alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of The CoreGraphics component in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (me
Matching passage: CVE-2015-5926. CWE: CWE-119. CVSS: 6.800000190734863. The CoreGraphics component in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2015-5925.
Near-miss passage: CVE-2015-3214. CWE: CWE-119. CVSS: 6.900000095367432. The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index.
Query: patch priority for CVE-2015-2275
Matching passage: CVE-2015-2275. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in WoltLab Community Gallery 2.0 before 2014-12-26 allows remote attackers to inject arbitrary web script or HTML via the parameters[data][7][title] parameter in a saveImageData action to index.php/AJAXProxy.
Near-miss passage: CVE-2015-2665. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: vulnerability: Asterisk Open Source 12.x before 12.8.1 and 13.x before 13.1.1, when using the PJSIP channel driver, does not properly reclaim RTP ports, which allows remote authenticated users to
Matching passage: CVE-2015-1558. CWE: CWE-399. CVSS: 3.5. Asterisk Open Source 12.x before 12.8.1 and 13.x before 13.1.1, when using the PJSIP channel driver, does not properly reclaim RTP ports, which allows remote authenticated users to cause a denial of service (file descriptor consumption) via an SDP offer containing only incompatible codecs.
Near-miss passage: CVE-2015-0765. CWE: CWE-399. CVSS: 5.0. Cisco ONS 15454 System Software 10.30 and 10.301 allows remote attackers to cause a denial of service (tNetTask CPU consumption or card reset) via a flood of (1) IP or (2) Ethernet traffic, aka Bug ID CSCus57263.
Query: describe CVE-2015-8375
Matching passage: CVE-2015-8375. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in PHP-Fusion 9.
Near-miss passage: CVE-2015-0734. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities on the Cisco Email Security Appliance (ESA) 8.5.6-106 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug ID CSCut87743.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommo. Logsource: windows / process_creation. Rule: title: Cscript/Wscript Potentially Suspicious Child Process id: b6676963-0353-4f88-90f5-36c20d443c6a status: test description: 'Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommon exports or PowerShell spawning rundll32 or regsvr32. Malware such as Pikabot and Qakbot were seen using similar techniques as well as many others. ' references: - Internal Research - https://github.com/pr0xylife/Pikabot/blob/fc58126127adf0f65e78f4eec59675523f48f086/Pikabot_30.10.2023.txt - https://github.com/pr0xylife/Pikabot/blob/fc58126127adf0f65e78f4eec59675523f48f086/Pikabot_22.12.2023.txt author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86') date: 2023-05-15 modified: 2024-01-02 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \wscript.exe - \cscript.exe selection_cli_script_main: Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe selection_cli_script_option_mshta: CommandLine|contains|all: - mshta - http selection_cli_script_option_other: CommandLine|contains: - rundll32 - regsvr32 - msiexec selection_cli_standalone: Image|endswith: \rundll32.exe filter_main_rundll32_known_exports: Image|endswith: \rundll32.exe CommandLine|contains: - UpdatePerUserSystemParameters - PrintUIEntry - ClearMyTracksByProcess condition: selection_parent and ( selection_cli_standalone or (selection_cli_script_main and 1 of selection_cli_script_option_*) ) and not 1 of filter_main_* falsepositives: - Some false positives might occur with admin or third party software scripts. Investigate and apply additional filters accordingly. level: medium
Near-miss passage: Sigma rule: Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...). Logsource: windows / file_event. Rule: title: DLL Search Order Hijackig Via Additional Space in Path id: b6f91281-20aa-446a-b986-38a92813a18f status: test description: 'Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...) but with a space in order to trick DLL load search order and perform a "DLL Search Order Hijacking" attack ' references: - https://twitter.com/cyb3rops/status/1552932770464292864 - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-07-30 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: - C:\Windows \ - C:\Program Files \ - C:\Program Files (x86) \ TargetFilename|endswith: .dll condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-2489
Matching passage: CVE-2015-2489. CWE: CWE-264. CVSS: 4.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to gain privileges via a crafted web site, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-5645. CWE: CWE-264. CVSS: 6.5. ICZ MATCHA SNS before 1.3.7 allows remote authenticated users to obtain administrative privileges via unspecified vectors.
