alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Matching passage: CVE-2015-9365. CWE: CWE-79. CVSS: 6.099999904632568. Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Near-miss passage: CVE-2015-2973. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the Welcart plugin before 1.4.18 for WordPress allow remote attackers to inject arbitrary web script or HTML via the usces_referer parameter to (1) classes/usceshop.class.php, (2) includes/edit-form-advanced.php, (3) includes/edit-form-advanced30.php, (4) includes/edit-form-advanced34.php, (5) includes/member_edit_form.php, (6) includes/order_edit_form.php, (7) includes/order_list.php, or (8) includes/usces_item_master_list.php, related to admin.php.
Query: vulnerability: Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Swing.
Matching passage: CVE-2015-0407. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Swing.
Near-miss passage: CVE-2015-4938. CWE: UNKNOWN. CVSS: 5.0. IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 allows remote attackers to spoof servlets and obtain sensitive information via unspecified vectors.
Query: vulnerability: IBM Capacity Management Analytics 2.1.0.0 allows local users to decrypt usernames and passwords by leveraging access to setenv.sh and parameter.txt. IBM X-Force ID: 107861.
Matching passage: CVE-2015-7432. CWE: CWE-200. CVSS: 7.800000190734863. IBM Capacity Management Analytics 2.1.0.0 allows local users to decrypt usernames and passwords by leveraging access to setenv.sh and parameter.txt. IBM X-Force ID: 107861.
Near-miss passage: CVE-2015-6418. CWE: CWE-200. CVSS: 4.300000190734863. The random-number generator on Cisco Small Business RV routers 4.x and SA500 security appliances 2.2.07 does not have sufficient entropy, which makes it easier for remote attackers to determine a TLS key pair via unspecified computations upon handshake key-exchange data, aka Bug ID CSCus15224.
Query: write Sigma for Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "Remo
Matching passage: Sigma rule: Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "Remo. Logsource: windows / process_creation. Rule: title: RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses id: a6fc3c46-23b8-4996-9ea2-573f4c4d88c5 related: - id: f65e22f9-819e-4f96-9c7b-498364ae7a25 type: similar - id: 38a7625e-b2cb-485d-b83d-aff137d859f4 type: similar - id: cacef8fc-9d3d-41f7-956d-455c6e881bc5 type: similar status: test description: Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "RemoteFXvGPUDisablement.exe" binary to run custom PowerShell code via module load-order hijacking. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md - https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1 author: frack113 date: 2021-07-13 modified: 2023-05-09 tags: - attack.stealth - attack.t1218 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - Invoke-ATHRemoteFXvGPUDisablementCommand - Invoke-ATHRemoteFXvGPUDisableme condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Indicates user activity that is unusual for the user or consistent with known attack patterns.. Logsource: azure / riskdetection. Rule: title: Azure AD Threat Intelligence id: a2cb56ff-4f46-437a-a0fa-ffa4d1303cba status: test description: Indicates user activity that is unusual for the user or consistent with known attack patterns. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#azure-ad-threat-intelligence-sign-in - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#azure-ad-threat-intelligence-user - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-07 tags: - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation - attack.initial-access logsource: product: azure service: riskdetection detection: selection: riskEventType: investigationsThreatIntelligence condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Query: exploit FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face operation.
Matching passage: CVE-2015-9382. CWE: CWE-125. CVSS: 6.5. FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face operation.
Near-miss passage: CVE-2015-2697. CWE: CWE-125. CVSS: 4.0. The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\0' character in a long realm field within a TGS request.
