alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Multiple stack-based buffer overflows in Ipropsapi in Panasonic Security API (PS-API) ActiveX SDK before 8.10.18 allow remote attackers to execute arbitrary code via a long string 
Matching passage: CVE-2015-4647. CWE: CWE-119. CVSS: 6.800000190734863. Multiple stack-based buffer overflows in Ipropsapi in Panasonic Security API (PS-API) ActiveX SDK before 8.10.18 allow remote attackers to execute arbitrary code via a long string in the (1) FilePassword property or to the (2) GetStringInfo method.
Near-miss passage: CVE-2015-3665. CWE: CWE-119. CVSS: 6.800000190734863. QT Media Foundation in Apple QuickTime before 7.7.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3664 and CVE-2015-3669.
Query: Sigma rule for Detects usage of system utilities to discover system network connections
Matching passage: Sigma rule: Detects usage of system utilities to discover system network connections. Logsource: macos / process_creation. Rule: title: System Network Connections Discovery - MacOs id: 9a7a0393-2144-4626-9bf1-7c2f5a7321db status: test description: Detects usage of system utilities to discover system network connections references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2022-12-28 tags: - attack.discovery - attack.t1049 logsource: category: process_creation product: macos detection: selection: Image|endswith: - /who - /w - /last - /lsof - /netstat condition: selection falsepositives: - Legitimate activities level: informational
Near-miss passage: Sigma rule: Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled ta. Logsource: windows / taskscheduler. Rule: title: Important Scheduled Task Deleted or Disabled id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d related: - id: dbc1f800-0fe0-4bc0-9c66-292c2abe3f78 type: similar - id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad type: similar - id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980 type: similar status: test description: 'Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities ' references: - https://www.socinvestigation.com/most-common-windows-event-ids-to-hunt-mind-map/ author: frack113 date: 2023-01-13 modified: 2026-03-11 tags: - attack.impact - attack.t1489 logsource: product: windows service: taskscheduler definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger' detection: selection: EventID: - 141 - 142 TaskName|contains: - \Windows\SystemRestore\SR - \Windows\Windows Defender\ - \Windows\BitLocker - \Windows\WindowsBackup\ - \Windows\WindowsUpdate\ - \Windows\UpdateOrchestrator\ - \Windows\ExploitGuard filter_main_user: UserName|contains: - AUTHORI - AUTORI condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable/info.yml simulation: - type: atomic-red-team name: Windows - Disable the SR scheduled task technique: T1490 atomic_guid: 1c68c68d-83a4-4981-974e-8993055fa034
Query: patch priority for CVE-2015-7937
Matching passage: CVE-2015-7937. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340 PLC BMXNOx and BMXPx devices allows remote attackers to execute arbitrary code via a long password in HTTP Basic Authentication data.
Near-miss passage: CVE-2015-7805. CWE: CWE-119. CVSS: 9.300000190734863. Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in an AIFF file.
Query: rule covering Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remov
Matching passage: Sigma rule: Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remov. Logsource: windows / process_creation. Rule: title: Service Registry Key Deleted Via Reg.EXE id: 05b2aa93-1210-42c8-8d9a-2fcc13b284f5 status: test description: Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remove AV software services references: - https://www.virustotal.com/gui/file/2bcd5702a7565952c44075ac6fb946c7780526640d1264f692c7664c02c68465 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-01 modified: 2023-02-04 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: reg.exe - OriginalFileName: reg.exe selection_delete: CommandLine|contains: ' delete ' selection_key: CommandLine|contains: \SYSTEM\CurrentControlSet\services\ condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands. Such behavior may be associate. Logsource: linux / process_creation. Rule: title: Vim GTFOBin Abuse - Linux id: 7ab8f73a-fcff-428b-84aa-6a5ff7877dea status: test description: 'Detects the use of "vim" and it''s siblings commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. ' references: - https://gtfobins.github.io/gtfobins/vi/ - https://gtfobins.github.io/gtfobins/vim/ - https://gtfobins.github.io/gtfobins/rvim/ - https://gtfobins.github.io/gtfobins/vimdiff/ author: Nasreddine Bencherchali (Nextron Systems), Luc Génaux date: 2022-12-28 modified: 2026-06-05 tags: - attack.execution - attack.discovery - attack.t1059 - attack.t1083 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: - /rvim - /vi - /vim - /vimdiff CommandLine|contains: - ' --cmd ' - ' -c' selection_cli: CommandLine|contains: - :!/ - :!$ - :!.. - ':lua ' - ':py ' - :shell - /bin/bash - /bin/dash - /bin/fish - /bin/sh - /bin/csh - /bin/ksh - /bin/zsh - /bin/tmux condition: all of selection_* falsepositives: - Unknown level: high
Query: risk of Cross-site request forgery (CSRF) vulnerability in Cisco Data Center Analytics Framework (DCAF) 1.4 allows remote attackers to hijack the authentication of arbitrary users, aka Bug
Matching passage: CVE-2015-4189. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco Data Center Analytics Framework (DCAF) 1.4 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun26807.
