alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-9462
Matching passage: CVE-2015-9462. CWE: CWE-89. CVSS: 7.199999809265137. The awesome-filterable-portfolio plugin before 1.9 for WordPress has afp_get_new_category_page SQL injection via the cat_id parameter.
Near-miss passage: CVE-2015-10017. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability has been found in HPI-Information-Systems ProLOD and classified as critical. This vulnerability affects unknown code. The manipulation of the argument this leads to sql injection. The name of the patch is 3f710905458d49c77530bd3cbcd8960457566b73. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217552.
Query: detection rule: Detects installation of new certificate on the system which attackers may use to avoid warnings when connecting to contr
Matching passage: Sigma rule: Detects installation of new certificate on the system which attackers may use to avoid warnings when connecting to contr. Logsource: linux / process_creation. Rule: title: Install Root Certificate id: 78a80655-a51e-4669-bc6b-e9d206a462ee status: test description: Detects installation of new certificate on the system which attackers may use to avoid warnings when connecting to controlled web servers or C2s references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md author: Ömer Günal, oscd.community date: 2020-10-05 modified: 2022-07-07 tags: - attack.defense-impairment - attack.t1553.004 logsource: product: linux category: process_creation detection: selection: Image|endswith: - /update-ca-certificates - /update-ca-trust condition: selection falsepositives: - Legitimate administration activities level: low
Near-miss passage: Sigma rule: Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Firewall Rule Collection Modified or Deleted id: 025c9fe7-db72-49f9-af0d-31341dd7dd57 status: test description: Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-08-08 modified: 2022-08-23 tags: - attack.impact - attack.defense-impairment - attack.t1686.001 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.NETWORK/AZUREFIREWALLS/APPLICATIONRULECOLLECTIONS/WRITE - MICROSOFT.NETWORK/AZUREFIREWALLS/APPLICATIONRULECOLLECTIONS/DELETE - MICROSOFT.NETWORK/AZUREFIREWALLS/NATRULECOLLECTIONS/WRITE - MICROSOFT.NETWORK/AZUREFIREWALLS/NATRULECOLLECTIONS/DELETE - MICROSOFT.NETWORK/AZUREFIREWALLS/NETWORKRULECOLLECTIONS/WRITE - MICROSOFT.NETWORK/AZUREFIREWALLS/NETWORKRULECOLLECTIONS/DELETE condition: selection falsepositives: - Rule Collections (Application, NAT, and Network) being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Rule Collections (Application, NAT, and Network) modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: CVE similar to CVE-2015-0210
Matching passage: CVE-2015-0210. CWE: CWE-295. CVSS: 5.900000095367432. wpa_supplicant 2.0-16 does not properly check certificate subject name, which allows remote attackers to cause a man-in-the-middle attack.
Near-miss passage: CVE-2015-5619. CWE: CWE-295. CVSS: 5.900000095367432. Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumberjack output or the Logstash forwarder does not validate SSL/TLS certificates from the Logstash server, which might allow attackers to obtain sensitive information via a man-in-the-middle attack.
Query: weakness Improper Restriction of Communication Channel to Intended Endpoints
Matching passage: CWE-923 Improper Restriction of Communication Channel to Intended Endpoints. The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
Near-miss passage: CWE-863 Incorrect Authorization. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Query: alert when Detects connections from routable IPs to an RDP listener. Which is indicative of a publicly-accessible RDP service.