Query: alert when Detects Obfuscated Powershell via VAR++ LAUNCHER
Matching passage: Sigma rule: Detects Obfuscated Powershell via VAR++ LAUNCHER. Logsource: windows / system. Rule: title: Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System id: 14bcba49-a428-42d9-b943-e2ce0f0f7ae6 status: test description: Detects Obfuscated Powershell via VAR++ LAUNCHER references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-13 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains|all: - '&&set' - cmd - /c - -f ImagePath|contains: - '{0}' - '{1}' - '{2}' - '{3}' - '{4}' - '{5}' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a websh. Logsource: windows / msexchange-management. Rule: title: Certificate Request Export to Exchange Webserver id: b7bc7038-638b-4ffd-880c-292c692209ef status: test description: Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a webshell references: - https://twitter.com/GossiTheDog/status/1429175908905127938 author: Max Altgelt (Nextron Systems) date: 2021-08-23 modified: 2023-01-23 tags: - attack.persistence - attack.t1505.003 logsource: service: msexchange-management product: windows detection: keywords_export_command: '|all': - New-ExchangeCertificate - ' -GenerateRequest' - ' -BinaryEncoded' - ' -RequestFile' keywords_export_params: - \\\\localhost\\C$ - \\\\127.0.0.1\\C$ - C:\\inetpub - .aspx condition: keywords_export_command and keywords_export_params falsepositives: - Unlikely level: critical
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects the creation of a file with the name "code_tunnel.json" which indicate execution and usage of VsCode tunneling u. Logsource: windows / file_event. Rule: title: Renamed VsCode Code Tunnel Execution - File Indicator id: d102b8f5-61dc-4e68-bd83-9a3187c67377 status: test description: 'Detects the creation of a file with the name "code_tunnel.json" which indicate execution and usage of VsCode tunneling utility by an "Image" or "Process" other than VsCode. ' references: - https://ipfyx.fr/post/visual-studio-code-tunnel/ - https://badoption.eu/blog/2023/01/31/code_c2.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-10-25 tags: - attack.command-and-control logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: \code_tunnel.json filter_main_legit_name: Image|endswith: - \code-tunnel.exe - \code.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "appverifUI.dll". Logsource: windows / image_load. Rule: title: Potential appverifUI.DLL Sideloading id: ee6cea48-c5b6-4304-a332-10fc6446f484 status: test description: Detects potential DLL sideloading of "appverifUI.dll" references: - https://web.archive.org/web/20220519091349/https://fatrodzianko.com/2020/02/15/dll-side-loading-appverif-exe/ author: X__Junior (Nextron Systems) date: 2023-06-20 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \appverifUI.dll filter_main_legit_path: Image: - C:\Windows\SysWOW64\appverif.exe - C:\Windows\System32\appverif.exe ImageLoaded|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Query: detection rule: Detects a network connection initiated by "wordpad.exe" over uncommon destination ports. This might indicate potential p
Matching passage: Sigma rule: Detects a network connection initiated by "wordpad.exe" over uncommon destination ports. This might indicate potential p. Logsource: windows / network_connection. Rule: title: Suspicious Wordpad Outbound Connections id: 786cdae8-fefb-4eb2-9227-04e34060db01 status: test description: 'Detects a network connection initiated by "wordpad.exe" over uncommon destination ports. This might indicate potential process injection activity from a beacon or similar mechanisms. ' references: - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit author: X__Junior (Nextron Systems) date: 2023-07-12 modified: 2023-12-15 tags: - attack.command-and-control - attack.stealth logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: \wordpad.exe filter_main_ports: DestinationPort: - 80 - 139 - 443 - 445 - 465 - 587 - 993 - 995 condition: selection and not 1 of filter_main_* falsepositives: - Other ports can be used, apply additional filters accordingly level: medium
Near-miss passage: Sigma rule: Detects attempts to enable the root account via "dsenableroot". Logsource: macos / process_creation. Rule: title: Root Account Enable Via Dsenableroot id: 821bcf4d-46c7-4b87-bc57-9509d3ba7c11 status: test description: Detects attempts to enable the root account via "dsenableroot" references: - https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1078.003/T1078.003.md - https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/persistence_enable_root_account.toml - https://ss64.com/osx/dsenableroot.html author: Sohan G (D4rkCiph3r) date: 2023-08-22 tags: - attack.privilege-escalation - attack.stealth - attack.t1078 - attack.t1078.001 - attack.t1078.003 - attack.initial-access - attack.persistence logsource: category: process_creation product: macos detection: selection: Image|endswith: /dsenableroot filter_main_disable: CommandLine|contains: ' -d ' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: Encoded PowerShell / command-line abuse matching Domain Accounts
Matching passage: T1078.002 Domain Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.(Citation: TechNet Credential Theft) Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.(Citation: Microsoft AD Accounts) Adversaries may compromise domain accounts, some with a high level of privileges, through various means such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or password reuse, allowing access to privileged resources of the domain.
Near-miss passage: T1078 Valid Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.(Citation: volexity_0day_sophos_FW) Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence. In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account.(Citation: CISA MFA PrintNightmare) The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.(Citation: TechNet Credential Theft)
Query: patch priority for CVE-2015-0614
Matching passage: CVE-2015-0614. CWE: CWE-19. CVSS: 7.099999904632568. The Connection Conversation Manager (aka CuCsMgr) process in Cisco Unity Connection 8.5 before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, 9.x before 9.1(2)SU2, and 10.0 before 10.0(1)SU1, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (core dump and restart) via crafted SIP INVITE messages, aka Bug ID CSCul26267.
Near-miss passage: CVE-2015-3763. CWE: CWE-19. CVSS: 4.300000190734863. Safari in Apple iOS before 8.4.1 does not limit the rate of JavaScript alert messages, which allows remote attackers to cause a denial of service (apparent browser locking) via a crafted web site.
Query: vulnerability: Unspecified vulnerability in HP NonStop Safeguard Security Software H06.x, L15.02, and J06.x before J06.19 allows remote authenticated users to gain privileges by leveraging Expand
Matching passage: CVE-2015-2123. CWE: UNKNOWN. CVSS: 9.0. Unspecified vulnerability in HP NonStop Safeguard Security Software H06.x, L15.02, and J06.x before J06.19 allows remote authenticated users to gain privileges by leveraging Expand access.
