alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Cross-site request forgery (CSRF) vulnerability in Cisco Unified Intelligence Center 10.6(1) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSC
Matching passage: CVE-2015-0740. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco Unified Intelligence Center 10.6(1) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus28826.
Near-miss passage: CVE-2015-6655. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Pligg CMS 2.0.2 allows remote attackers to hijack the authentication of administrators for requests that add an administrator via a request to admin/admin_users.php.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of certutil with the "encode" flag to encode a file to base64. This can be abused by threat actors. Logsource: windows / process_creation. Rule: title: File Encoded To Base64 Via Certutil.EXE id: e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a status: test description: Detects the execution of certutil with the "encode" flag to encode a file to base64. This can be abused by threat actors and attackers for data exfiltration references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil - https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/ - https://lolbas-project.github.io/lolbas/Binaries/Certutil/ author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2019-02-24 modified: 2024-03-05 tags: - attack.stealth - attack.t1027 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certutil.exe - OriginalFileName: CertUtil.exe selection_cli: CommandLine|contains|windash: -encode condition: all of selection_* falsepositives: - As this is a general purpose rule, legitimate usage of the encode functionality will trigger some false positives. Apply additional filters accordingly level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_encode/info.yml
Near-miss passage: Sigma rule: Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation b. Logsource: windows / process_creation. Rule: title: Potential PowerShell Obfuscation Via Reversed Commands id: b6b49cd1-34d6-4ead-b1bf-176e9edba9a4 status: test description: Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers references: - https://2019.offzone.moscow/ru/report/hunting-for-powershell-abuses/ - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=66 author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton date: 2020-10-11 modified: 2023-05-31 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli: CommandLine|contains: - hctac - kaerb - dnammoc - ekovn - eliFd - rahc - etirw - golon - tninon - eddih - tpircS - ssecorp - llehsrewop - esnopser - daolnwod - tneilCbeW - tneilc - ptth - elifotevas - 46esab - htaPpmeTteG - tcejbO - maerts - hcaerof - retupmoc filter_main_encoded_keyword: CommandLine|contains: - ' -EncodedCommand ' - ' -enc ' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unlikely level: high
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2730B router (rev C1) with firmware GE_1.01 allow remote authenticated users to inject arbitrary web script or HTM
Matching passage: CVE-2015-1028. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2730B router (rev C1) with firmware GE_1.01 allow remote authenticated users to inject arbitrary web script or HTML via the (1) domainname parameter to dnsProxy.cmd (DNS Proxy Configuration Panel); the (2) brName parameter to lancfg2get.cgi (Lan Configuration Panel); the (3) wlAuthMode, (4) wl_wsc_reg, or (5) wl_wsc_mode parameter to wlsecrefresh.wl (Wireless Security Panel); or the (6) wlWpaPsk parameter to wlsecurity.wl (Wireless Password Viewer).
Near-miss passage: CVE-2015-1180. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Web Reports in EventSentry 3.1.0 allows remote attackers to inject arbitrary web script or HTML via the pageId parameter to networktile/bullet.
Query: describe CVE-2015-2510
Matching passage: CVE-2015-2510. CWE: CWE-119. CVSS: 9.300000190734863. Buffer overflow in the Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 SP3, Office 2010 SP2, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "Graphics Component Buffer Overflow Vulnerability."
Near-miss passage: CVE-2015-2491. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2485 and CVE-2015-2541.
Query: campaign using Python
Matching passage: T1059.006 Python. Tactics: execution. Description: Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the <code>python.exe</code> interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.(Citation: Zscaler APT31 Covid-19 October 2020) Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.
Near-miss passage: T1059.003 Windows Command Shell. Tactics: execution. Description: Adversaries may abuse the Windows command shell for execution. The Windows command shell ([cmd](https://attack.mitre.org/software/S0106)) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via [Remote Services](https://attack.mitre.org/techniques/T1021) such as [SSH](https://attack.mitre.org/techniques/T1021/004).(Citation: SSH in Windows) Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems. Adversaries may leverage [cmd](https://attack.mitre.org/software/S0106) to execute various commands and payloads. Common uses include [cmd](https://attack.mitre.org/software/S0106) to execute a single command, or abusing [cmd](https://attack.mitre.org/software/S0106) interactively with input and output forwarded over a command and control channel.
Query: CVE similar to CVE-2015-7913
Matching passage: CVE-2015-7913. CWE: UNKNOWN. CVSS: 7.199999809265137. ag_server_service.exe in the AggreGate Server Service in Tibbo AggreGate before 5.30.06 allows local users to execute arbitrary Java code with SYSTEM privileges by using the Apache Axis AdminService deployment method to publish a class.
Near-miss passage: CVE-2015-4864. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Privileges.
Query: risk of Cisco ASR 5500 System Architecture Evolution (SAE) Gateway devices allow remote attackers to cause a denial of service (CPU consumption and SNMP outage) via malformed SNMP packets,
Matching passage: CVE-2015-0617. CWE: CWE-399. CVSS: 5.0. Cisco ASR 5500 System Architecture Evolution (SAE) Gateway devices allow remote attackers to cause a denial of service (CPU consumption and SNMP outage) via malformed SNMP packets, aka Bug ID CSCur13393.
