alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)
Matching passage: Sigma rule: Detects code execution via Pester.bat (Pester - Powershell Modulte for testing). Logsource: windows / process_creation. Rule: title: Execute Code with Pester.bat id: 59e938ff-0d6d-4dc3-b13f-36cc28734d4e status: test description: Detects code execution via Pester.bat (Pester - Powershell Modulte for testing) references: - https://twitter.com/Oddvarmoe/status/993383596244258816 - https://github.com/api0cradle/LOLBAS/blob/d148d278f5f205ce67cfaf49afdfb68071c7252a/OSScripts/pester.md author: Julia Fomina, oscd.community date: 2020-10-08 modified: 2023-11-09 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1216 logsource: category: process_creation product: windows detection: powershell_module: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains|all: - Pester - Get-Help cmd_execution: Image|endswith: \cmd.exe CommandLine|contains|all: - pester - ; get_help: CommandLine|contains: - help - \? condition: powershell_module or (cmd_execution and get_help) falsepositives: - Legitimate use of Pester for writing tests for Powershell scripts and modules level: medium
Near-miss passage: Sigma rule: Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag. Logsource: windows / process_creation. Rule: title: Mavinject Inject DLL Into Running Process id: 4f73421b-5a0b-4bbf-a892-5a7fb99bea66 related: - id: 17eb8e57-9983-420d-ad8a-2c4976c22eb8 type: obsolete status: test description: Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md - https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e - https://twitter.com/gN3mes1s/status/941315826107510784 - https://reaqta.com/2017/12/mavinject-microsoft-injector/ - https://twitter.com/Hexacorn/status/776122138063409152 - https://github.com/SigmaHQ/sigma/issues/3742 - https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/6a228d23eefe963ca81f2d52f94b815f61ef5ee0/Tactics/DefenseEvasion.md#t1055-process-injection author: frack113, Florian Roth date: 2021-07-12 modified: 2022-12-05 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.001 - attack.t1218.013 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: ' /INJECTRUNNING ' filter: ParentImage: C:\Windows\System32\AppVClient.exe condition: selection and not filter falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-5592
Matching passage: CVE-2015-5592. CWE: CWE-79. CVSS: 6.099999904632568. Incomplete blacklist in sanitize_string in Zenphoto before 1.4.9 allows remote attackers to conduct cross-site scripting (XSS) attacks.
Near-miss passage: CVE-2015-0655. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Unified Web Interaction Manager in Cisco Unified Web and E-Mail Interaction Manager allows remote attackers to inject arbitrary web script or HTML via vectors related to a POST request, aka Bug ID CSCus74184.
Query: risk of LibTIFF before 4.0.7 allows remote attackers to cause a denial of service (memory consumption and crash) via a crafted tiff file.
Matching passage: CVE-2015-7313. CWE: CWE-399. CVSS: 5.5. LibTIFF before 4.0.7 allows remote attackers to cause a denial of service (memory consumption and crash) via a crafted tiff file.
Near-miss passage: CVE-2015-0731. CWE: CWE-399. CVSS: 6.099999904632568. The ISDN implementation in Cisco IOS 15.3S allows remote attackers to cause a denial of service (device reload) via malformed Q931 SETUP messages, aka Bug ID CSCut37890.
Query: describe CVE-2015-2154
Matching passage: CVE-2015-2154. CWE: CWE-119. CVSS: 5.0. The osi_print_cksum function in print-isoclns.c in the ethernet printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) length, (2) offset, or (3) base pointer checksum value.
Near-miss passage: CVE-2015-7547. CWE: CWE-119. CVSS: 8.100000381469727. Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module.
Query: detect Purchase Technical Data
Matching passage: T1597.002 Purchase Technical Data. Tactics: reconnaissance. Description: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure.(Citation: ZDNET Selling Data) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
Near-miss passage: T1597 Search Closed Sources. Tactics: reconnaissance. Description: Adversaries may search and gather information about victims from closed (e.g., paid, private, or otherwise not freely available) sources that can be used during targeting. Information about victims may be available for purchase from reputable private sources and databases, such as paid subscriptions to feeds of technical/threat intelligence data. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets.(Citation: ZDNET Selling Data) Adversaries may search in different closed databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
Query: CVE similar to CVE-2015-7568
Matching passage: CVE-2015-7568. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in the password recovery feature in Yeager CMS 1.2.1 allows remote attackers to change the account credentials of known users via the "userEmail" parameter.
Near-miss passage: CVE-2015-1000003. CWE: CWE-89. CVSS: 9.800000190734863. Blind SQL Injection in filedownload v1.4 wordpress plugin
Query: patch priority for CVE-2015-6378
Matching passage: CVE-2015-6378. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability on Cisco DPQ3925 devices with EDVA 5.5.2 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuv05943.
