alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for macos / process_creation
Matching passage: Sigma rule: Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect u. Logsource: macos / process_creation. Rule: title: Binary Padding - MacOS id: 95361ce5-c891-4b0a-87ca-e24607884a96 status: test description: Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.001/T1027.001.md - https://linux.die.net/man/1/truncate - https://linux.die.net/man/1/dd author: Igor Fits, Mikhail Larin, oscd.community date: 2020-10-19 modified: 2023-02-17 tags: - attack.stealth - attack.t1027.001 logsource: product: macos category: process_creation detection: selection_truncate: Image|endswith: /truncate CommandLine|contains: -s + selection_dd: Image|endswith: /dd CommandLine|contains: - if=/dev/zero - if=/dev/random - if=/dev/urandom condition: 1 of selection_* falsepositives: - Legitimate script work level: high
Near-miss passage: Sigma rule: Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Win. Logsource: windows / registry_set. Rule: title: Winlogon Notify Key Logon Persistence id: bbf59793-6efb-4fa1-95ca-a7d288e52c88 status: test description: 'Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.004/T1547.004.md#atomic-test-3---winlogon-notify-key-logon-persistence---powershell author: frack113 date: 2021-12-30 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.004 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logon Details|endswith: .dll condition: selection falsepositives: - Unknown level: high
Query: SOC runbook when seeing EDR alert: possible Safe Mode Boot (T1688)
Matching passage: Playbook for T1688 Safe Mode Boot. 1) Validate alert telemetry against T1688. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: defense impairment. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start add
Near-miss passage: Playbook for T1556.005 Reversible Encryption. Different response path focused on defense impairment, persistence, credential access.
Query: secure coding against Always-Incorrect Control Flow Implementation
Matching passage: CWE-670 Always-Incorrect Control Flow Implementation. The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
Near-miss passage: CWE-194 Unexpected Sign Extension. The product performs an operation on a number that causes it to be sign extended when it is transformed into a larger data type. When the original number is negative, this can produce unexpected values that lead to resultant weaknesses.
Query: explain CWE-572
Matching passage: CWE-572 Call to Thread run() instead of start(). The product calls a thread's run() method instead of calling start(), which causes the code to run in the thread of the caller instead of the callee.
Near-miss passage: CWE-440 Expected Behavior Violation. A feature, API, or function does not perform according to its specification.
Query: patch priority for CVE-2015-3942
Matching passage: CVE-2015-3942. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the web-server component in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-3397. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6 or 7.
Query: exploit The Hotspot component in OpenJDK8 as packaged in Red Hat Enterprise Linux 6 and 7 allows local users to write to arbitrary files via a symlink attack.
Matching passage: CVE-2015-3149. CWE: CWE-59. CVSS: 5.5. The Hotspot component in OpenJDK8 as packaged in Red Hat Enterprise Linux 6 and 7 allows local users to write to arbitrary files via a symlink attack.
Near-miss passage: CVE-2015-3156. CWE: CWE-59. CVSS: 5.5. The _write_config function in trove/guestagent/datastore/experimental/mongodb/service.py, reset_configuration function in trove/guestagent/datastore/experimental/postgresql/service/config.py, write_config function in trove/guestagent/datastore/experimental/redis/service.py, _write_mycnf function in trove/guestagent/datastore/mysql/service.py, InnoBackupEx::_run_prepare function in trove/guestagent/strategies/restore/mysql_impl.py, InnoBackupEx::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, MySQLDump::cmd in trove/guestagent/strategies/backup/mysql_impl.py, InnoBackupExIncremental::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, _get_actual_db_status function in trove/guestagent/datastore/experimental/cassandra/system.py and trove/guestagent/datastore/experimental/cassandra/service.py, and multiple class CbBackup methods in trove/guestagent/strategies/backup/experimental/couchbase_impl.py in Openstack DBaaS (aka Trove) as packaged in Openstack before 2015.1.0 (aka Kilo) allows local users to write to configuration files via a symlink attack on a temporary file.
Query: Sigma rule for Detects the removal of a previously installed IIS module.
Matching passage: Sigma rule: Detects the removal of a previously installed IIS module.. Logsource: windows / iis-configuration. Rule: title: Previously Installed IIS Module Was Removed id: 9e1a1fdf-ee58-40ce-8e15-b66ca5a80e1f status: test description: Detects the removal of a previously installed IIS module. references: - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/ - https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/ - https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview author: Nasreddine Bencherchali date: 2024-10-06 tags: - attack.persistence - attack.defense-impairment - attack.t1685.001 - attack.t1505.004 logsource: product: windows service: iis-configuration detection: selection: EventID: 29 Configuration|contains: /system.webServer/modules/remove condition: selection falsepositives: - Legitimate administrator activity level: low
Near-miss passage: Sigma rule: Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for. Logsource: windows / driver_load. Rule: title: Vulnerable HackSys Extreme Vulnerable Driver Load id: 295c9289-acee-4503-a571-8eacaef36b28 status: test description: Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors references: - https://github.com/hacksysteam/HackSysExtremeVulnerableDriver author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-18 modified: 2024-11-23 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: product: windows category: driver_load detection: selection: - ImageLoaded|endswith: \HEVD.sys - Hashes|contains: - IMPHASH=f26d0b110873a1c7d8c4f08fbeab89c5 - IMPHASH=c46ea2e651fd5f7f716c8867c6d13594 condition: selection falsepositives: - Unlikely level: high
Query: explain CWE-1266
Matching passage: CWE-1266 Improper Scrubbing of Sensitive Data from Decommissioned Device. The product does not properly provide a capability for the product administrator to remove sensitive data at the time the product is decommissioned. A scrubbing capability could be missing, insufficient, or incorrect.