Matching passage: Sigma rule: Detects connections from routable IPs to an RDP listener. Which is indicative of a publicly-accessible RDP service.. Logsource: zeek / rdp. Rule: title: Publicly Accessible RDP Service id: 1fc0809e-06bf-4de3-ad52-25e5263b7623 status: test description: 'Detects connections from routable IPs to an RDP listener. Which is indicative of a publicly-accessible RDP service. ' author: Josh Brower @DefensiveDepth date: 2020-08-22 modified: 2024-03-13 tags: - attack.lateral-movement - attack.t1021.001 logsource: product: zeek service: rdp detection: selection: id.orig_h|cidr: - ::1/128 - 10.0.0.0/8 - 127.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - 2620:83:8000::/48 - fc00::/7 - fe80::/10 condition: not selection falsepositives: - Although it is recommended to NOT have RDP exposed to the internet, verify that this is a) allowed b) the server has not already been compromised via some brute force or remote exploit since it has been exposed to the internet. Work to secure the server if you are unable to remove it from being exposed to the internet. level: high
Near-miss passage: Sigma rule: Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library.. Logsource: windows / process_creation. Rule: title: Code Execution via Pcwutl.dll id: 9386d78a-7207-4048-9c9f-a93a7c2d1c05 status: test description: Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library. references: - https://lolbas-project.github.io/lolbas/Libraries/Pcwutl/ - https://twitter.com/harr0ey/status/989617817849876488 author: Julia Fomina, oscd.community date: 2020-10-05 modified: 2023-02-09 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|contains|all: - pcwutl - LaunchApplication condition: all of selection_* falsepositives: - Use of Program Compatibility Troubleshooter Helper level: medium
Query: describe CVE-2015-4749
Matching passage: CVE-2015-4749. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect availability via vectors related to JNDI.
Near-miss passage: CVE-2015-7636. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.
Query: detection rule: Detects the stopping of a Windows service via the "sc.exe" utility
Matching passage: Sigma rule: Detects the stopping of a Windows service via the "sc.exe" utility. Logsource: windows / process_creation. Rule: title: Stop Windows Service Via Sc.EXE id: 81bcb81b-5b1f-474b-b373-52c871aaa7b1 related: - id: eb87818d-db5d-49cc-a987-d5da331fbd90 type: obsolete status: test description: Detects the stopping of a Windows service via the "sc.exe" utility references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc742107(v=ws.11) author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2023-03-05 modified: 2024-01-18 tags: - attack.impact - attack.t1489 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: sc.exe - Image|endswith: \sc.exe selection_cli: CommandLine|contains: ' stop ' condition: all of selection_* falsepositives: - There are many legitimate reasons to stop a service. This rule isn't looking for any suspicious behavior in particular. Filter legitimate activity accordingly level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_sc_stop_service/info.yml
Near-miss passage: Sigma rule: Detects the execution of the nscurl utility in order to download files.. Logsource: macos / process_creation. Rule: title: File Download Via Nscurl - MacOS id: 6d8a7cf1-8085-423b-b87d-7e880faabbdf status: test description: Detects the execution of the nscurl utility in order to download files. references: - https://www.loobins.io/binaries/nscurl/ - https://www.agnosticdev.com/content/how-diagnose-app-transport-security-issues-using-nscurl-and-openssl - https://gist.github.com/nasbench/ca6ef95db04ae04ffd1e0b1ce709cadd author: Daniel Cortez date: 2024-06-04 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: macos detection: selection: Image|endswith: /nscurl CommandLine|contains: - '--download ' - '--download-directory ' - '--output ' - '-dir ' - '-dl ' - -ld - '-o ' condition: selection falsepositives: - Legitimate usage of nscurl by administrators and users. level: medium
Query: detect Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .N in logs
Matching passage: Sigma rule: Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .N. Logsource: windows / ps_script. Rule: title: Registry-Free Process Scope COR_PROFILER id: 23590215-4702-4a70-8805-8dc9e58314a2 status: test description: 'Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR. (Citation: Microsoft Profiling Mar 2017) (Citation: Microsoft COR_PROFILER Feb 2013) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.012/T1574.012.md#atomic-test-3---registry-free-process-scope-cor_profiler author: frack113 date: 2021-12-30 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.012 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - $env:COR_ENABLE_PROFILING - $env:COR_PROFILER - $env:COR_PROFILER_PATH condition: selection falsepositives: - Legitimate administrative script level: medium
Near-miss passage: Sigma rule: Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only availab. Logsource: windows / process_creation. Rule: title: Suspicious Service DACL Modification Via Set-Service Cmdlet id: a95b9b42-1308-4735-a1af-abb1c5e6f5ac related: - id: 99cf1e02-00fb-4c0d-8375-563f978dfd37 type: derived status: test description: Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only available with PowerShell 7) that can be used to hide services or make them unstopable references: - https://www.sans.org/blog/red-team-tactics-hiding-windows-services/ - https://learn.microsoft.com/pt-br/windows/win32/secauthz/sid-strings author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-18 tags: - attack.privilege-escalation - attack.persistence - attack.t1543.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \pwsh.exe - OriginalFileName: pwsh.dll selection_sddl_flag: CommandLine|contains: - '-SecurityDescriptorSddl ' - '-sd ' selection_set_service: CommandLine|contains|all: - 'Set-Service ' - D;; CommandLine|contains: - ;;;IU - ;;;SU - ;;;BA - ;;;SY - ;;;WD condition: all of selection_* falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-5570
Matching passage: CVE-2015-5570. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5574, CVE-2015-5581, CVE-2015-5584, and CVE-2015-6682.
