. The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.
Query: write Sigma for Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. Adversaries may use wmic to termina
Matching passage: Sigma rule: Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. Adversaries may use wmic to termina. Logsource: windows / process_creation. Rule: title: Application Termination Attempt via Wmic.EXE id: 49d9671b-0a0a-4c09-8280-d215bfd30662 related: - id: 847d5ff3-8a31-4737-a970-aeae8fe21765 type: derived status: test description: 'Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. Adversaries may use wmic to terminate security products or other applications on the compromised host. This event is triggered on on attempt and process creation can be either successful or unsuccessful. ' references: - https://cyble.com/blog/lockfile-ransomware-using-proxyshell-attack-to-deploy-ransomware/ - https://www.bitdefender.com/files/News/CaseStudies/study/377/Bitdefender-Whitepaper-WMI-creat4871-en-EN-GenericUse.pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-11 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WMIC.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains|all: - call - terminate condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_terminate_application/info.yml
Near-miss passage: Sigma rule: Detects execution of the Windows Kernel Debugger "kd.exe".. Logsource: windows / process_creation. Rule: title: Windows Kernel Debugger Execution id: 27ee9438-90dc-4bef-904b-d3ef927f5e7e status: test description: Detects execution of the Windows Kernel Debugger "kd.exe". references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-15 modified: 2024-04-24 tags: - attack.privilege-escalation - attack.stealth logsource: category: process_creation product: windows detection: selection: - Image|endswith: \kd.exe - OriginalFileName: kd.exe condition: selection falsepositives: - Rare occasions of legitimate cases where kernel debugging is necessary in production. Investigation is required level: medium
Query: mitigate Delay Execution
Matching passage: T1678 Delay Execution. Tactics: stealth. Description: Adversaries may employ various time-based methods to evade detection and analysis. These techniques often exploit system clocks, delays, or timing mechanisms to obscure malicious activity, blend in with benign activity, and avoid scrutiny. Adversaries can perform this behavior within virtualization/sandbox environments or natively on host systems. Adversaries may utilize programmatic `sleep` commands or native system scheduling functionality, for example [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053). Benign commands or other operations may also be used to delay malware execution or ensure prior commands have had time to execute properly. Loops or otherwise needless repetitions of commands, such as `ping`, may be used to delay malware execution and potentially exceed time thresholds of automated analysis environments.(Citation: Revil Independence Day)(Citation: Netskope Nitol) Another variation, commonly referred to as API hammering, involves making various calls to Native API functions in order to delay execution (while also potentially overloading analysis environments with junk data).(Citation: Joe Sec Nymaim)(Citation: Joe Sec Trickbot)
Near-miss passage: T1027.014 Polymorphic Code. Tactics: stealth. Description: Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection. Polymorphic code is a type of software capable of changing its runtime footprint during code execution.(Citation: polymorphic-blackberry) With each execution of the software, the code is mutated into a different version of itself that achieves the same purpose or objective as the original. This functionality enables the malware to evade traditional signature-based defenses, such as antivirus and antimalware tools.(Citation: polymorphic-sentinelone) Other obfuscation techniques can be used in conjunction with polymorphic code to accomplish the intended effects, including using mutation engines to conduct actions such as [Software Packing](https://attack.mitre.org/techniques/T1027/002), [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010), or [Encrypted/Encoded File](https://attack.mitre.org/techniques/T1027/013).(Citation: polymorphic-linkedin)(Citation: polymorphic-medium)
Query: exploit The detect_version function in wiretap/logcat.c in the Android Logcat file parser in Wireshark 1.12.x before 1.12.5 does not check the length of the payload, which allows remote at
Matching passage: CVE-2015-3815. CWE: CWE-119. CVSS: 5.0. The detect_version function in wiretap/logcat.c in the Android Logcat file parser in Wireshark 1.12.x before 1.12.5 does not check the length of the payload, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a packet with a crafted payload, as demonstrated by a length of zero, a different vulnerability than CVE-2015-3906.
Near-miss passage: CVE-2015-3123. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3117, CVE-2015-3130, CVE-2015-3133, CVE-2015-3134, and CVE-2015-4431.
Query: secure coding against Comparison of Incompatible Types
Matching passage: CWE-1024 Comparison of Incompatible Types. The product performs a comparison between two entities, but the entities are of different, incompatible types that cannot be guaranteed to provide correct results when they are directly compared.
Near-miss passage: CWE-386 Symbolic Name not Mapping to Correct Object. A constant symbolic reference to an object is used, even though the reference can resolve to a different object over time.
Query: risk of The XSSAuditor::canonicalize function in core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 44.0.2403.89, does not properly choose a trunc
Matching passage: CVE-2015-1285. CWE: CWE-200. CVSS: 5.0. The XSSAuditor::canonicalize function in core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 44.0.2403.89, does not properly choose a truncation point, which makes it easier for remote attackers to obtain sensitive information via an unspecified linear-time attack.
Near-miss passage: CVE-2015-7456. CWE: CWE-200. CVSS: 6.5. IBM Spectrum Scale 4.1.1 before 4.1.1.4, and 4.2.0.0, allows remote authenticated users to discover object-storage admin passwords via unspecified vectors.
Query: describe CVE-2015-2789
Matching passage: CVE-2015-2789. CWE: UNKNOWN. CVSS: 4.400000095367432. Unquoted Windows search path vulnerability in the Foxit Cloud Safe Update Service in the Cloud plugin in Foxit Reader 6.1 through 7.0.6.1126 allows local users to gain privileges via a Trojan horse program in the %SYSTEMDRIVE% folder.
