alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detect the update check performed by Advanced IP/Port Scanner utilities.
Matching passage: Sigma rule: Detect the update check performed by Advanced IP/Port Scanner utilities.. Logsource: proxy. Rule: title: PUA - Advanced IP/Port Scanner Update Check id: 1a9bb21a-1bb5-42d7-aa05-3219c7c8f47d status: test description: Detect the update check performed by Advanced IP/Port Scanner utilities. references: - https://www.advanced-ip-scanner.com/ - https://www.advanced-port-scanner.com/ author: Axel Olsson date: 2022-08-14 modified: 2024-02-15 tags: - attack.discovery - attack.reconnaissance - attack.t1590 logsource: category: proxy detection: selection: c-uri|contains: /checkupdate.php c-uri-query|contains|all: - lng= - ver= - beta= - type= - rmode= - product= condition: selection falsepositives: - Expected if you legitimately use the Advanced IP or Port Scanner utilities in your environement. level: medium
Near-miss passage: Sigma rule: Detects outbound network connection initiated by Microsoft Dialer. The Microsoft Dialer, also known as Phone Dialer, is. Logsource: windows / network_connection. Rule: title: Outbound Network Connection Initiated By Microsoft Dialer id: 37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1 status: test description: 'Detects outbound network connection initiated by Microsoft Dialer. The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer. This is an outdated process in the current conext of it''s usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys" ' references: - https://tria.ge/240301-rk34sagf5x/behavioral2 - https://app.any.run/tasks/6720b85b-9c53-4a12-b1dc-73052a78477d - https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/ - https://strontic.github.io/xcyclopedia/library/dialer.exe-0B69655F912619756C704A0BF716B61F.html author: CertainlyP date: 2024-04-26 tags: - attack.execution - attack.command-and-control - attack.t1071.001 logsource: category: network_connection product: windows detection: selection: Image|endswith: :\Windows\System32\dialer.exe Initiated: 'true' filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 condition: selection and not 1 of filter_main_* falsepositives: - In Modern Windows systems, unable to see legitimate usage of this process, However, if an organization has legitimate purpose for this there can be false positives. level: high
Query: exploit The MyScript SDK before 1.3 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-c
Matching passage: CVE-2015-2020. CWE: CWE-502. CVSS: 9.800000190734863. The MyScript SDK before 1.3 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
Near-miss passage: CVE-2015-8103. CWE: CWE-502. CVSS: 9.800000190734863. The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
Query: exploit Cross-site scripting (XSS) vulnerability in the Process Portal in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 allows re
Matching passage: CVE-2015-0105. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Process Portal in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-5455. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in X-Cart 4.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to install/.
Query: exploit epan/dissectors/packet-umts_fp.c in the UMTS FP dissector in Wireshark 1.12.x before 1.12.9 does not properly reserve memory for channel ID mappings, which allows remote attackers 
Matching passage: CVE-2015-8713. CWE: CWE-20. CVSS: 5.5. epan/dissectors/packet-umts_fp.c in the UMTS FP dissector in Wireshark 1.12.x before 1.12.9 does not properly reserve memory for channel ID mappings, which allows remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted packet.
Near-miss passage: CVE-2015-7993. CWE: CWE-20. CVSS: 7.5. The Extended Application Services (aka XS or XS Engine) in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to execute arbitrary code via unspecified vectors related to "HTTP Login," aka SAP Security Note 2197397.
Query: indicators of Domain Groups
Matching passage: T1069.002 Domain Groups. Tactics: discovery. Description: Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators. Commands such as <code>net group /domain</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscacheutil -q group</code> on macOS, and <code>ldapsearch</code> on Linux can list domain-level groups.
Near-miss passage: T1069.001 Local Groups. Tactics: discovery. Description: Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group. Commands such as <code>net localgroup</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscl . -list /Groups</code> on macOS, and <code>groups</code> on Linux can list local groups.
Query: intelligence brief on T1195.002
Matching passage: T1195.002 Compromise Software Supply Chain. Tactics: initial access. Description: Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version. Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.(Citation: Avast CCleaner3 2018)(Citation: Command Five SK 2011)
Near-miss passage: T1195.003 Compromise Hardware Supply Chain. Tactics: initial access. Description: Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system. Hardware backdoors may be inserted into various devices, such as servers, workstations, network infrastructure, or peripherals.
