alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-6778
Matching passage: CVE-2015-6778. CWE: CWE-119. CVSS: 7.5. The CJBig2_SymbolDict class in fxcodec/jbig2/JBig2_SymbolDict.cpp in PDFium, as used in Google Chrome before 47.0.2526.73, allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via a PDF document containing crafted data with JBIG2 compression.
Near-miss passage: CVE-2015-3744. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Query: patch priority for CVE-2015-8299
Matching passage: CVE-2015-8299. CWE: CWE-119. CVSS: 9.800000190734863. Buffer overflow in the Group messages monitor (Falcon) in KNX ETS 4.1.5 (Build 3246) allows remote attackers to execute arbitrary code via a crafted KNXnet/IP UDP packet.
Near-miss passage: CVE-2015-8385. CWE: CWE-119. CVSS: 7.5. PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Query: weakness Improper Control of Interaction Frequency
Matching passage: CWE-799 Improper Control of Interaction Frequency. The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.
Near-miss passage: CWE-1076 Insufficient Adherence to Expected Conventions. The product's architecture, source code, design, documentation, or other artifact does not follow required conventions.
Query: risk of Cross-site scripting (XSS) vulnerability in the NTT DATA Smart Sourcing JavaScript module 2003-11-26 through 2013-07-09 for Web Analytics Service allows remote attackers to inject 
Matching passage: CVE-2015-7786. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the NTT DATA Smart Sourcing JavaScript module 2003-11-26 through 2013-07-09 for Web Analytics Service allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-9438. CWE: CWE-79. CVSS: 5.400000095367432. The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, or instance parameter.
Query: exploit The com_contenthistory component in Joomla! 3.2 before 3.4.5 does not properly check ACLs, which allows remote attackers to obtain sensitive information via unspecified vectors.
Matching passage: CVE-2015-7859. CWE: CWE-200. CVSS: 5.0. The com_contenthistory component in Joomla! 3.2 before 3.4.5 does not properly check ACLs, which allows remote attackers to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-3782. CWE: CWE-200. CVSS: 4.300000190734863. CloudKit in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to access an iCloud user record associated with a previous user's login session via a crafted app.
Query: vulnerability: PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type conf
Matching passage: CVE-2015-4601. CWE: UNKNOWN. CVSS: 9.800000190734863. PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in (1) ext/soap/php_encoding.c, (2) ext/soap/php_http.c, and (3) ext/soap/soap.c, a different issue than CVE-2015-4600.
Near-miss passage: CVE-2015-0399. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle Fusion Middleware 10.1.3.4.2 and 11.1.1.7 allows remote authenticated users to affect confidentiality via unknown vectors related to Analytics Web General.
Query: write Sigma for Detects instances where an SIP service on an OpenCanary node has had a SIP request.
Matching passage: Sigma rule: Detects instances where an SIP service on an OpenCanary node has had a SIP request.. Logsource: opencanary / application. Rule: title: OpenCanary - SIP Request id: e30de276-68ec-435c-ab99-ef3befec6c61 status: test description: Detects instances where an SIP service on an OpenCanary node has had a SIP request. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.collection - attack.t1123 logsource: category: application product: opencanary detection: selection: logtype: 15001 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command li. Logsource: windows / process_creation. Rule: title: HackTool - Certify Execution id: 762f2482-ff21-4970-8939-0aa317a886bb status: test description: Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments. references: - https://github.com/GhostPack/Certify author: pH-T (Nextron Systems) date: 2023-04-17 modified: 2023-04-25 tags: - attack.discovery - attack.credential-access - attack.t1649 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \Certify.exe - OriginalFileName: Certify.exe - Description|contains: Certify selection_cli_commands: CommandLine|contains: - '.exe cas ' - '.exe find ' - '.exe pkiobjects ' - '.exe request ' - '.exe download ' selection_cli_options: CommandLine|contains: - ' /vulnerable' - ' /template:' - ' /altname:' - ' /domain:' - ' /path:' - ' /ca:' condition: selection_img or all of selection_cli_* falsepositives: - Unknown level: high
Query: exploit Unspecified vulnerability in IBM WebSphere eXtreme Scale 8.6 through 8.6.0.8 allows remote attackers to cause a denial of service via unknown vectors.
