alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the use of Ditsnap tool, an inspection tool for Active Directory database, ntds.dit.. Logsource: windows / process_creation. Rule: title: PUA - DIT Snapshot Viewer id: d3b70aad-097e-409c-9df2-450f80dc476b status: test description: Detects the use of Ditsnap tool, an inspection tool for Active Directory database, ntds.dit. references: - https://thedfirreport.com/2020/06/21/snatch-ransomware/ - https://web.archive.org/web/20201124182207/https://github.com/yosqueoy/ditsnap author: Furkan Caliskan (@caliskanfurkan_) date: 2020-07-04 modified: 2023-02-21 tags: - attack.credential-access - attack.t1003.003 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \ditsnap.exe - CommandLine|contains: ditsnap.exe condition: selection falsepositives: - Legitimate admin usage level: high
Near-miss passage: Sigma rule: Detects tampering with attachment manager settings policies associations to lower the default file type risks (See refer. Logsource: windows / registry_set. Rule: title: Potential Attachment Manager Settings Associations Tamper id: a9b6c011-ab69-4ddb-bc0a-c4f21c80ec47 status: test description: Detects tampering with attachment manager settings policies associations to lower the default file type risks (See reference for more information) references: - https://support.microsoft.com/en-us/topic/information-about-the-attachment-manager-in-microsoft-windows-c48a4dcd-8de5-2af5-ee9b-cd795ae42738 - https://www.virustotal.com/gui/file/2bcd5702a7565952c44075ac6fb946c7780526640d1264f692c7664c02c68465 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-01 modified: 2023-08-17 tags: - attack.defense-impairment logsource: category: registry_set product: windows detection: selection_main: TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations\ selection_value_default_file_type_rsik: TargetObject|endswith: \DefaultFileTypeRisk Details: DWORD (0x00006152) selection_value_low_risk_filetypes: TargetObject|endswith: \LowRiskFileTypes Details|contains: - .zip; - .rar; - .exe; - .bat; - .com; - .cmd; - .reg; - .msi; - .htm; - .html; condition: selection_main and 1 of selection_value_* falsepositives: - Unlikely level: high
Query: describe CVE-2015-0749
Matching passage: CVE-2015-0749. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on the affected software. The vulnerabilities is due to improper input validation of certain parameters passed to the affected software. An attacker could exploit this vulnerability by convincing a user to follow a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected site or allow the attacker to access sensitive browser-based information.
Near-miss passage: CVE-2015-6494. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Query: risk of Xen 4.4.x, 4.5.x, and 4.6.x does not limit the number of printk console messages when reporting unimplemented hypercalls, which allows local guests to cause a denial of service via
Matching passage: CVE-2015-7813. CWE: CWE-399. CVSS: 2.0999999046325684. Xen 4.4.x, 4.5.x, and 4.6.x does not limit the number of printk console messages when reporting unimplemented hypercalls, which allows local guests to cause a denial of service via a sequence of (1) HYPERVISOR_physdev_op hypercalls, which are not properly handled in the do_physdev_op function in arch/arm/physdev.c, or (2) HYPERVISOR_hvm_op hypercalls, which are not properly handled in the do_hvm_op function in arch/arm/hvm.c.
Near-miss passage: CVE-2015-8858. CWE: CWE-399. CVSS: 7.5. The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, aka a "regular expression denial of service (ReDoS)."
Query: patch priority for CVE-2015-0580
Matching passage: CVE-2015-0580. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in the ACS View reporting interface pages in Cisco Secure Access Control System (ACS) before 5.5 patch 7 allow remote authenticated administrators to execute arbitrary SQL commands via crafted HTTPS requests, aka Bug ID CSCuq79027.
Near-miss passage: CVE-2015-7567. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary SQL commands via the "passwordreset&token" parameter.
Query: describe CVE-2015-8220
Matching passage: CVE-2015-8220. CWE: CWE-119. CVSS: 7.5. Stack-based buffer overflow in the URI handler in DWRCC.exe in SolarWinds DameWare Mini Remote Control before 12.0 HotFix 1 allows remote attackers to execute arbitrary code via a crafted commandline argument in a link.
