alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactformpp_id parameter to cp_contactformpp.php.
Matching passage: CVE-2015-9234. CWE: CWE-89. CVSS: 7.199999809265137. The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactformpp_id parameter to cp_contactformpp.php.
Near-miss passage: CVE-2015-7569. CWE: CWE-89. CVSS: 8.800000190734863. SQL injection vulnerability in "yeager/y.php/tab_USERLIST" in Yeager CMS 1.2.1 allows local users to execute arbitrary SQL commands via the "pagedir_orderby" parameter.
Query: write Sigma for Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebe
Matching passage: Sigma rule: Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebe. Logsource: windows / process_creation. Rule: title: ImagingDevices Unusual Parent/Child Processes id: f11f2808-adb4-46c0-802a-8660db50fa99 status: test description: Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebee activity references: - https://thedfirreport.com/2022/09/26/bumblebee-round-two/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-27 modified: 2022-12-29 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \WmiPrvSE.exe - \svchost.exe - \dllhost.exe Image|endswith: \ImagingDevices.exe selection_child: ParentImage|endswith: \ImagingDevices.exe condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of rar.exe, on the command line, to create an archive with password protection or with a specific compre. Logsource: windows / process_creation. Rule: title: Rar Usage with Password and Compression Level id: faa48cae-6b25-4f00-a094-08947fef582f status: test description: Detects the use of rar.exe, on the command line, to create an archive with password protection or with a specific compression level. This is pretty indicative of malicious actions. references: - https://labs.sentinelone.com/the-anatomy-of-an-apt-attack-and-cobaltstrike-beacons-encoded-configuration/ - https://ss64.com/bash/rar.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md author: '@ROxPinTeddy' date: 2020-05-12 modified: 2022-03-16 tags: - attack.collection - attack.t1560.001 logsource: category: process_creation product: windows detection: selection_password: CommandLine|contains: ' -hp' selection_other: CommandLine|contains: - ' -m' - ' a ' condition: selection_password and selection_other falsepositives: - Legitimate use of Winrar command line version - Other command line tools, that use these flags level: high
Query: Sigma YAML for macos / process_creation
Matching passage: Sigma rule: Detects attempts to enable the guest account using the sysadminctl utility. Logsource: macos / process_creation. Rule: title: Guest Account Enabled Via Sysadminctl id: d7329412-13bd-44ba-a072-3387f804a106 status: test description: Detects attempts to enable the guest account using the sysadminctl utility references: - https://ss64.com/osx/sysadminctl.html author: Sohan G (D4rkCiph3r) date: 2023-02-18 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 - attack.t1078.001 logsource: category: process_creation product: macos detection: selection: Image|endswith: /sysadminctl CommandLine|contains|all: - ' -guestAccount' - ' on' condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects remote RPC calls to read information about scheduled tasks via AtScv. Logsource: rpc_firewall / application. Rule: title: Remote Schedule Task Recon via AtScv id: f177f2bc-5f3e-4453-b599-57eefce9a59c status: test description: Detects remote RPC calls to read information about scheduled tasks via AtScv references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931 - https://github.com/zeronetworks/rpcfirewall - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.discovery logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:1ff70682-0a51-30e8-076d-740be8cee98b"' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 1ff70682-0a51-30e8-076d-740be8cee98b filter: OpNum: - 0 - 1 condition: selection and not filter falsepositives: - Unknown level: high
Query: describe CVE-2015-0334
Matching passage: CVE-2015-0334. CWE: UNKNOWN. CVSS: 9.300000190734863. Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-0336.
Near-miss passage: CVE-2015-0432. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier allows remote authenticated users to affect availability via vectors related to Server : InnoDB : DDL : Foreign Key.
Query: exploit The service daemon in CRIU creates log and dump files insecurely, which allows local users to create arbitrary files and take ownership of existing files via unspecified vectors re
Matching passage: CVE-2015-5228. CWE: CWE-264. CVSS: 7.800000190734863. The service daemon in CRIU creates log and dump files insecurely, which allows local users to create arbitrary files and take ownership of existing files via unspecified vectors related to a directory path.
