alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /
Matching passage: Sigma rule: Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /. Logsource: linux / process_creation. Rule: title: OMIGOD SCX RunAsProvider ExecuteShellCommand id: 21541900-27a9-4454-9c4c-3f0a4240344a status: test description: 'Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite. ' references: - https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure - https://github.com/Azure/Azure-Sentinel/pull/3059 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC date: 2021-10-15 modified: 2022-10-05 tags: - attack.privilege-escalation - attack.initial-access - attack.execution - attack.t1068 - attack.t1190 - attack.t1203 logsource: product: linux category: process_creation detection: selection: User: root LogonId: 0 CurrentDirectory: /var/opt/microsoft/scx/tmp CommandLine|contains: /bin/sh condition: selection falsepositives: - Legitimate use of SCX RunAsProvider Invoke_ExecuteShellCommand. level: high
Near-miss passage: Sigma rule: Detects issues with Windows Defender Real-Time Protection features. Logsource: windows / windefend. Rule: title: Windows Defender Real-Time Protection Failure/Restart id: dd80db93-6ec2-4f4c-a017-ad40da6ffe81 status: stable description: Detects issues with Windows Defender Real-Time Protection features references: - Internal Research - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ - https://gist.github.com/nasbench/33732d6705cbdc712fae356f07666346 author: Nasreddine Bencherchali (Nextron Systems), Christopher Peacock '@securepeacock' (Update) date: 2023-03-28 modified: 2023-05-05 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: - 3002 - 3007 filter_optional_network_inspection: Feature_Name: '%%886' Reason: - '%%892' - '%%858' condition: selection and not 1 of filter_optional_* falsepositives: - Some crashes can occur sometimes and the event doesn't provide enough information to tune out these cases. Manual exception is required level: medium
Query: exploit A vulnerability has been found in SUKOHI Surpass and classified as critical. This vulnerability affects unknown code of the file src/Sukohi/Surpass/Surpass.php. The manipulation of
Matching passage: CVE-2015-10030. CWE: CWE-21. CVSS: 5.300000190734863. A vulnerability has been found in SUKOHI Surpass and classified as critical. This vulnerability affects unknown code of the file src/Sukohi/Surpass/Surpass.php. The manipulation of the argument dir leads to pathname traversal. Upgrading to version 1.0.0 is able to address this issue. The patch is identified as d22337d453a2a14194cdb02bf12cdf9d9f827aa7. It is recommended to upgrade the affected component. VDB-217642 is the identifier assigned to this vulnerability.
Near-miss passage: CVE-2015-9235. CWE: CWE-20. CVSS: 9.800000190734863. In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).
Query: CVE similar to CVE-2015-7202
Matching passage: CVE-2015-7202. CWE: CWE-119. CVSS: 10.0. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Near-miss passage: CVE-2015-5783. CWE: CWE-119. CVSS: 9.300000190734863. IOGraphics in Apple OS X before 10.10.5 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-3770.
Query: explain CWE-653
Matching passage: CWE-653 Improper Isolation or Compartmentalization. The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.