Near-miss passage: CVE-2015-8446. CWE: CWE-119. CVSS: 9.300000190734863. Heap-based buffer overflow in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via an MP3 file with COMM tags that are mishandled during memory allocation, a different vulnerability than CVE-2015-8438.
Query: describe CVE-2015-6959
Matching passage: CVE-2015-6959. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Vindula 1.9.
Near-miss passage: CVE-2015-7790. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability on ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: risk of The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection
Matching passage: CVE-2015-5600. CWE: CWE-264. CVSS: 8.100000381469727. The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list.
Near-miss passage: CVE-2015-8150. CWE: CWE-264. CVSS: 7.800000190734863. Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows local users to obtain root access by modifying a batch file.
Query: write Sigma for Adversaries may log user keystrokes to intercept credentials as the user types them.
Matching passage: Sigma rule: Adversaries may log user keystrokes to intercept credentials as the user types them.. Logsource: windows / ps_script. Rule: title: Powershell Keylogging id: 34f90d3c-c297-49e9-b26d-911b05a4866c status: test description: Adversaries may log user keystrokes to intercept credentials as the user types them. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.001/src/Get-Keystrokes.ps1 author: frack113 date: 2021-07-30 modified: 2022-07-11 tags: - attack.credential-access - attack.collection - attack.t1056.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_basic: ScriptBlockText|contains: Get-Keystrokes selection_high: ScriptBlockText|contains|all: - Get-ProcAddress user32.dll GetAsyncKeyState - Get-ProcAddress user32.dll GetForegroundWindow condition: 1 of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects an appx package deployment / installation with the error code "0x80073cff" which indicates that the package didn. Logsource: windows / appxdeployment-server. Rule: title: AppX Package Deployment Failed Due to Signing Requirements id: 898d5fc9-fbc3-43de-93ad-38e97237c344 status: test description: 'Detects an appx package deployment / installation with the error code "0x80073cff" which indicates that the package didn''t meet the signing requirements. ' references: - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/ - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-11 modified: 2025-12-03 tags: - attack.stealth logsource: product: windows service: appxdeployment-server detection: selection: EventID: 401 ErrorCode: '0x80073cff' condition: selection falsepositives: - Legitimate AppX packages not signed by MS used part of an enterprise. level: medium
Query: mitigate Office Application Startup
Matching passage: T1137 Office Application Startup. Tactics: persistence. Description: Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins. A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: SensePost Ruler GitHub) These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: TechNet O365 Outlook Rules)
Near-miss passage: T1137.004 Outlook Home Page. Tactics: persistence. Description: Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system. Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders. This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened. A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page.(Citation: SensePost Outlook Home Page) Once malicious home pages have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious Home Pages will execute when the right Outlook folder is loaded/reloaded.(Citation: SensePost Outlook Home Page)
Query: vulnerability: IBM Business Process Manager 7.5.x, 8.0.x, 8.5.0, 8.5.5, and 8.5.6.0 through cumulative fix 2 allow remote authenticated users to delete process and task data by leveraging incorre
Matching passage: CVE-2015-7463. CWE: CWE-285. CVSS: 4.300000190734863. IBM Business Process Manager 7.5.x, 8.0.x, 8.5.0, 8.5.5, and 8.5.6.0 through cumulative fix 2 allow remote authenticated users to delete process and task data by leveraging incorrect authorization checks. IBM X-Force ID: 108393.
Near-miss passage: CVE-2015-3656. CWE: CWE-285. CVSS: 7.199999809265137. Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain privileges by leveraging failure to properly enforce authorization checks.
Query: vulnerability: The Human Monitor Interface support in QEMU allows remote attackers to cause a denial of service (out-of-bounds write and application crash).
Matching passage: CVE-2015-8619. CWE: CWE-787. CVSS: 7.5. The Human Monitor Interface support in QEMU allows remote attackers to cause a denial of service (out-of-bounds write and application crash).
Near-miss passage: CVE-2015-8613. CWE: CWE-787. CVSS: 6.5. Stack-based buffer overflow in the megasas_ctrl_get_info function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows local guest users to cause a denial of service (QEMU instance crash) via a crafted SCSI controller CTRL_GET_INFO command.
