alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directori
Matching passage: Sigma rule: Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directori. Logsource: windows / registry_event. Rule: title: Suspicious Run Key from Download id: 9c5037d1-c568-49b3-88c7-9846a5bdc2be status: test description: Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories references: - https://app.any.run/tasks/c5bef5b7-f484-4c43-9cf3-d5c5c7839def/ - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poude (Nextron Systems) date: 2019-10-01 modified: 2025-02-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_event product: windows detection: selection: Image|contains: - \AppData\Local\Packages\Microsoft.Outlook_ - \AppData\Local\Microsoft\Olk\Attachments\ - \Downloads\ - \Temporary Internet Files\Content.Outlook\ - \Local Settings\Temporary Internet Files\ TargetObject|contains: - \Software\Microsoft\Windows\CurrentVersion\Run - \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run condition: selection falsepositives: - Software installers downloaded and used by users level: high
Near-miss passage: Sigma rule: Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location. These files are use. Logsource: windows / file_event. Rule: title: Self Extraction Directive File Created In Potentially Suspicious Location id: 760e75d8-c3b5-409b-a9bf-6130b4c4603f related: - id: ab90dab8-c7da-4010-9193-563528cfa347 type: derived status: test description: 'Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location. These files are used by the "iexpress.exe" utility in order to create self extracting packages. Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries. ' references: - https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html - https://en.wikipedia.org/wiki/IExpress - https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2024-02-05 tags: - attack.stealth - attack.t1218 logsource: category: file_event product: windows detection: selection: TargetFilename|contains: - :\ProgramData\ - :\Temp\ - :\Windows\System32\Tasks\ - :\Windows\Tasks\ - :\Windows\Temp\ - \AppData\Local\Temp\ TargetFilename|endswith: .sed condition: selection falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-6498
Matching passage: CVE-2015-6498. CWE: CWE-254. CVSS: 7.5. Alcatel-Lucent Home Device Manager before 4.1.10, 4.2.x before 4.2.2 allows remote attackers to spoof and make calls as target devices.
Near-miss passage: CVE-2015-7863. CWE: CWE-254. CVSS: 5.0. The default configuration of Persistent Accelerite Radia Client Automation (formerly HP Client Automation) 7.9 through 9.1 before 2015-02-19 enables a remote Notify capability without the Extended Notify Security features, which might allow remote attackers to bypass intended access restrictions via unspecified vectors.
Query: explain CWE-1316
Matching passage: CWE-1316 Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges. The address map of the on-chip fabric has protected and unprotected regions overlapping, allowing an attacker to bypass access control to the overlapping portion of the protected region.
Near-miss passage: CWE-1390 Weak Authentication. The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.
Query: secure coding against Authentication Bypass Using an Alternate Path or Channel
Matching passage: CWE-288 Authentication Bypass Using an Alternate Path or Channel. The product requires authentication, but the product has an alternate path or channel that does not require authentication.
Near-miss passage: CWE-1428 Reliance on HTTP instead of HTTPS. The product provides or relies on use of HTTP communications when HTTPS is available.
Query: describe CVE-2015-7703
Matching passage: CVE-2015-7703. CWE: CWE-20. CVSS: 7.5. The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers with an IP address that is allowed to send configuration requests, and with knowledge of the remote configuration password to write to arbitrary files via the :config command.
Near-miss passage: CVE-2015-1382. CWE: CWE-20. CVSS: 5.0. parsers.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (invalid read and crash) via vectors related to an HTTP time header.
Query: risk of Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before
Matching passage: CVE-2015-3078. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3089, CVE-2015-3090, and CVE-2015-3093.
Near-miss passage: CVE-2015-6991. CWE: CWE-119. CVSS: 6.800000190734863. FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, CVE-2015-7010, and CVE-2015-7018.
Query: exploit Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0
Matching passage: CVE-2015-5123. CWE: CWE-416. CVSS: 9.800000190734863. Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.
Near-miss passage: CVE-2015-5113. CWE: CWE-416. CVSS: 6.800000190734863. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-4448, CVE-2015-5095, CVE-2015-5099, CVE-2015-5101, CVE-2015-5111, and CVE-2015-5114.
Query: campaign using Data Transfer Size Limits
Matching passage: T1030 Data Transfer Size Limits. Tactics: exfiltration. Description: An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.
