alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects command lines that contain the 'accepteula' flag which could be a sign of execution of one of the Sysinternals t
Matching passage: Sigma rule: Detects command lines that contain the 'accepteula' flag which could be a sign of execution of one of the Sysinternals t. Logsource: windows / process_creation. Rule: title: Potential Execution of Sysinternals Tools id: 7cccd811-7ae9-4ebe-9afd-cb5c406b824b related: - id: 25ffa65d-76d8-4da5-a832-3f2b0136e133 type: derived status: test description: Detects command lines that contain the 'accepteula' flag which could be a sign of execution of one of the Sysinternals tools references: - https://twitter.com/Moti_B/status/1008587936735035392 author: Markus Neis date: 2017-08-28 modified: 2024-03-13 tags: - attack.resource-development - attack.t1588.002 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|windash: ' -accepteula' condition: selection falsepositives: - Legitimate use of SysInternals tools - Programs that use the same command line flag level: low
Near-miss passage: Sigma rule: Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. The. Logsource: windows / ps_script. Rule: title: Extracting Information with PowerShell id: bd5971a7-626d-46ab-8176-ed643f694f68 status: test description: 'Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md author: frack113 date: 2021-12-19 modified: 2022-12-25 tags: - attack.credential-access - attack.t1552.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - ls - ' -R' - 'select-string ' - '-Pattern ' condition: selection falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-5189
Matching passage: CVE-2015-5189. CWE: CWE-362. CVSS: 4.900000095367432. Race condition in pcsd in PCS 0.9.139 and earlier uses a global variable to validate usernames, which allows remote authenticated users to gain privileges by sending a command that is checked for security after another user is authenticated.
Near-miss passage: CVE-2015-1325. CWE: CWE-362. CVSS: 7.0. Race condition in Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2.14.1-0ubuntu3.11 as packaged in Ubuntu 14.04 LTS, and before 2.0.1-0ubuntu17.9 as packaged in Ubuntu 12.04 LTS allow local users to write to arbitrary files and gain root privileges.
Query: patch priority for CVE-2015-7651
Matching passage: CVE-2015-7651. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted DefineFunction atoms, a different vulnerability than CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
Near-miss passage: CVE-2015-4909. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.4.0, 12.1.2.0.0, and 12.1.3.0.0 allows remote attackers to affect integrity via vectors related to ADF Faces.
Query: CWE for Improper Clearing of Heap Memory Before Release ('Heap Inspection')
Matching passage: CWE-244 Improper Clearing of Heap Memory Before Release ('Heap Inspection'). Using realloc() to resize buffers that store sensitive information can leave the sensitive information exposed to attack, because it is not removed from memory.
Near-miss passage: CWE-1024 Comparison of Incompatible Types. The product performs a comparison between two entities, but the entities are of different, incompatible types that cannot be guaranteed to provide correct results when they are directly compared.
Query: adversary uses Malicious Library
Matching passage: T1204.005 Malicious Library. Tactics: execution. Description: Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may [Upload Malware](https://attack.mitre.org/techniques/T1608/001) to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that establishes persistence, steals data, or mines cryptocurrency.(Citation: Datadog Security Labs Malicious PyPi Packages 2024)(Citation: Fortinet Malicious NPM Packages 2023) In some cases, threat actors may compromise and backdoor existing popular libraries (i.e., [Compromise Software Dependencies and Development Tools](https://attack.mitre.org/techniques/T1195/001)). Alternatively, they may create entirely new packages and leverage behaviors such as typosquatting to encourage users to install them.
Near-miss passage: T1204.003 Malicious Image. Tactics: execution. Description: Adversaries may rely on a user running a malicious image to facilitate execution. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored. Backdoored images may be uploaded to a public repository via [Upload Malware](https://attack.mitre.org/techniques/T1608/001), and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container.(Citation: Summit Route Malicious AMIs) Adversaries may also name images a certain way to increase the chance of users mistakenly deploying an instance or container from the image (ex: [Match Legitimate Resource Name or Location](https://attack.mitre.org/techniques/T1036/005)).(Citation: Aqua Security Cloud Native Threat Report June 2021)
Query: risk of The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote atta
Matching passage: CVE-2015-5300. CWE: CWE-361. CVSS: 7.5. The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources, and leveraging a resulting denial of service (abort and restart).
Near-miss passage: CVE-2015-7381. CWE: CWE-94. CVSS: 7.5. Multiple PHP remote file inclusion vulnerabilities in install.php in Web Reference Database (aka refbase) through 0.9.6 allow remote attackers to execute arbitrary PHP code via the (1) pathToMYSQL or (2) databaseStructureFile parameter, a different issue than CVE-2015-6008.
