alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of The default configuration of the Apache HTTP Server on Apple OS X before 10.10.4 does not enable the mod_hfs_apple module, which allows remote attackers to bypass HTTP authenticati
Matching passage: CVE-2015-3675. CWE: CWE-284. CVSS: 5.0. The default configuration of the Apache HTTP Server on Apple OS X before 10.10.4 does not enable the mod_hfs_apple module, which allows remote attackers to bypass HTTP authentication via a crafted URL.
Near-miss passage: CVE-2015-3155. CWE: CWE-284. CVSS: 5.0. Foreman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Query: patch priority for CVE-2015-4414
Matching passage: CVE-2015-4414. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in download_audio.php in the SE HTML5 Album Audio Player (se-html5-album-audio-player) plugin 1.1.0 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Near-miss passage: CVE-2015-1429. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in Cybele Software Thinfinity Remote Desktop Workstation 3.0.0.3 32-bit and 64-bit allows remote attackers to download arbitrary files via a .. (dot dot) in an unspecified parameter.
Query: detection rule: Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by
Matching passage: Sigma rule: Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by. Logsource: windows / process_creation. Rule: title: Suspicious Rundll32 Invoking Inline VBScript id: 1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd status: test description: Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452 references: - https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ author: Florian Roth (Nextron Systems) date: 2021-03-05 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - rundll32.exe - Execute - RegRead - window.close condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, un. Logsource: linux / process_creation. Rule: title: Shell Execution via Rsync - Linux id: e2326866-609f-4015-aea9-7ec634e8aa04 status: experimental description: 'Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. ' references: - https://gtfobins.github.io/gtfobins/rsync/#shell author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Florian Roth date: 2024-09-02 modified: 2025-01-18 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: - /rsync - /rsyncd CommandLine|contains: ' -e ' selection_cli: CommandLine|contains: - '/ash ' - '/bash ' - '/dash ' - '/csh ' - '/sh ' - '/zsh ' - '/tcsh ' - '/ksh ' - '''ash ' - '''bash ' - '''dash ' - '''csh ' - '''sh ' - '''zsh ' - '''tcsh ' - '''ksh ' condition: all of selection_* falsepositives: - Legitimate cases in which "rsync" is used to execute a shell level: high
Query: detect Detects "read access" requests on the services registry key. Adversaries may execute their own malicious payloads by hij in logs
Matching passage: Sigma rule: Detects "read access" requests on the services registry key. Adversaries may execute their own malicious payloads by hij. Logsource: windows / security. Rule: title: Service Registry Key Read Access Request id: 11d00fff-5dc3-428c-8184-801f292faec0 status: test description: 'Detects "read access" requests on the services registry key. Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts. ' references: - https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/service_registry_permissions_weakness_check/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness author: Center for Threat Informed Defense (CTID) Summiting the Pyramid Team date: 2023-09-28 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.011 logsource: product: windows service: security definition: 'Requirements: SACLs must be enabled for "READ_CONTROL" on the registry keys used in this rule' detection: selection: EventID: 4663 ObjectName|contains|all: - \SYSTEM\ - ControlSet\Services\ AccessList|contains: '%%1538' condition: selection falsepositives: - Likely from legitimate applications reading their key. Requires heavy tuning level: low
Near-miss passage: Sigma rule: Detects the addition of a new Federated Domain.. Logsource: m365 / exchange. Rule: title: New Federated Domain Added - Exchange id: 42127bdd-9133-474f-a6f1-97b6c08a4339 related: - id: 58f88172-a73d-442b-94c9-95eaed3cbb36 type: similar status: test description: Detects the addition of a new Federated Domain. references: - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf - https://us-cert.cisa.gov/ncas/alerts/aa21-008a - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html - https://www.sygnia.co/golden-saml-advisory - https://o365blog.com/post/aadbackdoor/ author: Splunk Threat Research Team (original rule), '@ionsor (rule)' date: 2022-02-08 tags: - attack.persistence - attack.t1136.003 logsource: service: exchange product: m365 detection: selection: eventSource: Exchange eventName: Add-FederatedDomain status: success condition: selection falsepositives: - The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider. level: medium
Query: weakness Path Equivalence: '//multiple/leading/slash'