Near-miss passage: CVE-2015-2701. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in CS-Cart 4.2.4 allows remote attackers to hijack the authentication of users for requests that change a user password via a request to profiles-update/.
Query: describe CVE-2015-4182
Matching passage: CVE-2015-4182. CWE: CWE-264. CVSS: 5.5. The administrative web interface in Cisco Identity Services Engine (ISE) before 1.3 allows remote authenticated users to bypass intended access restrictions, and obtain sensitive information or change settings, via unspecified vectors, aka Bug ID CSCui72087.
Near-miss passage: CVE-2015-7598. CWE: CWE-264. CVSS: 7.800000190734863. SafeNet Authentication Service TokenValidator Proxy Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
Query: vulnerability: Multiple buffer overflows in (1) lmgrd and (2) Vendor Daemon in Flexera FlexNet Publisher before 11.13.1.2 Security Update 1 allow remote attackers to execute arbitrary code via a 
Matching passage: CVE-2015-8277. CWE: CWE-119. CVSS: 9.800000190734863. Multiple buffer overflows in (1) lmgrd and (2) Vendor Daemon in Flexera FlexNet Publisher before 11.13.1.2 Security Update 1 allow remote attackers to execute arbitrary code via a crafted packet with opcode (a) 0x107 or (b) 0x10a.
Near-miss passage: CVE-2015-3746. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Query: patch priority for CVE-2015-1681
Matching passage: CVE-2015-1681. CWE: CWE-119. CVSS: 1.899999976158142. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to cause a denial of service via a crafted .msc file, aka "Microsoft Management Console File Format Denial of Service Vulnerability."
Near-miss passage: CVE-2015-6118. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Office 2007 SP3 and Office 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: explain CWE-1164
Matching passage: CWE-1164 Irrelevant Code. The product contains code that is not essential for execution, i.e. makes no state changes and has no side effects that alter data or control flow, such that removal of the code would have no impact to functionality or correctness.
Near-miss passage: CWE-1078 Inappropriate Source Code Style or Formatting. The source code does not follow desired style or formatting for indentation, white space, comments, etc.
Query: Encoded PowerShell / command-line abuse matching SID-History Injection
Matching passage: T1134.005 SID-History Injection. Tactics: stealth, privilege escalation. Description: Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. (Citation: Microsoft SID) An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens). With Domain Administrator (or equivalent) rights, harvested or well-known SID values (Citation: Microsoft Well Known SIDs Jun 2017) may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators. This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as [Remote Services](https://attack.mitre.org/techniques/T1021), [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002), or [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006).
Near-miss passage: T1134.001 Token Impersonation/Theft. Tactics: stealth, privilege escalation. Description: Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`.(Citation: DuplicateToken function) The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread. An adversary may perform [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) when they have a specific, existing process they want to assign the duplicated token to. For example, this may be useful for when the target user has a non-network logon session on the system. When an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally [Create Process with Token](https://attack.mitre.org/techniques/T1134/002) using `CreateProcessWithTokenW` or `CreateProcessAsUserW`. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) is also distinct from [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) in that it refers to duplicating an existing token, rather than creating a new one.
Query: CVE similar to CVE-2015-3418
Matching passage: CVE-2015-3418. CWE: CWE-369. CVSS: 7.5. The ProcPutImage function in dix/dispatch.c in X.Org Server (aka xserver and xorg-server) before 1.16.4 allows attackers to cause a denial of service (divide-by-zero and crash) via a zero-height PutImage request.
Near-miss passage: CVE-2015-8504. CWE: CWE-369. CVSS: 6.5. Qemu, when built with VNC display driver support, allows remote attackers to cause a denial of service (arithmetic exception and application crash) via crafted SetPixelFormat messages from a client.
Query: detection rule: Detects the deletion of tomcat WebServer logs which may indicate an attempt to destroy forensic evidence
Matching passage: Sigma rule: Detects the deletion of tomcat WebServer logs which may indicate an attempt to destroy forensic evidence. Logsource: windows / file_delete. Rule: title: Tomcat WebServer Logs Deleted id: 270185ff-5f50-4d6d-a27f-24c3b8c9fef8 status: test description: Detects the deletion of tomcat WebServer logs which may indicate an attempt to destroy forensic evidence references: - Internal Research - https://linuxhint.com/view-tomcat-logs-windows/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-16 tags: - attack.stealth - attack.t1070 logsource: category: file_delete product: windows detection: selection: TargetFilename|contains|all: - \Tomcat - \logs\ TargetFilename|contains: - catalina. - _access_log. - localhost. condition: selection falsepositives: - During uninstallation of the tomcat server - During log rotation level: medium
Near-miss passage: Sigma rule: Detects execution of the builtin "del"/"erase" commands in order to delete files. Adversaries may delete files left behi. Logsource: windows / process_creation. Rule: title: File Deletion Via Del id: 379fa130-190e-4c3f-b7bc-6c8e834485f3 status: test description: 'Detects execution of the builtin "del"/"erase" commands in order to delete files. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary''s footprint. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase author: frack113 date: 2022-01-15 modified: 2024-03-05 tags: - attack.stealth - attack.t1070.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_del: CommandLine|contains: - 'del ' - 'erase ' selection_flags: CommandLine|contains|windash: - ' -f' - ' -s' - ' -q' condition: all of selection_* falsepositives: - False positives levels will differ Depending on the environment. You can use a combination of ParentImage and other keywords from the CommandLine field to filter legitimate activity level: low
Query: CVE similar to CVE-2015-3362
Matching passage: CVE-2015-3362. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Video module before 7.x-2.11 for Drupal, when using the video WYSIWYG plugin, allows remote authenticated users to inject arbitrary web script or HTML via a node title.