Near-miss passage: CVE-2015-3367. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Patterns module before 7.x-2.2 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) restore, (2) publish, or (3) unpublish a pattern via unspecified vectors.
Query: rule covering Detects Azure Hybrid Connection Manager services querying the Azure service bus service
Matching passage: Sigma rule: Detects Azure Hybrid Connection Manager services querying the Azure service bus service. Logsource: windows / dns_query. Rule: title: DNS HybridConnectionManager Service Bus id: 7bd3902d-8b8b-4dd4-838a-c6862d40150d status: test description: Detects Azure Hybrid Connection Manager services querying the Azure service bus service references: - https://twitter.com/Cyb3rWard0g/status/1381642789369286662 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2021-04-12 modified: 2023-01-16 tags: - attack.persistence - attack.t1554 logsource: product: windows category: dns_query detection: selection: QueryName|contains: servicebus.windows.net Image|contains: HybridConnectionManager condition: selection falsepositives: - Legitimate use of Azure Hybrid Connection Manager and the Azure Service Bus service level: high
Near-miss passage: Sigma rule: Detects the creation of a macro file for Outlook.. Logsource: windows / file_event. Rule: title: Suspicious Outlook Macro Created id: 117d3d3a-755c-4a61-b23e-9171146d094c related: - id: 8c31f563-f9a7-450c-bfa8-35f8f32f1f61 type: derived status: test description: Detects the creation of a macro file for Outlook. references: - https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/ - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53 - https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-08 tags: - attack.privilege-escalation - attack.persistence - attack.command-and-control - attack.t1137 - attack.t1008 - attack.t1546 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: \Microsoft\Outlook\VbaProject.OTM filter: Image|endswith: \outlook.exe condition: selection and not filter falsepositives: - Unlikely level: high
Query: risk of The Red Hat docker package before 1.5.0-28, when using the --add-registry option, falls back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle
Matching passage: CVE-2015-1843. CWE: CWE-20. CVSS: 4.300000190734863. The Red Hat docker package before 1.5.0-28, when using the --add-registry option, falls back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic. NOTE: this vulnerability exists because of a CVE-2014-5277 regression.
Near-miss passage: CVE-2015-6821. CWE: CWE-20. CVSS: 7.5. The ff_mpv_common_init function in libavcodec/mpegvideo.c in FFmpeg before 2.7.2 does not properly maintain the encoding context, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted MPEG data.
Query: detection rule: Detects suspicious invocation of the Get-ADDBAccount script that reads from a ntds.dit file and may be used to get acces
Matching passage: Sigma rule: Detects suspicious invocation of the Get-ADDBAccount script that reads from a ntds.dit file and may be used to get acces. Logsource: windows / ps_module. Rule: title: Suspicious Get-ADDBAccount Usage id: b140afd9-474b-4072-958e-2ebb435abd68 status: test description: Detects suspicious invocation of the Get-ADDBAccount script that reads from a ntds.dit file and may be used to get access to credentials without using any credential dumpers references: - https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/ - https://github.com/MichaelGrafnetter/DSInternals/blob/7ba59c12ee9a1cb430d7dc186a3366842dd612c8/Documentation/PowerShell/Get-ADDBAccount.md author: Florian Roth (Nextron Systems) date: 2022-03-16 tags: - attack.credential-access - attack.t1003.003 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection: Payload|contains|all: - Get-ADDBAccount - 'BootKey ' - 'DatabasePath ' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of smbexec.py tool by detecting a specific service installation. Logsource: windows / system. Rule: title: smbexec.py Service Installation id: 52a85084-6989-40c3-8f32-091e12e13f09 status: test description: Detects the use of smbexec.py tool by detecting a specific service installation references: - https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-2-psexec-and-services/ - https://github.com/fortra/impacket/blob/33058eb2fde6976ea62e04bc7d6b629d64d44712/examples/smbexec.py#L286-L296 - https://github.com/fortra/impacket/blob/edef71f17bc1240f9f8c957bbda98662951ac3ec/examples/smbexec.py#L60 author: Omer Faruk Celik date: 2018-03-20 modified: 2023-11-09 tags: - attack.lateral-movement - attack.execution - attack.t1021.002 - attack.t1569.002 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7045 selection_service_name: ServiceName: BTOBTO selection_service_image: ImagePath|contains: - '.bat & del ' - __output 2^>^&1 > condition: selection_eid and 1 of selection_service_* falsepositives: - Unknown level: high
Query: alert when Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.
Matching passage: Sigma rule: Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.. Logsource: rpc_firewall / application. Rule: title: SharpHound Recon Sessions id: 6d580420-ff3f-4e0e-b6b0-41b90c787e28 status: test description: Detects remote RPC calls useb by SharpHound to map remote connections and local group membership. references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/02b1f559-fda2-4ba3-94c2-806eb2777183 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SRVS.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.discovery - attack.t1033 logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:4b324fc8-1670-01d3-1278-5a47bf6ee188 opnum:12' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 4b324fc8-1670-01d3-1278-5a47bf6ee188 OpNum: 12 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when a user bypasses the push protection on a secret detected by secret scanning.. Logsource: github / audit. Rule: title: Github Push Protection Bypass Detected id: 02cf536a-cf21-4876-8842-4159c8aee3cc status: test description: Detects when a user bypasses the push protection on a secret detected by secret scanning. references: - https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/push-protection-for-repositories-and-organizations - https://thehackernews.com/2024/03/github-rolls-out-default-secret.html author: Muhammad Faisal (@faisalusuf) date: 2024-03-07 tags: - attack.defense-impairment - attack.t1685 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action|contains: secret_scanning_push_protection.bypass condition: selection falsepositives: - Allowed administrative activities. level: low
Query: patch priority for CVE-2015-5471
Matching passage: CVE-2015-5471. CWE: CWE-22. CVSS: 5.300000190734863. Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter.
