alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit The files_external app in ownCloud Server before 7.0.9, 8.0.x before 8.0.7, and 8.1.x before 8.1.2 allows remote authenticated users to instantiate arbitrary classes and possibly e
Matching passage: CVE-2015-7699. CWE: CWE-20. CVSS: 9.0. The files_external app in ownCloud Server before 7.0.9, 8.0.x before 8.0.7, and 8.1.x before 8.1.2 allows remote authenticated users to instantiate arbitrary classes and possibly execute arbitrary code via a crafted mount point option, related to "objectstore."
Near-miss passage: CVE-2015-1261. CWE: CWE-20. CVSS: 5.0. android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java in Google Chrome before 43.0.2357.65 on Android does not properly restrict use of a URL's fragment identifier during construction of a page-info popup, which allows remote attackers to spoof the URL bar or deliver misleading popup content via crafted text.
Query: write Sigma for Detects shellshock expressions in log files
Matching passage: Sigma rule: Detects shellshock expressions in log files. Logsource: linux. Rule: title: Shellshock Expression id: c67e0c98-4d39-46ee-8f6b-437ebf6b950e status: test description: Detects shellshock expressions in log files references: - https://owasp.org/www-pdf-archive/Shellshock_-_Tudor_Enache.pdf author: Florian Roth (Nextron Systems) date: 2017-03-14 modified: 2022-10-09 tags: - attack.persistence - attack.t1505.003 logsource: product: linux detection: keywords: - (){:;}; - () {:;}; - () { :;}; - () { :; }; condition: keywords falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware.. Logsource: windows / process_creation. Rule: title: PowerShell Execution With Potential Decryption Capabilities id: 434c08ba-8406-4d15-8b24-782cb071a691 status: test description: Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware. references: - https://research.checkpoint.com/2023/chinese-threat-actors-targeting-europe-in-smugx-campaign/ author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-06-30 modified: 2023-12-05 tags: - attack.execution logsource: product: windows category: process_creation detection: selection_img: Image|endswith: - \powershell.exe - \pwsh.exe OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli_dir: CommandLine|contains: - 'Get-ChildItem ' - 'dir ' - 'gci ' - 'ls ' selection_cli_gc: CommandLine|contains: - 'Get-Content ' - 'gc ' - 'cat ' - 'type ' - ReadAllBytes selection_cli_specific: - CommandLine|contains|all: - ' ^| ' - \*.lnk - -Recurse - '-Skip ' - CommandLine|contains|all: - ' -ExpandProperty ' - \*.lnk - WriteAllBytes - ' .length ' condition: all of selection_* falsepositives: - Unlikely level: high
Query: adversary uses Downgrade Attack
Matching passage: T1689 Downgrade Attack. Tactics: defense impairment. Description: Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls. Downgrade attacks typically take advantage of a system’s backward compatibility to force it into less secure modes of operation. Adversaries may downgrade and use various less-secure versions of features of a system, such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) or even network protocols that can be abused to enable [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) or [Network Sniffing](https://attack.mitre.org/techniques/T1040).(Citation: Praetorian TLS Downgrade Attack 2014) For example, [PowerShell](https://attack.mitre.org/techniques/T1059/001) versions 5+ includes Script Block Logging (SBL), which can record executed script content. However, adversaries may attempt to execute a previous version of PowerShell that does not support SBL with the intent to impair defenses while running malicious scripts that may have otherwise been detected.(Citation: CrowdStrike downgrade attack)(Citation: Google Cloud downgrade attack)(Citation: att_def_ps_logging) Adversaries may similarly target network traffic to downgrade from an encrypted HTTPS connection to an unsecured HTTP connection that exposes network data in clear text.(Citation: Targeted SSL Stripping Attacks Are Real)(Citation: CrowdStrike Downgrade attack 2) On Windows systems, adversaries may downgrade the boot manager to a vulnerable version that bypasses Secure Boot, granting the ability to disable various operating system security mechanisms.(Citation: SafeBreach)
Near-miss passage: T1686.003 Windows Host Firewall. Tactics: defense impairment. Description: Adversaries may disable or modify the Windows host firewall to bypass controls limiting network usage. This can include disabling the Windows host firewall entirely, suppressing specific profiles (domain, private, public), or adding, deleting, and modifying firewall rules to allow or restrict traffic.(Citation: Nearest Neighbor Volexity) Adversaries may perform these modifications through multiple mechanisms depending on the Windows operating system and access level. For example, adversaries may use command-line utilities (e.g., `netsh advfirewall` or PowerShell cmdlets like `Set-NetFirewallProfile`, `New-NetFirewallRule`), Windows Registry modifications (e.g., altering firewall states and rule configurations via registry keys), or the Windows Control Panel to modify firewall settings through the Windows Security interface. By disabling or modifying Windows firewall services, adversaries may enable access to remote services, open ports for command and control traffic, or configure rules for further actions.