Near-miss passage: T1567.002 Exfiltration to Cloud Storage. Tactics: exfiltration. Description: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet. Examples of cloud storage services include Dropbox and Google Docs. Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service.
Query: CVE similar to CVE-2015-4733
Matching passage: CVE-2015-4733. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI.
Near-miss passage: CVE-2015-0319. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-0317.
Query: containment actions for Encoded PowerShell / command-line abuse matching Clear Mailbox Data
Matching passage: Playbook for T1070.008 Clear Mailbox Data. 1) Validate alert telemetry against T1070.008. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests. Adversaries may manipulate emails and mailbox dat
Near-miss passage: Playbook for T1070.006 Timestomp. Different response path focused on stealth.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the WebGUI in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the zone parameter in a del action
Matching passage: CVE-2015-4029. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the WebGUI in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the zone parameter in a del action to services_captiveportal_zones.php.
Near-miss passage: CVE-2015-3447. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in macIpSpoofView.html in Dell SonicWall SonicOS 7.5.0.12 and 6.x allow remote attackers to inject arbitrary web script or HTML via the (1) searchSpoof or (2) searchSpoofIpDet parameter.
Query: SOC alert related to Exfiltration Over Symmetric Encrypted Non-C2 Protocol
Matching passage: T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Symmetric encryption algorithms are those that use shared or the same keys/secrets on each end of the channel. This requires an exchange or pre-arranged agreement/possession of the value used to encrypt and decrypt data. Network protocols that use asymmetric encryption often utilize symmetric encryption once keys are exchanged, but adversaries may opt to manually share keys and implement symmetric cryptographic algorithms (ex: RC4, AES) vice using mechanisms that are baked into a protocol. This may result in multiple layers of encryption (in protocols that are natively encrypted such as HTTPS) or encryption in protocols that not typically encrypted (such as HTTP or FTP).
Near-miss passage: T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Asymmetric encryption algorithms are those that use different keys on each end of the channel. Also known as public-key cryptography, this requires pairs of cryptographic keys that can encrypt/decrypt data from the corresponding key. Each end of the communication channels requires a private key (only in the procession of that entity) and the public key of the other entity. The public keys of each entity are exchanged before encrypted communications begin. Network protocols that use asymmetric encryption (such as HTTPS/TLS/SSL) often utilize symmetric encryption once keys are exchanged. Adversaries may opt to use these encrypted mechanisms that are baked into a protocol.
Query: exploit Cross-site scripting (XSS) vulnerability in the web server on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allows remote attackers
Matching passage: CVE-2015-6488. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the web server on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-9347. CWE: CWE-79. CVSS: 6.099999904632568. The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors.
Query: explain CWE-425
Matching passage: CWE-425 Direct Request ('Forced Browsing'). The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
Near-miss passage: CWE-1083 Data Access from Outside Expected Data Manager Component. The product is intended to manage data access through a particular data manager component such as a relational or non-SQL database, but it contains code that performs data access operations without using that component.
Query: vulnerability: The IPv4 implementation in the Linux kernel before 3.18.8 does not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of
Matching passage: CVE-2015-1465. CWE: CWE-17. CVSS: 7.800000190734863. The IPv4 implementation in the Linux kernel before 3.18.8 does not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allows remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets.
Near-miss passage: CVE-2015-0222. CWE: CWE-17. CVSS: 5.0. ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries.
Query: describe CVE-2015-2077
Matching passage: CVE-2015-2077. CWE: CWE-200. CVSS: 5.0. The SDK for Komodia Redirector with SSL Digestor, as used in Lavasoft Ad-Aware Web Companion 1.1.885.1766 and Ad-Aware AdBlocker (alpha) 1.3.69.1, Qustodio for Windows, Atom Security, Inc. StaffCop 5.8, and other products, uses the same X.509 certificate private key for a root CA certificate across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging knowledge of this key, as originally reported for Superfish VisualDiscovery on certain Lenovo Notebook laptop products.
Near-miss passage: CVE-2015-1677. CWE: CWE-200. CVSS: 2.0999999046325684. The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to bypass the ASLR protection mechanism via a crafted function call, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability," a different vulnerability than CVE-2015-1676, CVE-2015-1678, CVE-2015-1679, and CVE-2015-1680.
Query: describe CVE-2015-0413
Matching passage: CVE-2015-0413. CWE: UNKNOWN. CVSS: 1.899999976158142. Unspecified vulnerability in Oracle Java SE 7u72 and 8u25 allows local users to affect integrity via unknown vectors related to Serviceability.