Query: SIEM correlation: credential access activity consistent with Securityd Memory
Matching passage: T1555.002 Securityd Memory. Tactics: credential access. Description: An adversary with root access may gather credentials by reading `securityd`’s memory. `securityd` is a service/daemon responsible for implementing security protocols such as encryption and authorization.(Citation: Apple Dev SecurityD) A privileged adversary may be able to scan through `securityd`'s memory to find the correct sequence of keys to decrypt the user’s logon keychain. This may provide the adversary with various plaintext passwords, such as those for users, WiFi, mail, browsers, certificates, secure notes, etc.(Citation: OS X Keychain)(Citation: OSX Keydnap malware) In OS X prior to El Capitan, users with root access can read plaintext keychain passwords of logged-in users because Apple’s keychain implementation allows these credentials to be cached so that users are not repeatedly prompted for passwords.(Citation: OS X Keychain)(Citation: External to DA, the OS X Way) Apple’s `securityd` utility takes the user’s logon password, encrypts it with PBKDF2, and stores this master key in memory. Apple also uses a set of keys and algorithms to encrypt the user’s password, but once the master key is found, an adversary need only iterate over the other values to unlock the final password.(Citation: OS X Keychain)
Near-miss passage: T1555.001 Keychain. Tactics: credential access. Description: Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The System Keychain stores items accessed by the operating system, such as items shared among users on a host. The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service. Keychains can be viewed and edited through the Keychain Access application or using the command-line utility <code>security</code>. Keychain files are located in <code>~/Library/Keychains/</code>, <code>/Library/Keychains/</code>, and <code>/Network/Library/Keychains/</code>.(Citation: Keychain Services Apple)(Citation: Keychain Decryption Passware)(Citation: OSX Keychain Schaumann) Adversaries may gather user credentials from Keychain storage/memory. For example, the command <code>security dump-keychain –d</code> will dump all Login Keychain credentials from <code>~/Library/Keychains/login.keychain-db</code>. Adversaries may also directly read Login Keychain credentials from the <code>~/Library/Keychains/login.keychain</code> file. Both methods require a password, where the default password for the Login Keychain is the current user’s password to login to the macOS host.(Citation: External to DA, the OS X Way)(Citation: Empire Keychain Decrypt)
Query: Sigma rule for Detects shellshock expressions in log files
Matching passage: Sigma rule: Detects shellshock expressions in log files. Logsource: linux. Rule: title: Shellshock Expression id: c67e0c98-4d39-46ee-8f6b-437ebf6b950e status: test description: Detects shellshock expressions in log files references: - https://owasp.org/www-pdf-archive/Shellshock_-_Tudor_Enache.pdf author: Florian Roth (Nextron Systems) date: 2017-03-14 modified: 2022-10-09 tags: - attack.persistence - attack.t1505.003 logsource: product: linux detection: keywords: - (){:;}; - () {:;}; - () { :;}; - () { :; }; condition: keywords falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility. Logsource: windows / process_creation. Rule: title: HackTool - RedMimicry Winnti Playbook Execution id: 95022b85-ff2a-49fa-939a-d7b8f56eeb9b status: test description: Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility references: - https://redmimicry.com/posts/redmimicry-winnti/ author: Alexander Rausch date: 2020-06-24 modified: 2023-03-01 tags: - attack.execution - attack.stealth - attack.t1106 - attack.t1059.003 - attack.t1218.011 logsource: product: windows category: process_creation detection: selection: Image|endswith: - \rundll32.exe - \cmd.exe CommandLine|contains: - gthread-3.6.dll - \Windows\Temp\tmp.bat - sigcmm-2.4.dll condition: selection falsepositives: - Unknown level: high
Query: risk of WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application cras
Matching passage: CVE-2015-5800. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-5120. CWE: CWE-119. CVSS: 10.0. Adobe Shockwave Player before 12.1.9.159 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5121.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the management interface in Cisco Unity Connection 9.1(1.10) allows remote attackers to inject arbitrary web script or HTML via a crafte
Matching passage: CVE-2015-6390. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the management interface in Cisco Unity Connection 9.1(1.10) allows remote attackers to inject arbitrary web script or HTML via a crafted value in a URL, aka Bug ID CSCup92741.