Query: detection rule: Detects parameters used by WMImplant
Matching passage: Sigma rule: Detects parameters used by WMImplant. Logsource: windows / ps_script. Rule: title: WMImplant Hack Tool id: 8028c2c3-e25a-46e3-827f-bbb5abf181d7 status: test description: Detects parameters used by WMImplant references: - https://github.com/FortyNorthSecurity/WMImplant author: NVISO date: 2020-03-26 modified: 2022-12-25 tags: - attack.execution - attack.t1047 - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - WMImplant - ' change_user ' - ' gen_cli ' - ' command_exec ' - ' disable_wdigest ' - ' disable_winrm ' - ' enable_wdigest ' - ' enable_winrm ' - ' registry_mod ' - ' remote_posh ' - ' sched_job ' - ' service_mod ' - ' process_kill ' - ' active_users ' - ' basic_info ' - ' power_off ' - ' vacant_system ' - ' logon_events ' condition: selection falsepositives: - Administrative scripts that use the same keywords. level: high
Near-miss passage: Sigma rule: Detects usage of Msiexec.exe to install packages hosted remotely quietly. Logsource: windows / process_creation. Rule: title: Suspicious Msiexec Quiet Install From Remote Location id: 8150732a-0c9d-4a99-82b9-9efb9b90c40c related: - id: f7b5f842-a6af-4da5-9e95-e32478f3cd2f type: similar status: test description: Detects usage of Msiexec.exe to install packages hosted remotely quietly references: - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-28 modified: 2025-10-07 tags: - attack.stealth - attack.t1218.007 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \msiexec.exe - OriginalFileName: msiexec.exe selection_cli: CommandLine|contains|windash: - -i - -package - -a - -j selection_quiet: CommandLine|contains|windash: -q selection_remote: CommandLine|contains: - http - \\\\ filter_optional_openoffice: CommandLine|contains|all: - \AppData\Local\Temp\OpenOffice - Installation Files\openoffice condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Query: vulnerability: Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for W
Matching passage: CVE-2015-2292. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
Near-miss passage: CVE-2015-9352. CWE: CWE-89. CVSS: 9.800000190734863. The wp-polls plugin before 2.72 for WordPress has SQL injection.
Query: secure coding against On-Chip Debug and Test Interface With Improper Access Control
Matching passage: CWE-1191 On-Chip Debug and Test Interface With Improper Access Control. The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.
Near-miss passage: CWE-526 Cleartext Storage of Sensitive Information in an Environment Variable. The product uses an environment variable to store unencrypted sensitive information.
Query: risk of Multiple cross-site request forgery (CSRF) vulnerabilities in the CrossSlide jQuery (crossslide-jquery-plugin-for-wordpress) plugin 2.0.5 for WordPress allow remote attackers to hi
Matching passage: CVE-2015-2089. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the CrossSlide jQuery (crossslide-jquery-plugin-for-wordpress) plugin 2.0.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2) csj_width, (3) csj_height, (4) csj_sleep, (5) csj_fade, or (6) upload_image parameter in the thisismyurl_csj.php page to wp-admin/options-general.php.
Near-miss passage: CVE-2015-3986. CWE: CWE-352. CVSS: 4.300000190734863. Cross-site request forgery (CSRF) vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to hijack the authentication of administrators for requests that conduct directory traversal attacks via the tcp_box_path parameter in the checkout_editor_settings page to wp-admin/admin.php.
Query: intelligence brief on T1074.001
Matching passage: T1074.001 Local Data Staging. Tactics: collection. Description: Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location. Adversaries may also stage collected data in various available formats/locations of a system, including local storage databases/repositories or the Windows Registry.(Citation: Prevailion DarkWatchman 2021)
Near-miss passage: T1074.002 Remote Data Staging. Tactics: collection. Description: Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location. In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and stage data in that instance.(Citation: Mandiant M-Trends 2020) By staging data on one system prior to Exfiltration, adversaries can minimize the number of connections made to their C2 server and better evade detection.
Query: SIEM correlation: discovery activity consistent with Network Share Discovery
Matching passage: T1135 Network Share Discovery. Tactics: discovery. Description: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. File sharing over a Windows network occurs over the SMB protocol. (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder) [Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the <code>net view \\\\remotesystem</code> command. It can also be used to query shared drives on the local system using <code>net share</code>. For macOS, the <code>sharing -l</code> command lists all shared points used for smb services.
Near-miss passage: T1040 Network Sniffing. Tactics: credential access, discovery. Description: Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data. Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. Techniques for name service resolution poisoning, such as [Name Resolution Poisoning and SMB Relay](https://attack.mitre.org/techniques/T1557/001), can also be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary. Network sniffing may reveal configuration details, such as running services, version numbers, and other network characteristics (e.g. IP addresses, hostnames, VLAN IDs) necessary for subsequent [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and/or [Stealth](https://attack.mitre.org/tactics/TA0005) activities. Adversaries may likely also utilize network sniffing during [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) (AiTM) to passively gain additional knowledge about the environment. In cloud-based environments, adversaries may still be able to use traffic mirroring services to sniff network traffic from virtual machines. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to.(Citation: AWS Traffic Mirroring)(Citation: GCP Packet Mirroring)(Citation: Azure Virtual Network TAP) Often, much of this traffic will be in cleartext due to the use of TLS termination at the load balancer level to reduce the strain of encrypting and decrypting traffic.(Citation: R
Query: CVE similar to CVE-2015-5403
Matching passage: CVE-2015-5403. CWE: CWE-200. CVSS: 4.0. HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote authenticated users to obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2015-2139.