Matching passage: CVE-2015-4936. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in IBM WebSphere eXtreme Scale 8.6 through 8.6.0.8 allows remote attackers to cause a denial of service via unknown vectors.
Near-miss passage: CVE-2015-0912. CWE: UNKNOWN. CVSS: 6.5. EasyCTF before 1.4 allows remote authenticated users to write executable content to files via unspecified vectors.
Query: detection rule: Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember".
Matching passage: Sigma rule: Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember".. Logsource: windows / process_creation. Rule: title: User Added To Highly Privileged Group id: 10fb649c-3600-4d37-b1e6-56ea90bb7e09 related: - id: ffa28e60-bdb1-46e0-9f82-05f7a61cc06e type: similar - id: ad720b90-25ad-43ff-9b5e-5c841facc8e5 type: similar status: test description: Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember". references: - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708 author: Nasreddine Bencherchali (Nextron Systems) date: 2024-02-23 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: category: process_creation product: windows detection: selection_main: - CommandLine|contains|all: - 'localgroup ' - ' /add' - CommandLine|contains|all: - 'Add-LocalGroupMember ' - ' -Group ' selection_group: CommandLine|contains: - Group Policy Creator Owners - Schema Admins condition: all of selection_* falsepositives: - Administrative activity that must be investigated level: high
Near-miss passage: Sigma rule: Detects suspicious renamed SysInternals DebugView execution. Logsource: windows / process_creation. Rule: title: Renamed SysInternals DebugView Execution id: cd764533-2e07-40d6-a718-cfeec7f2da7f status: test description: Detects suspicious renamed SysInternals DebugView execution references: - https://www.epicturla.com/blog/sysinturla author: Florian Roth (Nextron Systems) date: 2020-05-28 modified: 2023-02-14 tags: - attack.resource-development - attack.t1588.002 logsource: category: process_creation product: windows detection: selection: Product: Sysinternals DebugView filter: OriginalFileName: Dbgview.exe Image|endswith: \Dbgview.exe condition: selection and not filter falsepositives: - Unknown level: high
Query: explain CWE-1055
Matching passage: CWE-1055 Multiple Inheritance from Concrete Classes. The product contains a class with inheritance from more than one concrete class.
Near-miss passage: CWE-756 Missing Custom Error Page. The product does not return custom error pages to the user, possibly exposing sensitive information.
Query: rule covering Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass au
Matching passage: Sigma rule: Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass au. Logsource: azure / auditlogs. Rule: title: Disabled MFA to Bypass Authentication Mechanisms id: 7ea78478-a4f9-42a6-9dcd-f861816122bf status: test description: Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms. references: - https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory - https://research.splunk.com/cloud/482dd42a-acfa-486b-a0bb-d6fcda27318e/ - https://analyticsrules.exchange/analyticrules/65c78944-930b-4cae-bd79-c3664ae30ba7/ - https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_mfa_disabled_for_user author: '@ionsor' date: 2022-02-08 modified: 2026-04-30 tags: - attack.credential-access - attack.persistence - attack.defense-impairment - attack.t1556 logsource: product: azure service: auditlogs detection: selection: operationName: Disable Strong Authentication properties.result: success condition: selection falsepositives: - Authorized modification by administrators level: medium
Near-miss passage: Sigma rule: Detects the removal of a previously installed IIS module.. Logsource: windows / iis-configuration. Rule: title: Previously Installed IIS Module Was Removed id: 9e1a1fdf-ee58-40ce-8e15-b66ca5a80e1f status: test description: Detects the removal of a previously installed IIS module. references: - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/ - https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/ - https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview author: Nasreddine Bencherchali date: 2024-10-06 tags: - attack.persistence - attack.defense-impairment - attack.t1685.001 - attack.t1505.004 logsource: product: windows service: iis-configuration detection: selection: EventID: 29 Configuration|contains: /system.webServer/modules/remove condition: selection falsepositives: - Legitimate administrator activity level: low
Query: vulnerability: The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.
Matching passage: CVE-2015-9321. CWE: CWE-79. CVSS: 6.099999904632568. The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.
Near-miss passage: CVE-2015-0787. CWE: CWE-79. CVSS: 6.099999904632568. XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the accessMgrDN value of the forgotUser.do CGI.