Matching passage: CWE-50 Path Equivalence: '//multiple/leading/slash'. The product accepts path input in the form of multiple leading slash ('//multiple/leading/slash') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Near-miss passage: CWE-184 Incomplete List of Disallowed Inputs. The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
Query: rule covering Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7
Matching passage: Sigma rule: Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7. Logsource: windows / ps_script. Rule: title: PowerShell ADRecon Execution id: bf72941a-cba0-41ea-b18c-9aca3925690d status: test description: Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7 references: - https://github.com/sense-of-security/ADRecon/blob/11881a24e9c8b207f31b56846809ce1fb189bcc9/ADRecon.ps1 - https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319 author: Bhabesh Raj date: 2021-07-16 modified: 2022-09-06 tags: - attack.discovery - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Function Get-ADRExcelComOb - Get-ADRGPO - Get-ADRDomainController - ADRecon-Report.xlsx condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects user permission data export attempt.. Logsource: bitbucket / audit. Rule: title: Bitbucket User Permissions Export Attempt id: 87cc6698-3e07-4ba2-9b43-a85a73e151e2 status: test description: Detects user permission data export attempt. references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html - https://confluence.atlassian.com/bitbucketserver/users-and-groups-776640439.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.reconnaissance - attack.collection - attack.discovery - attack.t1213 - attack.t1082 - attack.t1591.004 logsource: product: bitbucket service: audit definition: 'Requirements: "Advance" log level is required to receive these audit events.' detection: selection: auditType.category: Users and groups auditType.action: - User details export failed - User details export started - User details exported condition: selection falsepositives: - Legitimate user activity. level: medium
Query: patch priority for CVE-2015-4746
Matching passage: CVE-2015-4746. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle Agile Product Lifecycle Management for Process component in Oracle Supply Chain Products Suite 6.0.0.7, 6.1.0.3, 6.1.1.5, and 6.2.0.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Global Spec Management.
Near-miss passage: CVE-2015-1790. CWE: UNKNOWN. CVSS: 5.0. The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a PKCS#7 blob that uses ASN.1 encoding and lacks inner EncryptedContent data.
Query: detect Time Providers
Matching passage: T1547.003 Time Providers. Tactics: persistence, privilege escalation. Description: Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.(Citation: Microsoft W32Time Feb 2018) W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients.(Citation: Microsoft TimeProvider) Time providers are implemented as dynamic-link libraries (DLLs) that are registered in the subkeys of `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders\`.(Citation: Microsoft TimeProvider) The time provider manager, directed by the service control manager, loads and starts time providers listed and enabled under this key at system startup and/or whenever parameters are changed.(Citation: Microsoft TimeProvider) Adversaries may abuse this architecture to establish persistence, specifically by creating a new arbitrarily named subkey pointing to a malicious DLL in the `DllName` value. Administrator privileges are required for time provider registration, though execution will run in context of the Local Service account.(Citation: Github W32Time Oct 2017)
Near-miss passage: T1547.007 Re-opened Applications. Tactics: persistence, privilege escalation. Description: Adversaries may modify plist files to automatically run an application when a user logs in. When a user logs out or restarts via the macOS Graphical User Interface (GUI), a prompt is provided to the user with a checkbox to "Reopen windows when logging back in".(Citation: Re-Open windows on Mac) When selected, all applications currently open are added to a property list file named <code>com.apple.loginwindow.[UUID].plist</code> within the <code>~/Library/Preferences/ByHost</code> directory.(Citation: Methods of Mac Malware Persistence)(Citation: Wardle Persistence Chapter) Applications listed in this file are automatically reopened upon the user’s next logon. Adversaries can establish [Persistence](https://attack.mitre.org/tactics/TA0003) by adding a malicious application path to the <code>com.apple.loginwindow.[UUID].plist</code> file to execute payloads when a user logs in.
Query: CVE similar to CVE-2015-2604
Matching passage: CVE-2015-2604. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in the Oracle Endeca Information Discovery Studio component in Oracle Fusion Middleware 2.2.2, 2.3, 2.4, 3.0, and 3.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Integrator, a different vulnerability than CVE-2015-2602, CVE-2015-2603, CVE-2015-2605, CVE-2015-2606, and CVE-2015-4745.
