alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / driver_load
Matching passage: Sigma rule: Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for. Logsource: windows / driver_load. Rule: title: Vulnerable HackSys Extreme Vulnerable Driver Load id: 295c9289-acee-4503-a571-8eacaef36b28 status: test description: Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors references: - https://github.com/hacksysteam/HackSysExtremeVulnerableDriver author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-18 modified: 2024-11-23 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: product: windows category: driver_load detection: selection: - ImageLoaded|endswith: \HEVD.sys - Hashes|contains: - IMPHASH=f26d0b110873a1c7d8c4f08fbeab89c5 - IMPHASH=c46ea2e651fd5f7f716c8867c6d13594 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects suspicious file type dropped by an Exchange component in IIS. Logsource: windows / file_event. Rule: title: Suspicious File Drop by Exchange id: 6b269392-9eba-40b5-acb6-55c882b20ba6 related: - id: bd1212e5-78da-431e-95fa-c58e3237a8e6 type: similar status: test description: Detects suspicious file type dropped by an Exchange component in IIS references: - https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/ - https://www.gteltsc.vn/blog/canh-bao-chien-dich-tan-cong-su-dung-lo-hong-zero-day-tren-microsoft-exchange-server-12714.html - https://en.gteltsc.vn/blog/cap-nhat-nhe-ve-lo-hong-bao-mat-0day-microsoft-exchange-dang-duoc-su-dung-de-tan-cong-cac-to-chuc-tai-viet-nam-9685.html author: Florian Roth (Nextron Systems) date: 2022-10-04 tags: - attack.persistence - attack.t1190 - attack.initial-access - attack.t1505.003 logsource: product: windows category: file_event detection: selection: Image|endswith: \w3wp.exe CommandLine|contains: MSExchange selection_types: TargetFilename|endswith: - .aspx - .asp - .ashx - .ps1 - .bat - .exe - .dll - .vbs condition: all of selection* falsepositives: - Unknown level: medium
Query: risk of The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been mount
Matching passage: CVE-2015-4715. CWE: CWE-552. CVSS: 4.900000095367432. The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been mounted, allows remote administrators of Dropbox.com to read arbitrary files via an @ (at sign) character in unspecified POST values.
Near-miss passage: CVE-2015-1350. CWE: CWE-552. CVSS: 5.5. The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the Video module before 7.x-2.11 for Drupal, when using the video WYSIWYG plugin, allows remote authenticated users to inject arbitrary 
Matching passage: CVE-2015-3362. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Video module before 7.x-2.11 for Drupal, when using the video WYSIWYG plugin, allows remote authenticated users to inject arbitrary web script or HTML via a node title.
Near-miss passage: CVE-2015-8807. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the _renderVarInput_number function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via vectors involving numeric form fields.
Query: detect Detects when an organization member or an outside collaborator is added to or removed from a project board or has their in logs
Matching passage: Sigma rule: Detects when an organization member or an outside collaborator is added to or removed from a project board or has their. Logsource: github / audit. Rule: title: Github Outside Collaborator Detected id: eaa9ac35-1730-441f-9587-25767bde99d7 status: test description: 'Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA. ' author: Muhammad Faisal (@faisalusuf) date: 2023-01-20 references: - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization tags: - attack.privilege-escalation - attack.persistence - attack.collection - attack.t1098.001 - attack.t1098.003 - attack.t1213.003 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action: - org.remove_outside_collaborator - project.update_user_permission condition: selection falsepositives: - Validate the actor if permitted to access the repo. - Validate the Multifactor Authentication changes. level: medium
Near-miss passage: Sigma rule: Detects RDP session hijacking by using MSTSC shadowing. Logsource: windows / process_creation. Rule: title: Potential MSTSC Shadowing Activity id: 6ba5a05f-b095-4f0a-8654-b825f4f16334 status: test description: Detects RDP session hijacking by using MSTSC shadowing references: - https://twitter.com/kmkz_security/status/1220694202301976576 - https://github.com/kmkz/Pentesting/blob/47592e5e160d3b86c2024f09ef04ceb87d204995/Post-Exploitation-Cheat-Sheet author: Florian Roth (Nextron Systems) date: 2020-01-24 modified: 2023-02-05 tags: - attack.lateral-movement - attack.t1563.002 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - noconsentprompt - 'shadow:' condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-7456
Matching passage: CVE-2015-7456. CWE: CWE-200. CVSS: 6.5. IBM Spectrum Scale 4.1.1 before 4.1.1.4, and 4.2.0.0, allows remote authenticated users to discover object-storage admin passwords via unspecified vectors.