Near-miss passage: CVE-2015-2112. CWE: UNKNOWN. CVSS: 9.0. Unspecified vulnerability in HP Easy Deploy, as distributed standalone and in HP Easy Tools before 3.0.1.1650, on HP Thin Client t5540, t5740, and t5740e devices and HP Flexible Thin Client t510, t520, t610, t620, and t820 devices allows remote authenticated users to execute arbitrary code via unknown vectors.
Query: exploit Cisco NX-OS 5.2(5) on Nexus 7000 devices allows remote attackers to cause a denial of service (device crash) by sending a malformed LLDP packet on the local network, aka Bug ID CSC
Matching passage: CVE-2015-4197. CWE: CWE-20. CVSS: 6.099999904632568. Cisco NX-OS 5.2(5) on Nexus 7000 devices allows remote attackers to cause a denial of service (device crash) by sending a malformed LLDP packet on the local network, aka Bug ID CSCud89415.
Near-miss passage: CVE-2015-8217. CWE: CWE-20. CVSS: 7.5. The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in FFmpeg before 2.8.2 does not validate the Chroma Format Indicator, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted High Efficiency Video Coding (HEVC) data.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.. Logsource: windows / process_creation. Rule: title: Scheduled Task Creation Via Schtasks.EXE id: 92626ddd-662c-49e3-ac59-f6535f12d189 status: test description: Detects the creation of scheduled tasks by user accounts via the "schtasks" utility. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create author: Florian Roth (Nextron Systems) date: 2019-01-16 modified: 2025-10-22 tags: - attack.execution - attack.persistence - attack.privilege-escalation - attack.t1053.005 - attack.s0111 - car.2013-08-001 - stp.1u logsource: category: process_creation product: windows detection: selection: Image|endswith: \schtasks.exe CommandLine|contains: ' /create ' filter_main_system_user: User|contains: - AUTHORI - AUTORI filter_optional_msoffice: ParentImage: - C:\Program Files\Microsoft Office\root\integration\integrator.exe - C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe Image: - C:\Windows\System32\schtasks.exe - C:\Windows\SysWOW64\schtasks.exe CommandLine|contains: Microsoft\Office\Office Performance Monitor condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Administrative activity - Software installation level: low
Near-miss passage: Sigma rule: Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse pro. Logsource: linux / network_connection. Rule: title: Communication To LocaltoNet Tunneling Service Initiated - Linux id: c4568f5d-131f-4e78-83d4-45b2da0ec4f1 status: test description: 'Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls. ' references: - https://localtonet.com/documents/supported-tunnels - https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications author: Andreas Braathen (mnemonic.io) date: 2024-06-17 tags: - attack.command-and-control - attack.t1572 - attack.t1090 - attack.t1102 logsource: category: network_connection product: linux detection: selection: DestinationHostname|endswith: - .localto.net - .localtonet.com Initiated: 'true' condition: selection falsepositives: - Legitimate use of the LocaltoNet service. level: high
Query: CVE similar to CVE-2015-1427
Matching passage: CVE-2015-1427. CWE: UNKNOWN. CVSS: 9.800000190734863. The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
Near-miss passage: CVE-2015-2812. CWE: UNKNOWN. CVSS: 5.0. XML external entity (XXE) vulnerability in XMLValidationComponent in SAP NetWeaver Portal 7.31.201109172004 allows remote attackers to send requests to intranet servers via crafted XML, aka SAP Security Note 2093966.