Near-miss passage: CVE-2015-5301. CWE: CWE-264. CVSS: 5.5. providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).
Query: weakness Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Matching passage: CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. eval).
Near-miss passage: CWE-605 Multiple Binds to the Same Port. When multiple sockets are allowed to bind to the same port, other services on that port may be stolen or spoofed.
Query: detection rule: Detects suspicious command with /dev/tcp
Matching passage: Sigma rule: Detects suspicious command with /dev/tcp. Logsource: linux. Rule: title: Suspicious Use of /dev/tcp id: 6cc5fceb-9a71-4c23-aeeb-963abe0b279c status: test description: Detects suspicious command with /dev/tcp references: - https://www.andreafortuna.org/2021/03/06/some-useful-tips-about-dev-tcp/ - https://book.hacktricks.xyz/shells/shells/linux - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-1---port-scan author: frack113 date: 2021-12-10 modified: 2023-01-06 tags: - attack.reconnaissance logsource: product: linux detection: keywords: - cat </dev/tcp/ - exec 3<>/dev/tcp/ - echo >/dev/tcp/ - bash -i >& /dev/tcp/ - sh -i >& /dev/udp/ - 0<&196;exec 196<>/dev/tcp/ - exec 5<>/dev/tcp/ - (sh)0>/dev/tcp/ - bash -c 'bash -i >& /dev/tcp/ - echo -e '#!/bin/bash\nbash -i >& /dev/tcp/ condition: keywords falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility.. Logsource: windows / ps_module. Rule: title: HackTool - Evil-WinRm Execution - PowerShell Module id: 9fe55ea2-4cd6-4491-8a54-dd6871651b51 status: test description: 'Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility. ' references: - https://github.com/Hackplayers/evil-winrm/blob/7514b055d67ec19836e95c05bd63e7cc47c4c2aa/evil-winrm.rb - https://github.com/search?q=repo%3AHackplayers%2Fevil-winrm++shell.run%28&type=code author: Nasreddine Bencherchali (Nextron Systems) date: 2024-02-25 tags: - attack.lateral-movement logsource: product: windows category: ps_module detection: selection_wsm: ContextInfo|contains: - :\Windows\System32\wsmprovhost.exe - :\Windows\SysWOW64\wsmprovhost.exe selection_payload_1: Payload|contains: - value="(get-location).path - value="(get-item*).length - 'Invoke-Binary ' - Donut-Loader -process_id*-donutfile - Bypass-4MSI - IEX ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($a))).replace('???','') selection_payload_2: Payload|contains|all: - $servicios = Get-ItemProperty "registry::HKLM\System\CurrentControlSet\Services\" - Where-Object {$_.imagepath -notmatch "system" -and $_.imagepath -ne $null } | Select-Object pschildname,imagepath selection_payload_3: Payload|contains|all: - $a += \"$($_.FullName.Replace('\\','/'))/\"}else{ $a += \"$($_.FullName.Replace('\\', '/'))\" } - $a=@();$ condition: selection_wsm and 1 of selection_payload_* falsepositives: - Unknown level: high
Query: write Sigma for Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask.
Matching passage: Sigma rule: Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask.. Logsource: windows / process_access. Rule: title: Uncommon Process Access Rights For Target Image id: a24e5861-c6ca-4fde-a93c-ba9256feddf0 status: test description: 'Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask. ' references: - https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2024-05-27 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.011 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: - \calc.exe - \calculator.exe - \mspaint.exe - \notepad.exe - \ping.exe - \wordpad.exe - \write.exe GrantedAccess: '0x1FFFFF' condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.. Logsource: windows / security. Rule: title: Suspicious Teams Application Related ObjectAcess Event id: 25cde13e-8e20-4c29-b949-4e795b76f16f status: test description: Detects an access to authentication tokens and accounts of Microsoft Teams desktop application. references: - https://www.bleepingcomputer.com/news/security/microsoft-teams-stores-auth-tokens-as-cleartext-in-windows-linux-macs/ - https://www.vectra.ai/blogpost/undermining-microsoft-teams-security-by-mining-tokens author: '@SerkinValery' date: 2022-09-16 tags: - attack.credential-access - attack.t1528 logsource: product: windows service: security detection: selection: EventID: 4663 ObjectName|contains: - \Microsoft\Teams\Cookies - \Microsoft\Teams\Local Storage\leveldb filter: ProcessName|contains: \Microsoft\Teams\current\Teams.exe condition: selection and not filter falsepositives: - Unknown level: high
Query: weakness External Control of Critical State Data
Matching passage: CWE-642 External Control of Critical State Data. The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.
