alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explo
Matching passage: CVE-2015-1737. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1731, CVE-2015-1736, and CVE-2015-1755.
Near-miss passage: CVE-2015-1080. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Query: risk of GSKit in IBM Tivoli Directory Server (ITDS) 6.0 before 6.0.0.73-ISS-ITDS-IF0073, 6.1 before 6.1.0.66-ISS-ITDS-IF0066, 6.2 before 6.2.0.42-ISS-ITDS-IF0042, and 6.3 before 6.3.0.35-I
Matching passage: CVE-2015-0138. CWE: CWE-310. CVSS: 4.300000190734863. GSKit in IBM Tivoli Directory Server (ITDS) 6.0 before 6.0.0.73-ISS-ITDS-IF0073, 6.1 before 6.1.0.66-ISS-ITDS-IF0066, 6.2 before 6.2.0.42-ISS-ITDS-IF0042, and 6.3 before 6.3.0.35-ISS-ITDS-IF0035 and IBM Security Directory Server (ISDS) 6.3.1 before 6.3.1.9-ISS-ISDS-IF0009 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204.
Near-miss passage: CVE-2015-3322. CWE: CWE-310. CVSS: 5.0. Lenovo ThinkServer RD350, RD450, RD550, RD650, and TD350 servers before 1.26.0 use weak encryption to store (1) user and (2) administrator BIOS passwords, which allows attackers to decrypt the passwords via unspecified vectors.
Query: CVE similar to CVE-2015-3004
Matching passage: CVE-2015-3004. CWE: CWE-20. CVSS: 4.300000190734863. J-Web in Juniper Junos 11.4 before 11.4R12, 12.1X44 before 12.1X44-D35, 12.1X46 before 12.1X46-D25, 12.1X47 before 12.1X47-D10, 12.3X48 before 12.3X48-D10, 12.2 before 12.2R9, 12.3 before 12.3R7, 13.2 before 13.2R6, 13.2X51 before 13.2X51-D20, 13.3 before 13.3R5, 14.1 before 14.1R3, 14.1X53 before 14.1X53-D10, and 14.2 before 14.2R1 allows remote attackers to conduct clickjacking attacks via an X-Frame-Options header.
Near-miss passage: CVE-2015-4327. CWE: CWE-20. CVSS: 7.199999809265137. The CLI in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to obtain root privileges by writing script arguments to an unspecified file, aka Bug ID CSCuv12542.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe" Both can be used for AWL bypass and to execut. Logsource: windows / process_creation. Rule: title: Use of FSharp Interpreters id: b96b2031-7c17-4473-afe7-a30ce714db29 status: test description: 'Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe" Both can be used for AWL bypass and to execute F# code via scripts or inline. ' references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac - https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/ - https://lolbas-project.github.io/lolbas/OtherMSBinaries/FsiAnyCpu/ - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Fsi/ author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io date: 2022-06-02 modified: 2024-04-23 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \fsi.exe - \fsianycpu.exe - OriginalFileName: - fsi.exe - fsianycpu.exe condition: selection falsepositives: - Legitimate use by a software developer. level: medium
Near-miss passage: Sigma rule: Ntvdm.exe allows the execution of 16-bit Windows applications on 32-bit Windows operating systems, as well as the execut. Logsource: windows / process_creation. Rule: title: Start of NT Virtual DOS Machine id: 16905e21-66ee-42fe-b256-1318ada2d770 status: test description: Ntvdm.exe allows the execution of 16-bit Windows applications on 32-bit Windows operating systems, as well as the execution of both 16-bit and 32-bit DOS applications references: - https://learn.microsoft.com/en-us/windows/compatibility/ntvdm-and-16-bit-app-support - https://support.microsoft.com/fr-fr/topic/an-ms-dos-based-program-that-uses-the-ms-dos-protected-mode-interface-crashes-on-a-computer-that-is-running-windows-7-5dc739ea-987b-b458-15e4-d28d5cca63c7 - https://app.any.run/tasks/93fe92fa-8b2b-4d92-8c09-a841aed2e793/ - https://app.any.run/tasks/214094a7-0abc-4a7b-a564-1b757faed79d/ author: frack113 date: 2022-07-16 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: Image|endswith: - \ntvdm.exe - \csrstub.exe condition: selection falsepositives: - Legitimate use level: medium
Query: detection rule: Detects enumeration of Kubernetes secrets.
