alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects Obfuscated use of Clip.exe to execute PowerShell
Matching passage: Sigma rule: Detects Obfuscated use of Clip.exe to execute PowerShell. Logsource: windows / process_creation. Rule: title: Invoke-Obfuscation CLIP+ Launcher id: b222df08-0e07-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of Clip.exe to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-13 modified: 2022-11-17 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - cmd - '&&' - 'clipboard]::' - -f CommandLine|contains: - /c - /r condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious PowerShell invocation command parameters. Logsource: windows / process_creation. Rule: title: Suspicious PowerShell Invocations - Specific - ProcessCreation id: 536e2947-3729-478c-9903-745aaffe60d2 related: - id: fce5f582-cc00-41e1-941a-c6fabf0fdb8c type: obsolete - id: ae7fbf8e-f3cb-49fd-8db4-5f3bed522c71 type: similar - id: 8ff28fdd-e2fa-4dfa-aeda-ef3d61c62090 type: similar status: test description: Detects suspicious PowerShell invocation command parameters references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-05 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_convert_b64: CommandLine|contains|all: - -nop - ' -w ' - hidden - ' -c ' - '[Convert]::FromBase64String' selection_iex: CommandLine|contains|all: - ' -w ' - hidden - -noni - -nop - ' -c ' - iex - New-Object selection_enc: CommandLine|contains|all: - ' -w ' - hidden - -ep - bypass - -Enc selection_reg: CommandLine|contains|all: - powershell - reg - add - \software\ selection_webclient: CommandLine|contains|all: - bypass - -noprofile - -windowstyle - hidden - new-object - system.net.webclient - .download selection_iex_webclient: CommandLine|contains|all: - iex - New-Object - Net.WebClient - .Download filter_chocolatey: CommandLine|contains: - (New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1 - Write-ChocolateyWarning condition: 1 of selection_* and not 1 of filter_* falsepositives: - Unknown level: medium
Query: describe CVE-2015-1902
Matching passage: CVE-2015-1902. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in IBM Domino 8.5 before 8.5.3 FP6 IF7 and 9.0 before 9.0.1 FP3 IF3 allows remote attackers to execute arbitrary code via a crafted BMP image, aka SPR KLYH9TSMLA.
Near-miss passage: CVE-2015-6075. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6068, CVE-2015-6072, CVE-2015-6073, CVE-2015-6077, CVE-2015-6079, CVE-2015-6080, and CVE-2015-6082.
Query: alert when Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitra
Matching passage: Sigma rule: Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitra. Logsource: windows / image_load. Rule: title: Potential Mfdetours.DLL Sideloading id: d2605a99-2218-4894-8fd3-2afb7946514d status: test description: Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution. references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-03 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \mfdetours.dll filter_main_legit_path: ImageLoaded|contains: :\Program Files (x86)\Windows Kits\10\bin\ condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Exports the target Registry key and hides it in the specified alternate data stream.. Logsource: windows / create_stream_hash. Rule: title: Exports Registry Key To an Alternate Data Stream id: 0d7a9363-af70-4e7b-a3b7-1a176b7fbe84 status: test description: Exports the target Registry key and hides it in the specified alternate data stream. references: - https://lolbas-project.github.io/lolbas/Binaries/Regedit/ - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f author: Oddvar Moe, Sander Wiebing, oscd.community date: 2020-10-07 modified: 2021-11-27 tags: - attack.stealth - attack.t1564.004 logsource: product: windows category: create_stream_hash detection: selection: Image|endswith: \regedit.exe condition: selection falsepositives: - Unknown level: high
Query: risk of Cross-site scripting (XSS) vulnerability in VMware vRealize Automation 6.x before 6.2.4 on Linux allows remote authenticated users to inject arbitrary web script or HTML via unspec
Matching passage: CVE-2015-2344. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in VMware vRealize Automation 6.x before 6.2.4 on Linux allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-0917. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the backend in Kajona before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the action parameter to index.php.
Query: secure coding against Use of Obsolete Function
Matching passage: CWE-477 Use of Obsolete Function. The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
Near-miss passage: CWE-483 Incorrect Block Delimitation. The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error.
Query: risk of Microsoft Active Directory Federation Services (AD FS) 3.0 on Windows Server 2012 R2 does not properly handle logoff actions, which allows remote attackers to bypass intended acces
Matching passage: CVE-2015-1638. CWE: CWE-264. CVSS: 5.800000190734863. Microsoft Active Directory Federation Services (AD FS) 3.0 on Windows Server 2012 R2 does not properly handle logoff actions, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation, aka "Active Directory Federation Services Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-4225. CWE: CWE-264. CVSS: 4.0. Cisco Application Policy Infrastructure Controller (APIC) 1.0(1.110a) and 1.0(1e) on Nexus 9000 devices does not properly implement RBAC health scoring, which allows remote authenticated users to obtain sensitive information via unspecified vectors, aka Bug ID CSCuq77485.
Query: CVE similar to CVE-2015-9012
Matching passage: CVE-2015-9012. CWE: CWE-264. CVSS: 9.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384691.
