alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters.
Matching passage: CVE-2015-9447. CWE: CWE-352. CVSS: 6.5. The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters.
Near-miss passage: CVE-2015-6660. CWE: CWE-352. CVSS: 6.800000190734863. The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks."
Query: patch priority for CVE-2015-7383
Matching passage: CVE-2015-7383. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge through 2015-04-28 allow remote attackers to inject arbitrary web script or HTML via the (1) adminUserName, (2) pathToMYSQL, (3) databaseStructureFile, or (4) pathToBibutils parameter to install.php or the (5) adminUserName parameter to update.php.
Near-miss passage: CVE-2015-6672. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Administrative Web Interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 132.8, 10.5 before Build 57.7, and 10.5e before Build 56.1505.e allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: rule covering Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are
Matching passage: Sigma rule: Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are. Logsource: windows / ps_script. Rule: title: Detected Windows Software Discovery - PowerShell id: 2650dd1a-eb2a-412d-ac36-83f06c4f2282 status: test description: Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518/T1518.md - https://github.com/harleyQu1nn/AggressorScripts author: Nikita Nazarov, oscd.community date: 2020-10-16 modified: 2022-12-02 tags: - attack.discovery - attack.t1518 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - get-itemProperty - \software\ - select-object - format-table condition: selection falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects usage of "MSOHTMED" to download arbitrary files. Logsource: windows / process_creation. Rule: title: Arbitrary File Download Via MSOHTMED.EXE id: 459f2f98-397b-4a4a-9f47-6a5ec2f1c69d status: test description: Detects usage of "MSOHTMED" to download arbitrary files references: - https://github.com/LOLBAS-Project/LOLBAS/pull/238/files author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 modified: 2023-11-09 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \MSOHTMED.exe - OriginalFileName: MsoHtmEd.exe selection_cli: CommandLine|contains: - ftp:// - http:// - https:// condition: all of selection_* falsepositives: - Unknown level: medium
Query: risk of The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter.
Matching passage: CVE-2015-9467. CWE: CWE-89. CVSS: 9.800000190734863. The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter.
Near-miss passage: CVE-2015-6962. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the web application in Farol allows remote attackers to execute arbitrary SQL commands via the email parameter to tkmonitor/estrutura/login/Login.actions.php.
Query: explain CWE-710
Matching passage: CWE-710 Improper Adherence to Coding Standards. The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.
Near-miss passage: CWE-25 Path Traversal: '/../filedir'. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize /../ sequences that can resolve to a location that is outside of that directory.
Query: actor TTPs: Break Process Trees
Matching passage: T1036.009 Break Process Trees. Tactics: stealth. Description: An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID). If endpoint protection software leverages the “parent-child" relationship for detection, breaking this relationship could result in the adversary’s behavior not being associated with previous process tree activity. On Unix-based systems breaking this process tree is common practice for administrators to execute software using scripts and programs.(Citation: 3OHA double-fork 2022) On Linux systems, adversaries may execute a series of [Native API](https://attack.mitre.org/techniques/T1106) calls to alter malware's process tree. For example, adversaries can execute their payload without any arguments, call the `fork()` API call twice, then have the parent process exit. This creates a grandchild process with no parent process that is immediately adopted by the `init` system process (PID 1), which successfully disconnects the execution of the adversary's payload from its previous process tree. Another example is using the “daemon” syscall to detach from the current parent process and run in the background.(Citation: Sandfly BPFDoor 2022)(Citation: Microsoft XorDdos Linux Stealth 2022)
Near-miss passage: T1036 Masquerading. Tactics: stealth. Description: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site)
Query: detection rule: Detects the creation of files that indicator an interactive use of PowerShell in the SYSTEM user context
Matching passage: Sigma rule: Detects the creation of files that indicator an interactive use of PowerShell in the SYSTEM user context. Logsource: windows / file_event. Rule: title: Suspicious Interactive PowerShell as SYSTEM id: 5b40a734-99b6-4b98-a1d0-1cea51a08ab2 status: test description: Detects the creation of files that indicator an interactive use of PowerShell in the SYSTEM user context references: - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/PowerSploit_Invoke-Mimikatz.htm author: Florian Roth (Nextron Systems) date: 2021-12-07 modified: 2022-08-13 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: file_event detection: selection: TargetFilename: - C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt - C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive condition: selection falsepositives: - Administrative activity - PowerShell scripts running as SYSTEM user level: high
