alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for okta / okta
Matching passage: Sigma rule: Detects when an application Sign-on Policy is modified or deleted.. Logsource: okta / okta. Rule: title: Okta Application Sign-On Policy Modified or Deleted id: 8f668cc4-c18e-45fe-ad00-624a981cf88a status: test description: Detects when an application Sign-on Policy is modified or deleted. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-12 modified: 2026-04-27 tags: - attack.impact logsource: product: okta service: okta detection: selection: eventType: - application.policy.sign_on.update - application.policy.sign_on.rule.delete condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. This is often used by m. Logsource: windows / process_creation. Rule: title: Greedy File Deletion Using Del id: 204b17ae-4007-471b-917b-b917b315c5db status: test description: Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. This is often used by malware to delete content of folders that perhaps contains the initial malware infection or to delete evidence. references: - https://www.joesandbox.com/analysis/509330/0/html#1044F3BDBE3BB6F734E357235F4D5898582D - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase author: frack113 , X__Junior (Nextron Systems) date: 2021-12-02 modified: 2023-09-11 tags: - attack.stealth - attack.t1070.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_del: CommandLine|contains: - 'del ' - 'erase ' selection_extensions: CommandLine|contains: - \\\*.au3 - \\\*.dll - \\\*.exe - \\\*.js condition: all of selection_* falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-6404
Matching passage: CVE-2015-6404. CWE: CWE-200. CVSS: 4.0. Cisco Hosted Collaboration Mediation Fulfillment 10.6(3) does not use RBAC, which allows remote authenticated users to obtain sensitive credential information by leveraging admin access and making SOAP API requests, aka Bug ID CSCuw84374.
Near-miss passage: CVE-2015-0136. CWE: CWE-200. CVSS: 2.0999999046325684. powervc-iso-import in IBM PowerVC 1.2.0.x before 1.2.0.4 and 1.2.1.x before 1.2.2 places an access token on the command line during IVM and PowerKVM management, which allows local users to obtain sensitive information by listing the process.
Query: weakness Unrestricted Externally Accessible Lock
Matching passage: CWE-412 Unrestricted Externally Accessible Lock. The product properly checks for the existence of a lock, but the lock can be externally controlled or influenced by an actor that is outside of the intended sphere of control.
Near-miss passage: CWE-642 External Control of Critical State Data. The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.
Query: patch priority for CVE-2015-4303
Matching passage: CVE-2015-4303. CWE: CWE-264. CVSS: 6.5. Cisco TelePresence Video Communication Server (VCS) X8.5.2 allows remote authenticated users to execute arbitrary commands in the context of the nobody user account via an unspecified web-page parameter, aka Bug ID CSCuv12333.
Near-miss passage: CVE-2015-3290. CWE: CWE-264. CVSS: 7.199999809265137. arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during nested NMI processing, which allows local users to gain privileges by triggering an NMI within a certain instruction window.
Query: weakness Reliance on Runtime Component in Generated Code
Matching passage: CWE-1101 Reliance on Runtime Component in Generated Code. The product uses automatically-generated code that cannot be executed without a specific runtime support component.
Near-miss passage: CWE-1233 Security-Sensitive Hardware Controls with Missing Lock Bit Protection. The product uses a register lock bit protection mechanism, but it does not ensure that the lock bit prevents modification of system registers or controls that perform changes to important hardware system configuration.
Query: patch priority for CVE-2015-4293
Matching passage: CVE-2015-4293. CWE: CWE-399. CVSS: 5.0. The packet-reassembly implementation in Cisco IOS XE 3.13S and earlier allows remote attackers to cause a denial of service (CPU consumption or packet loss) via fragmented (1) IPv4 or (2) IPv6 packets that trigger ATTN-3-SYNC_TIMEOUT errors after reassembly failures, aka Bug ID CSCuo37957.
Near-miss passage: CVE-2015-8877. CWE: CWE-399. CVSS: 7.5. The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function.
