alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation att
Matching passage: Sigma rule: Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation att. Logsource: nginx. Rule: title: Nginx Core Dump id: 59ec40bb-322e-40ab-808d-84fa690d7e56 status: test description: Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts. references: - https://docs.nginx.com/nginx/admin-guide/monitoring/debugging/#enabling-core-dumps - https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/ author: Florian Roth (Nextron Systems) date: 2021-05-31 modified: 2023-05-08 tags: - attack.impact - attack.t1499.004 logsource: service: nginx detection: keywords: - exited on signal 6 (core dumped) condition: keywords falsepositives: - Serious issues with a configuration or plugin level: high
Near-miss passage: Sigma rule: Detects actions that clear the local ShimCache and remove forensic evidence. Logsource: windows / process_creation. Rule: title: ShimCache Flush id: b0524451-19af-4efa-a46f-562a977f792e status: stable description: Detects actions that clear the local ShimCache and remove forensic evidence references: - https://medium.com/@blueteamops/shimcache-flush-89daff28d15e author: Florian Roth (Nextron Systems) date: 2021-02-01 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: process_creation product: windows detection: selection1a: CommandLine|contains|all: - rundll32 - apphelp.dll selection1b: CommandLine|contains: - ShimFlushCache - '#250' selection2a: CommandLine|contains|all: - rundll32 - kernel32.dll selection2b: CommandLine|contains: - BaseFlushAppcompatCache - '#46' condition: ( selection1a and selection1b ) or ( selection2a and selection2b ) falsepositives: - Unknown level: high
Query: describe CVE-2015-3720
Matching passage: CVE-2015-3720. CWE: CWE-200. CVSS: 4.300000190734863. The kernel in Apple OS X before 10.10.4 does not properly manage memory in kernel-extension APIs, which allows attackers to obtain sensitive memory-layout information via a crafted app.
Near-miss passage: CVE-2015-3782. CWE: CWE-200. CVSS: 4.300000190734863. CloudKit in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to access an iCloud user record associated with a previous user's login session via a crafted app.
Query: rule covering Detects the invocation of the Stored User Names and Passwords dialogue (Key Manager)
Matching passage: Sigma rule: Detects the invocation of the Stored User Names and Passwords dialogue (Key Manager). Logsource: windows / process_creation. Rule: title: Suspicious Key Manager Access id: a4694263-59a8-4608-a3a0-6f8d3a51664c status: test description: Detects the invocation of the Stored User Names and Passwords dialogue (Key Manager) references: - https://twitter.com/NinjaParanoid/status/1516442028963659777 author: Florian Roth (Nextron Systems) date: 2022-04-21 modified: 2023-02-09 tags: - attack.credential-access - attack.t1555.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|contains|all: - keymgr - KRShowKeyMgr condition: all of selection_* falsepositives: - Administrative activity level: high
Near-miss passage: Sigma rule: Detects port forwarding activity via SSH.exe. Logsource: windows / process_creation. Rule: title: Port Forwarding Activity Via SSH.EXE id: 327f48c1-a6db-4eb8-875a-f6981f1b0183 status: test description: Detects port forwarding activity via SSH.exe references: - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-12 modified: 2024-03-05 tags: - attack.command-and-control - attack.lateral-movement - attack.t1572 - attack.t1021.001 - attack.t1021.004 logsource: category: process_creation product: windows detection: selection: Image|endswith: \ssh.exe CommandLine|contains|windash: ' -R ' condition: selection falsepositives: - Administrative activity using a remote port forwarding to a local port level: medium
Query: CVE similar to CVE-2015-2534
Matching passage: CVE-2015-2534. CWE: CWE-284. CVSS: 1.899999976158142. Hyper-V in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows 10 improperly processes ACL settings, which allows local users to bypass intended network-traffic restrictions via a crafted application, aka "Hyper-V Security Feature Bypass Vulnerability."
Near-miss passage: CVE-2015-4034. CWE: CWE-284. CVSS: 7.900000095367432. The createFromParcel method in the com.absolute.android.persistence.MethodSpec class in Samsung Galaxy S5s allows remote attackers to execute arbitrary files via a crafted Parcelable object in a serialized MethodSpec object.
Query: describe CVE-2015-8110
Matching passage: CVE-2015-8110. CWE: CWE-264. CVSS: 7.800000190734863. Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0019 allows local users to gain privileges by navigating to (1) "Click here to learn more" or (2) "View privacy policy" within the Tvsukernel.exe GUI application in the context of a temporary administrator account, aka a "local privilege escalation vulnerability."
Near-miss passage: CVE-2015-9013. CWE: CWE-264. CVSS: 9.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393251.
Query: patch priority for CVE-2015-1554
Matching passage: CVE-2015-1554. CWE: CWE-20. CVSS: 7.5. kgb-bot 1.33-2 allows remote attackers to cause a denial of service (crash).
Near-miss passage: CVE-2015-5457. CWE: CWE-20. CVSS: 7.5. PivotX before 2.3.11 does not validate the new file extension when renaming a file with multiple extensions, which allows remote attackers to execute arbitrary code by uploading a crafted file, as demonstrated by a file named foo.php.php.