Query: vulnerability: The destroy_buffers function in libavcodec/sanm.c in FFmpeg before 2.7.2 does not properly maintain height and width values in the video context, which allows remote attackers to c
Matching passage: CVE-2015-6822. CWE: CWE-17. CVSS: 7.5. The destroy_buffers function in libavcodec/sanm.c in FFmpeg before 2.7.2 does not properly maintain height and width values in the video context, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via crafted LucasArts Smush video data.
Near-miss passage: CVE-2015-4963. CWE: CWE-17. CVSS: 7.5. IBM Security Access Manager for Web 7.x before 7.0.0.16 and 8.x before 8.0.1.3 mishandles WebSEAL HTTPTransformation requests, which allows remote attackers to read or write to arbitrary files via unspecified vectors.
Query: patch priority for CVE-2015-0582
Matching passage: CVE-2015-0582. CWE: CWE-20. CVSS: 5.0. The High Availability (HA) subsystem in Cisco NX-OS on MDS 9000 devices allows remote attackers to cause a denial of service via crafted traffic, aka Bug ID CSCuo09129.
Near-miss passage: CVE-2015-6256. CWE: CWE-20. CVSS: 5.0. Cisco ASR 5000 devices with software 19.0.M0.60828 allow remote attackers to cause a denial of service (OSPF process restart) via crafted length fields in headers of OSPF packets, aka Bug ID CSCuv62820.
Query: vulnerability: The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066.
Matching passage: CVE-2015-9353. CWE: CWE-89. CVSS: 7.199999809265137. The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066.
Near-miss passage: CVE-2015-10056. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in 2071174A vinylmap. It has been classified as critical. Affected is the function contact of the file recordstoreapp/views.py. The manipulation leads to sql injection. The name of the patch is b07b79a1e92cc62574ba0492cce000ef4a7bd25f. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218400.
Query: threat report mentioning Brute Force
Matching passage: T1110 Brute Force. Tactics: credential access. Description: Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.(Citation: Dragos Crashoverride 2018) Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), [Account Discovery](https://attack.mitre.org/techniques/T1087), or [Password Policy Discovery](https://attack.mitre.org/techniques/T1201). Adversaries may also combine brute forcing activity with behaviors such as [External Remote Services](https://attack.mitre.org/techniques/T1133) as part of Initial Access. If an adversary guesses the correct password but fails to login to a compromised account due to location-based conditional access policies, they may change their infrastructure until they match the victim’s location and therefore bypass those policies.(Citation: ReliaQuest Health Care Social Engineering Campaign 2024)
Near-miss passage: T1110.004 Credential Stuffing. Tactics: credential access. Description: Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed. The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts. Credential stuffing is a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies. Typically, management services over commonly used ports are used when stuffing credentials. Commonly targeted services include the following: * SSH (22/TCP) * Telnet (23/TCP) * FTP (21/TCP) * NetBIOS / SMB / Samba (139/TCP & 445/TCP) * LDAP (389/TCP) * Kerberos (88/TCP) * RDP / Terminal Services (3389/TCP) * HTTP/HTTP Management Services (80/TCP & 443/TCP) * MSSQL (1433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP) * VNC (5900/TCP) In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018)
Query: rule covering Detects password change for the computer's domain account or host principal via "ksetup.exe"
Matching passage: Sigma rule: Detects password change for the computer's domain account or host principal via "ksetup.exe". Logsource: windows / process_creation. Rule: title: Computer Password Change Via Ksetup.EXE id: de16d92c-c446-4d53-8938-10aeef41c8b6 status: test description: Detects password change for the computer's domain account or host principal via "ksetup.exe" references: - https://twitter.com/Oddvarmoe/status/1641712700605513729 - https://learn.microsoft.com/en-gb/windows-server/administration/windows-commands/ksetup author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-06 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \ksetup.exe - OriginalFileName: ksetup.exe selection_cli: CommandLine|contains: ' /setcomputerpassword ' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe,. Logsource: windows / process_creation. Rule: title: Potential Suspicious Browser Launch From Document Reader Process id: 1193d960-2369-499f-a158-7b50a31df682 status: test description: 'Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc. And connects to a web application over http(s), this