alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects the addition of a new Federated Domain.
Matching passage: Sigma rule: Detects the addition of a new Federated Domain.. Logsource: m365 / audit. Rule: title: New Federated Domain Added id: 58f88172-a73d-442b-94c9-95eaed3cbb36 related: - id: 42127bdd-9133-474f-a6f1-97b6c08a4339 type: similar status: test description: Detects the addition of a new Federated Domain. references: - https://research.splunk.com/cloud/e155876a-6048-11eb-ae93-0242ac130002/ - https://o365blog.com/post/aadbackdoor/ author: Splunk Threat Research Team (original rule), Harjot Singh @cyb3rjy0t (sigma rule) date: 2023-09-18 tags: - attack.privilege-escalation - attack.defense-impairment - attack.t1484.002 logsource: service: audit product: m365 detection: selection_domain: Operation|contains: domain selection_operation: Operation|contains: - add - new condition: all of selection_* falsepositives: - The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider. level: medium
Near-miss passage: Sigma rule: Remote.exe is part of WinDbg in the Windows SDK and can be used for AWL bypass and running remote files.. Logsource: windows / process_creation. Rule: title: Use of Remote.exe id: 4eddc365-79b4-43ff-a9d7-99422dc34b93 status: test description: Remote.exe is part of WinDbg in the Windows SDK and can be used for AWL bypass and running remote files. references: - https://blog.thecybersecuritytutor.com/Exeuction-AWL-Bypass-Remote-exe-LOLBin/ - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Remote/ author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io date: 2022-06-02 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \remote.exe - OriginalFileName: remote.exe condition: selection falsepositives: - Approved installs of Windows SDK with Debugging Tools for Windows (WinDbg). level: medium
Query: risk of Apache Ambari before 2.1, as used in IBM Infosphere BigInsights 4.x before 4.1, stores a cleartext BigSheets password in a configuration file, which allows local users to obtain se
Matching passage: CVE-2015-4940. CWE: CWE-200. CVSS: 2.0999999046325684. Apache Ambari before 2.1, as used in IBM Infosphere BigInsights 4.x before 4.1, stores a cleartext BigSheets password in a configuration file, which allows local users to obtain sensitive information by reading this file.
Near-miss passage: CVE-2015-4213. CWE: CWE-200. CVSS: 4.0. Cisco NX-OS 1.1(1g) on Nexus 9000 devices allows remote authenticated users to discover cleartext passwords by leveraging the existence of a decryption mechanism, aka Bug ID CSCuu84391.
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in data_point_details.shtm in Mango Automation 2.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML v
Matching passage: CVE-2015-1179. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in data_point_details.shtm in Mango Automation 2.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dpid, (2) dpxid, or (3) pid parameter.
Near-miss passage: CVE-2015-2317. CWE: CWE-79. CVSS: 4.300000190734863. The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL.
Query: exploit The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.
Matching passage: CVE-2015-9402. CWE: CWE-434. CVSS: 8.800000190734863. The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.
Near-miss passage: CVE-2015-3884. CWE: CWE-434. CVSS: 8.800000190734863. Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/attachments/ or uploads/users/.
Query: vulnerability: Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and A
Matching passage: CVE-2015-6684. CWE: CWE-416. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7615, CVE-2015-7617, and CVE-2015-7621.
Near-miss passage: CVE-2015-7621. CWE: CWE-416. CVSS: 6.800000190734863. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via a crafted U3D object, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7615, and CVE-2015-7617.
