alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Cross-site scripting (XSS) vulnerability in the V8ContextNativeHandler::GetModuleSystem function in extensions/renderer/v8_context_native_handler.cc in Google Chrome before 44.0.24
Matching passage: CVE-2015-1286. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the V8ContextNativeHandler::GetModuleSystem function in extensions/renderer/v8_context_native_handler.cc in Google Chrome before 44.0.2403.89 allows remote attackers to inject arbitrary web script or HTML by leveraging the lack of a certain V8 context restriction, aka a Blink "Universal XSS (UXSS)."
Near-miss passage: CVE-2015-6511. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the server[] parameter to services_ntpd.php.
Query: vulnerability: The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2 before 2.2.4, as distributed in Apple OS X before 10.11.4 and other pr
Matching passage: CVE-2015-7551. CWE: CWE-20. CVSS: 8.399999618530273. The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2 before 2.2.4, as distributed in Apple OS X before 10.11.4 and other products, mishandles tainting, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string, related to the DL module and the libffi library. NOTE: this vulnerability exists because of a CVE-2009-5147 regression.
Near-miss passage: CVE-2015-2514. CWE: CWE-20. CVSS: 9.300000190734863. Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted .jnt file, aka "Windows Journal RCE Vulnerability," a different vulnerability than CVE-2015-2513 and CVE-2015-2530.
Query: describe CVE-2015-1286
Matching passage: CVE-2015-1286. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the V8ContextNativeHandler::GetModuleSystem function in extensions/renderer/v8_context_native_handler.cc in Google Chrome before 44.0.2403.89 allows remote attackers to inject arbitrary web script or HTML by leveraging the lack of a certain V8 context restriction, aka a Blink "Universal XSS (UXSS)."
Near-miss passage: CVE-2015-6511. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the server[] parameter to services_ntpd.php.
Query: rule covering Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys.
Matching passage: Sigma rule: Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys.. Logsource: windows / process_creation. Rule: title: Suspicious Registry Modification From ADS Via Regini.EXE id: 77946e79-97f1-45a2-84b4-f37b5c0d8682 related: - id: 5f60740a-f57b-4e76-82a1-15b6ff2cb134 type: derived status: test description: Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys. references: - https://lolbas-project.github.io/lolbas/Binaries/Regini/ - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regini author: Eli Salem, Sander Wiebing, oscd.community date: 2020-10-12 modified: 2023-02-08 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regini.exe - OriginalFileName: REGINI.EXE selection_re: CommandLine|re: :[^ \\] condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects events with patterns found in commands used for reconnaissance on linux systems. Logsource: linux / process_creation. Rule: title: Linux Recon Indicators id: 0cf7a157-8879-41a2-8f55-388dd23746b7 status: test description: Detects events with patterns found in commands used for reconnaissance on linux systems references: - https://github.com/sleventyeleven/linuxprivchecker/blob/0d701080bbf92efd464e97d71a70f97c6f2cd658/linuxprivchecker.py author: Florian Roth (Nextron Systems) date: 2022-06-20 tags: - attack.reconnaissance - attack.t1592.004 - attack.credential-access - attack.t1552.001 logsource: category: process_creation product: linux detection: selection: CommandLine|contains: - ' -name .htpasswd' - ' -perm -4000 ' condition: selection falsepositives: - Legitimate administration activities level: high
Query: exploit The Endpoint Manager for Remote Control component in IBM Tivoli Endpoint Manager for Lifecycle Management 9.0.1 before IF6 and 9.1.0 before IF6 does not set the secure flag for the
Matching passage: CVE-2015-1915. CWE: CWE-200. CVSS: 4.300000190734863. The Endpoint Manager for Remote Control component in IBM Tivoli Endpoint Manager for Lifecycle Management 9.0.1 before IF6 and 9.1.0 before IF6 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Near-miss passage: CVE-2015-1765. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to read the browser history via a crafted web site.
Query: vulnerability: Integer overflow in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 o
Matching passage: CVE-2015-3104. CWE: CWE-189. CVSS: 10.0. Integer overflow in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-2470. CWE: CWE-189. CVSS: 9.300000190734863. Integer underflow in Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office for Mac 2011, and Word Viewer allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Integer Underflow Vulnerability."
