alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-4928
Matching passage: CVE-2015-4928. CWE: CWE-200. CVSS: 4.300000190734863. Apache Ambari before 2.1, as used in IBM Infosphere BigInsights 4.x before 4.1, includes cleartext passwords on a Configs screen, which allows physically proximate attackers to obtain sensitive information by reading password fields.
Near-miss passage: CVE-2015-1800. CWE: CWE-200. CVSS: 7.5. The samsung_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to potentially obtain sensitive information.
Query: weakness Use of Path Manipulation Function without Maximum-sized Buffer
Matching passage: CWE-785 Use of Path Manipulation Function without Maximum-sized Buffer. The product invokes a function for normalizing paths or file names, but it provides an output buffer that is smaller than the maximum possible size, such as PATH_MAX.
Near-miss passage: CWE-82 Improper Neutralization of Script in Attributes of IMG Tags in a Web Page. The web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute.
Query: vulnerability: The Adobe Type Manager Library in Microsoft Windows 10 allows local users to gain privileges via a crafted application, aka "Font Driver Elevation of Privilege Vulnerability."
Matching passage: CVE-2015-2508. CWE: CWE-264. CVSS: 7.199999809265137. The Adobe Type Manager Library in Microsoft Windows 10 allows local users to gain privileges via a crafted application, aka "Font Driver Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-1156. CWE: CWE-264. CVSS: 4.300000190734863. The page-loading implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, does not properly handle the rel attribute in an A element, which allows remote attackers to bypass the Same Origin Policy for a link's target, and spoof the user interface, via a crafted web site.
Query: Sigma rule for Detects remote thread creation by PowerShell processes into "lsass.exe"
Matching passage: Sigma rule: Detects remote thread creation by PowerShell processes into "lsass.exe". Logsource: windows / create_remote_thread. Rule: title: Potential Credential Dumping Attempt Via PowerShell Remote Thread id: fb656378-f909-47c1-8747-278bf09f4f4f related: - id: 3f07b9d1-2082-4c56-9277-613a621983cc type: obsolete - id: 0f920ebe-7aea-4c54-b202-9aa0c609cfe5 type: similar status: test description: Detects remote thread creation by PowerShell processes into "lsass.exe" references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse author: oscd.community, Natalia Shornikova date: 2020-10-06 modified: 2022-12-18 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: create_remote_thread detection: selection: SourceImage|endswith: - \powershell.exe - \pwsh.exe TargetImage|endswith: \lsass.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects new BITS transfer job saving local files with potential suspicious extensions. Logsource: windows / bits-client. Rule: title: BITS Transfer Job Downloading File Potential Suspicious Extension id: b85e5894-9b19-4d86-8c87-a2f3b81f0521 status: test description: Detects new BITS transfer job saving local files with potential suspicious extensions references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md author: frack113 date: 2022-03-01 modified: 2023-03-27 tags: - attack.persistence - attack.execution - attack.stealth - attack.t1197 logsource: product: windows service: bits-client detection: selection: EventID: 16403 LocalName|endswith: - .bat - .dll - .exe - .hta - .ps1 - .psd1 - .sh - .vbe - .vbs filter_optional_generic: LocalName|contains: \AppData\ RemoteName|contains: .com condition: selection and not 1 of filter_optional_* falsepositives: - While the file extensions in question can be suspicious at times. It's best to add filters according to your environment to avoid large amount false positives level: medium
Query: Sigma YAML for linux