Near-miss passage: CVE-2015-3721. CWE: CWE-200. CVSS: 4.300000190734863. The kernel in Apple iOS before 8.4 and OS X before 10.10.4 does not properly handle HFS parameters, which allows attackers to obtain sensitive memory-layout information via a crafted app.
Query: CVE similar to CVE-2015-3935
Matching passage: CVE-2015-3935. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the Business Search (search_nom) field to (1) htdocs/societe/societe.php or (2) htdocs/societe/admin/societe.php.
Near-miss passage: CVE-2015-4380. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Linear Case module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Query: CVE similar to CVE-2015-6791
Matching passage: CVE-2015-6791. CWE: UNKNOWN. CVSS: 10.0. Multiple unspecified vulnerabilities in Google Chrome before 47.0.2526.80 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Near-miss passage: CVE-2015-6774. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in the GetLoadTimes function in renderer/loadtimes_extension_bindings.cc in the Extensions implementation in Google Chrome before 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that modifies a pointer used for reporting loadTimes data.
Query: CWE for Improper Neutralization of Trailing Special Elements
Matching passage: CWE-162 Improper Neutralization of Trailing Special Elements. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes trailing special elements that could be interpreted in unexpected ways when they are sent to a downstream component.
Near-miss passage: CWE-48 Path Equivalence: 'file name' (Internal Whitespace). The product accepts path input in the form of internal space ('file(SPACE)name') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Query: Outbound C2 pattern associated with Dynamic API Resolution
Matching passage: T1027.007 Dynamic API Resolution. Tactics: stealth. Description: Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis. Malware commonly uses various [Native API](https://attack.mitre.org/techniques/T1106) functions provided by the OS to perform various tasks such as those involving processes, files, and other system artifacts. API functions called by malware may leave static artifacts such as strings in payload files. Defensive analysts may also uncover which functions a binary file may execute via an import address table (IAT) or other structures that help dynamically link calling code to the shared modules that provide functions.(Citation: Huntress API Hash)(Citation: IRED API Hashing) To avoid static or other defensive analysis, adversaries may use dynamic API resolution to conceal malware characteristics and functionalities. Similar to [Software Packing](https://attack.mitre.org/techniques/T1027/002), dynamic API resolution may change file signatures and obfuscate malicious API function calls until they are resolved and invoked during runtime. Various methods may be used to obfuscate malware calls to API functions. For example, hashes of function names are commonly stored in malware in lieu of literal strings. Malware can use these hashes (or other identifiers) to manually reproduce the linking and loading process using functions such as `GetProcAddress()` and `LoadLibrary()`. These hashes/identifiers can also be further obfuscated using encryption or other string manipulation tricks (requiring various forms of [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) during execution).(Citation: BlackHat API Packers)(Citation: Drakonia HInvoke)(Citation: Huntress API Hash)
Near-miss passage: T1027.008 Stripped Payloads. Tactics: stealth. Description: Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information. Scripts and executables may contain variables names and other strings that help developers document code functionality. Symbols are often created by an operating system’s `linker` when executable payloads are compiled. Reverse engineers use these symbols and strings to analyze code and to identify functionality in payloads.(Citation: Mandiant golang stripped binaries explanation)(Citation: intezer stripped binaries elf files 2018) Adversaries may use stripped payloads in order to make malware analysis more difficult. For example, compilers and other tools may provide features to remove or obfuscate strings and symbols. Adversaries have also used stripped payload formats, such as run-only AppleScripts, a compiled and stripped version of [AppleScript](https://attack.mitre.org/techniques/T1059/002), to evade detection and analysis. The lack of human-readable information may directly hinder detection and analysis of payloads.(Citation: SentinelLabs reversing run-only applescripts 2021)
Query: risk of Cisco IP Communicator 8.6(4) allows remote attackers to cause a denial of service (service outage) via an unspecified URL in a GET request, aka Bug ID CSCuu37656.