Near-miss passage: CVE-2015-3810. CWE: CWE-399. CVSS: 7.800000190734863. epan/dissectors/packet-websocket.c in the WebSocket dissector in Wireshark 1.12.x before 1.12.5 uses a recursive algorithm, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted packet.
Query: Outbound C2 pattern associated with Resource Forking
Matching passage: T1564.009 Resource Forking. Tactics: stealth. Description: Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.(Citation: macOS Hierarchical File System Overview) Usage of a resource fork is identifiable when displaying a file’s extended attributes, using <code>ls -l@</code> or <code>xattr -l</code> commands. Resource forks have been deprecated and replaced with the application bundle structure. Non-localized resources are placed at the top level directory of an application bundle, while localized resources are placed in the <code>/Resources</code> folder.(Citation: Resource and Data Forks)(Citation: ELC Extended Attributes) Adversaries can use resource forks to hide malicious data that may otherwise be stored directly in files. Adversaries can execute content with an attached resource fork, at a specified offset, that is moved to an executable location then invoked. Resource fork content may also be obfuscated/encrypted until execution.(Citation: sentinellabs resource named fork 2020)(Citation: tau bundlore erika noerenberg 2020)
Near-miss passage: T1564.007 VBA Stomping. Tactics: stealth. Description: Adversaries may hide malicious Visual Basic for Applications (VBA) payloads embedded within MS Office documents by replacing the VBA source code with benign data.(Citation: FireEye VBA stomp Feb 2020) MS Office documents with embedded VBA content store source code inside of module streams. Each module stream has a <code>PerformanceCache</code> that stores a separate compiled version of the VBA source code known as p-code. The p-code is executed when the MS Office version specified in the <code>_VBA_PROJECT</code> stream (which contains the version-dependent description of the VBA project) matches the version of the host MS Office application.(Citation: Evil Clippy May 2019)(Citation: Microsoft _VBA_PROJECT Stream) An adversary may hide malicious VBA code by overwriting the VBA source code location with zero’s, benign code, or random bytes while leaving the previously compiled malicious p-code. Tools that scan for malicious VBA source code may be bypassed as the unwanted code is hidden in the compiled p-code. If the VBA source code is removed, some tools might even think that there are no macros present. If there is a version match between the <code>_VBA_PROJECT</code> stream and host MS Office application, the p-code will be executed, otherwise the benign VBA source code will be decompressed and recompiled to p-code, thus removing malicious p-code and potentially bypassing dynamic analysis.(Citation: Walmart Roberts Oct 2018)(Citation: FireEye VBA stomp Feb 2020)(Citation: pcodedmp Bontchev)
Query: write Sigma for Detects execution of "certutil" with the "addstore" flag in order to install a new certificate on the system. Adversarie
Matching passage: Sigma rule: Detects execution of "certutil" with the "addstore" flag in order to install a new certificate on the system. Adversarie. Logsource: windows / process_creation. Rule: title: New Root Certificate Installed Via Certutil.EXE id: d2125259-ddea-4c1c-9c22-977eb5b29cf0 related: - id: 42821614-9264-4761-acfc-5772c3286f76 type: derived - id: 46591fae-7a4c-46ea-aec3-dff5e6d785dc type: obsolete status: test description: 'Detects execution of "certutil" with the "addstore" flag in order to install a new certificate on the system. Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md author: oscd.community, @redcanary, Zach Stanford @svch0st date: 2023-03-05 modified: 2024-03-05 tags: - attack.defense-impairment - attack.t1553.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certutil.exe - OriginalFileName: CertUtil.exe selection_cli_add: CommandLine|contains|windash: -addstore selection_cli_store: CommandLine|contains: root condition: all of selection_* falsepositives: - Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to test if GPO push doesn't trigger FP level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_certificate_installation/info.yml
Near-miss passage: Sigma rule: Detects enumeration of local system accounts. This information can help adversaries determine which local accounts exist. Logsource: linux / process_creation. Rule: title: Local System Accounts Discovery - Linux id: b45e3d6f-42c6-47d8-a478-df6bd6cf534c status: test description: Detects enumeration of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.001/T1087.001.md - https://my.f5.com/manage/s/article/K589 - https://man.freebsd.org/cgi/man.cgi?pwd_mkdb author: Alejandro Ortuno, oscd.community, CheraghiMilad date: 2020-10-08 modified: 2024-12-10 tags: - attack.discovery - attack.t1087.001 logsource: category: process_creation product: linux detection: selection_1: Image|endswith: /lastlog selection_2: CommandLine|contains: '''x:0:''' selection_3: Image|endswith: - /cat - /ed - /head - /more - /nano - /tail - /vi - /vim - /less - /emacs - /sqlite3 - /makemap CommandLine|contains: - /etc/passwd - /etc/shadow - /etc/sudoers - /etc/spwd.db - /etc/pwd.db - /etc/master.passwd selection_4: Image|endswith: /id selection_5: Image|endswith: /lsof CommandLine|contains: -u condition: 1 of selection* falsepositives: - Legitimate administration activities level: low
Query: write Sigma for Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been