Near-miss passage: CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion'). The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
Query: rule covering A General detection for the Get-Clipboard commands in PowerShell logs. This could be an adversary capturing clipboard co
Matching passage: Sigma rule: A General detection for the Get-Clipboard commands in PowerShell logs. This could be an adversary capturing clipboard co. Logsource: windows / ps_module. Rule: title: PowerShell Get Clipboard id: 4cbd4f12-2e22-43e3-882f-bff3247ffb78 status: test description: A General detection for the Get-Clipboard commands in PowerShell logs. This could be an adversary capturing clipboard contents. references: - https://github.com/OTRF/detection-hackathon-apt29/issues/16 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/7.A.2_F4609F7E-C4DB-4327-91D4-59A58C962A02.md author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2023-01-04 tags: - attack.collection - attack.t1115 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection: Payload|contains: Get-Clipboard condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when an attacker register a new SIP provider for persistence and defense evasion. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Mpnotify id: 92772523-d9c1-4c93-9547-b0ca500baba3 status: test description: Detects when an attacker register a new SIP provider for persistence and defense evasion references: - https://persistence-info.github.io/Data/mpnotify.html - https://www.youtube.com/watch?v=ggY3srD9dYs&ab_channel=GrzegorzTworek author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2023-08-17 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\mpnotify condition: selection falsepositives: - Might trigger if a legitimate new SIP provider is registered. But this is not a common occurrence in an environment and should be investigated either way level: high
Query: CVE similar to CVE-2015-1577
Matching passage: CVE-2015-1577. CWE: CWE-22. CVSS: 6.400000095367432. Directory traversal vulnerability in u5admin/deletefile.php in u5CMS before 3.9.4 allows remote attackers to write to arbitrary files via a (1) .. (dot dot) or (2) full pathname in the f parameter.
Near-miss passage: CVE-2015-6406. CWE: CWE-22. CVSS: 4.0. Directory traversal vulnerability in the Tools menu in Cisco Emergency Responder 10.5(1.10000.5) allows remote authenticated users to write to arbitrary files via a crafted filename, aka Bug ID CSCuv21781.
Query: detection rule: Detects remote RPC calls to create or execute a scheduled task
Matching passage: Sigma rule: Detects remote RPC calls to create or execute a scheduled task. Logsource: rpc_firewall / application. Rule: title: Remote Schedule Task Lateral Movement via ITaskSchedulerService id: ace3ff54-e7fd-46bd-8ea0-74b49a0aca1d status: test description: Detects remote RPC calls to create or execute a scheduled task references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.lateral-movement - attack.t1053 - attack.t1053.002 logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:86d35949-83c9-4044-b424-db363231fd0c"' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 86d35949-83c9-4044-b424-db363231fd0c OpNum: - 1 - 3 - 4 - 10 - 11 - 12 - 13 - 14 - 15 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential suspicious child processes of "jamf". Could be a sign of potential abuse of Jamf as a C2 server as see. Logsource: macos / process_creation. Rule: title: JAMF MDM Potential Suspicious Child Process id: 2316929c-01aa-438c-970f-099145ab1ee6 status: test description: Detects potential suspicious child processes of "jamf". Could be a sign of potential abuse of Jamf as a C2 server as seen by Typhon MythicAgent. references: - https://github.com/MythicAgents/typhon/ - https://www.zoocoup.org/casper/jamf_cheatsheet.pdf - https://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Components_Installed_on_Managed_Computers.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-22 tags: - attack.execution logsource: category: process_creation product: macos detection: selection: ParentImage|endswith: /jamf Image|endswith: - /bash - /sh condition: selection falsepositives: - Legitimate execution of custom scripts or commands by Jamf administrators. Apply additional filters accordingly level: medium
Query: CVE similar to CVE-2015-4497
Matching passage: CVE-2015-4497. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in the CanvasRenderingContext2D implementation in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to execute arbitrary code by leveraging improper interaction between resize events and changes to Cascading Style Sheets (CSS) token sequences for a CANVAS element.
Near-miss passage: CVE-2015-1427. CWE: UNKNOWN. CVSS: 9.800000190734863. The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
Query: patch priority for CVE-2015-0128
Matching passage: CVE-2015-0128. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix4, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-0124.
Near-miss passage: CVE-2015-5720. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in the template-creation feature in Malware Information Sharing Platform (MISP) before 2.3.90 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) add.ctp, (2) edit.ctp, and (3) ajaxification.js.
Query: CVE similar to CVE-2015-0758
Matching passage: CVE-2015-0758. CWE: CWE-200. CVSS: 4.0. The web-based user interface in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka Bug ID CSCus97452.
Near-miss passage: CVE-2015-9119. CWE: CWE-200. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, sensitive information may be returned to the QMI client as a response.