Query: describe CVE-2015-1255
Matching passage: CVE-2015-1255. CWE: UNKNOWN. CVSS: 6.800000190734863. Use-after-free vulnerability in content/renderer/media/webaudio_capturer_source.cc in the WebAudio implementation in Google Chrome before 43.0.2357.65 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by leveraging improper handling of a stop action for an audio track.
Near-miss passage: CVE-2015-8421. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: exploit The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows re
Matching passage: CVE-2015-2317. CWE: CWE-79. CVSS: 4.300000190734863. The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL.
Near-miss passage: CVE-2015-6509. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) proxypass parameter to system_advanced_misc.php; (2) adaptiveend, (3) adaptivestart, (4) maximumstates, (5) maximumtableentries, or (6) aliasesresolveinterval parameter to system_advanced_firewall.php; (7) proxyurl, (8) proxyuser, or (9) proxyport parameter to system_advanced_misc.php; or (10) name, (11) notification_name, (12) ipaddress, (13) password, (14) smtpipaddress, (15) smtpport, (16) smtpfromaddress, (17) smtpnotifyemailaddress, (18) smtpusername, or (19) smtppassword parameter to system_advanced_notifications.php.
Query: vulnerability: Unspecified vulnerability in the Workspace Manager component in Oracle Database Server 11.2.0.4 allows remote authenticated users to affect confidentiality, integrity, and availabi
Matching passage: CVE-2015-4925. CWE: UNKNOWN. CVSS: 6.5. Unspecified vulnerability in the Workspace Manager component in Oracle Database Server 11.2.0.4 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
Near-miss passage: CVE-2015-4297. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in Cisco WebEx Node for Media Convergence Server (MCS) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted HTTP request parameters, aka Bug ID CSCuv32136.
Query: detection rule: Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands
Matching passage: Sigma rule: Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands. Logsource: windows / system. Rule: title: Sliver C2 Default Service Installation id: 31c51af6-e7aa-4da7-84d4-8f32cc580af2 status: test description: Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands references: - https://github.com/BishopFox/sliver/blob/79f2d48fcdfc2bee4713b78d431ea4b27f733f30/client/command/commands.go#L1231 - https://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-08-25 tags: - attack.persistence - attack.execution - attack.privilege-escalation - attack.t1543.003 - attack.t1569.002 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7045 selection_service_1: ImagePath|re: ^[a-zA-Z]:\\windows\\temp\\[a-zA-Z0-9]{10}\.exe selection_service_2: ServiceName: - Sliver - Sliver implant condition: selection_eid and 1 of selection_service_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lat. Logsource: windows / registry_set. Rule: title: Potential CobaltStrike Service Installations - Registry id: 61a7697c-cb79-42a8-a2ff-5f0cdfae0130 status: test description: 'Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement. ' references: - https://www.sans.org/webcasts/tech-tuesday-workshop-cobalt-strike-detection-log-analysis-119395 author: Wojciech Lesicki date: 2021-06-29 modified: 2024-03-25 tags: - attack.persistence - attack.execution - attack.privilege-escalation - attack.lateral-movement - attack.t1021.002 - attack.t1543.003 - attack.t1569.002 logsource: category: registry_set product: windows detection: selection_key: - TargetObject|contains: \System\CurrentControlSet\Services - TargetObject|contains|all: - \System\ControlSet - \Services selection_details: - Details|contains|all: - ADMIN$ - .exe - Details|contains|all: - '%COMSPEC%' - start - powershell condition: all of selection_* falsepositives: - Unlikely level: high
Query: CVE similar to CVE-2015-8389
Matching passage: CVE-2015-8389. CWE: CWE-119. CVSS: 9.800000190734863. PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, which allows remote attackers to cause a denial of service (infinite recursion) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Near-miss passage: CVE-2015-7034. CWE: CWE-119. CVSS: 6.800000190734863. The Apple iWork application before 2.6 for iOS and Apple Pages before 5.6 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Pages document.
Query: risk of Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 improperly counts objects before performing an array copy, which allows remote attackers to (1) execute 
Matching passage: CVE-2015-2504. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 improperly counts objects before performing an array copy, which allows remote attackers to (1) execute arbitrary code via a crafted XAML browser application (XBAP) or (2) bypass Code Access Security restrictions via a crafted .NET Framework application, aka ".NET Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-6601. CWE: CWE-119. CVSS: 10.0. libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22935234.
Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52). Logsource: windows / registry_set. Rule: title: UAC Bypass Abusing Winsat Path Parsing - Registry id: 6597be7b-ac61-4ac8-bef4-d3ec88174853 status: test description: Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Root\InventoryApplicationFile\winsat.exe| TargetObject|endswith: \LowerCaseLongPath Details|startswith: c:\users\ Details|endswith: \appdata\local\temp\system32\winsat.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects password policy discovery commands. Logsource: linux / auditd. Rule: title: Password Policy Discovery - Linux id: ca94a6db-8106-4737-9ed2-3e3bb826af0a status: stable description: Detects password policy discovery commands references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1201/T1201.md - https://linux.die.net/man/1/chage - https://man7.org/linux/man-pages/man1/passwd.1.html - https://superuser.com/questions/150675/how-to-display-password-policy-information-for-a-user-ubuntu author: Ömer Günal, oscd.community, Pawel Mazur date: 2020-10-08 modified: 2024-12-01 tags: - attack.discovery - attack.t1201 logsource: product: linux service: auditd detection: selection_files: type: PATH name: - /etc/login.defs - /etc/pam.d/auth - /etc/pam.d/common-account - /etc/pam.d/common-auth - /etc/pam.d/common-password - /etc/pam.d/system-auth - /etc/security/pwquality.conf selection_chage: type: EXECVE a0: chage a1: - --list - -l selection_passwd: type: EXECVE a0: passwd a1: - -S - --status condition: 1 of selection_* falsepositives: - Legitimate administration activities level: low
Query: vulnerability: Cybozu Office 9.0.0 through 10.3 allows remote attackers to discover CSRF tokens via unspecified vectors, a different vulnerability than CVE-2015-8488.
Matching passage: CVE-2015-8487. CWE: CWE-200. CVSS: 4.300000190734863. Cybozu Office 9.0.0 through 10.3 allows remote attackers to discover CSRF tokens via unspecified vectors, a different vulnerability than CVE-2015-8488.
Near-miss passage: CVE-2015-1994. CWE: CWE-200. CVSS: 5.0. IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Query: vulnerability: win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly validate the token of a ca
Matching passage: CVE-2015-0078. CWE: CWE-264. CVSS: 7.199999809265137. win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly validate the token of a calling thread, which allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-4303. CWE: CWE-264. CVSS: 6.5. Cisco TelePresence Video Communication Server (VCS) X8.5.2 allows remote authenticated users to execute arbitrary commands in the context of the nobody user account via an unspecified web-page parameter, aka Bug ID CSCuv12333.
Query: CVE similar to CVE-2015-3330
Matching passage: CVE-2015-3330. CWE: CWE-20. CVSS: 6.800000190734863. The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via pipelined HTTP requests that result in a "deconfigured interpreter."
Near-miss passage: CVE-2015-5234. CWE: CWE-20. CVSS: 6.800000190734863. IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of a renamed "NirCmd.exe" binary based on the PE metadata fields.. Logsource: windows / process_creation. Rule: title: Renamed NirCmd.EXE Execution id: 264982dc-dbad-4dce-b707-1e0d3e0f73d9 status: test description: Detects the execution of a renamed "NirCmd.exe" binary based on the PE metadata fields. references: - https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/ - https://www.nirsoft.net/utils/nircmd.html author: X__Junior (Nextron Systems) date: 2024-03-11 tags: - attack.execution - attack.stealth - attack.t1059 - attack.t1202 logsource: category: process_creation product: windows detection: selection: OriginalFileName: NirCmd.exe filter_main_img: Image|endswith: - \nircmd.exe - \nircmdc.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework. Logsource: windows / process_creation. Rule: title: HackTool - Potential Impacket Lateral Movement Activity id: 10c14723-61c7-4c75-92ca-9af245723ad2 related: - id: e31f89f7-36fb-4697-8ab6-48823708353b type: obsolete status: stable description: Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework references: - https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/wmiexec.py - https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/atexec.py - https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/smbexec.py - https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/dcomexec.py - https://www.elastic.co/guide/en/security/current/suspicious-cmd-execution-via-wmi.html author: Ecco, oscd.community, Jonhnathan Ribeiro, Tim Rauch date: 2019-09-03 modified: 2023-02-21 tags: - attack.execution - attack.t1047 - attack.lateral-movement - attack.t1021.003 logsource: category: process_creation product: windows detection: selection_other: ParentImage|endswith: - \wmiprvse.exe - \mmc.exe - \explorer.exe - \services.exe CommandLine|contains|all: - cmd.exe - /Q - /c - \\\\127.0.0.1\\ - '&1' selection_atexec: ParentCommandLine|contains: - svchost.exe -k netsvcs - taskeng.exe CommandLine|contains|all: - cmd.exe - /C - Windows\Temp\ - '&1' condition: 1 of selection_* falsepositives: - Unknown level: high
Query: risk of Cross-site scripting (XSS) vulnerability in the image processor in Zenphoto before 1.4.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Matching passage: CVE-2015-2948. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the image processor in Zenphoto before 1.4.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-1983. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Projects page in IBM UrbanCode Build 6.1.x before 6.1.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: exploit The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to generate a continuous st
Matching passage: CVE-2015-8552. CWE: CWE-20. CVSS: 4.400000095367432. The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to generate a continuous stream of WARN messages and cause a denial of service (disk consumption) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and XEN_PCI_OP_enable_msi operations, aka "Linux pciback missing sanity checks."
Near-miss passage: CVE-2015-3621. CWE: CWE-20. CVSS: 9.300000190734863. Untrusted search path vulnerability in SAP Enterprise Central Component (ECC) allows local users to gain privileges via a Trojan horse program.