Query: campaign using Conditional Access Policies
Matching passage: T1556.009 Conditional Access Policies. Tactics: defense impairment, persistence, credential access. Description: Adversaries may disable or modify conditional access policies to enable persistent access to compromised accounts. Conditional access policies are additional verifications used by identity providers and identity and access management systems to determine whether a user should be granted access to a resource. For example, in Entra ID, Okta, and JumpCloud, users can be denied access to applications based on their IP address, device enrollment status, and use of multi-factor authentication.(Citation: Microsoft Conditional Access)(Citation: JumpCloud Conditional Access Policies)(Citation: Okta Conditional Access Policies) In some cases, identity providers may also support the use of risk-based metrics to deny sign-ins based on a variety of indicators. In AWS and GCP, IAM policies can contain `condition` attributes that verify arbitrary constraints such as the source IP, the date the request was made, and the nature of the resources or regions being requested.(Citation: AWS IAM Conditions)(Citation: GCP IAM Conditions) These measures help to prevent compromised credentials from resulting in unauthorized access to data or resources, as well as limit user permissions to only those required. By modifying conditional access policies, such as adding additional trusted IP ranges, removing [Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006) requirements, or allowing additional [Unused/Unsupported Cloud Regions](https://attack.mitre.org/techniques/T1535), adversaries may be able to ensure persistent access to accounts and circumvent defensive measures.
Near-miss passage: T1556.002 Password Filter DLL. Tactics: defense impairment, persistence, credential access. Description: Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated. Windows password filters are password policy enforcement mechanisms for both domain and local accounts. Filters are implemented as DLLs containing a method to validate potential passwords against password policies. Filter DLLs can be positioned on local computers for local accounts and/or domain controllers for domain accounts. Before registering new passwords in the Security Accounts Manager (SAM), the Local Security Authority (LSA) requests validation from each registered filter. Any potential changes cannot take effect until every registered filter acknowledges validation. Adversaries can register malicious password filters to harvest credentials from local computers and/or entire domains. To perform proper validation, filters must receive plain-text credentials from the LSA. A malicious password filter would receive these plain-text credentials every time a password request is made.(Citation: Carnal Ownage Password Filters Sept 2013)
Query: containment actions for SIEM correlation: stealth activity consistent with PubPrn
Matching passage: Playbook for T1216.001 PubPrn. 1) Validate alert telemetry against T1216.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a [Visual Basic](https://attack.mitre.org/techniques/T1059/005) script that publishes a printer to Active Directory Domain Services. The script may be signed by Microsoft and is commonly executed through the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) via <code>Cscript.exe</code>. For
Near-miss passage: Playbook for T1216 System Script Proxy Execution. Different response path focused on stealth.
Query: weakness Insecure Automated Optimizations
Matching passage: CWE-1038 Insecure Automated Optimizations. The product uses a mechanism that automatically optimizes code, e.g. to improve a characteristic such as performance, but the optimizations can have an unintended side effect that might violate an intended security assumption.
Near-miss passage: CWE-1089 Large Data Table with Excessive Number of Indices. The product uses a large data table that contains an excessively large number of indices.
Query: risk of In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, MDM9650, MDM9655, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/
Matching passage: CVE-2015-9195. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, MDM9650, MDM9655, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 808, SD 810, and SDX20, in a QTEE syscall handler, HLOS can cause a buffer overflow to occur.
Near-miss passage: CVE-2015-1681. CWE: CWE-119. CVSS: 1.899999976158142. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to cause a denial of service via a crafted .msc file, aka "Microsoft Management Console File Format Denial of Service Vulnerability."
Query: risk of In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on the host system. By staging an applicatio
Matching passage: CVE-2015-5350. CWE: CWE-284. CVSS: 7.5. In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on the host system. By staging an application on Cloud Foundry using Diego and Garden installations with a malicious custom buildpack an end user could read files on the host system that the BOSH-created vcap user has permissions to read and then package them into their app droplet.
Near-miss passage: CVE-2015-6867. CWE: CWE-284. CVSS: 7.5. The vertica-udx-zygote process in HP Vertica 7.1.1 UDx does not require authentication, which allows remote attackers to execute arbitrary commands via a crafted packet, aka ZDI-CAN-2914.
Query: CVE similar to CVE-2015-8094
Matching passage: CVE-2015-8094. CWE: CWE-601. CVSS: 6.099999904632568. Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter.
Near-miss passage: CVE-2015-5608. CWE: CWE-601. CVSS: 6.099999904632568. Open redirect vulnerability in Joomla! CMS 3.0.0 through 3.4.1.
Query: write Sigma for Detects execution of "curl.exe" with the "--insecure" flag.