Near-miss passage: CVE-2015-7788. CWE: CWE-264. CVSS: 7.300000190734863. ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to execute arbitrary commands via unspecified vectors.
Query: describe CVE-2015-8679
Matching passage: CVE-2015-8679. CWE: CWE-284. CVSS: 5.5. The Maxim_smartpa_dev driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230 and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allow attackers to cause a denial of service (system crash) via a crafted application, which triggers an invalid memory access.
Near-miss passage: CVE-2015-7184. CWE: CWE-284. CVSS: 6.800000190734863. The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Query: vulnerability: The Commerce Commonwealth (CBA) module 7.x-1.x before 7.x-1.5 for Drupal does not properly validate payments, which allows remote attackers to make a failed payment appear valid vi
Matching passage: CVE-2015-7231. CWE: CWE-20. CVSS: 5.0. The Commerce Commonwealth (CBA) module 7.x-1.x before 7.x-1.5 for Drupal does not properly validate payments, which allows remote attackers to make a failed payment appear valid via a crafted URL, related to a "response from commweb."
Near-miss passage: CVE-2015-5175. CWE: CWE-20. CVSS: 7.5. Application plugins in Apache CXF Fediz before 1.1.3 and 1.2.x before 1.2.1 allow remote attackers to cause a denial of service.
Query: vulnerability: Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.90 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Matching passage: CVE-2015-1249. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.90 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Near-miss passage: CVE-2015-8424. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: risk of In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for WordPress, XSS is possible for remote authenticated administrators v
Matching passage: CVE-2015-9230. CWE: CWE-79. CVSS: 4.800000190734863. In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for WordPress, XSS is possible for remote authenticated administrators via the DBTablePrefix parameter.
Near-miss passage: CVE-2015-3268. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the DisplayEntityField.getDescription method in ModelFormField.java in Apache OFBiz before 12.04.06 and 13.07.x before 13.07.03 allows remote attackers to inject arbitrary web script or HTML via the description attribute of a display-entity element.
Query: describe CVE-2015-10025
Matching passage: CVE-2015-10025. CWE: CWE-404. CVSS: 7.5. A vulnerability has been found in luelista miniConf up to 1.7.6 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file miniConf/MessageView.cs of the component URL Scanning. The manipulation leads to denial of service. Upgrading to version 1.7.7 and 1.8.0 is able to address this issue. The patch is named c06c2e5116c306e4e1bc79779f0eda2d1182f655. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217615.
Near-miss passage: CVE-2015-10085. CWE: CWE-404. CVSS: 7.5. A vulnerability was found in GoPistolet. It has been declared as problematic. This vulnerability affects unknown code of the component MTA. The manipulation leads to denial of service. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as b91aa4674d460993765884e8463c70e6d886bc90. It is recommended to apply a patch to fix this issue. VDB-221506 is the identifier assigned to this vulnerability.
Query: actor TTPs: Junk Code Insertion
Matching passage: T1027.016 Junk Code Insertion. Tactics: stealth. Description: Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code that either does not execute, or if it does execute, does not change the functionality of the code. Junk code makes analysis more difficult and time-consuming, as the analyst steps through non-functional code instead of analyzing the main code. It also may hinder detections that rely on static code analysis due to the use of benign functionality, especially when combined with [Compression](https://attack.mitre.org/techniques/T1027/015) or [Software Packing](https://attack.mitre.org/techniques/T1027/002).(Citation: ReasonLabs)(Citation: ReasonLabs Cyberpedia Junk Code) No-Operation (NOP) instructions are an example of dead code commonly used in x86 assembly language. They are commonly used as the 0x90 opcode. When NOPs are added to malware, the disassembler may show the NOP instructions, leading to the analyst needing to step through them.(Citation: ReasonLabs) The use of junk / dead code insertion is distinct from [Binary Padding](https://attack.mitre.org/techniques/T1027/001) because the purpose is to obfuscate the functionality of the code, rather than simply to change the malware’s signature.
Near-miss passage: T1027.017 SVG Smuggling. Tactics: stealth. Description: Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG files.(Citation: Trustwave SVG Smuggling 2025) SVGs, or Scalable Vector Graphics, are vector-based image files constructed using XML. As such, they can legitimately include `<script>` tags that enable adversaries to include malicious JavaScript payloads. However, SVGs may appear less suspicious to users than other types of executable files, as they are often treated as image files. SVG smuggling can take a number of forms. For example, threat actors may include content that: * Assembles malicious payloads(Citation: Talos SVG Smuggling 2022) * Downloads malicious payloads(Citation: Cofense SVG Smuggling 2024) * Redirects users to malicious websites(Citation: Bleeping Computer SVG Smuggling 2024) * Displays interactive content to users, such as fake login forms and download buttons.(Citation: Bleeping Computer SVG Smuggling 2024) SVG Smuggling may be used in conjunction with [HTML Smuggling](https://attack.mitre.org/techniques/T1027/006) where an SVG with a malicious payload is included inside an HTML file.(Citation: Talos SVG Smuggling 2022) SVGs may also be included in other types of documents, such as PDFs.