Near-miss passage: CVE-2015-7603. CWE: CWE-22. CVSS: 7.800000190734863. Directory traversal vulnerability in Konica Minolta FTP Utility 1.0 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in a RETR command.
Query: intelligence brief on T1602.001
Matching passage: T1602.001 SNMP (MIB Dump). Tactics: collection. Description: Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP). The MIB is a configuration repository that stores variable information accessible via SNMP in the form of object identifiers (OID). Each OID identifies a variable that can be read or set and permits active management tasks, such as configuration changes, through remote modification of these variables. SNMP can give administrators great insight in their systems, such as, system information, description of hardware, physical location, and software packages(Citation: SANS Information Security Reading Room Securing SNMP Securing SNMP). The MIB may also contain device operational information, including running configuration, routing table, and interface details. Adversaries may use SNMP queries to collect MIB content directly from SNMP-managed devices in order to collect network information that allows the adversary to build network maps and facilitate future targeted exploitation.(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks)
Near-miss passage: T1602 Data from Configuration Repository. Tactics: collection. Description: Adversaries may collect data related to managed devices from configuration repositories. Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems. Configuration repositories may also facilitate remote access and administration of devices. Adversaries may target these repositories in order to collect large quantities of sensitive system administration data. Data from configuration repositories may be exposed by various protocols and software and can store a wide variety of data, much of which may align with adversary Discovery objectives.(Citation: US-CERT-TA18-106A)(Citation: US-CERT TA17-156A SNMP Abuse 2017)
Query: CVE similar to CVE-2015-3062
Matching passage: CVE-2015-3062. CWE: CWE-284. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3063, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, CVE-2015-3073, and CVE-2015-3074.
Near-miss passage: CVE-2015-6984. CWE: CWE-284. CVSS: 8.800000190734863. libarchive in Apple OS X before 10.11.1 allows attackers to write to arbitrary files via a crafted app that conducts an unspecified symlink attack.
Query: patch priority for CVE-2015-1141
Matching passage: CVE-2015-1141. CWE: UNKNOWN. CVSS: 4.900000095367432. The mach_vm_read functionality in the kernel in Apple OS X before 10.10.3 allows local users to cause a denial of service (system crash) via unspecified vectors.
Near-miss passage: CVE-2015-7636. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.
Query: Persistence mechanism resembling Hijack Execution Flow
Matching passage: T1574 Hijack Execution Flow. Tactics: stealth, execution. Description: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.
Near-miss passage: T1574.014 AppDomainManager. Tactics: stealth, execution. Description: Adversaries may execute their own malicious payloads by hijacking how the .NET `AppDomainManager` loads assemblies. The .NET framework uses the `AppDomainManager` class to create and manage one or more isolated runtime environments (called application domains) inside a process to host the execution of .NET applications. Assemblies (`.exe` or `.dll` binaries compiled to run as .NET code) may be loaded into an application domain as executable code.(Citation: Microsoft App Domains) Known as "AppDomainManager injection," adversaries may execute arbitrary code by hijacking how .NET applications load assemblies. For example, malware may create a custom application domain inside a target process to load and execute an arbitrary assembly. Alternatively, configuration files (`.config`) or process environment variables that define .NET runtime settings may be tampered with to instruct otherwise benign .NET applications to load a malicious assembly (identified by name) into the target process.(Citation: PenTestLabs AppDomainManagerInject)(Citation: PwC Yellow Liderc)(Citation: Rapid7 AppDomain Manager Injection)
Query: CVE similar to CVE-2015-4111
Matching passage: CVE-2015-4111. CWE: CWE-20. CVSS: 6.800000190734863. mc_demux_mp4_ds.ax in an unspecified third-party codec demux in BlackBerry Link before 1.2.3.53 with installer before 1.1.0.22 allows remote attackers to execute arbitrary code via a crafted MP4 file.
Near-miss passage: CVE-2015-4148. CWE: CWE-20. CVSS: 5.0. The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data type, related to a "type confusion" issue.
Query: exploit Cross-site request forgery (CSRF) vulnerability in the WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 allo
Matching passage: CVE-2015-2852. CWE: CWE-352. CVSS: 4.300000190734863. Cross-site request forgery (CSRF) vulnerability in the WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 allows remote attackers to hijack the authentication of administrators.
Near-miss passage: CVE-2015-3363. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Contact Form Fields module before 6.x-2.3 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete fields via unspecified vectors.