Matching passage: Sigma rule: Detects enumeration of Kubernetes secrets.. Logsource: kubernetes / application / audit. Rule: title: Kubernetes Secrets Enumeration id: eeb3e9e1-b685-44e4-9232-6bb701f925b5 related: - id: 7ee0b4aa-d8d4-4088-b661-20efdf41a04c type: derived status: test description: Detects enumeration of Kubernetes secrets. references: - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/List%20K8S%20secrets/ author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.t1552.007 - attack.credential-access logsource: category: application product: kubernetes service: audit detection: selection: verb: list objectRef.resource: secrets condition: selection falsepositives: - The Kubernetes dashboard occasionally accesses the kubernetes-dashboard-key-holder secret level: low
Near-miss passage: Sigma rule: Detects the recovery of files from backups via "wbadmin.exe". Attackers can restore sensitive files such as NTDS.DIT or. Logsource: windows / process_creation. Rule: title: File Recovery From Backup Via Wbadmin.EXE id: 6fe4aa1e-0531-4510-8be2-782154b73b48 related: - id: 84972c80-251c-4c3a-9079-4f00aad93938 type: derived status: test description: 'Detects the recovery of files from backups via "wbadmin.exe". Attackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials. ' references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery - https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/ author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2024-05-10 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wbadmin.exe - OriginalFileName: WBADMIN.EXE selection_cli: CommandLine|contains|all: - ' recovery' - recoveryTarget - itemtype:File condition: all of selection_* falsepositives: - Unknown level: medium
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects use of Cobalt Strike commands accidentally entered in the CMD shell. Logsource: windows / process_creation. Rule: title: Operator Bloopers Cobalt Strike Commands id: 647c7b9e-d784-4fda-b9a0-45c565a7b729 related: - id: 4f154fb6-27d1-4813-a759-78b93e0b9c48 type: similar status: test description: Detects use of Cobalt Strike commands accidentally entered in the CMD shell references: - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/cobalt-4-5-user-guide.pdf - https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/ - https://thedfirreport.com/2022/06/16/sans-ransomware-summit-2022-can-you-detect-this/ author: _pete_0, TheDFIRReport date: 2022-05-06 modified: 2023-01-30 tags: - attack.execution - attack.t1059.003 - stp.1u logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: Cmd.Exe - Image|endswith: \cmd.exe selection_cli: CommandLine|startswith: - 'cmd ' - cmd.exe - c:\windows\system32\cmd.exe CommandLine|contains: - psinject - spawnas - make_token - remote-exec - rev2self - dcsync - logonpasswords - execute-assembly - getsystem condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious process command line that starts with a shell that executes something and finally gets piped into ano. Logsource: linux / process_creation. Rule: title: Linux Shell Pipe to Shell id: 880973f3-9708-491c-a77b-2a35a1921158 status: test description: Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell references: - Internal Research author: Florian Roth (Nextron Systems) date: 2022-03-14 modified: 2022-07-26 tags: - attack.stealth - attack.t1140 logsource: product: linux category: process_creation detection: selection: CommandLine|startswith: - 'sh -c ' - 'bash -c ' selection_exec: - CommandLine|contains: - '| bash ' - '| sh ' - '|bash ' - '|sh ' - CommandLine|endswith: - '| bash' - '| sh' - '|bash' - ' |sh' condition: all of selection* falsepositives: - Legitimate software that uses these patterns level: medium
Query: vulnerability: Cross-site scripting (XSS) vulnerability in Microsoft Skype for Business 2016, Lync 2010 and 2013 SP1, Lync 2010 Attendee, and Lync Room System allows remote attackers to inject ar
Matching passage: CVE-2015-6061. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Microsoft Skype for Business 2016, Lync 2010 and 2013 SP1, Lync 2010 Attendee, and Lync Room System allows remote attackers to inject arbitrary web script or HTML via an instant-message session, aka "Server Input Validation Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-7706. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in Secure Data Space SDS-API before 3.5.7 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO to api/v3/public/shares/downloads/, the (2) authType parameter to api/v3/auth/login, or the (3) login parameter to api/v3/auth/reset_password.