Matching passage: Sigma rule: Detects commands that try to clear or tamper with the Linux command history. This technique is used by threat actors in. Logsource: linux. Rule: title: Linux Command History Tampering id: fdc88d25-96fb-4b7c-9633-c0e417fdbd4e status: test description: 'Detects commands that try to clear or tamper with the Linux command history. This technique is used by threat actors in order to evade defenses and execute commands without them being recorded in files such as "bash_history" or "zsh_history". ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.003/T1070.003.md - https://www.hackers-arise.com/post/2016/06/20/covering-your-bash-shell-tracks-antiforensics - https://www.cadosecurity.com/spinning-yarn-a-new-linux-malware-campaign-targets-docker-apache-hadoop-redis-and-confluence/ author: Patrick Bareiss date: 2019-03-24 modified: 2024-04-17 tags: - attack.stealth - attack.t1070.003 logsource: product: linux detection: keywords: - cat /dev/null >*sh_history - cat /dev/zero >*sh_history - chattr +i*sh_history - echo "" >*sh_history - empty_bash_history - export HISTFILESIZE=0 - history -c - history -w - ln -sf /dev/null *sh_history - ln -sf /dev/zero *sh_history - rm *sh_history - shopt -ou history - shopt -uo history - shred *sh_history - truncate -s0 *sh_history condition: keywords falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects external disk drives or plugged-in USB devices.. Logsource: windows / security. Rule: title: External Disk Drive Or USB Storage Device Was Recognized By The System id: f69a87ea-955e-4fb4-adb2-bb9fd6685632 status: test description: Detects external disk drives or plugged-in USB devices. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6416 author: Keith Wright date: 2019-11-20 modified: 2024-02-09 tags: - attack.t1091 - attack.t1200 - attack.lateral-movement - attack.initial-access logsource: product: windows service: security detection: selection_eid: EventID: 6416 selection_field: - ClassName: DiskDrive - DeviceDescription: USB Mass Storage Device condition: all of selection_* falsepositives: - Likely level: low
Query: vulnerability: OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to "fake LLDP injection."
Matching passage: CVE-2015-1611. CWE: CWE-20. CVSS: 7.5. OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to "fake LLDP injection."
Near-miss passage: CVE-2015-1833. CWE: CWE-20. CVSS: 6.400000095367432. XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.
Query: explain CWE-1336
Matching passage: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine. The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
Near-miss passage: CWE-143 Improper Neutralization of Record Delimiters. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as record delimiters when they are sent to a downstream component.
Query: detection rule: Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain
Matching passage: Sigma rule: Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain. Logsource: windows / security. Rule: title: DPAPI Domain Master Key Backup Attempt id: 39a94fd1-8c9a-4ff6-bf22-c058762f8014 status: test description: Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain Controller. references: - https://threathunterplaybook.com/hunts/windows/190620-DomainDPAPIBackupKeyExtraction/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-08-10 modified: 2023-03-15 tags: - attack.credential-access - attack.t1003.004 logsource: product: windows service: security detection: selection: EventID: 4692 condition: selection falsepositives: - If a computer is a member of a domain, DPAPI has a backup mechanism to allow unprotection of the data. Which will trigger this event. level: medium
Near-miss passage: Sigma rule: Identifies when a service account is modified in Google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud Service Account Modified id: 6b67c12e-5e40-47c6-b3b0-1e6b571184cc status: test description: Identifies when a service account is modified in Google Cloud. references: - https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts author: Austin Songer @austinsonger date: 2021-08-14 modified: 2022-10-09 tags: - attack.impact logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name|endswith: - .serviceAccounts.patch - .serviceAccounts.create - .serviceAccounts.update - .serviceAccounts.enable - .serviceAccounts.undelete condition: selection falsepositives: - Service Account being modified may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Service Account modified from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: patch priority for CVE-2015-0284
Matching passage: CVE-2015-0284. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7811.
Near-miss passage: CVE-2015-7775. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-1197.