Near-miss passage: CVE-2015-3137. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
Query: vulnerability: The web interface in Bosch Security Systems NBN-498 Dinion2X Day/Night IP Cameras with H.264 Firmware 4.54.0026 allows remote attackers to conduct XML injection attacks via the ids
Matching passage: CVE-2015-6970. CWE: CWE-91. CVSS: 9.800000190734863. The web interface in Bosch Security Systems NBN-498 Dinion2X Day/Night IP Cameras with H.264 Firmware 4.54.0026 allows remote attackers to conduct XML injection attacks via the idstring parameter to rcp.xml.
Near-miss passage: CVE-2015-3932. CWE: CWE-91. CVSS: 7.800000190734863. Netlock Mokka before 2.7.8.1204 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object.
Query: vulnerability: The EnableNetwork method in the Network class in plugins/mechanism/Network.py in Blueman before 2.0.3 allows local users to gain privileges via the dhcp_handler argument.
Matching passage: CVE-2015-8612. CWE: CWE-264. CVSS: 8.399999618530273. The EnableNetwork method in the Network class in plugins/mechanism/Network.py in Blueman before 2.0.3 allows local users to gain privileges via the dhcp_handler argument.
Near-miss passage: CVE-2015-1814. CWE: CWE-264. CVSS: 7.5. The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token change" involving anonymous users.
Query: Sigma rule for Detects attempts to enable the guest account using the sysadminctl utility
Matching passage: Sigma rule: Detects attempts to enable the guest account using the sysadminctl utility. Logsource: macos / process_creation. Rule: title: Guest Account Enabled Via Sysadminctl id: d7329412-13bd-44ba-a072-3387f804a106 status: test description: Detects attempts to enable the guest account using the sysadminctl utility references: - https://ss64.com/osx/sysadminctl.html author: Sohan G (D4rkCiph3r) date: 2023-02-18 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 - attack.t1078.001 logsource: category: process_creation product: macos detection: selection: Image|endswith: /sysadminctl CommandLine|contains|all: - ' -guestAccount' - ' on' condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects usage of the SysInternals Procdump utility. Logsource: windows / process_creation. Rule: title: Procdump Execution id: 2e65275c-8288-4ab4-aeb7-6274f58b6b20 status: test description: Detects usage of the SysInternals Procdump utility references: - https://learn.microsoft.com/en-us/sysinternals/downloads/procdump author: Florian Roth (Nextron Systems) date: 2021-08-16 modified: 2026-06-29 tags: - attack.stealth - attack.t1036 - attack.t1003.001 - attack.credential-access logsource: category: process_creation product: windows detection: selection: Image|endswith: - \procdump.exe - \procdump64.exe - \procdump64a.exe condition: selection falsepositives: - Legitimate use of procdump by a developer or administrator level: medium
Query: describe CVE-2015-6614
Matching passage: CVE-2015-6614. CWE: CWE-264. CVSS: 5.800000190734863. Telephony in Android 5.x before 5.1.1 LMY48X allows attackers to gain privileges, and consequently bypass intended network-interface restrictions, perform expensive data transfers, or cause a denial of service (call-reception outage or mute manipulation), via a crafted application, aka internal bug 21900139.
Near-miss passage: CVE-2015-3335. CWE: CWE-264. CVSS: 7.5. The NaClSandbox::InitializeLayerTwoSandbox function in components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc in Google Chrome before 42.0.2311.90 does not have RLIMIT_AS and RLIMIT_DATA limits for Native Client (aka NaCl) processes, which might make it easier for remote attackers to conduct row-hammer attacks or have unspecified other impact by leveraging the ability to run a crafted program in the NaCl sandbox.
Query: Lateral movement indicators for Screen Capture
Matching passage: T1113 Screen Capture. Tactics: collection. Description: Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.(Citation: CopyFromScreen .NET)(Citation: Antiquated Mac Malware)
Near-miss passage: T1114 Email Collection. Tactics: collection. Description: Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses.(Citation: TrustedSec OOB Communications)(Citation: CISA AA20-352A 2021) Adversaries can collect or forward email from mail servers or clients.