Query: Sigma rule for Monitor and alert for users added to device admin roles.
Matching passage: Sigma rule: Monitor and alert for users added to device admin roles.. Logsource: azure / auditlogs. Rule: title: Users Added to Global or Device Admin Roles id: 11c767ae-500b-423b-bae3-b234450736ed status: test description: Monitor and alert for users added to device admin roles. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#device-administrator-roles author: Michael Epping, '@mepples21' date: 2022-06-28 tags: - attack.persistence - attack.initial-access - attack.privilege-escalation - attack.stealth - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: Category: RoleManagement OperationName|contains|all: - Add - member to role TargetResources|contains: - 7698a772-787b-4ac8-901f-60d6b08affd2 - 62e90394-69f5-4237-9190-012177145e10 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikat. Logsource: windows / process_access. Rule: title: Remote LSASS Process Access Through Windows Remote Management id: aa35a627-33fb-4d04-a165-d33b4afca3e8 status: stable description: Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz. references: - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/ author: Patryk Prauze - ING Tech date: 2019-05-20 modified: 2023-11-29 tags: - attack.credential-access - attack.execution - attack.t1003.001 - attack.t1059.001 - attack.lateral-movement - attack.t1021.006 - attack.s0002 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe SourceImage|endswith: :\Windows\system32\wsmprovhost.exe filter_main_access: GrantedAccess: '0x80000000' condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Query: CVE similar to CVE-2015-1798
Matching passage: CVE-2015-1798. CWE: CWE-17. CVSS: 1.7999999523162842. The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting the MAC.
Near-miss passage: CVE-2015-1728. CWE: CWE-17. CVSS: 9.300000190734863. Microsoft Windows Media Player 10 through 12 allows remote attackers to execute arbitrary code via a crafted DataObject on a web site, aka "Windows Media Player RCE via DataObject Vulnerability."
Query: CVE similar to CVE-2015-6946
Matching passage: CVE-2015-6946. CWE: CWE-119. CVSS: 9.300000190734863. Multiple stack-based buffer overflows in the Reprise License Manager service in Borland AccuRev allow remote attackers to execute arbitrary code via the (1) akey or (2) actserver parameter to the activate_doit function or (3) licfile parameter to the service_startup_doit functionality.
Near-miss passage: CVE-2015-7083. CWE: CWE-119. CVSS: 7.199999809265137. The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7084.
Query: SOC alert related to Code Signing
Matching passage: T1553.002 Code Signing. Tactics: defense impairment. Description: Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. (Citation: Wikipedia Code Signing) The certificates used during an operation may be created, acquired, or stolen by the adversary. (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates) Unlike [Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001), this activity will result in a valid signature. Code signing to verify software on first run can be used on modern Windows and macOS systems. It is not used on Linux due to the decentralized nature of the platform. (Citation: Wikipedia Code Signing)(Citation: EclecticLightChecksonEXECodeSigning) Code signing certificates may be used to bypass security policies that require signed code to execute on a system.
Near-miss passage: T1553 Subvert Trust Controls. Tactics: defense impairment. Description: Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site. Adversaries may attempt to subvert these trust mechanisms. The method adversaries use will depend on the specific mechanism they seek to subvert. Adversaries may conduct [File and Directory Permissions Modification](https://attack.mitre.org/techniques/T1222) or [Modify Registry](https://attack.mitre.org/techniques/T1112) in support of subverting these controls.(Citation: SpectorOps Subverting Trust Sept 2017) Adversaries may also create or steal code signing certificates to acquire trust on target systems.(Citation: Securelist Digital Certificates)(Citation: Symantec Digital Certificates)
Query: exploit Aruba AirWave before 8.0.7 allows bypass of a CSRF protection mechanism.
Matching passage: CVE-2015-1391. CWE: CWE-352. CVSS: 8.800000190734863. Aruba AirWave before 8.0.7 allows bypass of a CSRF protection mechanism.