Query: patch priority for CVE-2015-7343
Matching passage: CVE-2015-7343. CWE: CWE-79. CVSS: 4.800000190734863. JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter.
Near-miss passage: CVE-2015-9104. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerabilities in Synology Audio Station 5.1 before 5.1-2550 and 5.4 before 5.4-2857 allows remote authenticated attackers to inject arbitrary web script or HTML via the album title.
Query: weakness Observable Behavioral Discrepancy
Matching passage: CWE-205 Observable Behavioral Discrepancy. The product's behaviors indicate important differences that may be observed by unauthorized actors in a way that reveals (1) its internal state or decision process, or (2) differences from other products with equivalent functionality.
Near-miss passage: CWE-431 Missing Handler. A handler is not available or implemented.
Query: risk of Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attackers to connect as slaves and obtain s
Matching passage: CVE-2015-5320. CWE: CWE-200. CVSS: 5.0. Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attackers to connect as slaves and obtain sensitive information or possibly gain administrative access by leveraging knowledge of the name of a slave.
Near-miss passage: CVE-2015-5310. CWE: CWE-200. CVSS: 4.300000190734863. The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 does not properly ignore key data in response frames when management frame protection (MFP) was not negotiated, which allows remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service (ignored packets) via a WNM Sleep Mode response.
Query: risk of The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter.
Matching passage: CVE-2015-9413. CWE: CWE-352. CVSS: 6.5. The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter.
Near-miss passage: CVE-2015-7678. CWE: CWE-352. CVSS: 8.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Ipswitch MOVEit Mobile 1.2.0.962 and earlier allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Query: rule covering Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environ
Matching passage: Sigma rule: Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environ. Logsource: azure / signinlogs. Rule: title: Application Using Device Code Authentication Flow id: 248649b7-d64f-46f0-9fb2-a52774166fb5 status: test description: 'Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious. ' references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' date: 2022-06-01 tags: - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation - attack.initial-access logsource: product: azure service: signinlogs detection: selection: properties.message: Device Code condition: selection falsepositives: - Applications that are input constrained will need to use device code flow and are valid authentications. level: medium
Near-miss passage: Sigma rule: Detects potential WerFault "ReflectDebugger" registry value abuse for persistence.. Logsource: windows / registry_set. Rule: title: Potential WerFault ReflectDebugger Registry Value Abuse id: 0cf2e1c6-8d10-4273-8059-738778f981ad related: - id: fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd type: derived status: test description: Detects potential WerFault "ReflectDebugger" registry value abuse for persistence. references: - https://cocomelonc.github.io/malware/2022/11/02/malware-pers-18.html - https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/ author: X__Junior date: 2023-05-18 tags: - attack.stealth - attack.t1036.003 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Microsoft\Windows\Windows Error Reporting\Hangs\ReflectDebugger condition: selection falsepositives: - Unknown level: high
Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Us. Logsource: windows / registry_set. Rule: title: Hiding User Account Via SpecialAccounts Registry Key id: f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd related: - id: 8a58209c-7ae6-4027-afb0-307a78e4589a type: obsolete - id: 9ec9fb1b-e059-4489-9642-f270c207923d type: similar status: test description: Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen. references: - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1564.002/T1564.002.md#atomic-test-3---create-hidden-user-in-registry author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2022-07-12 modified: 2023-01-26 tags: - attack.stealth - attack.t1564.002 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_special_accounts/info.yml simulation: - type: atomic-red-team name: Create Hidden User in Registry technique: T1564.002 atomic_guid: 173126b7-afe4-45eb-8680-fa9f6400431c