Query: detection rule: Detects the creation of taskmgr.exe process in context of LOCAL_SYSTEM
Matching passage: Sigma rule: Detects the creation of taskmgr.exe process in context of LOCAL_SYSTEM. Logsource: windows / process_creation. Rule: title: Taskmgr as LOCAL_SYSTEM id: 9fff585c-c33e-4a86-b3cd-39312079a65f status: test description: Detects the creation of taskmgr.exe process in context of LOCAL_SYSTEM references: - Internal Research author: Florian Roth (Nextron Systems) date: 2018-03-18 modified: 2022-05-27 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: User|contains: - AUTHORI - AUTORI Image|endswith: \taskmgr.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Monitor and alert on group membership removal of groups that have CA policy modification access. Logsource: azure / auditlogs. Rule: title: User Removed From Group With CA Policy Modification Access id: 665e2d43-70dc-4ccc-9d27-026c9dd7ed9c status: test description: Monitor and alert on group membership removal of groups that have CA policy modification access references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner' date: 2022-08-04 tags: - attack.privilege-escalation - attack.credential-access - attack.persistence - attack.defense-impairment - attack.t1548 - attack.t1556 logsource: product: azure service: auditlogs detection: selection: properties.message: Remove member from group condition: selection falsepositives: - User removed from the group is approved level: medium
Query: weakness Improperly Controlled Modification of Dynamically-Determined Object Attributes
Matching passage: CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes. The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Near-miss passage: CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains. The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
Query: alert when Detects any assembly DLL being loaded by an Office Product
Matching passage: Sigma rule: Detects any assembly DLL being loaded by an Office Product. Logsource: windows / image_load. Rule: title: DotNET Assembly DLL Loaded Via Office Application id: ff0f2b05-09db-4095-b96d-1b75ca24894a status: test description: Detects any assembly DLL being loaded by an Office Product references: - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16 author: Antonlovesdnb date: 2020-02-19 modified: 2023-03-29 tags: - attack.execution - attack.t1204.002 logsource: category: image_load product: windows detection: selection: Image|endswith: - \excel.exe - \mspub.exe - \onenote.exe - \onenoteim.exe - \outlook.exe - \powerpnt.exe - \winword.exe ImageLoaded|startswith: C:\Windows\assembly\ condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects a method to load DLL via LSASS process using an undocumented Registry key. Logsource: windows / registry_event. Rule: title: DLL Load via LSASS id: b3503044-60ce-4bf4-bbcb-e3db98788823 status: test description: Detects a method to load DLL via LSASS process using an undocumented Registry key references: - https://blog.xpnsec.com/exploring-mimikatz-part-1/ - https://twitter.com/SBousseaden/status/1183745981189427200 author: Florian Roth (Nextron Systems) date: 2019-10-16 modified: 2022-04-21 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1547.008 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: - \CurrentControlSet\Services\NTDS\DirectoryServiceExtPt - \CurrentControlSet\Services\NTDS\LsaDbExtPt filter_domain_controller: Image: C:\Windows\system32\lsass.exe Details: - '%%systemroot%%\system32\ntdsa.dll' - '%%systemroot%%\system32\lsadb.dll' condition: selection and not 1 of filter_* falsepositives: - Unknown level: high
Query: Sigma rule for Detects a CodePage modification using the "mode.com" utility to Russian language. This behavior has been used by threat
Matching passage: Sigma rule: Detects a CodePage modification using the "mode.com" utility to Russian language. This behavior has been used by threat. Logsource: windows / process_creation. Rule: title: CodePage Modification Via MODE.COM To Russian Language id: 12fbff88-16b5-4b42-9754-cd001a789fb3 related: - id: d48c5ffa-3b02-4c0f-9a9e-3c275650dd0e type: derived status: test description: 'Detects a CodePage modification using the "mode.com" utility to Russian language. This behavior has been used by threat actors behind Dharma ransomware. ' references: - https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mode - https://strontic.github.io/xcyclopedia/library/mode.com-59D1ED51ACB8C3D50F1306FD75F20E99.html - https://www.virustotal.com/gui/file/5e75ef02517afd6e8ba6462b19217dc4a5a574abb33d10eb0f2bab49d8d48c22/behavior author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2024-01-17 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mode.com - OriginalFileName: MODE.COM selection_cli: CommandLine|contains|all: - ' con ' - ' cp ' - ' select=' CommandLine|endswith: - =1251 - =866 condition: all of selection_* falsepositives: - Russian speaking people changing the CodePage level: medium