could indicate a possible phishing attempt. ' references: - https://app.any.run/tasks/69c5abaa-92ad-45ba-8c53-c11e23e05d04/ - https://app.any.run/tasks/64043a79-165f-4052-bcba-e6e49f847ec1/ author: Joseph Kamau date: 2024-05-27 modified: 2025-10-07 tags: - attack.execution - attack.t1204.002 logsource: product: windows category: process_creation detection: selection: ParentImage|contains: - Acrobat Reader - Microsoft Office - PDF Reader Image|endswith: - \brave.exe - \chrome.exe - \firefox.exe - \msedge.exe - \opera.exe - \maxthon.exe - \seamonkey.exe - \vivaldi.exe CommandLine|contains: http filter_main_microsoft_help: CommandLine|contains: https://go.microsoft.com/fwlink/ filter_optional_foxit: CommandLine|contains: - http://ad.foxitsoftware.com/adlog.php? - https://globe-map.foxitservice.com/go.php?do=redirect condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unlikely in most cases, further investigation should be done in the commandline of the browser process to determine the context of the URL accessed. level: medium
Query: stealth using File/Path Exclusions
Matching passage: T1564.012 File/Path Exclusions. Tactics: stealth. Description: Adversaries may attempt to hide their file-based artifacts by writing them to specific folders or file names excluded from antivirus (AV) scanning and other defensive capabilities. AV and other file-based scanners often include exclusions to optimize performance as well as ease installation and legitimate use of applications. These exclusions may be contextual (e.g., scans are only initiated in response to specific triggering events/alerts), but are also often hardcoded strings referencing specific folders and/or files assumed to be trusted and legitimate.(Citation: Microsoft File Folder Exclusions) Adversaries may abuse these exclusions to hide their file-based artifacts. For example, rather than tampering with tool settings to add a new exclusion (i.e., [Disable or Modify Tools](https://attack.mitre.org/techniques/T1685)), adversaries may drop their file-based payloads in default or otherwise well-known exclusions. Adversaries may also use [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) and other [Discovery](https://attack.mitre.org/tactics/TA0007)/[Reconnaissance](https://attack.mitre.org/tactics/TA0043) activities to both discover and verify existing exclusions in a victim environment.
Near-miss passage: T1564.013 Bind Mounts. Tactics: stealth. Description: Adversaries may abuse bind mounts on file structures to hide their activity and artifacts from native utilities. A bind mount maps a directory or file from one location on the filesystem to another, similar to a shortcut on Windows. It’s commonly used to provide access to specific files or directories across different environments, such as inside containers or chroot environments, and requires sudo access. Adversaries may use bind mounts to map either an empty directory or a benign `/proc` directory to a malicious process’s `/proc` directory. Using the commands `mount –o bind /proc/benign-process /proc/malicious-process` (or `mount –B`), the malicious process's `/proc` directory is overlayed with the contents of a benign process's `/proc` directory. When system utilities query process activity, such as `ps` and `top`, the kernel follows the bind mount and presents the benign directory’s contents instead of the malicious process's actual `/proc` directory. As a result, these utilities display information that appears to come from the benign process, effectively hiding the malicious process's metadata, executable, or other artifacts from detection.(Citation: Cado Security Commando Cat 2024)(Citation: Ahn Lab CoinMiner 2023)
Query: describe CVE-2015-1860
Matching passage: CVE-2015-1860. CWE: CWE-119. CVSS: 6.800000190734863. Multiple buffer overflows in gui/image/qgifhandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a crafted GIF image.
Near-miss passage: CVE-2015-7092. CWE: CWE-119. CVSS: 6.599999904632568. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via a crafted TXXX frame within an ID3 tag in MP3 data in a movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, and CVE-2015-7117.
Query: exploit EMC SourceOne Email Supervisor before 7.2 does not properly employ random values for session IDs, which makes it easier for remote attackers to obtain access by guessing an ID.
Matching passage: CVE-2015-6845. CWE: UNKNOWN. CVSS: 7.5. EMC SourceOne Email Supervisor before 7.2 does not properly employ random values for session IDs, which makes it easier for remote attackers to obtain access by guessing an ID.
Near-miss passage: CVE-2015-0385. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.21 and earlier allows remote authenticated users to affect availability via unknown vectors related to Pluggable Auth.