Near-miss passage: CVE-2015-0303. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0306.
Query: detect Detects service installation with suspicious folder patterns in logs
Matching passage: Sigma rule: Detects service installation with suspicious folder patterns. Logsource: windows / system. Rule: title: Service Installation with Suspicious Folder Pattern id: 1b2ae822-6fe1-43ba-aa7c-d1a3b3d1d5f2 status: test description: Detects service installation with suspicious folder patterns references: - Internal Research author: pH-T (Nextron Systems) date: 2022-03-18 modified: 2022-03-24 tags: - attack.persistence - attack.privilege-escalation - car.2013-09-005 - attack.t1543.003 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7045 selection_img_paths: - ImagePath|re: ^[Cc]:\\[Pp]rogram[Dd]ata\\.{1,9}\.exe - ImagePath|re: ^[Cc]:\\.{1,9}\.exe condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events in an attempt to evade detectio. Logsource: kubernetes / application / audit. Rule: title: Kubernetes Events Deleted id: 3132570d-cab2-4561-9ea6-1743644b2290 related: - id: 225d8b09-e714-479c-a0e4-55e6f29adf35 type: derived status: test description: 'Detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events in an attempt to evade detection. ' references: - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Delete%20K8S%20events/ author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.stealth - attack.t1070 logsource: category: application product: kubernetes service: audit detection: selection: verb: delete objectRef.resource: events condition: selection falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-1365
Matching passage: CVE-2015-1365. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to write to arbitrary files via a .. (dot dot) in the q parameter.
Near-miss passage: CVE-2015-2971. CWE: CWE-22. CVSS: 5.5. Directory traversal vulnerability in Seeds acmailer before 3.8.18 and 3.9.x before 3.9.12 Beta allows remote authenticated users to delete arbitrary files via a crafted string.
Query: detection rule: Detects shellshock expressions in log files
Matching passage: Sigma rule: Detects shellshock expressions in log files. Logsource: linux. Rule: title: Shellshock Expression id: c67e0c98-4d39-46ee-8f6b-437ebf6b950e status: test description: Detects shellshock expressions in log files references: - https://owasp.org/www-pdf-archive/Shellshock_-_Tudor_Enache.pdf author: Florian Roth (Nextron Systems) date: 2017-03-14 modified: 2022-10-09 tags: - attack.persistence - attack.t1505.003 logsource: product: linux detection: keywords: - (){:;}; - () {:;}; - () { :;}; - () { :; }; condition: keywords falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of a "privileged" container, an action which could be indicative of a threat actor mounting a conta. Logsource: kubernetes / application / audit. Rule: title: Privileged Container Deployed id: c5cd1b20-36bb-488d-8c05-486be3d0cb97 status: test description: 'Detects the creation of a "privileged" container, an action which could be indicative of a threat actor mounting a container breakout attacks. A privileged container is a container that can access the host with all of the root capabilities of the host machine. This allows it to view, interact and modify processes, network operations, IPC calls, the file system, mount points, SELinux configurations etc. as the root user on the host. Various versions of "privileged" containers can be specified, e.g. by setting the securityContext.privileged flag in the resource specification, setting non-standard Linux capabilities, or configuring the hostNetwork/hostPID fields ' references: - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Privileged%20container/ - https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-kubernetes.html#privilegeescalation-kubernetes-privilegedcontainer - https://www.elastic.co/guide/en/security/current/kubernetes-pod-created-with-hostnetwork.html - https://www.elastic.co/guide/en/security/current/kubernetes-container-created-with-excessive-linux-capabilities.html author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.t1611 - attack.privilege-escalation logsource: category: application product: kubernetes service: audit detection: selection: verb: create objectRef.resource: pods capabilities: '*' condition: selection falsepositives: - Unknown level: low
Query: CVE similar to CVE-2015-0651
Matching passage: CVE-2015-0651. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the web GUI in Cisco Application Networking Manager (ANM), and Device Manager (DM) on Cisco 4710 Application Control Engine (ACE) appliances, allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuo99753.
Near-miss passage: CVE-2015-4355. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Watchdog Aggregator module for Drupal allows remote attackers to hijack the authentication of administrators for requests that enable or disable monitoring sites via unspecified vectors.