Query: detection rule: Detects when a user manipulates with Firmward Password on MacOS. NOTE - this command has been disabled on silicon-based
Matching passage: Sigma rule: Detects when a user manipulates with Firmward Password on MacOS. NOTE - this command has been disabled on silicon-based. Logsource: macos / process_creation. Rule: title: Suspicious MacOS Firmware Activity id: 7ed2c9f7-c59d-4c82-a7e2-f859aa676099 status: test description: Detects when a user manipulates with Firmward Password on MacOS. NOTE - this command has been disabled on silicon-based apple computers. references: - https://github.com/usnistgov/macos_security/blob/932a51f3e819dd3e02ebfcf3ef433cfffafbe28b/rules/os/os_firmware_password_require.yaml - https://www.manpagez.com/man/8/firmwarepasswd/ - https://support.apple.com/guide/security/firmware-password-protection-sec28382c9ca/web author: Austin Songer @austinsonger date: 2021-09-30 modified: 2022-10-09 tags: - attack.impact logsource: category: process_creation product: macos detection: selection1: Image: /usr/sbin/firmwarepasswd CommandLine|contains: - setpasswd - full - delete - check condition: selection1 falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or fir. Logsource: windows / process_creation. Rule: title: PUA - Fast Reverse Proxy (FRP) Execution id: 32410e29-5f94-4568-b6a3-d91a8adad863 status: test description: Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet. references: - https://asec.ahnlab.com/en/38156/ - https://github.com/fatedier/frp author: frack113, Florian Roth date: 2022-09-02 modified: 2024-11-23 tags: - attack.command-and-control - attack.t1090 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: - \frpc.exe - \frps.exe selection_cli: CommandLine|contains: \frpc.ini selection_hashes: Hashes|contains: - MD5=7D9C233B8C9E3F0EA290D2B84593C842 - SHA1=06DDC9280E1F1810677935A2477012960905942F - SHA256=57B0936B8D336D8E981C169466A15A5FD21A7D5A2C7DAF62D5E142EE860E387C condition: 1 of selection_* falsepositives: - Legitimate use level: high
Query: alert when Detects potential DLL sideloading of "EACore.dll"
Matching passage: Sigma rule: Detects potential DLL sideloading of "EACore.dll". Logsource: windows / image_load. Rule: title: Potential EACore.DLL Sideloading id: edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5 status: test description: Detects potential DLL sideloading of "EACore.dll" references: - https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/ author: X__Junior (Nextron Systems) date: 2023-08-03 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \EACore.dll filter_main_legit_path: Image|contains|all: - C:\Program Files\Electronic Arts\EA Desktop\ - \EACoreServer.exe ImageLoaded|startswith: C:\Program Files\Electronic Arts\EA Desktop\ condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects suspicious rules that delete or move messages or folders are set on a user's inbox.. Logsource: azure / riskdetection. Rule: title: Suspicious Inbox Manipulation Rules id: ceb55fd0-726e-4656-bf4e-b585b7f7d572 status: test description: Detects suspicious rules that delete or move messages or folders are set on a user's inbox. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-inbox-manipulation-rules - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.stealth - attack.t1140 logsource: product: azure service: riskdetection detection: selection: riskEventType: mcasSuspiciousInboxManipulationRules condition: selection falsepositives: - Actual mailbox rules that are moving items based on their workflow. level: high
Query: exploit Cisco AnyConnect Secure Mobility Client 4.1(8) on OS X and Linux does not verify pathnames before installation actions, which allows local users to obtain root privileges via a cra
Matching passage: CVE-2015-6306. CWE: CWE-264. CVSS: 7.199999809265137. Cisco AnyConnect Secure Mobility Client 4.1(8) on OS X and Linux does not verify pathnames before installation actions, which allows local users to obtain root privileges via a crafted installation file, aka Bug ID CSCuv11947.
Near-miss passage: CVE-2015-0518. CWE: CWE-264. CVSS: 9.0. The Properties service in the D2FS web-service component in EMC Documentum D2 3.1 through SP1, 4.0 and 4.1 before 4.1 P22, and 4.2 before P11 allows remote authenticated users to obtain superuser privileges via an unspecified method call that modifies group permissions.