Near-miss passage: CVE-2015-8807. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the _renderVarInput_number function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via vectors involving numeric form fields.
Query: risk of The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a 
Matching passage: CVE-2015-5740. CWE: CWE-444. CVSS: 9.800000190734863. The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request with two Content-length headers.
Near-miss passage: CVE-2015-5741. CWE: CWE-444. CVSS: 9.800000190734863. The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request that contains Content-Length and Transfer-Encoding header fields.
Query: rule covering Detects a Mesh Agent service installation. Mesh Agent is used to remotely manage computers
Matching passage: Sigma rule: Detects a Mesh Agent service installation. Mesh Agent is used to remotely manage computers. Logsource: windows / system. Rule: title: Mesh Agent Service Installation id: e0d1ad53-c7eb-48ec-a87a-72393cc6cedc status: test description: Detects a Mesh Agent service installation. Mesh Agent is used to remotely manage computers references: - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-28 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows service: system detection: selection_root: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ImagePath|contains: MeshAgent.exe - ServiceName|contains: Mesh Agent condition: all of selection_* falsepositives: - Legitimate use of the tool level: medium
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via Stdin in Scripts. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation Via Stdin - Powershell id: 86b896ba-ffa1-4fea-83e3-ee28a4c915c7 status: test description: Detects Obfuscated Powershell via Stdin in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-12 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|re: (?i)(set).*&&\s?set.*(environment|invoke|\$\{?input).*&&.*" condition: selection_4104 falsepositives: - Unknown level: high
Query: what is T1027.010
Matching passage: T1027.010 Command Obfuscation. Tactics: stealth. Description: Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., [Phishing](https://attack.mitre.org/techniques/T1566) and [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)) or interactively via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).(Citation: Akamai JS)(Citation: Malware Monday VBE) For example, adversaries may abuse syntax that utilizes various symbols and escape characters (such as spacing, `^`, `+`. `$`, and `%`) to make commands difficult to analyze while maintaining the same intended functionality.(Citation: RC PowerShell) Many languages support built-in obfuscation in the form of base64 or URL encoding.(Citation: Microsoft PowerShellB64) Adversaries may also manually implement command obfuscation via string splitting (`“Wor”+“d.Application”`), order and casing of characters (`rev <<<'dwssap/cte/ tac'`), globing (`mkdir -p '/tmp/:&$NiA'`), as well as various tricks involving passing strings through tokens/environment variables/input streams.(Citation: Bashfuscator Command Obfuscators)(Citation: FireEye Obfuscation June 2017) Adversaries may also use tricks such as directory traversals to obfuscate references to the binary being invoked by a command (`C:\voi\pcw\..\..\Windows\tei\qs\k\..\..\..\system32\erool\..\wbem\wg\je\..\..\wmic.exe shadowcopy delete`).(Citation: Twitter Richard WMIC) Tools such as <code>Invoke-Obfuscation</code> and <code>Invoke-DOSfucation</code> have also been used to obfuscate commands.(Citation: Invoke-DOSfuscation)(Citation: Invoke-Obfuscation)
Near-miss passage: T1027.008 Stripped Payloads. Tactics: stealth. Description: Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information. Scripts and executables may contain variables names and other strings that help developers document code functionality. Symbols are often created by an operating system’s `linker` when executable payloads are compiled. Reverse engineers use these symbols and strings to analyze code and to identify functionality in payloads.(Citation: Mandiant golang stripped binaries explanation)(Citation: intezer stripped binaries elf files 2018) Adversaries may use stripped payloads in order to make malware analysis more difficult. For example, compilers and other tools may provide features to remove or obfuscate strings and symbols. Adversaries have also used stripped payload formats, such as run-only AppleScripts, a compiled and stripped version of [AppleScript](https://attack.mitre.org/techniques/T1059/002), to evade detection and analysis. The lack of human-readable information may directly hinder detection and analysis of payloads.(Citation: SentinelLabs reversing run-only applescripts 2021)