alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Integer overflow in the aio_setup_single_vector function in fs/aio.c in the Linux kernel 4.0 allows local users to cause a denial of service or possibly have unspecified other impa
Matching passage: CVE-2015-8830. CWE: UNKNOWN. CVSS: 7.800000190734863. Integer overflow in the aio_setup_single_vector function in fs/aio.c in the Linux kernel 4.0 allows local users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec. NOTE: this vulnerability exists because of a CVE-2012-6701 regression.
Near-miss passage: CVE-2015-4737. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Pluggable Auth.
Query: rule covering Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from
Matching passage: Sigma rule: Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from. Logsource: windows / file_event. Rule: title: ISO File Created Within Temp Folders id: 2f9356ae-bf43-41b8-b858-4496d83b2acb status: test description: Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022. references: - https://twitter.com/Sam0x90/status/1552011547974696960 - https://securityaffairs.co/wordpress/133680/malware/dll-sideloading-spread-qakbot.html - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image author: '@sam0x90' date: 2022-07-30 tags: - attack.initial-access - attack.t1566.001 logsource: category: file_event product: windows detection: selection_1: TargetFilename|contains|all: - \AppData\Local\Temp\ - .zip\ TargetFilename|endswith: .iso selection_2: TargetFilename|contains: \AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\ TargetFilename|endswith: .iso condition: 1 of selection* falsepositives: - Potential FP by sysadmin opening a zip file containing a legitimate ISO file level: high
Near-miss passage: Sigma rule: Clear command history in network OS which is used for defense evasion. Logsource: cisco / aaa. Rule: title: Cisco Clear Logs id: ceb407f6-8277-439b-951f-e4210e3ed956 status: test description: Clear command history in network OS which is used for defense evasion references: - https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/command/reference/sysmgmt/n5k-sysmgmt-cr/n5k-sm_cmds_c.html - https://www.cisco.com/c/en/us/td/docs/ios/12_2sr/12_2sra/feature/guide/srmgtint.html#wp1127609 author: Austin Clark date: 2019-08-12 modified: 2023-05-26 tags: - attack.stealth - attack.t1070.003 logsource: product: cisco service: aaa detection: keywords: - clear logging - clear archive condition: keywords falsepositives: - Legitimate administrators may run these commands level: high
Query: describe CVE-2015-7712
Matching passage: CVE-2015-7712. CWE: UNKNOWN. CVSS: 6.5. Multiple eval injection vulnerabilities in mods/_standard/gradebook/edit_marks.php in ATutor 2.2 and earlier allow remote authenticated users with the AT_PRIV_GRADEBOOK privilege to execute arbitrary PHP code via the (1) asc or (2) desc parameter.
Near-miss passage: CVE-2015-4896. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.0.34, 4.1.42, 4.2.34, 4.3.32, and 5.0.8, when a VM has the Remote Display feature (RDP) enabled, allows remote attackers to affect availability via unknown vectors related to Core.
Query: what is T1134.005
Matching passage: T1134.005 SID-History Injection. Tactics: stealth, privilege escalation. Description: Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. (Citation: Microsoft SID) An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens). With Domain Administrator (or equivalent) rights, harvested or well-known SID values (Citation: Microsoft Well Known SIDs Jun 2017) may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators. This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as [Remote Services](https://attack.mitre.org/techniques/T1021), [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002), or [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006).
Near-miss passage: T1134.001 Token Impersonation/Theft. Tactics: stealth, privilege escalation. Description: Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`.(Citation: DuplicateToken function) The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread. An adversary may perform [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) when they have a specific, existing process they want to assign the duplicated token to. For example, this may be useful for when the target user has a non-network logon session on the system. When an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally [Create Process with Token](https://attack.mitre.org/techniques/T1134/002) using `CreateProcessWithTokenW` or `CreateProcessAsUserW`. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) is also distinct from [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) in that it refers to duplicating an existing token, rather than creating a new one.
Query: vulnerability: PCRE before 8.38 mishandles certain instances of the (?| substring, which allows remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibl
Matching passage: CVE-2015-8392. CWE: CWE-119. CVSS: 7.5. PCRE before 8.38 mishandles certain instances of the (?| substring, which allows remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8395.
Near-miss passage: CVE-2015-8472. CWE: CWE-119. CVSS: 7.300000190734863. Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126.