Near-miss passage: CVE-2015-5412. CWE: CWE-352. CVSS: 6.0. Cross-site request forgery (CSRF) vulnerability in HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
Query: alert when Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs
Matching passage: Sigma rule: Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs. Logsource: windows / process_creation. Rule: title: HackTool - SharpEvtMute Execution id: bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c related: - id: 49329257-089d-46e6-af37-4afce4290685 type: similar status: test description: Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs references: - https://github.com/bats3c/EvtMute author: Florian Roth (Nextron Systems) date: 2022-09-07 modified: 2023-02-14 tags: - attack.defense-impairment - attack.t1685.001 logsource: product: windows category: process_creation detection: selection: - Image|endswith: \SharpEvtMute.exe - Description: SharpEvtMute - CommandLine|contains: - '--Filter "rule ' - --Encoded --Filter \" condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects LOLBINs and applications that should not legitimately drop executable or executable-equivalent files to disk. Th. Logsource: windows / file_event. Rule: title: Legitimate Application Dropped Executable id: f0540f7e-2db3-4432-b9e0-3965486744bc status: test description: 'Detects LOLBINs and applications that should not legitimately drop executable or executable-equivalent files to disk. This may indicate malware staging, process injection, or abuse of a trusted binary for payload delivery. ' references: - https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326 - https://dmpdump.github.io/posts/TelegramRat/ - https://www.virustotal.com/gui/file/a0d5b30578acd1df9139e7a8a4bfc659dc2cf48f4dc0c5804b70890adeb9fa21/behavior author: frack113, Florian Roth (Nextron Systems) date: 2022-08-21 modified: 2026-05-11 tags: - attack.stealth - attack.t1218 logsource: product: windows category: file_event detection: selection: Image|endswith: - \eqnedt32.exe - \wordpad.exe - \wordview.exe - \certutil.exe - \certoc.exe - \CertReq.exe - \Desktopimgdownldr.exe - \esentutl.exe - \mshta.exe - \AcroRd32.exe - \RdrCEF.exe - \hh.exe - \finger.exe TargetFilename|endswith: - .com - .dll - .exe - .jar - .ocx - .pyc condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_exe/info.yml
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in dncs 7.0.0.12 in Cisco Headend Digital Broadband Delivery System allow remote attackers to inject arbitrary web script or HTM
Matching passage: CVE-2015-0724. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in dncs 7.0.0.12 in Cisco Headend Digital Broadband Delivery System allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug ID CSCur25604.
Near-miss passage: CVE-2015-10090. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability, which was classified as problematic, has been found in Landing Pages Plugin up to 1.8.7 on WordPress. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.8.8 is able to address this issue. The name of the patch is c8e22c1340c11fedfb0a0a67ea690421bdb62b94. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222320.
Query: vulnerability: The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, related 
Matching passage: CVE-2015-5727. CWE: CWE-399. CVSS: 7.5. The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, related to a length field.
Near-miss passage: CVE-2015-0044. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-8967 and CVE-2015-0050.
Query: exploit A vulnerability was found in Watu Quiz Plugin up to 2.6.7 on WordPress. It has been rated as critical. This issue affects the function watu_exams of the file controllers/exam.php o
Matching passage: CVE-2015-10111. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in Watu Quiz Plugin up to 2.6.7 on WordPress. It has been rated as critical. This issue affects the function watu_exams of the file controllers/exam.php of the component Exam Handler. The manipulation of the argument quiz leads to sql injection. The attack may be initiated remotely. Upgrading to version 2.6.8 is able to address this issue. The patch is named bf42e7cfd819a3e76cf3e1465697e89f4830590c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230651.
Near-miss passage: CVE-2015-1517. CWE: CWE-89. CVSS: 6.0. SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users to execute arbitrary SQL commands via the filter_level parameter in a "Refresh photo set" action in the batch_manager page to admin.php.