Near-miss passage: CWE-663 Use of a Non-reentrant Function in a Concurrent Context. The product calls a non-reentrant function in a concurrent context in which a competing code sequence (e.g. thread or signal handler) may have an opportunity to call the same function or otherwise influence its state.
Query: CWE for Suspicious Comment
Matching passage: CWE-546 Suspicious Comment. The code contains comments that suggest the presence of bugs, incomplete functionality, or weaknesses.
Near-miss passage: CWE-433 Unparsed Raw Web Content Delivery. The product stores raw content or supporting code under the web document root with an extension that is not specifically handled by the server.
Query: common weakness: Inefficient CPU Computation
Matching passage: CWE-1176 Inefficient CPU Computation. The product performs CPU computations using algorithms that are not as efficient as they could be for the needs of the developer, i.e., the computations can be optimized further.
Near-miss passage: CWE-173 Improper Handling of Alternate Encoding. The product does not properly handle when an input uses an alternate encoding that is valid for the control sphere to which the input is being sent.
Query: patch priority for CVE-2015-7931
Matching passage: CVE-2015-7931. CWE: CWE-20. CVSS: 8.699999809265137. The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station does not authenticate the station device, which allows man-in-the-middle attackers to spoof devices and obtain sensitive information by reading cleartext packet data, related to the lack of SSL support.
Near-miss passage: CVE-2015-4992. CWE: CWE-20. CVSS: 3.5. IBM Sterling B2B Integrator 5.2 before 5020500_8 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors.
Query: vulnerability: Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. 
Matching passage: CVE-2015-5211. CWE: CWE-552. CVSS: 9.600000381469727. Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.
Near-miss passage: CVE-2015-4715. CWE: CWE-552. CVSS: 4.900000095367432. The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been mounted, allows remote administrators of Dropbox.com to read arbitrary files via an @ (at sign) character in unspecified POST values.
Query: risk of Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before
Matching passage: CVE-2015-8126. CWE: CWE-120. CVSS: 7.5. Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.
Near-miss passage: CVE-2015-7854. CWE: CWE-120. CVSS: 8.800000190734863. Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted key file.
Query: detection rule: Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like
Matching passage: Sigma rule: Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like. Logsource: windows / security. Rule: title: RottenPotato Like Attack Pattern id: 16f5d8ca-44bd-47c8-acbe-6fc95a16c12f status: test description: Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like references: - https://twitter.com/SBousseaden/status/1195284233729777665 author: '@SBousseaden, Florian Roth' date: 2019-11-15 modified: 2022-12-22 tags: - attack.collection - attack.privilege-escalation - attack.credential-access - attack.t1557.001 logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 3 TargetUserName: ANONYMOUS LOGON WorkstationName: '-' IpAddress: - 127.0.0.1 - ::1 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility.. Logsource: windows / ps_module. Rule: title: HackTool - Evil-WinRm Execution - PowerShell Module id: 9fe55ea2-4cd6-4491-8a54-dd6871651b51 status: test description: 'Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility. ' references: - https://github.com/Hackplayers/evil-winrm/blob/7514b055d67ec19836e95c05bd63e7cc47c4c2aa/evil-winrm.rb - https://github.com/search?q=repo%3AHackplayers%2Fevil-winrm++shell.run%28&type=code author: Nasreddine Bencherchali (Nextron Systems) date: 2024-02-25 tags: - attack.lateral-movement logsource: product: windows category: ps_module detection: selection_wsm: ContextInfo|contains: - :\Windows\System32\wsmprovhost.exe - :\Windows\SysWOW64\wsmprovhost.exe selection_payload_1: Payload|contains: - value="(get-location).path - value="(get-item*).length - 'Invoke-Binary ' - Donut-Loader -process_id*-donutfile - Bypass-4MSI - IEX ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($a))).replace('???','') selection_payload_2: Payload|contains|all: - $servicios = Get-ItemProperty "registry::HKLM\System\CurrentControlSet\Services\" - Where-Object {$_.imagepath -notmatch "system" -and $_.imagepath -ne $null } | Select-Object pschildname,imagepath selection_payload_3: Payload|contains|all: - $a += \"$($_.FullName.Replace('\\','/'))/\"}else{ $a += \"$($_.FullName.Replace('\\', '/'))\" } - $a=@();$ condition: selection_wsm and 1 of selection_payload_* falsepositives: - Unknown level: high
Query: vulnerability: Heap-based buffer overflow in the Archive support module in ESET NOD32 before update 11861 allows remote attackers to execute arbitrary code via a large number of languages in an E
Matching passage: CVE-2015-8841. CWE: CWE-787. CVSS: 9.800000190734863. Heap-based buffer overflow in the Archive support module in ESET NOD32 before update 11861 allows remote attackers to execute arbitrary code via a large number of languages in an EPOC installation file of type SIS_FILE_MULTILANG.