Near-miss passage: CVE-2015-7485. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 before 5.0.2 iFix15, and 6.0 before 6.0.1 iFix4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108626.
Query: Sigma rule for Detects usage of base64 utility to decode arbitrary base64-encoded text
Matching passage: Sigma rule: Detects usage of base64 utility to decode arbitrary base64-encoded text. Logsource: linux / process_creation. Rule: title: Decode Base64 Encoded Text id: e2072cab-8c9a-459b-b63c-40ae79e27031 status: test description: Detects usage of base64 utility to decode arbitrary base64-encoded text references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2021-11-27 tags: - attack.stealth - attack.t1027 logsource: category: process_creation product: linux detection: selection: Image|endswith: /base64 CommandLine|contains: -d condition: selection falsepositives: - Legitimate activities level: low
Near-miss passage: Sigma rule: Detects the execution of a specific OneLiner to download and execute powershell modules in memory.. Logsource: windows / process_creation. Rule: title: Obfuscated PowerShell OneLiner Execution id: 44e24481-6202-4c62-9127-5a0ae8e3fe3d status: test description: Detects the execution of a specific OneLiner to download and execute powershell modules in memory. references: - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/ - https://gist.github.com/mgeeky/3b11169ab77a7de354f4111aa2f0df38 author: '@Kostastsale, TheDFIRReport' date: 2022-05-09 modified: 2025-04-16 tags: - attack.execution - attack.defense-impairment - attack.t1059.001 - attack.t1685 logsource: product: windows category: process_creation detection: selection: Image|endswith: \powershell.exe CommandLine|contains|all: - http://127.0.0.1 - '%{(IRM $_)}' - Invoke condition: selection falsepositives: - Unknown level: high
Query: Encoded PowerShell / command-line abuse matching Cloud Service Hijacking
Matching passage: T1496.004 Cloud Service Hijacking. Tactics: impact. Description: Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability. For example, adversaries may leverage email and messaging services, such as AWS Simple Email Service (SES), AWS Simple Notification Service (SNS), SendGrid, and Twilio, in order to send large quantities of spam / [Phishing](https://attack.mitre.org/techniques/T1566) emails and SMS messages.(Citation: Invictus IR DangerDev 2024)(Citation: Permiso SES Abuse 2023)(Citation: SentinelLabs SNS Sender 2024) Alternatively, they may engage in LLMJacking by leveraging reverse proxies to hijack the power of cloud-hosted AI models.(Citation: Sysdig LLMJacking 2024)(Citation: Lacework LLMJacking 2024) In some cases, adversaries may leverage services that the victim is already using. In others, particularly when the service is part of a larger cloud platform, they may first enable the service.(Citation: Sysdig LLMJacking 2024) Leveraging SaaS applications may cause the victim to incur significant financial costs, use up service quotas, and otherwise impact availability.
Near-miss passage: T1496.003 SMS Pumping. Tactics: impact. Description: Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted service availability.(Citation: Twilio SMS Pumping) SMS pumping is a type of telecommunications fraud whereby a threat actor first obtains a set of phone numbers from a telecommunications provider, then leverages a victim’s messaging infrastructure to send large amounts of SMS messages to numbers in that set. By generating SMS traffic to their phone number set, a threat actor may earn payments from the telecommunications provider.(Citation: Twilio SMS Pumping Fraud) Threat actors often use publicly available web forms, such as one-time password (OTP) or account verification fields, in order to generate SMS traffic. These fields may leverage services such as Twilio, AWS SNS, and Amazon Cognito in the background.(Citation: Twilio SMS Pumping)(Citation: AWS RE:Inforce Threat Detection 2024) In response to the large quantity of requests, SMS costs may increase and communication channels may become overwhelmed.(Citation: Twilio SMS Pumping)
Query: exploit Integer overflow in the PL_ARENA_ALLOCATE implementation in Netscape Portable Runtime (NSPR) in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as
Matching passage: CVE-2015-7183. CWE: CWE-119. CVSS: 7.5. Integer overflow in the PL_ARENA_ALLOCATE implementation in Netscape Portable Runtime (NSPR) in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.
Near-miss passage: CVE-2015-2379. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."