Query: CVE similar to CVE-2015-1048
Matching passage: CVE-2015-1048. CWE: UNKNOWN. CVSS: 4.300000190734863. Open redirect vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices with firmware before 4.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Near-miss passage: CVE-2015-6723. CWE: UNKNOWN. CVSS: 6.800000190734863. The ANTrustPropagateAll method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Query: patch priority for CVE-2015-6377
Matching passage: CVE-2015-6377. CWE: CWE-399. CVSS: 7.800000190734863. Cisco Virtual Topology System (VTS) 2.0(0) and 2.0(1) allows remote attackers to cause a denial of service (CPU and memory consumption, and TCP port outage) via a flood of crafted TCP packets, aka Bug ID CSCux13379.
Near-miss passage: CVE-2015-1735. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1740, CVE-2015-1744, CVE-2015-1745, and CVE-2015-1766.
Query: rule covering Detects potential DLL sideloading of "AVKkid.dll"
Matching passage: Sigma rule: Detects potential DLL sideloading of "AVKkid.dll". Logsource: windows / image_load. Rule: title: Potential AVKkid.DLL Sideloading id: 952ed57c-8f99-453d-aee0-53a49c22f95d status: test description: Detects potential DLL sideloading of "AVKkid.dll" references: - https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/ author: X__Junior (Nextron Systems) date: 2023-08-03 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \AVKkid.dll filter_main_legit_path: Image|contains: - C:\Program Files (x86)\G DATA\ - C:\Program Files\G DATA\ Image|endswith: \AVKKid.exe ImageLoaded|startswith: - C:\Program Files (x86)\G DATA\ - C:\Program Files\G DATA\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of the "jsc.exe" (JScript Compiler). Attacker might abuse this in order to compile JScript files o. Logsource: windows / process_creation. Rule: title: JScript Compiler Execution id: 52788a70-f1da-40dd-8fbd-73b5865d6568 status: test description: 'Detects the execution of the "jsc.exe" (JScript Compiler). Attacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Jsc/ - https://www.phpied.com/make-your-javascript-a-windows-exe/ - https://twitter.com/DissectMalware/status/998797808907046913 author: frack113 date: 2022-05-02 modified: 2024-04-24 tags: - attack.execution - attack.stealth - attack.t1127 logsource: product: windows category: process_creation detection: selection: - Image|endswith: \jsc.exe - OriginalFileName: jsc.exe condition: selection falsepositives: - Legitimate use to compile JScript by developers. level: low
Query: Sigma YAML for windows / network_connection
Matching passage: Sigma rule: Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN i. Logsource: windows / network_connection. Rule: title: Network Connection Initiated By IMEWDBLD.EXE id: 8d7e392e-9b28-49e1-831d-5949c6281228 related: - id: 863218bd-c7d0-4c52-80cd-0a96c09f54af type: derived status: test description: 'Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-10---windows---powershell-download - https://lolbas-project.github.io/lolbas/Binaries/IMEWDBLD/ author: frack113 date: 2022-01-22 modified: 2023-11-09 tags: - attack.command-and-control - attack.t1105 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: \IMEWDBLD.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of screensaver files (.scr) outside of system folders. Attackers may execute an application as an ". Logsource: windows / file_event. Rule: title: SCR File Write Event id: c048f047-7e2a-4888-b302-55f509d4a91d status: test description: Detects the creation of screensaver files (.scr) outside of system folders. Attackers may execute an application as an ".SCR" file using "rundll32.exe desk.cpl,InstallScreenSaver" for example. references: - https://lolbas-project.github.io/lolbas/Libraries/Desk/ author: Christopher Peacock @securepeacock, SCYTHE @scythe_io date: 2022-04-27 modified: 2023-08-23 tags: - attack.stealth - attack.t1218.011 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: .scr filter: TargetFilename|contains: - :\$WINDOWS.~BT\NewOS\ - :\Windows\System32\ - :\Windows\SysWOW64\ - :\Windows\WinSxS\ - :\WUDownloadCache\ condition: selection and not filter falsepositives: - The installation of new screen savers by third party software level: medium
Query: detection rule: Detects the execution of a renamed "Msdt.exe" binary
Matching passage: Sigma rule: Detects the execution of a renamed "Msdt.exe" binary. Logsource: windows / process_creation. Rule: title: Renamed Msdt.EXE Execution id: bd1c6866-65fc-44b2-be51-5588fcff82b9 status: test description: Detects the execution of a renamed "Msdt.exe" binary references: - https://lolbas-project.github.io/lolbas/Binaries/Msdt/ author: pH-T (Nextron Systems) date: 2022-06-03 modified: 2023-02-03 tags: - attack.stealth - attack.t1036.003 logsource: category: process_creation product: windows detection: selection: OriginalFileName: msdt.exe filter: Image|endswith: \msdt.exe condition: selection and not filter falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_msdt/info.yml
Near-miss passage: Sigma rule: Detects the use of the "nice" utility to execute a shell. Such behavior may be associated with privilege escalation, una. Logsource: linux / process_creation. Rule: title: Shell Execution via Nice - Linux id: 093d68c7-762a-42f4-9f46-95e79142571a status: test description: 'Detects the use of the "nice" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. ' references: - https://gtfobins.github.io/gtfobins/nice/#shell - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-09-02 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: linux detection: selection: Image|endswith: /nice CommandLine|endswith: - /bin/bash - /bin/dash - /bin/fish - /bin/sh - /bin/zsh condition: selection falsepositives: - Unknown level: high
Query: secure coding against PHP External Variable Modification
Matching passage: CWE-473 PHP External Variable Modification. A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise.