Near-miss passage: Sigma rule: Detects the use of SharpUp, a tool for local privilege escalation. Logsource: windows / process_creation. Rule: title: HackTool - SharpUp PrivEsc Tool Execution id: c484e533-ee16-4a93-b6ac-f0ea4868b2f1 status: test description: Detects the use of SharpUp, a tool for local privilege escalation references: - https://github.com/GhostPack/SharpUp author: Florian Roth (Nextron Systems) date: 2022-08-20 modified: 2023-02-13 tags: - attack.persistence - attack.privilege-escalation - attack.discovery - attack.execution - attack.stealth - attack.t1615 - attack.t1569.002 - attack.t1574.005 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \SharpUp.exe - Description: SharpUp - CommandLine|contains: - HijackablePaths - UnquotedServicePath - ProcessDLLHijack - ModifiableServiceBinaries - ModifiableScheduledTask - DomainGPPPassword - CachedGPPPassword condition: selection falsepositives: - Unknown level: critical
Query: exploit Integer overflow in the CJBig2_Image::expand function in fxcodec/jbig2/JBig2_Image.cpp in PDFium, as used in Google Chrome before 44.0.2403.89, allows remote attackers to cause a d
Matching passage: CVE-2015-1279. CWE: CWE-189. CVSS: 7.5. Integer overflow in the CJBig2_Image::expand function in fxcodec/jbig2/JBig2_Image.cpp in PDFium, as used in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via large height and stride values.
Near-miss passage: CVE-2015-5213. CWE: CWE-189. CVSS: 6.800000190734863. Integer overflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a long DOC file, which triggers a buffer overflow.
Query: detection rule: Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numer
Matching passage: Sigma rule: Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numer. Logsource: windows / ps_script. Rule: title: Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script id: c1337eb8-921a-4b59-855b-4ba188ddcc42 related: - id: e17121b4-ef2a-4418-8a59-12fb1631fa9e type: derived - id: 21ff4ca9-f13a-41ad-b828-0077b2af2e40 type: similar status: test description: Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell - https://www.elastic.co/guide/en/security/current/volume-shadow-copy-deletion-via-powershell.html author: Tim Rauch, frack113 date: 2022-09-20 modified: 2022-12-02 tags: - attack.impact - attack.t1490 logsource: category: ps_script product: windows detection: selection_get: ScriptBlockText|contains: - Get-WmiObject - gwmi - Get-CimInstance - gcim selection_shadowcopy: ScriptBlockText|contains: Win32_ShadowCopy selection_delete: ScriptBlockText|contains: - .Delete() - Remove-WmiObject - rwmi - Remove-CimInstance - rcim condition: all of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can by. Logsource: windows / image_load. Rule: title: Trusted Path Bypass via Windows Directory Spoofing id: 0cbe38c0-270c-41d9-ab79-6e5a9a669290 related: - id: 4ac47ed3-44c2-4b1f-9d51-bf46e8914126 type: similar status: experimental description: 'Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification. This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC. ' references: - https://x.com/Wietze/status/1933495426952421843 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-06-17 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.007 - attack.t1548.002 logsource: category: image_load product: windows detection: selection: ImageLoaded|contains: - :\Windows \System32\ - :\Windows \SysWOW64\ condition: selection falsepositives: - Unlikely level: high
Query: alert when Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These
Matching passage: Sigma rule: Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These. Logsource: windows / process_creation. Rule: title: XBAP Execution From Uncommon Locations Via PresentationHost.EXE id: d22e2925-cfd8-463f-96f6-89cec9d9bc5f status: test description: 'Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These files can be abused to run malicious ".xbap" files any bypass AWL ' references: - https://lolbas-project.github.io/lolbas/Binaries/Presentationhost/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-01 modified: 2023-11-09 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \presentationhost.exe - OriginalFileName: PresentationHost.exe selection_cli: CommandLine|contains: .xbap filter_main_generic: CommandLine|contains: - ' C:\Windows\' - ' C:\Program Files' condition: all of selection* and not 1 of filter_main_* falsepositives: - Legitimate ".xbap" being executed via "PresentationHost" level: medium