Near-miss passage: CVE-2015-5431. CWE: UNKNOWN. CVSS: 6.5. HP Matrix Operating Environment before 7.5.0 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.
Query: describe CVE-2015-5544
Matching passage: CVE-2015-5544. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5552, and CVE-2015-5553.
Near-miss passage: CVE-2015-8778. CWE: CWE-119. CVSS: 9.800000190734863. Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via the size argument to the __hcreate_r function, which triggers out-of-bounds heap-memory access.
Query: intelligence brief on T1565.002
Matching passage: T1565.002 Transmitted Data Manipulation. Tactics: impact. Description: Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Manipulation may be possible over a network connection or between system processes where there is an opportunity deploy a tool that will intercept and change information. The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Near-miss passage: T1565.001 Stored Data Manipulation. Tactics: impact. Description: Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Query: vulnerability: The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the C
Matching passage: CVE-2015-7184. CWE: CWE-284. CVSS: 6.800000190734863. The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Near-miss passage: CVE-2015-8275. CWE: CWE-284. CVSS: 5.5. LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 allow attackers to write to arbitrary files via crafted EDOC files.
Query: risk of Cisco Unified Computing System (UCS) B Blade Server Software 2.2.x before 2.2.6 allows local users to cause a denial of service (host OS or BMC hang) by sending crafted packets ove
Matching passage: CVE-2015-4265. CWE: CWE-399. CVSS: 4.900000095367432. Cisco Unified Computing System (UCS) B Blade Server Software 2.2.x before 2.2.6 allows local users to cause a denial of service (host OS or BMC hang) by sending crafted packets over the Inter-IC (I2C) bus, aka Bug ID CSCuq77241.
Near-miss passage: CVE-2015-0671. CWE: CWE-399. CVSS: 5.0. The DNS implementation in Cisco Videoscape Distribution Suite for Internet Streaming (VDS-IS) 3.2(1) allows remote attackers to cause a denial of service (CPU consumption and network-resource consumption) via crafted packets, aka Bug ID CSCun15911.
Query: CWE for Assignment to Variable without Use
Matching passage: CWE-563 Assignment to Variable without Use. The variable's value is assigned but never used, making it a dead store.
Near-miss passage: CWE-375 Returning a Mutable Object to an Untrusted Caller. Sending non-cloned mutable data as a return value may result in that data being altered or deleted by the calling function.
Query: vulnerability: The emulation routines for unspecified X86 devices in Xen 3.2.x through 4.5.x does not properly initialize data, which allow local HVM guest users to obtain sensitive information v
Matching passage: CVE-2015-2044. CWE: CWE-200. CVSS: 2.0999999046325684. The emulation routines for unspecified X86 devices in Xen 3.2.x through 4.5.x does not properly initialize data, which allow local HVM guest users to obtain sensitive information via vectors involving an unsupported access size.
Near-miss passage: CVE-2015-5152. CWE: CWE-200. CVSS: 8.100000381469727. Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the require_ssl setting is set to true, which allows remote attackers to obtain user credentials via a man-in-the-middle attack.
Query: Sigma YAML for windows / registry_event
Matching passage: Sigma rule: Detects potential malicious modification of the property value of IsCredGuardEnabled from HKLM:\SYSTEM\CurrentControlSet. Logsource: windows / registry_event. Rule: title: Wdigest CredGuard Registry Modification id: 1a2d6c47-75b0-45bd-b133-2c0be75349fd status: test description: 'Detects potential malicious modification of the property value of IsCredGuardEnabled from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to disable Cred Guard on a system. This is usually used with UseLogonCredential to manipulate the caching credentials. ' references: - https://teamhydra.blog/2020/08/25/bypassing-credential-guard/ author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2019-08-25 modified: 2021-11-27 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: \IsCredGuardEnabled condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Window. Logsource: windows / process_creation. Rule: title: Arbitrary File Download Via ConfigSecurityPolicy.EXE id: 1f0f6176-6482-4027-b151-00071af39d7e status: test description: 'Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Windows Defender. Users can configure different pilot collections for each of the co-management workloads. It can be abused by attackers in order to upload or download files. ' references: - https://lolbas-project.github.io/lolbas/Binaries/ConfigSecurityPolicy/ author: frack113 date: 2021-11-26 modified: 2022-05-16 tags: - attack.exfiltration - attack.t1567 logsource: category: process_creation product: windows detection: selection_img: - CommandLine|contains: ConfigSecurityPolicy.exe - Image|endswith: \ConfigSecurityPolicy.exe - OriginalFileName: ConfigSecurityPolicy.exe selection_url: CommandLine|contains: - ftp:// - http:// - https:// condition: all of selection_* falsepositives: - Unknown level: medium
Query: risk of Advantech EKI-132x devices with firmware before 2015-12-31 allow remote attackers to bypass authentication via unspecified vectors.
Matching passage: CVE-2015-7938. CWE: CWE-287. CVSS: 9.800000190734863. Advantech EKI-132x devices with firmware before 2015-12-31 allow remote attackers to bypass authentication via unspecified vectors.
Near-miss passage: CVE-2015-1778. CWE: CWE-287. CVSS: 9.800000190734863. The custom authentication realm used by karaf-tomcat's "opendaylight" realm in Opendaylight before Helium SR3 will authenticate any username and password combination.
Query: describe CVE-2015-9049
Matching passage: CVE-2015-9049. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in the processing of certain responses from the USIM.
Near-miss passage: CVE-2015-9061. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, playReady DRM failed to check a length potentially leading to unauthorized access to secure memory.