Query: CVE similar to CVE-2015-8261
Matching passage: CVE-2015-8261. CWE: CWE-89. CVSS: 9.800000190734863. The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized XML objects, which allows remote attackers to conduct SQL injection attacks via a crafted SOAP request.
Near-miss passage: CVE-2015-6829. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in the getip function in wp-limit-login-attempts.php in the WP Limit Login Attempts plugin before 2.0.1 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) X-Forwarded-For or (2) Client-IP HTTP header.
Query: write Sigma for Detects the installation of VsCode tunnel (code-tunnel) as a service.
Matching passage: Sigma rule: Detects the installation of VsCode tunnel (code-tunnel) as a service.. Logsource: windows / process_creation. Rule: title: Visual Studio Code Tunnel Service Installation id: 30bf1789-379d-4fdc-900f-55cd0a90a801 status: test description: Detects the installation of VsCode tunnel (code-tunnel) as a service. references: - https://ipfyx.fr/post/visual-studio-code-tunnel/ - https://badoption.eu/blog/2023/01/31/code_c2.html - https://code.visualstudio.com/docs/remote/tunnels author: Nasreddine Bencherchali (Nextron Systems) date: 2023-10-25 tags: - attack.command-and-control - attack.t1071.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - 'tunnel ' - service - internal-run - tunnel-service.log condition: selection falsepositives: - Legitimate installation of code-tunnel as a service level: medium
Near-miss passage: Sigma rule: Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file. These ".lst" file can con. Logsource: windows / process_creation. Rule: title: Setup16.EXE Execution With Custom .Lst File id: 99c8be4f-3087-4f9f-9c24-8c7e257b442e status: test description: 'Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file. These ".lst" file can contain references to external program that "Setup16.EXE" will execute. Attackers and adversaries might leverage this as a living of the land utility. ' references: - https://www.hexacorn.com/blog/2024/10/12/the-sweet16-the-oldbin-lolbin-called-setup16-exe/ author: frack113 date: 2024-12-01 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.005 logsource: category: process_creation product: windows detection: selection: ParentImage: C:\Windows\SysWOW64\setup16.exe ParentCommandLine|contains: ' -m ' filter_optional_valid_path: Image|startswith: C:\~MSSETUP.T\ condition: selection and not 1 of filter_optional_* falsepositives: - On modern Windows system, the "Setup16" utility is practically never used, hence false positive should be very rare. level: medium
Query: Sigma rule for Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts
Matching passage: Sigma rule: Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts. Logsource: windows / process_creation. Rule: title: Suspicious Child Process Created as System id: 590a5f4c-6c8c-4f10-8307-89afe9453a9d status: test description: Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment - https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/ - https://github.com/antonioCoco/RogueWinRM - https://twitter.com/Cyb3rWard0g/status/1453123054243024897 author: Teymur Kheirkhabarov, Roberto Rodriguez (@Cyb3rWard0g), Open Threat Research (OTR) date: 2019-10-26 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.002 logsource: category: process_creation product: windows definition: 'Requirements: ParentUser field needs sysmon >= 13.30' detection: selection: ParentUser|contains: - AUTHORI - AUTORI ParentUser|endswith: - \NETWORK SERVICE - \LOCAL SERVICE User|contains: - AUTHORI - AUTORI User|endswith: - \SYSTEM - \Système - \СИСТЕМА IntegrityLevel: - System - S-1-16-16384 filter_rundll32: Image|endswith: \rundll32.exe CommandLine|contains: DavSetCookie condition: selection and not 1 of filter_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects PAExec service installation. Logsource: windows / system. Rule: title: PAExec Service Installation id: de7ce410-b3fb-4e8a-b38c-3b999e2c3420 status: test description: Detects PAExec service installation references: - https://www.poweradmin.com/paexec/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-26 tags: - attack.execution - attack.t1569.002 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7045 selection_image: - ServiceName|startswith: PAExec- - ImagePath|startswith: C:\WINDOWS\PAExec- condition: all of selection_* falsepositives: - Unknown level: medium