Near-miss passage: CWE-99 Improper Control of Resource Identifiers ('Resource Injection'). The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.
Query: alert when Detects the use of the Microsoft Windows Resource Leak Diagnostic tool "rdrleakdiag.exe" to dump process memory
Matching passage: Sigma rule: Detects the use of the Microsoft Windows Resource Leak Diagnostic tool "rdrleakdiag.exe" to dump process memory. Logsource: windows / process_creation. Rule: title: Process Memory Dump via RdrLeakDiag.EXE id: edadb1e5-5919-4e4c-8462-a9e643b02c4b related: - id: 6355a919-2e97-4285-a673-74645566340d type: obsolete status: test description: Detects the use of the Microsoft Windows Resource Leak Diagnostic tool "rdrleakdiag.exe" to dump process memory references: - https://www.pureid.io/dumping-abusing-windows-credentials-part-1/ - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/ - https://lolbas-project.github.io/lolbas/Binaries/Rdrleakdiag/ - https://twitter.com/0gtweet/status/1299071304805560321?s=21 - https://news.sophos.com/en-us/2024/06/05/operation-crimson-palace-a-technical-deep-dive author: Cedric MAURUGEON, Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems) date: 2021-09-24 modified: 2024-08-15 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rdrleakdiag.exe - OriginalFileName: RdrLeakDiag.exe selection_cli_dump: CommandLine|contains|windash: - /memdmp - fullmemdmp selection_cli_output_process: CommandLine|contains|windash: - ' /o ' - ' /p ' condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code.. Logsource: windows / process_creation. Rule: title: AspNetCompiler Execution id: a01b8329-5953-4f73-ae2d-aa01e1f35f00 related: - id: 9ccba514-7cb6-4c5c-b377-700758f2f120 type: similar - id: 4c7f49ee-2638-43bb-b85b-ce676c30b260 type: similar - id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622 type: similar status: test description: Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code. references: - https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/ - https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/ author: frack113 date: 2021-11-24 modified: 2025-02-24 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection: Image|contains: - :\Windows\Microsoft.NET\Framework\ - :\Windows\Microsoft.NET\Framework64\ - :\Windows\Microsoft.NET\FrameworkArm\ - :\Windows\Microsoft.NET\FrameworkArm64\ Image|endswith: \aspnet_compiler.exe condition: selection falsepositives: - Unknown level: medium
Query: threat report mentioning Supply Chain Compromise
Matching passage: T1195 Supply Chain Compromise. Tactics: initial access. Description: Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise can take place at any stage of the supply chain including: * Manipulation of development tools * Manipulation of a development environment * Manipulation of source code repositories (public or private) * Manipulation of source code in open-source dependencies * Manipulation of software update/distribution mechanisms * Compromised/infected system images (removable media infected at the factory)(Citation: IBM Storwize)(Citation: Schneider Electric USB Malware) * Replacement of legitimate software with modified versions * Sales of modified/counterfeit products to legitimate distributors * Shipment interdiction While supply chain compromise can impact any component of hardware or software, adversaries looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels.(Citation: Avast CCleaner3 2018)(Citation: Microsoft Dofoil 2018)(Citation: Command Five SK 2011) Adversaries may limit targeting to a desired victim set or distribute malicious software to a broad set of consumers but only follow up with specific victims.(Citation: Symantec Elderwood Sept 2012)(Citation: Avast CCleaner3 2018)(Citation: Command Five SK 2011) Popular open-source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise) In some cases, adversaries may conduct “second-order” supply chain compromises by leveraging the access gained from an initial supply chain compromise to further compromise a software component.(Citation: Krebs 3cx overview 2023) This may allow the threat actor to spread to even more victims.