Near-miss passage: CVE-2015-6471. CWE: CWE-200. CVSS: 5.300000190734863. Eaton Cooper Power Systems ProView 4.x and 5.x before 5.1 on Form 6 controls and Idea and IdeaPLUS relays does not properly initialize padding fields in Ethernet packets, which allows remote attackers to obtain sensitive information by reading packet data.
Query: describe CVE-2015-8764
Matching passage: CVE-2015-8764. CWE: CWE-119. CVSS: 8.100000381469727. Off-by-one error in the EAP-PWD module in FreeRADIUS 3.0 through 3.0.8, which triggers a buffer overflow.
Near-miss passage: CVE-2015-5283. CWE: CWE-119. CVSS: 4.699999809265137. The sctp_init function in net/sctp/protocol.c in the Linux kernel before 4.2.3 has an incorrect sequence of protocol-initialization steps, which allows local users to cause a denial of service (panic or memory corruption) by creating SCTP sockets before all of the steps have finished.
Query: patch priority for CVE-2015-2559
Matching passage: CVE-2015-2559. CWE: CWE-284. CVSS: 3.5. Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL.
Near-miss passage: CVE-2015-5512. CWE: CWE-284. CVSS: 5.0. The me aliases module 6.x-2.x before 6.x-2.10 and 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to access Views using the "me" user argument handler by substituting "me" for a user id in a URL.
Query: detection rule: Detects attempts to disable the Windows Firewall using PowerShell
Matching passage: Sigma rule: Detects attempts to disable the Windows Firewall using PowerShell. Logsource: windows / process_creation. Rule: title: Windows Firewall Disabled via PowerShell id: 12f6b752-042d-483e-bf9c-915a6d06ad75 related: - id: 488b44e7-3781-4a71-888d-c95abfacf44d type: similar status: test description: Detects attempts to disable the Windows Firewall using PowerShell references: - https://www.elastic.co/guide/en/security/current/windows-firewall-disabled-via-powershell.html author: Tim Rauch, Elastic (idea) date: 2022-09-14 modified: 2023-02-13 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_name: - Image|endswith: - \powershell.exe - \pwsh.exe - \powershell_ise.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_args: CommandLine|contains|all: - 'Set-NetFirewallProfile ' - ' -Enabled ' - ' False' selection_opt: CommandLine|contains: - ' -All ' - Public - Domain - Private condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects loaded unsigned image on the system. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Unsigned Image Loaded id: c92c24e7-f595-493f-9c98-53d5142f5c18 status: test description: Detects loaded unsigned image on the system references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-06 tags: - attack.privilege-escalation logsource: product: windows service: codeintegrity-operational detection: selection: EventID: 3037 condition: selection falsepositives: - Unlikely level: high
Query: risk of IBM Maximo Asset Management 7.5 before 7.5.0.8 IF6 and 7.6 before 7.6.0.2 IF1 and Maximo Asset Management 7.5 before 7.5.0.8 IF6, 7.5.1, and 7.6 before 7.6.0.2 IF1 for SmartCloud C
Matching passage: CVE-2015-5051. CWE: CWE-264. CVSS: 4.300000190734863. IBM Maximo Asset Management 7.5 before 7.5.0.8 IF6 and 7.6 before 7.6.0.2 IF1 and Maximo Asset Management 7.5 before 7.5.0.8 IF6, 7.5.1, and 7.6 before 7.6.0.2 IF1 for SmartCloud Control Desk allow remote authenticated users to bypass intended access restrictions on query results via unspecified vectors.
Near-miss passage: CVE-2015-6856. CWE: CWE-264. CVSS: 7.800000190734863. Dell Pre-Boot Authentication Driver (PBADRV.sys) 1.0.1.5 allows local users to write to arbitrary physical memory locations and gain privileges via a 0x0022201c IOCTL call.
Query: CVE similar to CVE-2015-4432
Matching passage: CVE-2015-4432. CWE: CWE-119. CVSS: 10.0. Heap-based buffer overflow in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3135 and CVE-2015-5118.
Near-miss passage: CVE-2015-5867. CWE: CWE-119. CVSS: 9.300000190734863. IOHIDFamily in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Query: vulnerability: The Lock Screen component in Apple iOS before 8.3 does not properly implement the erasure feature for incorrect passcode-authentication attempts, which makes it easier for physical
Matching passage: CVE-2015-1107. CWE: UNKNOWN. CVSS: 1.899999976158142. The Lock Screen component in Apple iOS before 8.3 does not properly implement the erasure feature for incorrect passcode-authentication attempts, which makes it easier for physically proximate attackers to obtain access by making many passcode guesses.
Near-miss passage: CVE-2015-0332. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0333, CVE-2015-0335, and CVE-2015-0339.