alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: Multiple buffer overflows in the esa_write function in /dev/seirenin the Exynos Seiren Audio driver, as used in Samsung S6 Edge, allow local users to cause a denial of service (mem
Matching passage: CVE-2015-7890. CWE: CWE-120. CVSS: 5.5. Multiple buffer overflows in the esa_write function in /dev/seirenin the Exynos Seiren Audio driver, as used in Samsung S6 Edge, allow local users to cause a denial of service (memory corruption) via a large (1) buffer or (2) size parameter.
Near-miss passage: CVE-2015-3717. CWE: CWE-120. CVSS: 7.5. Multiple buffer overflows in the printf functionality in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.
Query: CVE similar to CVE-2015-3641
Matching passage: CVE-2015-3641. CWE: UNKNOWN. CVSS: 7.5. bitcoind and Bitcoin-Qt prior to 0.10.2 allow attackers to cause a denial of service (disabled functionality such as a client application crash) via an "Easy" attack.
Near-miss passage: CVE-2015-0395. CWE: UNKNOWN. CVSS: 9.300000190734863. Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
Query: exploit name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DNSSEC validation, allows remote attackers
Matching passage: CVE-2015-4620. CWE: CWE-17. CVSS: 7.800000190734863. name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DNSSEC validation, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) by constructing crafted zone data and then making a query for a name in that zone.
Near-miss passage: CVE-2015-1262. CWE: CWE-17. CVSS: 7.5. platform/fonts/shaping/HarfBuzzShaper.cpp in Blink, as used in Google Chrome before 43.0.2357.65, does not initialize a certain width field, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted Unicode text.
Query: rule covering Detects a Powershell process that contains download commands in its command line string
Matching passage: Sigma rule: Detects a Powershell process that contains download commands in its command line string. Logsource: windows / process_creation. Rule: title: PowerShell Download Pattern id: 3b6ab547-8ec2-4991-b9d2-2b06702a48d7 related: - id: e6c54d94-498c-4562-a37c-b469d8e9a275 type: derived - id: 8f70ac5f-1f6f-4f8e-b454-db19561216c5 type: obsolete status: test description: Detects a Powershell process that contains download commands in its command line string references: - https://blog.redteam.pl/2020/06/black-kingdom-ransomware.html - https://lab52.io/blog/winter-vivern-all-summer/ - https://hatching.io/blog/powershell-analysis/ author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro date: 2019-01-16 modified: 2025-10-20 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell_ISE.EXE - PowerShell.EXE - pwsh.dll selection_cli: CommandLine|contains|all: - new-object - net.webclient). - download CommandLine|contains: - string( - file( condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the use of the find command to execute a shell. Such behavior may be associated with privilege escalation, unaut. Logsource: linux / process_creation. Rule: title: Shell Execution via Find - Linux id: 6adfbf8f-52be-4444-9bac-81b539624146 status: test description: 'Detects the use of the find command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or exploitation attempt. ' references: - https://gtfobins.github.io/gtfobins/find/#shell - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-09-02 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /find CommandLine|contains|all: - ' . ' - -exec selection_cli: CommandLine|contains: - /bin/bash - /bin/dash - /bin/fish - /bin/sh - /bin/zsh condition: all of selection_* falsepositives: - Unknown level: high
Query: risk of The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions.
Matching passage: CVE-2015-9305. CWE: CWE-79. CVSS: 6.099999904632568. The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions.
Near-miss passage: CVE-2015-4356. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the view-based webform results table in the Webform module 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a webform.
Query: risk of Multiple use-after-free vulnerabilities in the ServiceWorkerScriptCacheMap implementation in content/browser/service_worker/service_worker_script_cache_map.cc in Google Chrome befo
Matching passage: CVE-2015-1222. CWE: UNKNOWN. CVSS: 7.5. Multiple use-after-free vulnerabilities in the ServiceWorkerScriptCacheMap implementation in content/browser/service_worker/service_worker_script_cache_map.cc in Google Chrome before 41.0.2272.76 allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a ServiceWorkerContextWrapper::DeleteAndStartOver call, related to the NotifyStartedCaching and NotifyFinishedCaching functions.
Near-miss passage: CVE-2015-4784. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790.
Query: CVE similar to CVE-2015-9388
Matching passage: CVE-2015-9388. CWE: CWE-352. CVSS: 6.5. The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS.
Near-miss passage: CVE-2015-7364. CWE: CWE-352. CVSS: 6.800000190734863. The HTML_Quickform library, as used in Revive Adserver before 3.2.2, allows remote attackers to bypass the CSRF protection mechanism via an empty token.