Query: detection rule: Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory
Matching passage: Sigma rule: Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory. Logsource: windows / process_creation. Rule: title: HackTool - Dumpert Process Dumper Execution id: 2704ab9e-afe2-4854-a3b1-0c0706d03578 status: test description: Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory references: - https://github.com/outflanknl/Dumpert - https://unit42.paloaltonetworks.com/actors-still-exploiting-sharepoint-vulnerability/ author: Florian Roth (Nextron Systems) date: 2020-02-04 modified: 2025-01-22 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: - Hashes|contains: MD5=09D278F9DE118EF09163C6140255C690 - CommandLine|contains: Dumpert.dll condition: selection falsepositives: - Very unlikely level: critical
Near-miss passage: Sigma rule: Use of reg to get MachineGuid information. Logsource: windows / process_creation. Rule: title: Suspicious Query of MachineGUID id: f5240972-3938-4e56-8e4b-e33893176c1f status: test description: Use of reg to get MachineGuid information references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-8---windows-machineguid-discovery author: frack113 date: 2022-01-01 tags: - attack.discovery - attack.t1082 logsource: category: process_creation product: windows detection: selection: Image|endswith: \reg.exe CommandLine|contains|all: - SOFTWARE\Microsoft\Cryptography - '/v ' - MachineGuid condition: selection falsepositives: - Unknown level: low
Query: detection rule: Detects potentially suspicious execution of the Regasm/Regsvcs utilities from a potentially suspicious location
Matching passage: Sigma rule: Detects potentially suspicious execution of the Regasm/Regsvcs utilities from a potentially suspicious location. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location id: cc368ed0-2411-45dc-a222-510ace303cb2 related: - id: e9f8f8cc-07cc-4e81-b724-f387db9175e4 type: derived status: test description: Detects potentially suspicious execution of the Regasm/Regsvcs utilities from a potentially suspicious location references: - https://www.fortiguard.com/threat-signal-report/4718?s=09 - https://lolbas-project.github.io/lolbas/Binaries/Regasm/ - https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-25 modified: 2023-02-13 tags: - attack.stealth - attack.t1218.009 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \Regsvcs.exe - \Regasm.exe - OriginalFileName: - RegSvcs.exe - RegAsm.exe selection_dir: CommandLine|contains: - \AppData\Local\Temp\ - \Microsoft\Windows\Start Menu\Programs\Startup\ - \PerfLogs\ - \Users\Public\ - \Windows\Temp\ condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of "tar.exe" in order to create a compressed file. Adversaries may abuse various utilities to compress. Logsource: windows / process_creation. Rule: title: Compressed File Creation Via Tar.EXE id: 418a3163-3247-4b7b-9933-dcfcb7c52ea9 status: test description: 'Detects execution of "tar.exe" in order to create a compressed file. Adversaries may abuse various utilities to compress or encrypt data before exfiltration. ' references: - https://unit42.paloaltonetworks.com/chromeloader-malware/ - https://lolbas-project.github.io/lolbas/Binaries/Tar/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage author: Nasreddine Bencherchali (Nextron Systems), AdmU3 date: 2023-12-19 tags: - attack.collection - attack.exfiltration - attack.t1560 - attack.t1560.001 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \tar.exe - OriginalFileName: bsdtar selection_create: CommandLine|contains: - -c - -r - -u condition: all of selection_* falsepositives: - Likely level: low
Query: rule covering Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate po
Matching passage: Sigma rule: Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate po. Logsource: windows / process_creation. Rule: title: ConvertTo-SecureString Cmdlet Usage Via CommandLine id: 74403157-20f5-415d-89a7-c505779585cf status: test description: Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65 - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/convertto-securestring?view=powershell-7.3#examples author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton date: 2020-10-11 modified: 2023-02-01 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli: CommandLine|contains: ConvertTo-SecureString condition: all of selection_* falsepositives: - Legitimate use to pass password to different powershell commands level: medium
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "chrome_frame_helper.dll". Logsource: windows / image_load. Rule: title: Potential Chrome Frame Helper DLL Sideloading id: 72ca7c75-bf85-45cd-aca7-255d360e423c status: test description: Detects potential DLL sideloading of "chrome_frame_helper.dll" references: - https://hijacklibs.net/entries/3rd_party/google/chrome_frame_helper.html author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) date: 2022-08-17 modified: 2023-05-15 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \chrome_frame_helper.dll filter_main_path: ImageLoaded|startswith: - C:\Program Files\Google\Chrome\Application\ - C:\Program Files (x86)\Google\Chrome\Application\ filter_optional_user_path: ImageLoaded|contains: \AppData\local\Google\Chrome\Application\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Query: adversary uses Exfiltration Over Web Service
Matching passage: T1567 Exfiltration Over Web Service. Tactics: exfiltration. Description: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Near-miss passage: T1567.001 Exfiltration to Code Repository. Tactics: exfiltration. Description: Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection. Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network.