Query: SIEM correlation: initial access activity consistent with Wi-Fi Networks
Matching passage: T1669 Wi-Fi Networks. Tactics: initial access. Description: Adversaries may gain initial access to target systems by connecting to wireless networks. They may accomplish this by exploiting open Wi-Fi networks used by target devices or by accessing secured Wi-Fi networks — requiring [Valid Accounts](https://attack.mitre.org/techniques/T1078) — belonging to a target organization.(Citation: DOJ GRU Charges 2018)(Citation: Nearest Neighbor Volexity) Establishing a connection to a Wi-Fi access point requires a certain level of proximity to both discover and maintain a stable network connection. Adversaries may establish a wireless connection through various methods, such as by physically positioning themselves near a Wi-Fi network to conduct close access operations. To bypass the need for physical proximity, adversaries may attempt to remotely compromise nearby third-party systems that have both wired and wireless network connections available (i.e., dual-homed systems). These third-party compromised devices can then serve as a bridge to connect to a target’s Wi-Fi network.(Citation: Nearest Neighbor Volexity) Once an initial wireless connection is achieved, adversaries may leverage this access for follow-on activities in the victim network or further targeting of specific devices on the network. Adversaries may perform [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) activities for [Credential Access](https://attack.mitre.org/tactics/TA0006) or [Discovery](https://attack.mitre.org/tactics/TA0007).
Near-miss passage: T1195.003 Compromise Hardware Supply Chain. Tactics: initial access. Description: Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system. Hardware backdoors may be inserted into various devices, such as servers, workstations, network infrastructure, or peripherals.
Query: detection rule: Detects the addition of a new network route to a route table in AWS.
Matching passage: Sigma rule: Detects the addition of a new network route to a route table in AWS.. Logsource: aws / cloudtrail. Rule: title: New Network Route Added id: c803b2ce-c4a2-4836-beae-b112010390b1 status: test description: 'Detects the addition of a new network route to a route table in AWS. ' references: - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/ author: jamesc-grafana date: 2024-07-11 tags: - attack.defense-impairment - attack.t1686.001 logsource: product: aws service: cloudtrail detection: selection: eventSource: ec2.amazonaws.com eventName: CreateRoute condition: selection falsepositives: - New VPC Creation requiring setup of a new route table - New subnets added requiring routing setup level: medium
Near-miss passage: Sigma rule: Detects when there is a interruption in the authentication process.. Logsource: azure / signinlogs. Rule: title: Azure Unusual Authentication Interruption id: 8366030e-7216-476b-9927-271d79f13cf3 status: test description: Detects when there is a interruption in the authentication process. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts author: Austin Songer @austinsonger date: 2021-11-26 modified: 2022-12-18 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 logsource: product: azure service: signinlogs detection: selection_50097: ResultType: 50097 ResultDescription: Device authentication is required selection_50155: ResultType: 50155 ResultDescription: DeviceAuthenticationFailed selection_50158: ResultType: 50158 ResultDescription: ExternalSecurityChallenge - External security challenge was not satisfied condition: 1 of selection_* falsepositives: - Unknown level: medium
Query: describe CVE-2015-9045
Matching passage: CVE-2015-9045. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in GERAN where a buffer can be overflown while taking power measurements.
Near-miss passage: CVE-2015-5800. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Query: write Sigma for Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.