Query: patch priority for CVE-2015-4917
Matching passage: CVE-2015-4917. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 allows remote authenticated users to affect integrity via unknown vectors related to Security, a different vulnerability than CVE-2015-4892.
Near-miss passage: CVE-2015-0417. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Portal Framework, a different vulnerability than CVE-2015-0388.
Query: CVE similar to CVE-2015-6171
Matching passage: CVE-2015-6171. CWE: CWE-264. CVSS: 7.199999809265137. The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-6173 and CVE-2015-6174.
Near-miss passage: CVE-2015-3865. CWE: CWE-264. CVSS: 9.300000190734863. The Runtime subsystem in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23050463.
Query: detection rule: Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.
Matching passage: Sigma rule: Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.. Logsource: windows / registry_set. Rule: title: PowerShell Script Execution Policy Enabled id: 8218c875-90b9-42e2-b60d-0b0069816d10 related: - id: fad91067-08c5-4d1a-8d8c-d96a21b37814 type: derived status: test description: Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed. references: - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.PowerShell::EnableScripts author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo date: 2023-10-18 tags: - attack.execution logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Policies\Microsoft\Windows\PowerShell\EnableScripts Details: DWORD (0x00000001) condition: selection falsepositives: - Likely level: low
Near-miss passage: Sigma rule: Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately. Logsource: azure / auditlogs. Rule: title: Azure Subscription Permission Elevation Via AuditLogs id: ca9bf243-465e-494a-9e54-bf9fc239057d status: test description: 'Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn''t planned. This setting could allow an attacker access to Azure subscriptions in your environment. ' references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#assignment-and-elevation author: Austin Songer @austinsonger date: 2021-11-26 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 logsource: product: azure service: auditlogs detection: selection: Category: Administrative OperationName: Assigns the caller to user access admin condition: selection falsepositives: - If this was approved by System Administrator. level: high
Query: describe CVE-2015-1363
Matching passage: CVE-2015-1363. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Free Reprintables ArticleFR 3.0.5 allows remote attackers to inject arbitrary web script or HTML via the q parameter to search/v/.
Near-miss passage: CVE-2015-9468. CWE: CWE-79. CVSS: 6.099999904632568. The broken-link-manager plugin 0.4.5 for WordPress has XSS via the page parameter in a delURL action.
Query: explain CWE-196
Matching passage: CWE-196 Unsigned to Signed Conversion Error. The product uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value if the value of the unsigned primitive can not be represented using a signed primitive.
Near-miss passage: CWE-390 Detection of Error Condition Without Action. The product detects a specific error, but takes no actions to handle the error.
Query: detect Detects when the "Windows Defender Threat Protection" service is disabled. in logs
Matching passage: Sigma rule: Detects when the "Windows Defender Threat Protection" service is disabled.. Logsource: windows / system. Rule: title: Windows Defender Threat Detection Service Disabled id: 6c0a7755-6d31-44fa-80e1-133e57752680 related: - id: fe34868f-6e0e-4882-81f6-c43aa8f15b62 type: derived status: stable description: Detects when the "Windows Defender Threat Protection" service is disabled. references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md author: Ján Trenčanský, frack113 date: 2020-07-28 modified: 2024-07-02 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: system detection: selection: EventID: 7036 Provider_Name: Service Control Manager param1: - Windows Defender Antivirus Service - Service antivirus Microsoft Defender param2: - stopped - arrêté condition: selection falsepositives: - Administrator actions - Auto updates of Windows Defender causes restarts level: medium
Near-miss passage: Sigma rule: Detect failed attempts to sign in to disabled accounts.. Logsource: azure / signinlogs. Rule: title: Login to Disabled Account id: 908655e0-25cf-4ae1-b775-1c8ce9cf43d8 status: test description: Detect failed attempts to sign in to disabled accounts. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts author: AlertIQ date: 2021-10-10 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078.004 logsource: product: azure service: signinlogs detection: selection: ResultType: 50057 ResultDescription: User account is disabled. The account has been disabled by an administrator. condition: selection falsepositives: - Unknown level: medium