Matching passage: CVE-2015-4240. CWE: CWE-399. CVSS: 5.0. Cisco IP Communicator 8.6(4) allows remote attackers to cause a denial of service (service outage) via an unspecified URL in a GET request, aka Bug ID CSCuu37656.
Near-miss passage: CVE-2015-0711. CWE: CWE-399. CVSS: 5.0. The hamgr service in the IPv6 Proxy Mobile (PM) implementation in Cisco StarOS 18.1.0.59776 on ASR 5000 devices allows remote attackers to cause a denial of service (service reload and call-processing outage) via malformed PM packets, aka Bug ID CSCut94711.
Query: CVE similar to CVE-2015-2267
Matching passage: CVE-2015-2267. CWE: CWE-284. CVSS: 4.0. mdeploy.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass intended access restrictions and extract archives to arbitrary directories via a crafted dataroot value.
Near-miss passage: CVE-2015-7184. CWE: CWE-284. CVSS: 6.800000190734863. The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Query: write Sigma for Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.
Matching passage: Sigma rule: Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.. Logsource: aws / cloudtrail. Rule: title: AWS GuardDuty Important Change id: 6e61ee20-ce00-4f8d-8aee-bedd8216f7e3 status: test description: Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs. references: - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/guardduty__whitelist_ip/main.py#L9 author: faloker date: 2020-02-11 modified: 2022-10-09 tags: - attack.defense-impairment - attack.t1685 logsource: product: aws service: cloudtrail detection: selection_source: eventSource: guardduty.amazonaws.com eventName: CreateIPSet condition: selection_source falsepositives: - Valid change in the GuardDuty (e.g. to ignore internal scanners) level: high
Near-miss passage: Sigma rule: Detects an issue in apache logs that reports threading related errors. Logsource: apache. Rule: title: Apache Threading Error id: e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c status: test description: Detects an issue in apache logs that reports threading related errors references: - https://github.com/hannob/apache-uaf/blob/da40f2be3684c8095ec6066fa68eb5c07a086233/README.md author: Florian Roth (Nextron Systems) date: 2019-01-22 modified: 2021-11-27 tags: - attack.initial-access - attack.lateral-movement - attack.t1190 - attack.t1210 logsource: service: apache definition: 'Requirements: Must be able to collect the error.log file' detection: keywords: - '__pthread_tpp_change_priority: Assertion `new_prio == -1 || (new_prio >= fifo_min_prio && new_prio <= fifo_max_prio)' condition: keywords falsepositives: - 3rd party apache modules - https://bz.apache.org/bugzilla/show_bug.cgi?id=46185 level: medium
Query: playbook for alert: Encoded PowerShell / command-line abuse matching Ccache Files
Matching passage: Playbook for T1558.005 Ccache Files. 1) Validate alert telemetry against T1558.005. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: credential access. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having to re-enter credentials. The <code>/etc/krb5.conf</code> configuration file and the <code>KRB5CCNAME<
Near-miss passage: Playbook for T1558.002 Silver Ticket. Different response path focused on credential access.
Query: describe CVE-2015-7338
Matching passage: CVE-2015-7338. CWE: CWE-89. CVSS: 7.199999809265137. SQL Injection exists in AcyMailing Joomla Component before 4.9.5 via exportgeolocorder in a geolocation_longitude request to index.php.
Near-miss passage: CVE-2015-5376. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in the login form in GSI WiNPAT Portal 3.2.0.1001 through 3.6.1.0 allows remote attackers to execute arbitrary SQL commands via the username field.
Query: exploit Cross-site request forgery (CSRF) vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators for
Matching passage: CVE-2015-2838. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands as nsroot via shell metacharacters in the file_name JSON member in params/xen_hotfix/0 to nitro/v1/config/xen_hotfix.
Near-miss passage: CVE-2015-4140. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the WP Smiley plugin 1.4.1 for WordPress allows remote attackers to hijack the authentication of editors for requests that conduct cross-site scripting (XSS) attacks via the s4w-more parameter to the smilies4wp.php page to wp-admin/options-general.php.
Query: vulnerability: Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI.
Matching passage: CVE-2015-0408. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI.
Near-miss passage: CVE-2015-4363. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the finder_form_goto function in the Finder module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Query: vulnerability: PC-EGG pWebManager before 3.3.10, and before 2.2.2 for PHP 4.x, allows remote authenticated users to execute arbitrary OS commands by leveraging the editor role.