Query: SIEM correlation: stealth activity consistent with Indicator Removal from Tools
Matching passage: T1027.005 Indicator Removal from Tools. Tactics: stealth. Description: Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems. A good example of this is when malware is detected with a file signature and quarantined by anti-virus software. An adversary who can determine that the malware was quarantined because of its file signature may modify the file to explicitly avoid that signature, and then re-use the malware.
Near-miss passage: T1027.018 Invisible Unicode. Tactics: stealth. Description: Adversaries may abuse invisible or non-printing Unicode characters to conceal malicious content within files, scripts, or text. By inserting characters that do not visibly render, adversaries may hide data, alter how content is interpreted, or make malicious code appear as benign text or whitespace. Adversaries may encode these malicious payloads, using binary, Base64, or custom schemes, to be reconstructed at runtime through scripting features such as [JavaScript](https://attack.mitre.org/techniques/T1059/007) Proxy traps, `eval()`, or other dynamic execution methods. This technique enables adversaries to evade visual inspection and basic static analysis by hiding malicious encoded content in innocuous text.(Citation: PUAs Unicode - Eriksen)(Citation: Tycoon2FA - Unicode)(Citation: Unicode - Veracode) Unicode is a standardized character encoding model that assigns a unique numerical value, known as a code point, to every character across writing systems, enabling consistent text representation across platforms, applications, and languages. Code points are represented as `U+` followed by a hexadecimal value and may be encoded using formats such as `UTF-8` or `UTF-16`. Adversaries may abuse the valid code points in Unicode that are not visibly rendered but still take up bytes, such as zero-width spaces, variation selectors, or bidirectional formatting controls, to conceal malicious payloads.(Citation: Tycoon2FA - Unicode)(Citation: GlassWorm - Unicode)(Citation: Unicode and Hidden Prompts - Perets) Adversaries may additionally exploit Private Use Area (PUA) characters, a range of code points reserved for custom assignment. PUA characters that are not defined by a font or application are typically rendered blank.(Citation: PUAs Unicode - Eriksen) Unicode characters may also be leveraged in support of other techniques such as [Phishing](https://attack.mitre.org/techniques/T1660), [Right-to-Left Override](https://attack.mitre.org/techniques/T1036/002), or [User Executio
Query: exploit WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption an
Matching passage: CVE-2015-5814. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-8317. CWE: CWE-119. CVSS: 5.0. The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive information via an (1) unterminated encoding value or (2) incomplete XML declaration in XML data, which triggers an out-of-bounds heap read.
Query: describe CVE-2015-6685
Matching passage: CVE-2015-6685. CWE: CWE-119. CVSS: 6.800000190734863. Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) by using the Format action for unspecified fields, a different vulnerability than CVE-2015-6686, CVE-2015-6693, CVE-2015-6694, CVE-2015-6695, and CVE-2015-7622.
Near-miss passage: CVE-2015-5588. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5575, CVE-2015-5577, CVE-2015-5578, CVE-2015-5580, CVE-2015-5582, and CVE-2015-6677.
Query: CVE similar to CVE-2015-1662
Matching passage: CVE-2015-1662. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1659 and CVE-2015-1665.
Near-miss passage: CVE-2015-0885. CWE: CWE-399. CVSS: 5.0. checkpw 1.02 and earlier allows remote attackers to cause a denial of service (infinite loop) via a -- (dash dash) in a username.