Near-miss passage: Sigma rule: Detects the execution of a renamed "client32.exe" (NetSupport RAT) via Imphash, Product and OriginalFileName strings. Logsource: windows / process_creation. Rule: title: Renamed NetSupport RAT Execution id: 0afbd410-de03-4078-8491-f132303cb67d status: test description: Detects the execution of a renamed "client32.exe" (NetSupport RAT) via Imphash, Product and OriginalFileName strings references: - https://redcanary.com/blog/misbehaving-rats/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-19 modified: 2024-11-23 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: - Product|contains: NetSupport Remote Control - OriginalFileName|contains: client32.exe - Hashes|contains: IMPHASH=A9D50692E95B79723F3E76FCF70D023E filter: Image|endswith: \client32.exe condition: selection and not filter falsepositives: - Unknown level: high
Query: exploit Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect param
Matching passage: CVE-2015-5354. CWE: CWE-601. CVSS: 5.800000190734863. Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to admin/nos/login.
Near-miss passage: CVE-2015-9058. CWE: CWE-601. CVSS: 6.099999904632568. Open redirect vulnerability in Proxmox Mail Gateway prior to hotfix 4.0-8-097d26a9 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the destination parameter.
Query: alert when A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC tech
Matching passage: Sigma rule: A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC tech. Logsource: windows / process_creation. Rule: title: Sdclt Child Processes id: da2738f2-fadb-4394-afa7-0a0674885afa status: test description: A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC techniques. references: - https://github.com/OTRF/detection-hackathon-apt29/issues/6 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.B.2_C36B49B5-DF58-4A34-9FE9-56189B9DEFEA.md author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \sdclt.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques. Logsource: windows / system. Rule: title: Tap Driver Installation id: 8e4cf0e5-aa5d-4dc3-beff-dc26917744a9 status: test description: Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques references: - https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers author: Daniil Yugoslavskiy, Ian Davis, oscd.community date: 2019-10-24 modified: 2022-12-25 tags: - attack.exfiltration - attack.t1048 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains: tap0901 condition: selection falsepositives: - Legitimate OpenVPN TAP installation level: medium
Query: write Sigma for Detects using WorkFolders.exe to execute an arbitrary control.exe
Matching passage: Sigma rule: Detects using WorkFolders.exe to execute an arbitrary control.exe. Logsource: windows / process_creation. Rule: title: Execution via WorkFolders.exe id: 0bbc6369-43e3-453d-9944-cae58821c173 status: test description: Detects using WorkFolders.exe to execute an arbitrary control.exe references: - https://twitter.com/elliotkillick/status/1449812843772227588 author: Maxime Thiebaut (@0xThiebaut) date: 2021-10-21 modified: 2022-12-25 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: Image|endswith: \control.exe ParentImage|endswith: \WorkFolders.exe filter: Image: C:\Windows\System32\control.exe condition: selection and not filter falsepositives: - Legitimate usage of the uncommon Windows Work Folders feature. level: high
Near-miss passage: Sigma rule: Detects the creation of a new office macro files on the systems. Logsource: windows / file_event. Rule: title: Office Macro File Creation id: 91174a41-dc8f-401b-be89-7bfc140612a0 related: - id: 0e29e3a7-1ad8-40aa-b691-9f82ecd33d66 type: similar status: test description: Detects the creation of a new office macro files on the systems references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference author: Nasreddine Bencherchali (Nextron Systems) date: 2022-01-23 modified: 2026-01-09 tags: - attack.initial-access - attack.t1566.001 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - .docm - .dotm - .xlsm - .xltm - .potm - .pptm filter_main_office: Image|startswith: - C:\Program Files\Microsoft Office\ - C:\Program Files (x86)\Microsoft Office\ Image|endswith: - \WINWORD.EXE - \EXCEL.EXE - \POWERPNT.EXE TargetFilename|contains: \~$ condition: selection and not 1 of filter_main_* falsepositives: - Very common in environments that rely heavily on macro documents level: low
Query: explain T1547.002 Authentication Package
Matching passage: T1547.002 Authentication Package. Tactics: persistence, privilege escalation. Description: Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system.(Citation: MSDN Authentication Packages) Adversaries can use the autostart mechanism provided by LSA authentication packages for persistence by placing a reference to a binary in the Windows Registry location <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\</code> with the key value of <code>"Authentication Packages"=&lt;target binary&gt;</code>. The binary will then be executed by the system when the authentication packages are loaded.