Matching passage: CVE-2015-7774. CWE: CWE-78. CVSS: 6.5. PC-EGG pWebManager before 3.3.10, and before 2.2.2 for PHP 4.x, allows remote authenticated users to execute arbitrary OS commands by leveraging the editor role.
Near-miss passage: CVE-2015-6370. CWE: CWE-78. CVSS: 7.199999809265137. The Management I/O (MIO) component in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows local users to execute arbitrary OS commands as root via crafted CLI input, aka Bug ID CSCux10578.
Query: discovery using Log Enumeration
Matching passage: T1654 Log Enumeration. Tactics: discovery. Description: Adversaries may enumerate system and service logs to find useful data. These logs may highlight various types of valuable insights for an adversary, such as user authentication records ([Account Discovery](https://attack.mitre.org/techniques/T1087)), security or vulnerable software ([Software Discovery](https://attack.mitre.org/techniques/T1518)), or hosts within a compromised network ([Remote System Discovery](https://attack.mitre.org/techniques/T1018)). Host binaries may be leveraged to collect system logs. Examples include using `wevtutil.exe` or [PowerShell](https://attack.mitre.org/techniques/T1059/001) on Windows to access and/or export security event information.(Citation: WithSecure Lazarus-NoPineapple Threat Intel Report 2023)(Citation: Cadet Blizzard emerges as novel threat actor) In cloud environments, adversaries may leverage utilities such as the Azure VM Agent’s `CollectGuestLogs.exe` to collect security logs from cloud hosted infrastructure.(Citation: SIM Swapping and Abuse of the Microsoft Azure Serial Console) Adversaries may also target centralized logging infrastructure such as SIEMs. Logs may also be bulk exported and sent to adversary-controlled infrastructure for offline analysis. In addition to gaining a better understanding of the environment, adversaries may also monitor logs in real time to track incident response procedures. This may allow them to adjust their techniques in order to maintain persistence or evade defenses.(Citation: Permiso GUI-Vil 2023)
Near-miss passage: T1613 Container and Resource Discovery. Tactics: discovery. Description: Adversaries may attempt to discover containers and other resources that are available within a containers environment. Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster. These resources can be viewed within web applications such as the Kubernetes dashboard or can be queried via the Docker and Kubernetes APIs.(Citation: Docker API)(Citation: Kubernetes API) In Docker, logs may leak information about the environment, such as the environment’s configuration, which services are available, and what cloud provider the victim may be utilizing. The discovery of these resources may inform an adversary’s next steps in the environment, such as how to perform lateral movement and which methods to utilize for execution.
Query: risk of Huawei Quidway switches with firmware before V200R005C00SPC300 allows remote attackers to gain privileges via a crafted packet.
Matching passage: CVE-2015-1460. CWE: CWE-264. CVSS: 7.5. Huawei Quidway switches with firmware before V200R005C00SPC300 allows remote attackers to gain privileges via a crafted packet.
Near-miss passage: CVE-2015-0721. CWE: CWE-264. CVSS: 8.0. Cisco NX-OS 4.0 through 7.3 on Multilayer Director and Nexus 1000V, 2000, 3000, 3500, 4000, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote authenticated users to bypass intended AAA restrictions and obtain privileged CLI access via crafted parameters in an SSH connection negotiation, aka Bug IDs CSCum35502, CSCuw78669, CSCuw79754, and CSCux88492.
Query: CVE similar to CVE-2015-5668
Matching passage: CVE-2015-5668. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Techno Project Japan Enisys Gw before 1.4.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-4610. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the Store Locator (locator) extension before 3.3.1 for TYPO3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Query: CVE similar to CVE-2015-1009
Matching passage: CVE-2015-1009. CWE: CWE-200. CVSS: 1.7000000476837158. Schneider Electric InduSoft Web Studio before 7.1.3.5 Patch 5 and Wonderware InTouch Machine Edition through 7.1 SP3 Patch 4 use cleartext for project-window password storage, which allows local users to obtain sensitive information by reading a file.
Near-miss passage: CVE-2015-5860. CWE: CWE-200. CVSS: 5.0. The CFNetwork HTTPProtocol component in Apple iOS before 9 mishandles HSTS state, which allows remote attackers to bypass the Safari private-browsing protection mechanism and track users via a crafted web site.