Query: vulnerability: Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a
Matching passage: CVE-2015-2542. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-2372. CWE: CWE-119. CVSS: 9.300000190734863. vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 6 through 11 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "VBScript Memory Corruption Vulnerability."
Query: vulnerability: Cross-site request forgery (CSRF) vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.2 allows remote attackers to hijack the authentication of unspecified victims fo
Matching passage: CVE-2015-5397. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.2 allows remote attackers to hijack the authentication of unspecified victims for requests that upload code via unknown vectors.
Near-miss passage: CVE-2015-2350. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in MikroTik RouterOS 5.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request in the status page to /cfg.
Query: weakness Path Equivalence: 'filename.' (Trailing Dot)
Matching passage: CWE-42 Path Equivalence: 'filename.' (Trailing Dot). The product accepts path input in the form of trailing dot ('filedir.') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Near-miss passage: CWE-277 Insecure Inherited Permissions. A product defines a set of insecure permissions that are inherited by objects that are created by the program.
Query: describe CVE-2015-4211
Matching passage: CVE-2015-4211. CWE: CWE-264. CVSS: 7.199999809265137. Cisco AnyConnect Secure Mobility Client 3.1(60) on Windows does not properly validate pathnames, which allows local users to gain privileges via a crafted INF file, aka Bug ID CSCus65862.
Near-miss passage: CVE-2015-9011. CWE: CWE-264. CVSS: 9.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36714882.
Query: Sigma rule for Detects the installation of VsCode tunnel (code-tunnel) as a service.
Matching passage: Sigma rule: Detects the installation of VsCode tunnel (code-tunnel) as a service.. Logsource: windows / process_creation. Rule: title: Visual Studio Code Tunnel Service Installation id: 30bf1789-379d-4fdc-900f-55cd0a90a801 status: test description: Detects the installation of VsCode tunnel (code-tunnel) as a service. references: - https://ipfyx.fr/post/visual-studio-code-tunnel/ - https://badoption.eu/blog/2023/01/31/code_c2.html - https://code.visualstudio.com/docs/remote/tunnels author: Nasreddine Bencherchali (Nextron Systems) date: 2023-10-25 tags: - attack.command-and-control - attack.t1071.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - 'tunnel ' - service - internal-run - tunnel-service.log condition: selection falsepositives: - Legitimate installation of code-tunnel as a service level: medium
Near-miss passage: Sigma rule: Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry. Logsource: windows / process_creation. Rule: title: Enable LM Hash Storage - ProcCreation id: 98dedfdd-8333-49d4-9f23-d7018cccae53 related: - id: c420410f-c2d8-4010-856b-dffe21866437 type: similar status: test description: 'Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases. ' references: - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a - https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password - https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-12-15 modified: 2023-12-22 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: process_creation detection: selection: CommandLine|contains|all: - \System\CurrentControlSet\Control\Lsa - NoLMHash - ' 0' condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-7567
Matching passage: CVE-2015-7567. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary SQL commands via the "passwordreset&token" parameter.