Near-miss passage: CVE-2015-2925. CWE: UNKNOWN. CVSS: 6.900000095367432. The prepend_path function in fs/dcache.c in the Linux kernel before 4.2.4 does not properly handle rename actions inside a bind mount, which allows local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack."
Query: rule covering Detects the enumeration of other remote systems.
Matching passage: Sigma rule: Detects the enumeration of other remote systems.. Logsource: linux / process_creation. Rule: title: Linux Remote System Discovery id: 11063ec2-de63-4153-935e-b1a8b9e616f1 status: test description: Detects the enumeration of other remote systems. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md author: Alejandro Ortuno, oscd.community date: 2020-10-22 modified: 2021-11-27 tags: - attack.discovery - attack.t1018 logsource: category: process_creation product: linux detection: selection_1: Image|endswith: /arp CommandLine|contains: -a selection_2: Image|endswith: /ping CommandLine|contains: - ' 10.' - ' 192.168.' - ' 172.16.' - ' 172.17.' - ' 172.18.' - ' 172.19.' - ' 172.20.' - ' 172.21.' - ' 172.22.' - ' 172.23.' - ' 172.24.' - ' 172.25.' - ' 172.26.' - ' 172.27.' - ' 172.28.' - ' 172.29.' - ' 172.30.' - ' 172.31.' - ' 127.' - ' 169.254.' condition: 1 of selection* falsepositives: - Legitimate administration activities level: low
Near-miss passage: Sigma rule: Detects creation of a file with an ".rdp" extension by an application that doesn't commonly create such files.. Logsource: windows / file_event. Rule: title: .RDP File Created By Uncommon Application id: fccfb43e-09a7-4bd2-8b37-a5a7df33386d related: - id: f748c45a-f8d3-4e6f-b617-fe176f695b8f type: derived status: test description: 'Detects creation of a file with an ".rdp" extension by an application that doesn''t commonly create such files. ' references: - https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/ - https://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-18 modified: 2024-11-01 tags: - attack.stealth logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: .rdp Image|endswith: - \brave.exe - \CCleaner Browser\Application\CCleanerBrowser.exe - \chromium.exe - \firefox.exe - \Google\Chrome\Application\chrome.exe - \iexplore.exe - \microsoftedge.exe - \msedge.exe - \Opera.exe - \Vivaldi.exe - \Whale.exe - \olk.exe - \Outlook.exe - \RuntimeBroker.exe - \Thunderbird.exe - \Discord.exe - \Keybase.exe - \msteams.exe - \Slack.exe - \teams.exe condition: selection falsepositives: - Unknown level: high
Query: playbook for alert: Lateral movement indicators for OS Credential Dumping
Matching passage: Playbook for T1003 OS Credential Dumping. 1) Validate alert telemetry against T1003. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: credential access. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures.(Citation: Brining MimiKatz to Unix) Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information. Several of t
Near-miss passage: Playbook for T1003.003 NTDS. Different response path focused on credential access.
Query: detect This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of in logs
Matching passage: Sigma rule: This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of. Logsource: windows / process_creation. Rule: title: Detection of PowerShell Execution via Sqlps.exe id: 0152550d-3a26-4efd-9f0e-54a0b28ae2f3 status: test description: 'This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs. ' references: - https://learn.microsoft.com/en-us/sql/tools/sqlps-utility?view=sql-server-ver15 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqlps/ - https://twitter.com/bryon_/status/975835709587075072 author: Agro (@agro_sev) oscd.community date: 2020-10-10 modified: 2022-12-09 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1127 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \sqlps.exe selection_image: - Image|endswith: \sqlps.exe - OriginalFileName: sqlps.exe filter_image: ParentImage|endswith: \sqlagent.exe condition: selection_parent or (selection_image and not filter_image) falsepositives: - Direct PS command execution through SQLPS.exe is uncommon, childprocess sqlps.exe spawned by sqlagent.exe is a legitimate action. level: medium
Near-miss passage: Sigma rule: Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom WMI query. Logsource: windows / registry_set. Rule: title: New BgInfo.EXE Custom WMI Query Registry Configuration id: cd277474-5c52-4423-a52b-ac2d7969902f related: - id: 992dd79f-dde8-4bb0-9085-6350ba97cfb3 type: similar status: test description: Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom WMI query via "BgInfo.exe" references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-16 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Software\Winternals\BGInfo\UserFields\ Details|startswith: '6' condition: selection falsepositives: - Legitimate WMI query level: medium
Query: describe CVE-2015-3637
Matching passage: CVE-2015-3637. CWE: CWE-89. CVSS: 8.100000381469727. SQL injection vulnerability in phpMyBackupPro when run in multi-user mode before 2.5 allows remote attackers to execute arbitrary SQL commands via the username and password parameters.
Near-miss passage: CVE-2015-10086. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability, which was classified as critical, was found in OpenCycleCompass server-php. Affected is an unknown function of the file api1/login.php. The manipulation of the argument user leads to sql injection. It is possible to launch the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is fa0d9bcf81c711a88172ad0d37a842f029ac3782. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-221808.