Query: rule covering Detects when a all the rules have been deleted from the Windows Defender Firewall configuration
Matching passage: Sigma rule: Detects when a all the rules have been deleted from the Windows Defender Firewall configuration. Logsource: windows / firewall-as. Rule: title: All Rules Have Been Deleted From The Windows Firewall Configuration id: 79609c82-a488-426e-abcf-9f341a39365d status: test description: Detects when a all the rules have been deleted from the Windows Defender Firewall configuration references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10) author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-01-17 modified: 2024-01-22 tags: - attack.defense-impairment - attack.t1686.003 logsource: product: windows service: firewall-as detection: selection: EventID: - 2033 - 2059 filter_main_svchost: ModifyingApplication|endswith: :\Windows\System32\svchost.exe filter_optional_msmpeng: ModifyingApplication|contains|all: - :\ProgramData\Microsoft\Windows Defender\Platform\ - \MsMpEng.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* level: high
Near-miss passage: Sigma rule: Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which. Logsource: windows / process_creation. Rule: title: Import LDAP Data Interchange Format File Via Ldifde.EXE id: 6f535e01-ca1f-40be-ab8d-45b19c0c8b7f status: test description: 'Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server. ' references: - https://twitter.com/0gtweet/status/1564968845726580736 - https://strontic.github.io/xcyclopedia/library/ldifde.exe-979DE101F5059CEC1D2C56967CA2BAC0.html - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11) author: '@gott_cyber' date: 2022-09-02 modified: 2023-03-14 tags: - attack.command-and-control - attack.stealth - attack.t1218 - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \ldifde.exe - OriginalFileName: ldifde.exe selection_cli: CommandLine|contains|all: - -i - -f condition: all of selection_* falsepositives: - Since the content of the files are unknown, false positives are expected level: medium
Query: alert when Detects the process injection of a LittleCorporal generated Maldoc.
Matching passage: Sigma rule: Detects the process injection of a LittleCorporal generated Maldoc.. Logsource: windows / process_access. Rule: title: HackTool - LittleCorporal Generated Maldoc Injection id: 7bdde3bf-2a42-4c39-aa31-a92b3e17afac status: test description: Detects the process injection of a LittleCorporal generated Maldoc. references: - https://github.com/connormcgarr/LittleCorporal author: Christian Burkard (Nextron Systems) date: 2021-08-09 modified: 2023-11-28 tags: - attack.execution - attack.privilege-escalation - attack.stealth - attack.t1204.002 - attack.t1055.003 logsource: category: process_access product: windows detection: selection: SourceImage|endswith: \winword.exe CallTrace|contains|all: - :\Windows\Microsoft.NET\Framework64\v2. - UNKNOWN condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware ac. Logsource: windows / file_rename. Rule: title: Suspicious Appended Extension id: e3f673b3-65d1-4d80-9146-466f8b63fa99 status: test description: Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware activity renaming files and adding a custom extension to the encrypted files, such as ".jpg.crypted", ".docx.locky", etc. references: - https://app.any.run/tasks/d66ead5a-faf4-4437-93aa-65785afaf9e5/ - https://blog.cyble.com/2022/08/10/onyx-ransomware-renames-its-leak-site-to-vsop/ author: frack113 date: 2022-07-16 modified: 2023-11-11 tags: - attack.impact - attack.t1486 logsource: product: windows category: file_rename definition: 'Requirements: Microsoft-Windows-Kernel-File Provider with at least the KERNEL_FILE_KEYWORD_RENAME_SETLINK_PATH keyword' detection: selection: SourceFilename|endswith: - .doc - .docx - .jpeg - .jpg - .lnk - .pdf - .png - .pst - .rtf - .xls - .xlsx TargetFilename|contains: - .doc. - .docx. - .jpeg. - .jpg. - .lnk. - .pdf. - .png. - .pst. - .rtf. - .xls. - .xlsx. filter_main_generic: TargetFilename|endswith: - .backup - .bak - .old - .orig - .temp - .tmp filter_optional_anaconda: TargetFilename|contains: :\ProgramData\Anaconda3\ TargetFilename|endswith: .c~ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Backup software level: medium