Near-miss passage: Sigma rule: Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacke. Logsource: windows / process_creation. Rule: title: Add SafeBoot Keys Via Reg Utility id: d7662ff6-9e97-4596-a61d-9839e32dee8d related: - id: fc0e89b5-adb0-43c1-b749-c12a10ec37de type: similar status: test description: Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not references: - https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-02 modified: 2024-03-19 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_safeboot: CommandLine|contains: \SYSTEM\CurrentControlSet\Control\SafeBoot selection_flag: CommandLine|contains: - ' copy ' - ' add ' condition: all of selection* falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_add_safeboot/info.yml
Query: describe CVE-2015-2814
Matching passage: CVE-2015-2814. CWE: CWE-264. CVSS: 6.400000095367432. SAP EMR Unwired (com.sap.mobile.healthcare.emr.v2) and Clinical Task Tracker (com.sap.mobile.healthcare.ctt) does not properly restrict access, which allows remote attackers to change the backendurl, clientid, ssourl, and infopageurl settings via unspecified vectors, aka SAP Security Note 2117079.
Near-miss passage: CVE-2015-1814. CWE: CWE-264. CVSS: 7.5. The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token change" involving anonymous users.
Query: vulnerability: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corr
Matching passage: CVE-2015-2451. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2450.
Near-miss passage: CVE-2015-3776. CWE: CWE-119. CVSS: 9.300000190734863. IOKit in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption and application crash) via a malformed plist.
Query: Sigma rule for Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh
Matching passage: Sigma rule: Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh. Logsource: linux / process_creation. Rule: title: Execution Of Script Located In Potentially Suspicious Directory id: 30bcce26-51c5-49f2-99c8-7b59e3af36c7 status: test description: Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh", etc. references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.execution logsource: product: linux category: process_creation detection: selection_img: Image|endswith: - /bash - /csh - /dash - /fish - /ksh - /sh - /zsh selection_flag: CommandLine|contains: ' -c ' selection_paths: CommandLine|contains: /tmp/ condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Manag. Logsource: windows / ps_script. Rule: title: Powershell WMI Persistence id: 9e07f6e7-83aa-45c6-998e-0af26efd0a85 status: test description: Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.003/T1546.003.md - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/data/module_source/persistence/Persistence.psm1#L545 author: frack113 date: 2021-08-19 modified: 2022-12-25 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_ioc: - ScriptBlockText|contains|all: - 'New-CimInstance ' - '-Namespace root/subscription ' - '-ClassName __EventFilter ' - '-Property ' - ScriptBlockText|contains|all: - 'New-CimInstance ' - '-Namespace root/subscription ' - '-ClassName CommandLineEventConsumer ' - '-Property ' condition: selection_ioc falsepositives: - Unknown level: medium
Query: playbook for alert: Lateral movement indicators for Outlook Home Page
Matching passage: Playbook for T1137.004 Outlook Home Page. 1) Validate alert telemetry against T1137.004. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: persistence. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system. Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders. This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened. A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page
Near-miss passage: Playbook for T1137.003 Outlook Forms. Different response path focused on persistence.
Query: exploit The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allows attackers to bypass intended IP address access restriction
Matching passage: CVE-2015-8008. CWE: CWE-284. CVSS: 7.5. The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allows attackers to bypass intended IP address access restrictions by making an API request with an existing token.
Near-miss passage: CVE-2015-3692. CWE: CWE-284. CVSS: 6.800000190734863. Apple Mac EFI before 2015-001, as used in OS X before 10.10.4 and other products, does not enforce a locking protection mechanism upon being woken from sleep, which allows local users to conduct EFI flash attacks by leveraging root privileges.