Query: Sigma rule for Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool. Xclip has to be
Matching passage: Sigma rule: Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool. Xclip has to be. Logsource: linux / auditd. Rule: title: Clipboard Collection of Image Data with Xclip Tool id: f200dc3f-b219-425d-a17e-c38467364816 status: test description: 'Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations. ' references: - https://linux.die.net/man/1/xclip author: Pawel Mazur date: 2021-10-01 modified: 2022-10-09 tags: - attack.collection - attack.t1115 logsource: product: linux service: auditd detection: selection: type: EXECVE a0: xclip a1: - -selection - -sel a2: - clipboard - clip a3: -t a4|startswith: image/ a5: -o condition: selection falsepositives: - Legitimate usage of xclip tools level: low
Near-miss passage: Sigma rule: Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles. Logsource: windows / process_access. Rule: title: HackTool - HandleKatz Duplicating LSASS Handle id: b1bd3a59-c1fd-4860-9f40-4dd161a7d1f5 status: test description: Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles references: - https://github.com/codewhitesec/HandleKatz author: Bhabesh Raj (rule), @thefLinkk date: 2022-06-27 modified: 2023-11-28 tags: - attack.execution - attack.t1106 - attack.t1003.001 - attack.credential-access logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe GrantedAccess: '0x1440' CallTrace|startswith: C:\Windows\System32\ntdll.dll+ CallTrace|contains: '|UNKNOWN(' CallTrace|endswith: ) condition: selection falsepositives: - Unknown level: high
Query: detect Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the networ in logs
Matching passage: Sigma rule: Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the networ. Logsource: windows / file_event. Rule: title: Wmiprvse Wbemcomn DLL Hijack - File id: 614a7e17-5643-4d89-b6fe-f9df1a79641c status: test description: Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario. references: - https://threathunterplaybook.com/hunts/windows/201009-RemoteWMIWbemcomnDLLHijack/notebook.html author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-12 modified: 2022-12-02 tags: - attack.execution - attack.t1047 - attack.lateral-movement - attack.t1021.002 logsource: product: windows category: file_event detection: selection: Image: System TargetFilename|endswith: \wbem\wbemcomn.dll condition: selection falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detect when users are authenticating without MFA being required.. Logsource: azure / signinlogs. Rule: title: Azure AD Only Single Factor Authentication Required id: 28eea407-28d7-4e42-b0be-575d5ba60b2c status: test description: Detect when users are authenticating without MFA being required. references: - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts author: MikeDuddington, '@dudders1' date: 2022-07-27 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.credential-access - attack.stealth - attack.defense-impairment - attack.t1078.004 - attack.t1556.006 logsource: product: azure service: signinlogs detection: selection: Status: Success AuthenticationRequirement: singleFactorAuthentication condition: selection falsepositives: - If this was approved by System Administrator. level: low
Query: detect Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc. in logs
Matching passage: Sigma rule: Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.. Logsource: windows / security. Rule: title: Suspicious Scheduled Task Creation id: 3a734d25-df5c-4b99-8034-af1ddb5883a4 status: test description: Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-05 modified: 2022-12-07 tags: - attack.execution - attack.privilege-escalation - attack.persistence - attack.t1053.005 logsource: product: windows service: security definition: The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data. detection: selection_eid: EventID: 4698 selection_paths: TaskContent|contains: - \AppData\Local\Temp\ - \AppData\Roaming\ - \Users\Public\ - \WINDOWS\Temp\ - C:\Temp\ - \Desktop\ - \Downloads\ - \Temporary Internet - C:\ProgramData\ - C:\Perflogs\ selection_commands: TaskContent|contains: - regsvr32 - rundll32 - cmd.exe</Command> - cmd</Command> - '<Arguments>/c ' - '<Arguments>/k ' - '<Arguments>/r ' - powershell - pwsh - mshta - wscript - cscript - certutil - bitsadmin - bash.exe - 'bash ' - scrcons - 'wmic ' - wmic.exe - forfiles - scriptrunner - hh.exe condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been. Logsource: aws / cloudtrail. Rule: title: New Network ACL Entry Added id: e1f7febb-7b94-4234-b5c6-00fb8500f5dd status: test description: 'Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been opened up in the AWS account. ' references: - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/ author: jamesc-grafana date: 2024-07-11 tags: - attack.defense-impairment - attack.t1686.001 logsource: product: aws service: cloudtrail detection: selection: eventSource: ec2.amazonaws.com eventName: CreateNetworkAclEntry condition: selection falsepositives: - Legitimate use of ACLs to enable customer and staff access from the public internet into a public VPC level: low
Query: exploit The cp-polls plugin before 1.0.5 for WordPress has XSS.
Matching passage: CVE-2015-9346. CWE: CWE-79. CVSS: 6.099999904632568. The cp-polls plugin before 1.0.5 for WordPress has XSS.
Near-miss passage: CVE-2015-3362. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Video module before 7.x-2.11 for Drupal, when using the video WYSIWYG plugin, allows remote authenticated users to inject arbitrary web script or HTML via a node title.
Query: risk of In all Qualcomm products with Android releases from CAF using the Linux kernel, a NULL pointer may be dereferenced in the front end.
Matching passage: CVE-2015-9038. CWE: CWE-476. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a NULL pointer may be dereferenced in the front end.
Near-miss passage: CVE-2015-9100. CWE: CWE-476. CVSS: 5.5. The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted audio file.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in IBM Tivoli Storage Manger for Virtual Environments: Data Protection for VMware 6.3 before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before 7.