Near-miss passage: CVE-2015-10042. CWE: CWE-89. CVSS: 9.800000190734863. ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in Dovgalyuk AIBattle. Affected by this vulnerability is the function registerUser of the file site/procedures.php. The manipulation of the argument postLogin leads to sql injection. The identifier of the patch is 448e9880aac18ae7832f8d065e03e46ce0f1d3e3. It is recommended to apply a patch to fix this issue. The identifier VDB-218305 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Query: Sigma rule for Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands
Matching passage: Sigma rule: Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands. Logsource: windows / system. Rule: title: Sliver C2 Default Service Installation id: 31c51af6-e7aa-4da7-84d4-8f32cc580af2 status: test description: Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands references: - https://github.com/BishopFox/sliver/blob/79f2d48fcdfc2bee4713b78d431ea4b27f733f30/client/command/commands.go#L1231 - https://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-08-25 tags: - attack.persistence - attack.execution - attack.privilege-escalation - attack.t1543.003 - attack.t1569.002 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7045 selection_service_1: ImagePath|re: ^[a-zA-Z]:\\windows\\temp\\[a-zA-Z0-9]{10}\.exe selection_service_2: ServiceName: - Sliver - Sliver implant condition: selection_eid and 1 of selection_service_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation). Logsource: windows / process_creation. Rule: title: Shell Process Spawned by Java.EXE id: dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0 related: - id: 0d34ed8b-1c12-4ff2-828c-16fc860b766d type: similar status: test description: Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation) references: - https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/ author: Andreas Hunkeler (@Karneades), Nasreddine Bencherchali date: 2021-12-17 modified: 2024-01-18 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \java.exe Image|endswith: - \bash.exe - \cmd.exe - \powershell.exe - \pwsh.exe filter_main_build: ParentImage|contains: build CommandLine|contains: build condition: selection and not 1 of filter_main_* falsepositives: - Legitimate calls to system binaries - Company specific internal usage level: medium
Query: write Sigma for Detects technique used by MAZE ransomware to enumerate directories using Powershell
Matching passage: Sigma rule: Detects technique used by MAZE ransomware to enumerate directories using Powershell. Logsource: windows / ps_script. Rule: title: Powershell Directory Enumeration id: 162e69a7-7981-4344-84a9-0f1c9a217a52 status: test description: Detects technique used by MAZE ransomware to enumerate directories using Powershell references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md - https://www.mandiant.com/resources/tactics-techniques-procedures-associated-with-maze-ransomware-incidents author: frack113 date: 2022-03-17 tags: - attack.discovery - attack.t1083 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - foreach - Get-ChildItem - '-Path ' - '-ErrorAction ' - SilentlyContinue - 'Out-File ' - -append condition: selection falsepositives: - Legitimate PowerShell scripts level: medium
Near-miss passage: Sigma rule: Detects execution of powershell scripts via Runscripthelper.exe. Logsource: windows / process_creation. Rule: title: Suspicious Runscripthelper.exe id: eca49c87-8a75-4f13-9c73-a5a29e845f03 status: test description: Detects execution of powershell scripts via Runscripthelper.exe references: - https://lolbas-project.github.io/lolbas/Binaries/Runscripthelper/ author: Victor Sergeev, oscd.community date: 2020-10-09 modified: 2022-07-11 tags: - attack.execution - attack.stealth - attack.t1059 - attack.t1202 logsource: category: process_creation product: windows detection: selection: Image|endswith: \Runscripthelper.exe CommandLine|contains: surfacecheck condition: selection falsepositives: - Unknown level: medium
Query: exploit mediaserver in Android 4.4 and 5.1 before 5.1.1 LMY48X allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, 
Matching passage: CVE-2015-8073. CWE: CWE-119. CVSS: 10.0. mediaserver in Android 4.4 and 5.1 before 5.1.1 LMY48X allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 14388161, a different vulnerability than CVE-2015-6608 and CVE-2015-8072.
Near-miss passage: CVE-2015-7049. CWE: CWE-119. CVSS: 4.599999904632568. otools in Apple Xcode before 7.2 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted mach-o file, a different vulnerability than CVE-2015-7057.
Query: vulnerability: The Authentication Proxy feature in Cisco IOS does not properly handle invalid AAA return codes from RADIUS and TACACS+ servers, which allows remote attackers to bypass authenticat
Matching passage: CVE-2015-0607. CWE: CWE-287. CVSS: 4.300000190734863. The Authentication Proxy feature in Cisco IOS does not properly handle invalid AAA return codes from RADIUS and TACACS+ servers, which allows remote attackers to bypass authentication in opportunistic circumstances via a connection attempt that triggers an invalid code, as demonstrated by a connection attempt with a blank password, aka Bug IDs CSCuo09400 and CSCun16016.
Near-miss passage: CVE-2015-6237. CWE: CWE-287. CVSS: 9.800000190734863. The RPC service in Tripwire (formerly nCircle) IP360 VnE Manager 7.2.2 before 7.2.6 allows remote attackers to bypass authentication and (1) enumerate users, (2) reset passwords, or (3) manipulate IP filter restrictions via crafted "privileged commands."