Query: write Sigma for Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs
Matching passage: Sigma rule: Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs. Logsource: windows / process_creation. Rule: title: HackTool - SharpEvtMute Execution id: bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c related: - id: 49329257-089d-46e6-af37-4afce4290685 type: similar status: test description: Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs references: - https://github.com/bats3c/EvtMute author: Florian Roth (Nextron Systems) date: 2022-09-07 modified: 2023-02-14 tags: - attack.defense-impairment - attack.t1685.001 logsource: product: windows category: process_creation detection: selection: - Image|endswith: \SharpEvtMute.exe - Description: SharpEvtMute - CommandLine|contains: - '--Filter "rule ' - --Encoded --Filter \" condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in th. Logsource: azure / riskdetection. Rule: title: Suspicious Browser Activity id: 944f6adb-7a99-4c69-80c1-b712579e93e6 status: test description: Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-browser - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation - attack.initial-access logsource: product: azure service: riskdetection detection: selection: riskEventType: suspiciousBrowser condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Query: exploit Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous befo
Matching passage: CVE-2015-4438. CWE: UNKNOWN. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-4435, CVE-2015-4441, CVE-2015-4445, CVE-2015-4447, CVE-2015-4451, CVE-2015-4452, CVE-2015-5085, and CVE-2015-5086.
Near-miss passage: CVE-2015-4890. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Replication.
Query: write Sigma for Detects potential DLL sideloading using the Microsoft Office winword process via the '/l' flag.
Matching passage: Sigma rule: Detects potential DLL sideloading using the Microsoft Office winword process via the '/l' flag.. Logsource: windows / process_creation. Rule: title: Potential Arbitrary DLL Load Using Winword id: f7375e28-5c14-432f-b8d1-1db26c832df3 related: - id: 2621b3a6-3840-4810-ac14-a02426086171 type: obsolete status: test description: Detects potential DLL sideloading using the Microsoft Office winword process via the '/l' flag. references: - https://github.com/D4Vinci/One-Lin3r/blob/9fdfa5f0b9c698dfbd4cdfe7d2473192777ae1c6/one_lin3r/core/liners/windows/cmd/dll_loader_word.py author: Victor Sergeev, oscd.community date: 2020-10-09 modified: 2023-03-29 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WINWORD.exe - OriginalFileName: WinWord.exe selection_dll: CommandLine|contains|all: - '/l ' - .dll condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence purposes by malicious. Logsource: windows / process_creation. Rule: title: Suspicious GrpConv Execution id: f14e169e-9978-4c69-acb3-1cff8200bc36 status: test description: Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors references: - https://twitter.com/0gtweet/status/1526833181831200770 author: Florian Roth (Nextron Systems) date: 2022-05-19 tags: - attack.privilege-escalation - attack.persistence - attack.t1547 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - grpconv.exe -o - grpconv -o condition: selection falsepositives: - Unknown level: high
Query: vulnerability: The Frontel protocol before 3 on RSI Video Technologies Videofied devices does not use integrity protection, which makes it easier for man-in-the-middle attackers to (1) initiate a
Matching passage: CVE-2015-8254. CWE: CWE-345. CVSS: 5.900000095367432. The Frontel protocol before 3 on RSI Video Technologies Videofied devices does not use integrity protection, which makes it easier for man-in-the-middle attackers to (1) initiate a false alarm or (2) deactivate an alarm by modifying the client-server data stream.
Near-miss passage: CVE-2015-6854. CWE: CWE-345. CVSS: 9.100000381469727. The non-Domino web agents in CA Single Sign-On (aka SSO, formerly SiteMinder) R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, and R12.5 before CR5 allow remote attackers to cause a denial of service (daemon crash) or obtain sensitive information via a crafted request.
Query: CWE for External Control of Critical State Data
Matching passage: CWE-642 External Control of Critical State Data. The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.
Near-miss passage: CWE-277 Insecure Inherited Permissions. A product defines a set of insecure permissions that are inherited by objects that are created by the program.
Query: incident response steps for Persistence mechanism resembling Container Service
Matching passage: Playbook for T1543.005 Container Service. 1) Validate alert telemetry against T1543.005. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: persistence, privilege escalation. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may create or modify container or container cluster management tools that run as daemons, agents, or services on individual hosts. These include software for creating and managing individual containers, such as Docker and Podman, as well as container cluster node-level agents such as kubelet. By modifying these services, an adversary may be able to achieve persistence or escalate their
Near-miss passage: Playbook for T1543.004 Launch Daemon. Different response path focused on persistence, privilege escalation.
Query: CVE similar to CVE-2015-5692
Matching passage: CVE-2015-5692. CWE: CWE-264. CVSS: 7.900000095367432. admin_messages.php in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary code by uploading a file with a safe extension and content type, and then leveraging an improper Sudo configuration to make this a setuid-root file.
Near-miss passage: CVE-2015-3379. CWE: CWE-264. CVSS: 4.0. The Views module before 6.x-2.18, 6.x-3.x before 6.x-3.2, and 7.x-3.x before 7.x-3.10 for Drupal does not properly restrict access to the default views configurations, which allows remote authenticated users to obtain sensitive information via unspecified vectors.