Matching passage: Sigma rule: Detects execution of "curl.exe" with the "--insecure" flag.. Logsource: windows / process_creation. Rule: title: Insecure Transfer Via Curl.EXE id: cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec status: test description: Detects execution of "curl.exe" with the "--insecure" flag. references: - https://curl.se/docs/manpage.html author: X__Junior (Nextron Systems) date: 2023-06-30 tags: - attack.execution logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \curl.exe - OriginalFileName: curl.exe selection_cli: - CommandLine|re: \s-k\s - CommandLine|contains: --insecure condition: all of selection_* falsepositives: - Access to badly maintained internal or development systems level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_insecure_connection/info.yml
Near-miss passage: Sigma rule: Detects the use of the 'setcap' utility to set the 'setgid' capability (cap_setgid) on a binary file. This capability al. Logsource: linux / process_creation. Rule: title: Linux Setgid Capability Set on a Binary via Setcap Utility id: 3a716279-c18c-4488-83be-f9ececbfb9fc status: experimental description: 'Detects the use of the ''setcap'' utility to set the ''setgid'' capability (cap_setgid) on a binary file. This capability allows a non privileged process to make arbitrary manipulations of group IDs (GIDs), including setting its current GID to a value that would otherwise be restricted (i.e. GID 0, the root group). This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed. ' references: - https://man7.org/linux/man-pages/man8/setcap.8.html - https://dfir.ch/posts/linux_capabilities/ - https://juggernaut-sec.com/capabilities/#cap_setgid author: Luc Génaux date: 2026-01-24 tags: - attack.privilege-escalation - attack.persistence - attack.t1548 - attack.t1554 logsource: product: linux category: process_creation detection: selection: Image|endswith: /setcap CommandLine|contains: cap_setgid condition: selection falsepositives: - Unknown level: low
Query: Sigma YAML for azure / activitylogs
Matching passage: Sigma rule: Identifies when DNS zone is modified or deleted.. Logsource: azure / activitylogs. Rule: title: Azure DNS Zone Modified or Deleted id: af6925b0-8826-47f1-9324-337507a0babd status: test description: Identifies when DNS zone is modified or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes author: Austin Songer @austinsonger date: 2021-08-08 modified: 2022-08-23 tags: - attack.impact - attack.t1565.001 logsource: product: azure service: activitylogs detection: selection: operationName|startswith: MICROSOFT.NETWORK/DNSZONES operationName|endswith: - /WRITE - /DELETE condition: selection falsepositives: - DNS zone modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - DNS zone modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs. Logsource: windows / image_load. Rule: title: HackTool - SharpEvtMute DLL Load id: 49329257-089d-46e6-af37-4afce4290685 related: - id: bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c type: similar status: test description: Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs references: - https://github.com/bats3c/EvtMute author: Florian Roth (Nextron Systems) date: 2022-09-07 modified: 2024-11-23 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: image_load product: windows detection: selection: Hashes|contains: IMPHASH=330768A4F172E10ACB6287B87289D83B condition: selection falsepositives: - Other DLLs with the same Imphash level: high
Query: describe CVE-2015-3325
Matching passage: CVE-2015-3325. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in forum.php in the WP Symposium plugin before 15.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the show parameter in the QUERY_STRING to the default URI.
Near-miss passage: CVE-2015-5703. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the public key discovery API call in Open-Xchange OX Guard before 2.0.0-rev8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Query: describe CVE-2015-4133
Matching passage: CVE-2015-4133. CWE: UNKNOWN. CVSS: 7.5. Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in uploads/ directory.
Near-miss passage: CVE-2015-8327. CWE: UNKNOWN. CVSS: 7.5. Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.2.0 and in foomatic-filters in Foomatic 4.0.x allows remote attackers to execute arbitrary commands via ` (backtick) characters in a print job.
Query: describe CVE-2015-2401
Matching passage: CVE-2015-2401. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1767 and CVE-2015-2408.
Near-miss passage: CVE-2015-3905. CWE: CWE-119. CVSS: 7.5. Buffer overflow in the set_cs_start function in t1disasm.c in t1utils before 1.39 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.
Query: describe CVE-2015-1074
Matching passage: CVE-2015-1074. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Near-miss passage: CVE-2015-1082. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Query: risk of In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, acco
Matching passage: CVE-2015-9289. CWE: CWE-125. CVSS: 5.5. In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows larger values such as 23.
Near-miss passage: CVE-2015-8783. CWE: CWE-125. CVSS: 6.5. tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds reads) via a crafted TIFF image.
Query: risk of Heap-based buffer overflow in the nestegg_track_codec_data function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote attackers to execute arbitrary cod
Matching passage: CVE-2015-4511. CWE: CWE-119. CVSS: 6.800000190734863. Heap-based buffer overflow in the nestegg_track_codec_data function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote attackers to execute arbitrary code via a crafted header in a WebM video.
Near-miss passage: CVE-2015-7086. CWE: CWE-119. CVSS: 6.599999904632568. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.