Matching passage: CVE-2015-1988. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Tivoli Storage Manger for Virtual Environments: Data Protection for VMware 6.3 before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before 7.1.3 and Tivoli Storage FlashCopy Manager for VMware 3.1 before 3.1.1.3, 3.2 before 3.2.0.6, and 4.1 before 4.1.3.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-0298. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the manager web interface in mod_cluster before 1.3.2.Alpha1 allows remote attackers to inject arbitrary web script or HTML via a crafted MCMP message.
Query: patch priority for CVE-2015-6634
Matching passage: CVE-2015-6634. CWE: CWE-119. CVSS: 9.300000190734863. The display drivers in Android before 5.1.1 LMY48Z allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 24163261.
Near-miss passage: CVE-2015-7202. CWE: CWE-119. CVSS: 10.0. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Query: vulnerability: The TRE library in Libc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows context-dependent attackers to execute arbitrary code or cause a denial of service (memory corrupti
Matching passage: CVE-2015-3798. CWE: CWE-119. CVSS: 7.5. The TRE library in Libc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows context-dependent attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted regular expression, a different vulnerability than CVE-2015-3796 and CVE-2015-3797.
Near-miss passage: CVE-2015-9126. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, possible buffer overflow when processing 1X circuit service message.
Query: risk of The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 do not properly consider yielding a processor, which allows remote attackers to cause a denial 
Matching passage: CVE-2015-5364. CWE: CWE-399. CVSS: 7.800000190734863. The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 do not properly consider yielding a processor, which allows remote attackers to cause a denial of service (system hang) via incorrect checksums within a UDP packet flood.
Near-miss passage: CVE-2015-0048. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0028.
Query: mitigate File and Directory Discovery
Matching passage: T1083 File and Directory Discovery. Tactics: discovery. Description: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Many command shell utilities can be used to obtain this information. Examples include <code>dir</code>, <code>tree</code>, <code>ls</code>, <code>find</code>, and <code>locate</code>.(Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the [Native API](https://attack.mitre.org/techniques/T1106). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather file and directory information (e.g. <code>dir</code>, <code>show flash</code>, and/or <code>nvram</code>).(Citation: US-CERT-TA18-106A) Some files and directories may require elevated or specific user permissions to access.
Near-miss passage: T1120 Peripheral Device Discovery. Tactics: discovery. Description: Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.(Citation: Peripheral Discovery Linux)(Citation: Peripheral Discovery macOS) Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Query: vulnerability: Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect int
Matching passage: CVE-2015-0483. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect integrity via unknown vectors.
Near-miss passage: CVE-2015-0365. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Siebel Core - Server Infrastructure component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Security.
Query: describe CVE-2015-1000012
Matching passage: CVE-2015-1000012. CWE: CWE-200. CVSS: 7.5. Local File Inclusion Vulnerability in mypixs v0.3 wordpress plugin
Near-miss passage: CVE-2015-5340. CWE: CWE-200. CVSS: 4.300000190734863. Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not consider the moodle/badges:viewbadges capability, which allows remote authenticated users to obtain sensitive badge information via a request involving (1) badges/overview.php or (2) badges/view.php.
Query: describe CVE-2015-2204
Matching passage: CVE-2015-2204. CWE: CWE-200. CVSS: 7.5. Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to bypass an intended access restriction and obtain sensitive information about org unit settings by leveraging failure of open-ils.actor.ou_setting.ancestor_default to enforce view_perm when no auth token is provided.
Near-miss passage: CVE-2015-3187. CWE: CWE-200. CVSS: 4.0. The svn_repos_trace_node_locations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote authenticated users to obtain sensitive path information by reading the history of a node that has been moved from a hidden path.
Query: intelligence brief on T1102
Matching passage: T1102 Web Service. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: Broadcom BirdyClient Microsoft Graph API 2024) Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
Near-miss passage: T1102.001 Dead Drop Resolver. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
Query: CVE similar to CVE-2015-2940
Matching passage: CVE-2015-2940. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the CheckUser extension for MediaWiki allows remote attackers to hijack the authentication of certain users for requests that retrieve sensitive user information via unspecified vectors.
Near-miss passage: CVE-2015-5660. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.
Query: patch priority for CVE-2015-7979
Matching passage: CVE-2015-7979. CWE: CWE-19. CVSS: 7.5. NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server association tear down) by sending broadcast packets with invalid authentication to a broadcast client.
Near-miss passage: CVE-2015-0613. CWE: CWE-19. CVSS: 7.099999904632568. The Connection Conversation Manager (aka CuCsMgr) process in Cisco Unity Connection 8.5 before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, 9.x before 9.1(2)SU2, and 10.0 before 10.0(1)SU1, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (core dump and restart) via crafted SIP INVITE messages, aka Bug ID CSCul20444.