Near-miss passage: T1547.006 Kernel Modules and Extensions. Tactics: persistence, privilege escalation. Description: Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system.(Citation: Linux Kernel Programming) When used maliciously, LKMs can be a type of kernel-mode [Rootkit](https://attack.mitre.org/techniques/T1014) that run with the highest operating system privilege (Ring 0).(Citation: Linux Kernel Module Programming Guide) Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors, and enabling root access to non-privileged users.(Citation: iDefense Rootkit Overview) Kernel extensions, also called kext, are used in macOS to load functionality onto a system similar to LKMs for Linux. Since the kernel is responsible for enforcing security and the kernel extensions run as apart of the kernel, kexts are not governed by macOS security policies. Kexts are loaded and unloaded through <code>kextload</code> and <code>kextunload</code> commands. Kexts need to be signed with a developer ID that is granted privileges by Apple allowing it to sign Kernel extensions. Developers without these privileges may still sign kexts but they will not load unless SIP is disabled. If SIP is enabled, the kext signature is verified before being added to the AuxKC.(Citation: System and kernel extensions in macOS) Since macOS Catalina 10.15, kernel extensions have been deprecated in favor of System Extensions. However, kexts are still allowed as "Legacy System Extensions" since there is no System Extension for Kernel Programming Interfaces.(Citation: Apple Kernel Extension Deprecation) Adversaries can use LKMs and kexts to conduct [Persistence](https
Query: patch priority for CVE-2015-6758
Matching passage: CVE-2015-6758. CWE: CWE-17. CVSS: 6.800000190734863. The CPDF_Document::GetPage function in fpdfapi/fpdf_parser/fpdf_parser_document.cpp in PDFium, as used in Google Chrome before 46.0.2490.71, does not properly perform a cast of a dictionary object, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.
Near-miss passage: CVE-2015-7045. CWE: CWE-17. CVSS: 5.0. Keychain Access in Apple OS X before 10.11.2 and tvOS before 9.1 improperly interacts with Keychain Agent, which allows attackers to spoof the Keychain Server via unspecified vectors.
Query: vulnerability: The visitors-online plugin before 0.4 for WordPress has SQL injection.
Matching passage: CVE-2015-9325. CWE: CWE-89. CVSS: 9.800000190734863. The visitors-online plugin before 0.4 for WordPress has SQL injection.
Near-miss passage: CVE-2015-1013. CWE: CWE-89. CVSS: 6.5. OSIsoft PI AF 2.6 and 2.7 and PI SQL for AF 2.1.2.19 do not ensure that the PI SQL (AF) Trusted Users group lacks the Everyone account, which allows remote authenticated users to bypass intended command restrictions via SQL statements.
Query: CVE similar to CVE-2015-0686
Matching passage: CVE-2015-0686. CWE: CWE-399. CVSS: 6.300000190734863. The SNMP implementation in Cisco NX-OS 6.1(2)I2(3) on Nexus 9000 devices, when a Reset High Availability (HA) policy is configured, allows remote authenticated users to cause a denial of service (device reload) via unspecified vectors, aka Bug ID CSCuq92240.