Query: reconnaissance using Digital Certificates
Matching passage: T1596.003 Digital Certificates. Tactics: reconnaissance. Description: Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content. These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location. Adversaries may search digital certificate data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about certificates.(Citation: SSLShopper Lookup) Digital certificate data may also be available from artifacts signed by the organization (ex: certificates used from encrypted web traffic are served with content).(Citation: Medium SSL Cert) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Near-miss passage: T1596.002 WHOIS. Tactics: reconnaissance. Description: Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers.(Citation: WHOIS) Adversaries may search WHOIS data to gather actionable information. Threat actors can use online resources or command-line utilities to pillage through WHOIS data for information about potential victims. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Query: Sigma rule for Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfus
Matching passage: Sigma rule: Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfus. Logsource: windows / process_creation. Rule: title: HackTool - HandleKatz LSASS Dumper Execution id: ca621ba5-54ab-4035-9942-d378e6fcde3c status: test description: Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same references: - https://github.com/codewhitesec/HandleKatz author: Florian Roth (Nextron Systems) date: 2022-08-18 modified: 2024-11-23 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection_loader_img: Image|endswith: \loader.exe CommandLine|contains: '--pid:' selection_loader_imphash: Hashes|contains: - IMPHASH=38D9E015591BBFD4929E0D0F47FA0055 - IMPHASH=0E2216679CA6E1094D63322E3412D650 selection_flags: CommandLine|contains|all: - '--pid:' - '--outfile:' CommandLine|contains: - .dmp - lsass - .obf - dump condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Windows update errors including installation failures and connection issues. Defenders should observe this in ca. Logsource: windows / system. Rule: title: Windows Update Error id: 13cfeb75-9e33-4d04-b0f7-ab8faaa95a59 status: stable description: 'Detects Windows update errors including installation failures and connection issues. Defenders should observe this in case critical update KBs aren''t installed. ' references: - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/1903/W10_1903_Pro_20200714_18362.959/WEPExplorer/Microsoft-Windows-WindowsUpdateClient.xml author: frack113 date: 2021-12-04 modified: 2023-09-07 tags: - attack.impact - attack.resource-development - attack.t1584 logsource: product: windows service: system detection: selection: Provider_Name: Microsoft-Windows-WindowsUpdateClient EventID: - 16 - 20 - 24 - 213 - 217 condition: selection falsepositives: - Unknown level: informational
Query: explain CWE-178
Matching passage: CWE-178 Improper Handling of Case Sensitivity. The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
Near-miss passage: CWE-156 Improper Neutralization of Whitespace. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as whitespace when they are sent to a downstream component.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects modification of LSA PPL protection settings via CommandLine. It may indicate an attempt to disable protection an. Logsource: windows / process_creation. Rule: title: LSA PPL Protection Setting Modification via CommandLine id: 8c0eca51-0f88-4db2-9183-fdfb10c703f9 status: test description: 'Detects modification of LSA PPL protection settings via CommandLine. It may indicate an attempt to disable protection and enable credential dumping tools to access LSASS process memory. ' references: - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/ - https://github.com/shoober420/windows11-scripts/blob/38d83331738cd713ccb42f2c4557d17a27aefd98/Windows11Tweaks.bat#L1825 author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2022-03-22 modified: 2026-03-13 tags: - attack.defense-impairment - attack.t1689 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \reg.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - reg.exe - powershell.exe - pwsh.dll selection_cli_action: CommandLine|contains|all: - ControlSet - \Control\Lsa CommandLine|contains: - Set-ItemProperty - New-ItemProperty - ' add ' selection_key: CommandLine|contains: - IsPplAutoEnabled - RunAsPPL - RunAsPPLBoot condition: all of selection_* falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Window. Logsource: windows / process_creation. Rule: title: Arbitrary File Download Via ConfigSecurityPolicy.EXE id: 1f0f6176-6482-4027-b151-00071af39d7e status: test description: 'Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Windows Defender. Users can configure different pilot collections for each of the co-management workloads. It can be abused by attackers in order to upload or download files. ' references: - https://lolbas-project.github.io/lolbas/Binaries/ConfigSecurityPolicy/ author: frack113 date: 2021-11-26 modified: 2022-05-16 tags: - attack.exfiltration - attack.t1567 logsource: category: process_creation product: windows detection: selection_img: - CommandLine|contains: ConfigSecurityPolicy.exe - Image|endswith: \ConfigSecurityPolicy.exe - OriginalFileName: ConfigSecurityPolicy.exe selection_url: CommandLine|contains: - ftp:// - http:// - https:// condition: all of selection_* falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-4183
Matching passage: CVE-2015-4183. CWE: CWE-78. CVSS: 7.199999809265137. Cisco UCS Central Software 1.2(1a) allows local users to gain privileges for OS command execution via a crafted CLI parameter, aka Bug ID CSCut32795.