Near-miss passage: CVE-2015-5098. CWE: CWE-787. CVSS: 10.0. Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5096 and CVE-2015-5105.
Query: SOC runbook when seeing Persistence mechanism resembling PowerShell Profile
Matching passage: Playbook for T1546.013 PowerShell Profile. 1) Validate alert telemetry against T1546.013. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: privilege escalation, persistence. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles. A PowerShell profile (<code>profile.ps1</code>) is a script that runs when [PowerShell](https://attack.mitre.org/techniques/T1059/001) starts and can be used as a logon script to customize user environments. [PowerShell](https://attack.mitre.org/techniques/T1059/001) supports se
Near-miss passage: Playbook for T1546.008 Accessibility Features. Different response path focused on privilege escalation, persistence.
Query: CVE similar to CVE-2015-4958
Matching passage: CVE-2015-4958. CWE: CWE-200. CVSS: 3.299999952316284. IBM InfoSphere Master Data Management - Collaborative Edition 9.1, 10.1, 11.0 before 11.0.0.0 IF11, 11.3 before 11.3.0.0 IF7, and 11.4 before 11.4.0.4 IF1 does not properly restrict browser caching, which allows local users to obtain sensitive information by reading cache files.
Near-miss passage: CVE-2015-5288. CWE: CWE-200. CVSS: 6.400000095367432. The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause a denial of service (server crash) or read arbitrary server memory via a "too-short" salt.
Query: exploit Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote attacke
Matching passage: CVE-2015-2733. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote attackers to execute arbitrary code via vectors involving attachment of an XMLHttpRequest object to a dedicated worker.
Near-miss passage: CVE-2015-2619. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 7u80 and 8u45, JavaFX 2.2.80, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via unknown vectors related to 2D.
Query: patch priority for CVE-2015-4990
Matching passage: CVE-2015-4990. CWE: CWE-200. CVSS: 4.0. The portal in IBM Tealeaf Customer Experience before 8.7.1.8818, 8.8 before 8.8.0.9026, 9.0.0, 9.0.0A, 9.0.1 before 9.0.1.1083, 9.0.1A before 9.0.1.5073, 9.0.2 before 9.0.2.1095, and 9.0.2A before 9.0.2.5144 allows local users to discover credentials by leveraging privileges during an unspecified connection type.
Near-miss passage: CVE-2015-0178. CWE: CWE-200. CVSS: 4.300000190734863. The Java overlay feature in IBM Bluemix Liberty before 1.13-20150209-1122 for Java does not properly support WAR applications, which allows remote attackers to obtain sensitive information via unspecified vectors.
Query: secure coding against Privilege Defined With Unsafe Actions
Matching passage: CWE-267 Privilege Defined With Unsafe Actions. A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.
Near-miss passage: CWE-1312 Missing Protection for Mirrored Regions in On-Chip Fabric Firewall. The firewall in an on-chip fabric protects the main addressed region, but it does not protect any mirrored memory or memory-mapped-IO (MMIO) regions.
Query: Sigma rule for See what commands are being input into the device by other people, full credentials can be in the history
Matching passage: Sigma rule: See what commands are being input into the device by other people, full credentials can be in the history. Logsource: cisco / aaa. Rule: title: Cisco Show Commands Input id: b094d9fb-b1ad-4650-9f1a-fb7be9f1d34b status: test description: See what commands are being input into the device by other people, full credentials can be in the history author: Austin Clark date: 2019-08-11 modified: 2023-01-04 tags: - attack.credential-access - attack.t1552.003 logsource: product: cisco service: aaa detection: keywords: - show history - show history all - show logging condition: keywords falsepositives: - Not commonly run by administrators, especially if remote logging is configured level: medium
Near-miss passage: Sigma rule: Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.. Logsource: azure / riskdetection. Rule: title: Malicious IP Address Sign-In Suspicious id: 36440e1c-5c22-467a-889b-593e66498472 status: test description: Indicates sign-in from a malicious IP address known to be malicious at time of sign-in. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malicious-ip-address - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-07 tags: - attack.t1090 - attack.command-and-control logsource: product: azure service: riskdetection detection: selection: riskEventType: suspiciousIPAddress condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Query: CVE similar to CVE-2015-5955
Matching passage: CVE-2015-5955. CWE: CWE-522. CVSS: 5.0. ownCloud iOS app before 3.4.4 does not properly switch state between multiple instances, which might allow remote instance administrators to obtain sensitive credential and cookie information by reading authentication headers.
Near-miss passage: CVE-2015-7546. CWE: CWE-522. CVSS: 7.5. The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) before 1.5.4 (Kilo) and Liberty before 2.3.3 does not properly invalidate authorization tokens when using the PKI or PKIZ token providers, which allows remote authenticated users to bypass intended access restrictions and gain access to cloud resources by manipulating byte fields within a revoked token.