Near-miss passage: CVE-2015-8002. CWE: CWE-399. CVSS: 6.800000190734863. The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated users to cause a denial of service (disk consumption) via a file upload using one byte chunks.
Query: detection rule: Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual
Matching passage: Sigma rule: Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual. Logsource: azure / activitylogs. Rule: title: Azure Virtual Network Device Modified or Deleted id: 15ef3fac-f0f0-4dc4-ada0-660aa72980b3 status: test description: 'Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual appliance, virtual hub, or virtual router. ' references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-08-08 modified: 2022-08-23 tags: - attack.impact logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/WRITE - MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/DELETE - MICROSOFT.NETWORK/NETWORKINTERFACES/WRITE - MICROSOFT.NETWORK/NETWORKINTERFACES/JOIN/ACTION - MICROSOFT.NETWORK/NETWORKINTERFACES/DELETE - MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/DELETE - MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/WRITE - MICROSOFT.NETWORK/VIRTUALHUBS/DELETE - MICROSOFT.NETWORK/VIRTUALHUBS/WRITE - MICROSOFT.NETWORK/VIRTUALROUTERS/WRITE - MICROSOFT.NETWORK/VIRTUALROUTERS/DELETE condition: selection falsepositives: - Virtual Network Device being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Virtual Network Device modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects the presence and execution of Inveigh via dropped artefacts. Logsource: windows / file_event. Rule: title: HackTool - Inveigh Execution Artefacts id: bb09dd3e-2b78-4819-8e35-a7c1b874e449 status: test description: Detects the presence and execution of Inveigh via dropped artefacts references: - https://github.com/Kevin-Robertson/Inveigh/blob/29d9e3c3a625b3033cdaf4683efaafadcecb9007/Inveigh/Support/Output.cs - https://github.com/Kevin-Robertson/Inveigh/blob/29d9e3c3a625b3033cdaf4683efaafadcecb9007/Inveigh/Support/Control.cs - https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-24 modified: 2024-06-27 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \Inveigh-Log.txt - \Inveigh-Cleartext.txt - \Inveigh-NTLMv1Users.txt - \Inveigh-NTLMv2Users.txt - \Inveigh-NTLMv1.txt - \Inveigh-NTLMv2.txt - \Inveigh-FormInput.txt - \Inveigh.dll - \Inveigh.exe - \Inveigh.ps1 - \Inveigh-Relay.ps1 condition: selection falsepositives: - Unlikely level: critical
Query: Sigma rule for Detects the addition of a new file or path exclusion to MacOS Time Machine via the "tmutil" utility. An adversary could
Matching passage: Sigma rule: Detects the addition of a new file or path exclusion to MacOS Time Machine via the "tmutil" utility. An adversary could. Logsource: macos / process_creation. Rule: title: New File Exclusion Added To Time Machine Via Tmutil - MacOS id: 9acf45ed-3a26-4062-bf08-56857613eb52 status: test description: 'Detects the addition of a new file or path exclusion to MacOS Time Machine via the "tmutil" utility. An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine - https://www.loobins.io/binaries/tmutil/ author: Pratinav Chandra date: 2024-05-29 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: macos detection: selection_img: - Image|endswith: /tmutil - CommandLine|contains: tmutil selection_cmd: CommandLine|contains: addexclusion condition: all of selection_* falsepositives: - Legitimate administrator activity level: medium
Near-miss passage: Sigma rule: Detects file and folder permission changes.. Logsource: linux / auditd. Rule: title: File or Folder Permissions Change id: 74c01ace-0152-4094-8ae2-6fd776dd43e5 status: test description: Detects file and folder permission changes. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.002/T1222.002.md author: Jakob Weinzettl, oscd.community date: 2019-09-23 modified: 2021-11-27 tags: - attack.defense-impairment - attack.t1222.002 logsource: product: linux service: auditd detection: selection: type: EXECVE a0|contains: - chmod - chown condition: selection falsepositives: - User interacting with files permissions (normal/daily behaviour). level: low