Matching passage: Sigma rule: Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been. Logsource: linux / process_creation. Rule: title: Remote Access Tool - Team Viewer Session Started On Linux Host id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d related: - id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357 type: similar - id: f459ccb4-9805-41ea-b5b2-55e279e2424a type: similar status: test description: 'Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder. ' references: - Internal Research author: Josh Nickels, Qi Nan date: 2024-03-11 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: process_creation product: linux detection: selection: ParentImage|endswith: /TeamViewer_Service Image|endswith: /TeamViewer_Desktop CommandLine|endswith: /TeamViewer_Desktop --IPCport 5939 --Module 1 condition: selection falsepositives: - Legitimate usage of TeamViewer level: low
Near-miss passage: Sigma rule: Detects the creation of a remote thread from a Powershell process in an uncommon target process. Logsource: windows / create_remote_thread. Rule: title: Remote Thread Creation Via PowerShell In Uncommon Target id: 99b97608-3e21-4bfe-8217-2a127c396a0e related: - id: eeb2e3dc-c1f4-40dd-9bd5-149ee465ad50 type: similar status: test description: Detects the creation of a remote thread from a Powershell process in an uncommon target process references: - https://www.fireeye.com/blog/threat-research/2018/06/bring-your-own-land-novel-red-teaming-technique.html author: Florian Roth (Nextron Systems) date: 2018-06-25 modified: 2023-11-10 tags: - attack.execution - attack.stealth - attack.t1218.011 - attack.t1059.001 logsource: product: windows category: create_remote_thread detection: selection: SourceImage|endswith: - \powershell.exe - \pwsh.exe TargetImage|endswith: - \rundll32.exe - \regsvr32.exe condition: selection falsepositives: - Unknown level: medium
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the Job Manager plugin 0.7.22 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the email fie
Matching passage: CVE-2015-2321. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Job Manager plugin 0.7.22 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the email field.
Near-miss passage: CVE-2015-9368. CWE: CWE-79. CVSS: 6.099999904632568. Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Query: patch priority for CVE-2015-6374
Matching passage: CVE-2015-6374. CWE: CWE-20. CVSS: 4.300000190734863. The web interface in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, aka Bug ID CSCux10604.
Near-miss passage: CVE-2015-0647. CWE: CWE-20. CVSS: 7.800000190734863. Cisco IOS 12.2, 12.4, 15.0, 15.2, and 15.3 allows remote attackers to cause a denial of service (device reload) via malformed Common Industrial Protocol (CIP) UDP packets, aka Bug ID CSCum98371.
Query: rule covering Detects file being transferred via ScreenConnect RMM
Matching passage: Sigma rule: Detects file being transferred via ScreenConnect RMM. Logsource: windows / application. Rule: title: Remote Access Tool - ScreenConnect File Transfer id: 5d19eb78-5b5b-4ef2-a9f0-4bfa94d58a13 related: - id: b1f73849-6329-4069-bc8f-78a604bb8b23 type: similar status: test description: Detects file being transferred via ScreenConnect RMM references: - https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling - https://github.com/SigmaHQ/sigma/pull/4467 author: Ali Alwashali date: 2023-10-10 tags: - attack.execution - attack.t1059.003 logsource: service: application product: windows detection: selection: Provider_Name: ScreenConnect EventID: 201 Data|contains: Transferred files with action condition: selection falsepositives: - Legitimate use of ScreenConnect level: low
Near-miss passage: Sigma rule: Detect change of the user account associated with the FAX service to avoid the escalation problem.. Logsource: windows / registry_set. Rule: title: Change User Account Associated with the FAX Service id: e3fdf743-f05b-4051-990a-b66919be1743 status: test description: Detect change of the user account associated with the FAX service to avoid the escalation problem. references: - https://twitter.com/dottor_morte/status/1544652325570191361 - https://raw.githubusercontent.com/RiccardoAncarani/talks/master/F-Secure/unorthodox-lateral-movement.pdf author: frack113 date: 2022-07-17 modified: 2022-12-30 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection: TargetObject: HKLM\System\CurrentControlSet\Services\Fax\ObjectName filter: Details|contains: NetworkService condition: selection and not filter falsepositives: - Unknown level: high
Query: SIEM correlation: reconnaissance activity consistent with Social Media
Matching passage: T1593.001 Social Media. Tactics: reconnaissance. Description: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. [Spearphishing Service](https://attack.mitre.org/techniques/T1598/001)).(Citation: Cyware Social Media) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).
Near-miss passage: T1593 Search Open Websites/Domains. Tactics: reconnaissance. Description: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.(Citation: Cyware Social Media)(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking) Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Phishing](https://attack.mitre.org/techniques/T1566)).
Query: describe CVE-2015-0410
Matching passage: CVE-2015-0410. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows remote attackers to affect availability via unknown vectors related to Security.
Near-miss passage: CVE-2015-2589. CWE: UNKNOWN. CVSS: 4.900000095367432. Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect availability via vectors related to S10 Branded Zone.