Near-miss passage: T1195.003 Compromise Hardware Supply Chain. Tactics: initial access. Description: Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system. Hardware backdoors may be inserted into various devices, such as servers, workstations, network infrastructure, or peripherals.
Query: CVE similar to CVE-2015-1635
Matching passage: CVE-2015-1635. CWE: CWE-94. CVSS: 9.800000190734863. HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."
Near-miss passage: CVE-2015-5693. CWE: CWE-94. CVSS: 7.900000095367432. The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands via vectors related to "traffic capture."
Query: patch priority for CVE-2015-9148
Matching passage: CVE-2015-9148. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, SD 400, SD 425, SD 430, SD 450, SD 600, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, and SDX20, in the Diag User-PD command registration function, a length variable used during buffer allocation is not checked, so if it is very large, an integer overflow followed by a buffer overflow occurs.
Near-miss passage: CVE-2015-3076. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-9161, CVE-2015-3046, CVE-2015-3049, CVE-2015-3050, CVE-2015-3051, CVE-2015-3052, CVE-2015-3056, CVE-2015-3057, and CVE-2015-3070.
Query: detection rule: Detects usage of crontab to list the tasks of the user
Matching passage: Sigma rule: Detects usage of crontab to list the tasks of the user. Logsource: linux / process_creation. Rule: title: Crontab Enumeration id: 403ed92c-b7ec-4edd-9947-5b535ee12d46 status: test description: Detects usage of crontab to list the tasks of the user references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.discovery - attack.t1007 logsource: product: linux category: process_creation detection: selection: Image|endswith: /crontab CommandLine|contains: ' -l' condition: selection falsepositives: - Legitimate use of crontab level: low
Near-miss passage: Sigma rule: Loading unsigned image (DLL, EXE) into LSASS process. Logsource: windows / image_load. Rule: title: Unsigned Image Loaded Into LSASS Process id: 857c8db3-c89b-42fb-882b-f681c7cf4da2 status: test description: Loading unsigned image (DLL, EXE) into LSASS process references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Teymur Kheirkhabarov, oscd.community date: 2019-10-22 modified: 2021-11-27 tags: - attack.credential-access - attack.t1003.001 logsource: category: image_load product: windows detection: selection: Image|endswith: \lsass.exe Signed: 'false' condition: selection falsepositives: - Valid user connecting using RDP level: medium
Query: describe CVE-2015-4941
Matching passage: CVE-2015-4941. CWE: CWE-17. CVSS: 5.300000190734863. IBM WebSphere MQ Light 1.x before 1.0.2 mishandles abbreviated TLS handshakes, which allows remote attackers to cause a denial of service (MQXR service crash) via unspecified vectors.
Near-miss passage: CVE-2015-0805. CWE: CWE-17. CVSS: 7.5. The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 makes an incorrect memset call during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors that trigger rendering of 2D graphics content.
Query: rule covering Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool
Matching passage: Sigma rule: Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool. Logsource: windows / process_creation. Rule: title: HackTool - Inveigh Execution id: b99a1518-1ad5-4f65-bc95-1ffff97a8fd0 status: test description: Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool references: - https://github.com/Kevin-Robertson/Inveigh - https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-24 modified: 2023-02-04 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \Inveigh.exe - OriginalFileName: - \Inveigh.exe - \Inveigh.dll - Description: Inveigh - CommandLine|contains: - ' -SpooferIP' - ' -ReplyToIPs ' - ' -ReplyToDomains ' - ' -ReplyToMACs ' - ' -SnifferIP' condition: selection falsepositives: - Very unlikely level: critical
Near-miss passage: Sigma rule: Detects execution of "curl.exe" with the "file://" protocol handler in order to read local files.. Logsource: windows / process_creation. Rule: title: Local File Read Using Curl.EXE id: aa6f6ea6-0676-40dd-b510-6e46f02d8867 status: test description: Detects execution of "curl.exe" with the "file://" protocol handler in order to read local files. references: - https://curl.se/docs/manpage.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-07-27 tags: - attack.execution logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \curl.exe - OriginalFileName: curl.exe selection_cli: CommandLine|contains: file:/// condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_local_file_read/info.yml