Query: Multiple failed authentications followed by Archive via Custom Method
Matching passage: T1560.003 Archive via Custom Method. Tactics: collection. Description: An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.(Citation: ESET Sednit Part 2)
Near-miss passage: T1560 Archive Collected Data. Tactics: collection. Description: An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.(Citation: DOJ GRU Indictment Jul 2018) Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender. Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.
Query: patch priority for CVE-2015-6834
Matching passage: CVE-2015-6834. CWE: UNKNOWN. CVSS: 9.800000190734863. Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to (1) the Serializable interface, (2) the SplObjectStorage class, and (3) the SplDoublyLinkedList class, which are mishandled during unserialization.
Near-miss passage: CVE-2015-6012. CWE: UNKNOWN. CVSS: 5.800000190734863. Multiple open redirect vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the referrer parameter.
Query: vulnerability: Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Ex
Matching passage: CVE-2015-6076. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6066, CVE-2015-6070, CVE-2015-6071, CVE-2015-6074, and CVE-2015-6087.
Near-miss passage: CVE-2015-0848. CWE: CWE-119. CVSS: 6.800000190734863. Heap-based buffer overflow in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image.
Query: write Sigma for Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.
Matching passage: Sigma rule: Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.. Logsource: windows / file_event. Rule: title: Advanced IP Scanner - File Event id: fed85bf9-e075-4280-9159-fbe8a023d6fa related: - id: bef37fa2-f205-4a7b-b484-0759bfd5f86f type: derived status: test description: Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups. references: - https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/ - https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html - https://labs.f-secure.com/blog/prelude-to-ransomware-systembc - https://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf - https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer author: '@ROxPinTeddy' date: 2020-05-12 modified: 2022-11-29 tags: - attack.discovery - attack.t1046 logsource: category: file_event product: windows detection: selection: TargetFilename|contains: \AppData\Local\Temp\Advanced IP Scanner 2 condition: selection falsepositives: - Legitimate administrative use level: medium regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_advanced_ip_scanner/info.yml
Near-miss passage: Sigma rule: Detects the addition of new root, CA or AuthRoot certificates to the Windows registry. Logsource: windows / registry_set. Rule: title: New Root or CA or AuthRoot Certificate to Store id: d223b46b-5621-4037-88fe-fda32eead684 status: test description: Detects the addition of new root, CA or AuthRoot certificates to the Windows registry references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md#atomic-test-6---add-root-certificate-to-currentuser-certificate-store - https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec author: frack113 date: 2022-04-04 modified: 2023-08-17 tags: - attack.impact - attack.t1490 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\ - \SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates\ - \SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\ - \SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\ - \SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates\ - \SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates\ - \SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\ - \SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot\Certificates\ - \SOFTWARE\Microsoft\EnterpriseCertificates\AuthRoot\Certificates\ TargetObject|endswith: \Blob Details: Binary Data condition: selection falsepositives: - Unknown level: medium
Query: risk of The backup implementation in Time Machine in Apple OS X before 10.11 allows local users to obtain access to keychain items via unspecified vectors.
Matching passage: CVE-2015-5854. CWE: CWE-200. CVSS: 2.0999999046325684. The backup implementation in Time Machine in Apple OS X before 10.11 allows local users to obtain access to keychain items via unspecified vectors.
Near-miss passage: CVE-2015-1027. CWE: CWE-200. CVSS: 5.900000095367432. The version checking subroutine in percona-toolkit before 2.2.13 and xtrabackup before 2.2.9 was vulnerable to silent HTTP downgrade attacks and Man In The Middle attacks in which the server response could be modified to allow the attacker to respond with modified command payload and have the client return additional running configuration information leading to an information disclosure of running configuration of MySQL.
Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects tamper attempts to sophos av functionality via registry key modification. Logsource: windows / registry_set. Rule: title: Tamper With Sophos AV Registry Keys id: 9f4662ac-17ca-43aa-8f12-5d7b989d0101 status: test description: Detects tamper attempts to sophos av functionality via registry key modification references: - https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-02 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Sophos Endpoint Defense\TamperProtection\Config\SAVEnabled - \Sophos Endpoint Defense\TamperProtection\Config\SEDEnabled - \Sophos\SAVService\TamperProtection\Enabled Details: DWORD (0x00000000) condition: selection falsepositives: - Some FP may occur when the feature is disabled by the AV itself, you should always investigate if the action was legitimate level: high
Near-miss passage: Sigma rule: This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that ar. Logsource: windows. Rule: title: Mimikatz Use id: 06d71506-7beb-4f22-8888-e2e5e2ca7fd8 status: test description: This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups) references: - https://tools.thehacker.recipes/mimikatz/modules author: Florian Roth (Nextron Systems), David ANDRE (additional keywords) date: 2017-01-10 modified: 2022-01-05 tags: - attack.s0002 - attack.lateral-movement - attack.credential-access - car.2013-07-001 - car.2019-04-004 - attack.t1003.002 - attack.t1003.004 - attack.t1003.001 - attack.t1003.006 logsource: product: windows detection: keywords: - dpapi::masterkey - eo.oe.kiwi - event::clear - event::drop - gentilkiwi.com - kerberos::golden - kerberos::ptc - kerberos::ptt - kerberos::tgt - Kiwi Legit Printer - 'lsadump::' - mimidrv.sys - \mimilib.dll - misc::printnightmare - misc::shadowcopies - misc::skeleton - privilege::backup - privilege::debug - privilege::driver - 'sekurlsa::' filter: EventID: 15 condition: keywords and not filter falsepositives: - Naughty administrators - AV Signature updates - Files with Mimikatz in their filename level: high
Query: write Sigma for Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". T
Matching passage: Sigma rule: Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". T. Logsource: windows / ps_script. Rule: title: Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell ScriptBlock id: cacef8fc-9d3d-41f7-956d-455c6e881bc5 related: - id: a6fc3c46-23b8-4996-9ea2-573f4c4d88c5 type: similar - id: f65e22f9-819e-4f96-9c7b-498364ae7a25 type: similar - id: 38a7625e-b2cb-485d-b83d-aff137d859f4 type: similar status: test description: Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This could be a sign of potential abuse of the "RemoteFXvGPUDisablement.exe" binary which is known to be vulnerable to module load-order hijacking. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md - https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-09 tags: - attack.stealth - attack.t1218 logsource: product: windows category: ps_script definition: bade5735-5ab0-4aa7-a642-a11be0e40872 detection: selection: ScriptBlockText|startswith: function Get-VMRemoteFXPhysicalVideoAdapter { condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects remote thread creation from CACTUSTORCH as described in references.. Logsource: windows / create_remote_thread. Rule: title: HackTool - CACTUSTORCH Remote Thread Creation id: 2e4e488a-6164-4811-9ea1-f960c7359c40 status: test description: Detects remote thread creation from CACTUSTORCH as described in references. references: - https://twitter.com/SBousseaden/status/1090588499517079552 - https://github.com/mdsecactivebreach/CACTUSTORCH author: '@SBousseaden (detection), Thomas Patzke (rule)' date: 2019-02-01 modified: 2023-05-05 tags: - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1055.012 - attack.t1059.005 - attack.t1059.007 - attack.t1218.005 logsource: product: windows category: create_remote_thread detection: selection: SourceImage|endswith: - \System32\cscript.exe - \System32\wscript.exe - \System32\mshta.exe - \winword.exe - \excel.exe TargetImage|contains: \SysWOW64\ StartModule: null condition: selection falsepositives: - Unknown level: high
Query: vulnerability: Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors.
Matching passage: CVE-2015-8871. CWE: CWE-416. CVSS: 9.800000190734863. Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors.
Near-miss passage: CVE-2015-3055. CWE: CWE-416. CVSS: 7.5. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3053, CVE-2015-3054, CVE-2015-3059, and CVE-2015-3075.
Query: detection rule: Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual"
Matching passage: Sigma rule: Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual". Logsource: windows / process_creation. Rule: title: Service StartupType Change Via PowerShell Set-Service id: 62b20d44-1546-4e61-afce-8e175eb9473c status: test description: Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual" references: - https://www.virustotal.com/gui/file/38283b775552da8981452941ea74191aa0d203edd3f61fb2dee7b0aea3514955 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-04 tags: - attack.execution - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \powershell.exe - OriginalFileName: PowerShell.EXE selection_cli: CommandLine|contains|all: - Set-Service - -StartupType CommandLine|contains: - Disabled - Manual condition: all of selection_* falsepositives: - False positives may occur with troubleshooting scripts level: medium
Near-miss passage: Sigma rule: Detects a suspicious child process of Script Event Consumer (scrcons.exe).. Logsource: windows / process_creation. Rule: title: Script Event Consumer Spawning Process id: f6d1dd2f-b8ce-40ca-bc23-062efb686b34 status: test description: Detects a suspicious child process of Script Event Consumer (scrcons.exe). references: - https://redcanary.com/blog/child-processes/ - https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-analytics-alert-reference/cortex-xdr-analytics-alert-reference/scrcons-exe-rare-child-process.html author: Sittikorn S date: 2021-06-21 modified: 2022-07-14 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \scrcons.exe Image|endswith: - \svchost.exe - \dllhost.exe - \powershell.exe - \pwsh.exe - \wscript.exe - \cscript.exe - \schtasks.exe - \regsvr32.exe - \mshta.exe - \rundll32.exe - \msiexec.exe - \msbuild.exe condition: selection falsepositives: - Unknown level: high