Matching passage: Sigma rule: Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.. Logsource: linux / process_creation. Rule: title: Potential Linux Amazon SSM Agent Hijacking id: f9b3edc5-3322-4fc7-8aa3-245d646cc4b7 status: test description: Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report. references: - https://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan - https://www.bleepingcomputer.com/news/security/amazons-aws-ssm-agent-can-be-used-as-post-exploitation-rat-malware/ - https://www.helpnetsecurity.com/2023/08/02/aws-instances-attackers-access/ author: Muhammad Faisal date: 2023-08-03 tags: - attack.command-and-control - attack.persistence - attack.t1219.002 logsource: category: process_creation product: linux detection: selection: Image|endswith: /amazon-ssm-agent CommandLine|contains|all: - '-register ' - '-code ' - '-id ' - '-region ' condition: selection falsepositives: - Legitimate activity of system administrators level: medium
Near-miss passage: Sigma rule: Detects the creation of file by the "node.exe" process in the ".vscode-server" directory. Could be a sign of remote file. Logsource: windows / file_event. Rule: title: Visual Studio Code Tunnel Remote File Creation id: 56e05d41-ce99-4ecd-912d-93f019ee0b71 status: test description: 'Detects the creation of file by the "node.exe" process in the ".vscode-server" directory. Could be a sign of remote file creation via VsCode tunnel feature ' references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-10-25 tags: - attack.command-and-control logsource: category: file_event product: windows detection: selection: Image|contains: \servers\Stable- Image|endswith: \server\node.exe TargetFilename|contains: \.vscode-server\data\User\History\ condition: selection falsepositives: - Unknown level: medium
Query: alert when Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Wi
Matching passage: Sigma rule: Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Wi. Logsource: windows / process_creation. Rule: title: Renamed AutoIt Execution id: f4264e47-f522-4c38-a420-04525d5b880f status: test description: 'Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks. Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious. ' references: - https://twitter.com/malmoeb/status/1665463817130725378?s=12&t=C0_T_re0wRP_NfKa27Xw9w - https://www.autoitscript.com/site/ author: Florian Roth (Nextron Systems) date: 2023-06-04 modified: 2024-11-23 tags: - attack.stealth - attack.t1027 logsource: category: process_creation product: windows detection: selection_1: CommandLine|contains: - ' /AutoIt3ExecuteScript' - ' /ErrorStdOut' selection_2: Hashes|contains: - IMPHASH=FDC554B3A8683918D731685855683DDF - IMPHASH=CD30A61B60B3D60CECDB034C8C83C290 - IMPHASH=F8A00C72F2D667D2EDBB234D0C0AE000 selection_3: OriginalFileName: - AutoIt3.exe - AutoIt2.exe - AutoIt.exe filter_main_legit_name: Image|endswith: - \AutoIt.exe - \AutoIt2.exe - \AutoIt3_x64.exe - \AutoIt3.exe condition: 1 of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects creation of files with the ".one"/".onepkg" extension in suspicious or uncommon locations. This could be a sign. Logsource: windows / file_event. Rule: title: OneNote Attachment File Dropped In Suspicious Location id: 7fd164ba-126a-4d9c-9392-0d4f7c243df0 status: test description: Detects creation of files with the ".one"/".onepkg" extension in suspicious or uncommon locations. This could be a sign of attackers abusing OneNote attachments references: - https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/ - https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-22 modified: 2023-09-19 tags: - attack.stealth logsource: category: file_event product: windows detection: selection: TargetFilename|contains: - \AppData\Local\Temp\ - \Users\Public\ - \Windows\Temp\ - :\Temp\ TargetFilename|endswith: - .one - .onepkg filter_main_onenote: Image|contains: :\Program Files\Microsoft Office\ Image|endswith: \ONENOTE.EXE condition: selection and not 1 of filter_main_* falsepositives: - Legitimate usage of ".one" or ".onepkg" files from those locations level: medium
Query: detect Detects when a process tries to access the memory of svchost to potentially dump credentials. in logs
Matching passage: Sigma rule: Detects when a process tries to access the memory of svchost to potentially dump credentials.. Logsource: windows / process_access. Rule: title: Credential Dumping Attempt Via Svchost id: 174afcfa-6e40-4ae9-af64-496546389294 status: test description: Detects when a process tries to access the memory of svchost to potentially dump credentials. references: - Internal Research author: Florent Labouyrie date: 2021-04-30 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548 logsource: product: windows category: process_access detection: selection: TargetImage|endswith: \svchost.exe GrantedAccess: '0x143a' filter_main_known_processes: SourceImage|endswith: - \services.exe - \msiexec.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface. Logsource: windows / process_creation. Rule: title: UAC Bypass via ICMLuaUtil id: 49f2f17b-b4c8-4172-a68b-d5bf95d05130 status: test description: Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface references: - https://www.elastic.co/guide/en/security/current/uac-bypass-via-icmluautil-elevated-com-interface.html author: Florian Roth (Nextron Systems), Elastic (idea) date: 2022-09-13 modified: 2022-09-27 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \dllhost.exe ParentCommandLine|contains: - /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} - /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937} filter: - Image|endswith: \WerFault.exe - OriginalFileName: WerFault.exe condition: selection and not filter falsepositives: - Unknown level: high