Near-miss passage: CWE-1101 Reliance on Runtime Component in Generated Code. The product uses automatically-generated code that cannot be executed without a specific runtime support component.
Query: indicators of Ccache Files
Matching passage: T1558.005 Ccache Files. Tactics: credential access. Description: Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having to re-enter credentials. The <code>/etc/krb5.conf</code> configuration file and the <code>KRB5CCNAME</code> environment variable are used to set the storage location for ccache entries. On Linux, credentials are typically stored in the `/tmp` directory with a naming format of `krb5cc_%UID%` or `krb5.ccache`. On macOS, ccache entries are stored by default in memory with an `API:{uuid}` naming scheme. Typically, users interact with ticket storage using <code>kinit</code>, which obtains a Ticket-Granting-Ticket (TGT) for the principal; <code>klist</code>, which lists obtained tickets currently held in the credentials cache; and other built-in binaries.(Citation: Kerberos GNU/Linux)(Citation: Binary Defense Kerberos Linux) Adversaries can collect tickets from ccache files stored on disk and authenticate as the current user without their password to perform [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003) attacks. Adversaries can also use these tickets to impersonate legitimate users with elevated privileges to perform [Privilege Escalation](https://attack.mitre.org/tactics/TA0004). Tools like Kekeo can also be used by adversaries to convert ccache files to Windows format for further [Lateral Movement](https://attack.mitre.org/tactics/TA0008). On macOS, adversaries may use open-source tools or the Kerberos framework to interact with ccache files and extract TGTs or Service Tickets via lower-level APIs.(Citation: SpectorOps Bifrost Kerberos macOS 2019)(Citation: Linux Kerberos Tickets)(Citation: Brining MimiKatz to Unix)(Citation: Kekeo)
Near-miss passage: T1558 Steal or Forge Kerberos Tickets. Tactics: credential access. Description: Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder) Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access. On Windows, the built-in <code>klist</code> utility can be used to list and analyze cached Kerberos tickets.(Citation: Microsoft Klist)
Query: risk of The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a
Matching passage: CVE-2015-8557. CWE: CWE-78. CVSS: 9.0. The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.
Near-miss passage: CVE-2015-4186. CWE: CWE-78. CVSS: 7.199999809265137. The diagnostics subsystem in the administrative web interface on Cisco Virtualization Experience (aka VXC) Client 6215 devices with firmware 11.2(27.4) allows local users to gain privileges for OS command execution via a crafted option value, aka Bug ID CSCug54412.
Query: Sigma rule for Detects suspicious encoded character syntax often used for defense evasion
Matching passage: Sigma rule: Detects suspicious encoded character syntax often used for defense evasion. Logsource: windows / process_creation. Rule: title: Potential PowerShell Obfuscation Via WCHAR/CHAR id: e312efd0-35a1-407f-8439-b8d434b438a6 status: test description: Detects suspicious encoded character syntax often used for defense evasion references: - https://twitter.com/0gtweet/status/1281103918693482496 author: Florian Roth (Nextron Systems) date: 2020-07-09 modified: 2025-03-03 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1027 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - '[char]0x' - (WCHAR)0x condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects default RemCom pipe creation. Logsource: windows / pipe_created. Rule: title: PUA - RemCom Default Named Pipe id: d36f87ea-c403-44d2-aa79-1a0ac7c24456 related: - id: 9e77ed63-2ecf-4c7b-b09d-640834882028 type: obsolete status: test description: Detects default RemCom pipe creation references: - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view - https://github.com/kavika13/RemCom author: Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2023-08-07 modified: 2023-11-30 tags: - attack.lateral-movement - attack.t1021.002 - attack.execution - attack.t1569.002 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName|contains: \RemCom condition: selection falsepositives: - Legitimate Administrator activity level: medium
Query: exploit Cross-site scripting (XSS) vulnerability in Redmine before 2.6.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving flash message rendering.
Matching passage: CVE-2015-8477. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Redmine before 2.6.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving flash message rendering.
Near-miss passage: CVE-2015-5654. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Dojo Toolkit before 1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.