Near-miss passage: Sigma rule: Detects the execution of REGSVR32.exe with DLL files masquerading as other files. Logsource: windows / process_creation. Rule: title: Regsvr32 DLL Execution With Suspicious File Extension id: 089fc3d2-71e8-4763-a8a5-c97fbb0a403e related: - id: 8e2b24c9-4add-46a0-b4bb-0057b4e6187d type: obsolete status: test description: Detects the execution of REGSVR32.exe with DLL files masquerading as other files references: - https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/ - https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html - https://guides.lib.umich.edu/c.php?g=282942&p=1885348 - https://harfanglab.io/insidethelab/uac-0057-pressure-ukraine-poland/ author: Florian Roth (Nextron Systems), frack113 date: 2021-11-29 modified: 2025-08-27 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regsvr32.exe - OriginalFileName: REGSVR32.EXE selection_cli: CommandLine|endswith: - .bin - .bmp - .cr2 - .dat - .eps - .gif - .ico - .jpeg - .jpg - .log - .nef - .orf - .png - .raw - .rtf - .sr2 - .temp - .tif - .tiff - .tmp - .txt condition: all of selection_* falsepositives: - Unlikely level: high
Query: vulnerability: The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in
Matching passage: CVE-2015-2265. CWE: CWE-77. CVSS: 7.5. The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.
Near-miss passage: CVE-2015-8257. CWE: CWE-77. CVSS: 8.800000190734863. The devtools.sh script in AXIS network cameras allows remote authenticated users to execute arbitrary commands via shell metacharacters in the app parameter to (1) app_license.shtml, (2) app_license_custom.shtml, (3) app_index.shtml, or (4) app_params.shtml.
Query: vulnerability: EMC SourceOne Email Management before 7.2 does not have a lockout mechanism for invalid login attempts, which makes it easier for remote attackers to obtain access via a brute-forc
Matching passage: CVE-2015-0531. CWE: CWE-284. CVSS: 5.0. EMC SourceOne Email Management before 7.2 does not have a lockout mechanism for invalid login attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.
Near-miss passage: CVE-2015-1253. CWE: CWE-284. CVSS: 7.5. core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that appends a child to a SCRIPT element, related to the insert and executeReparentTask functions.
Query: exploit Microsoft Internet Explorer 6 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explore
Matching passage: CVE-2015-0029. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-1077. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Query: Outbound C2 pattern associated with System Service Discovery
Matching passage: T1007 System Service Discovery. Tactics: discovery. Description: Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as <code>sc query</code>, <code>tasklist /svc</code>, <code>systemctl --type=service</code>, and <code>net start</code>. Adversaries may also gather information about schedule tasks via commands such as `schtasks` on Windows or `crontab -l` on Linux and macOS.(Citation: Elastic Security Labs GOSAR 2024)(Citation: SentinelLabs macOS Malware 2021)(Citation: Splunk Linux Gormir 2024)(Citation: Aquasec Kinsing 2020) Adversaries may use the information from [System Service Discovery](https://attack.mitre.org/techniques/T1007) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Near-miss passage: T1018 Remote System Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as [Ping](https://attack.mitre.org/software/S0097), <code>net view</code> using [Net](https://attack.mitre.org/software/S0039), or, on ESXi servers, `esxcli network diag ping`. Adversaries may also analyze data from local host files (ex: <code>C:\Windows\System32\Drivers\etc\hosts</code> or <code>/etc/hosts</code>) or other passive means (such as local [Arp](https://attack.mitre.org/software/S0099) cache entries) in order to discover the presence of remote systems in an environment. Adversaries may also target discovery of network infrastructure as well as leverage [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands on network devices to gather detailed information about systems within a network (e.g. <code>show cdp neighbors</code>, <code>show arp</code>).(Citation: US-CERT-TA18-106A)(Citation: CISA AR21-126A FIVEHANDS May 2021)