Near-miss passage: CVE-2015-2201. CWE: CWE-78. CVSS: 7.199999809265137. Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and file disclosure by administrative users.
Query: risk of Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0 allow remote attackers to cause a denial of service (memory corruption and application cra
Matching passage: CVE-2015-2726. CWE: CWE-119. CVSS: 10.0. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Near-miss passage: CVE-2015-2494. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486, CVE-2015-2487, CVE-2015-2490, CVE-2015-2492, CVE-2015-2498, and CVE-2015-2499.
Query: risk of CFNetwork in Apple iOS before 9.1 and OS X before 10.11.1 does not properly consider the uppercase-versus-lowercase distinction during cookie parsing, which allows remote web serve
Matching passage: CVE-2015-7023. CWE: CWE-17. CVSS: 5.800000190734863. CFNetwork in Apple iOS before 9.1 and OS X before 10.11.1 does not properly consider the uppercase-versus-lowercase distinction during cookie parsing, which allows remote web servers to overwrite cookies via unspecified vectors.
Near-miss passage: CVE-2015-8027. CWE: CWE-17. CVSS: 7.5. Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not ensure the availability of a parser for each HTTP socket, which allows remote attackers to cause a denial of service (uncaughtException and service outage) via a pipelined HTTP request.
Query: common weakness: Improper Neutralization of Special Elements
Matching passage: CWE-138 Improper Neutralization of Special Elements. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.
Near-miss passage: CWE-493 Critical Public Variable Without Final Modifier. The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values.
Query: patch priority for CVE-2015-0733
Matching passage: CVE-2015-0733. CWE: CWE-113. CVSS: 4.300000190734863. CRLF injection vulnerability in the HTTP Header Handler in Digital Broadband Delivery System in Cisco Headend System Release allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks, via a crafted request, aka Bug ID CSCur25580.
Near-miss passage: CVE-2015-1445. CWE: CWE-113. CVSS: 7.199999809265137. HTTP header injection in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30.
Query: actor TTPs: Path Interception by Unquoted Path
Matching passage: T1574.009 Path Interception by Unquoted Path. Tactics: stealth, execution. Description: Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch. Service paths (Citation: Microsoft CurrentControlSet Services) and shortcut paths may also be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., <code>C:\unsafe path with space\program.exe</code> vs. <code>"C:\safe path with space\program.exe"</code>). (Citation: Help eliminate unquoted path) (stored in Windows Registry keys) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is <code>C:\program files\myapp.exe</code>, an adversary may create a program at <code>C:\program.exe</code> that will be run instead of the intended program. (Citation: Windows Unquoted Services) (Citation: Windows Privilege Escalation Guide) This technique can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.
Near-miss passage: T1574.004 Dylib Hijacking. Tactics: stealth, execution. Description: Adversaries may execute their own payloads by placing a malicious dynamic library (dylib) with an expected name in a path a victim application searches at runtime. The dynamic loader will try to find the dylibs based on the sequential order of the search paths. Paths to dylibs may be prefixed with <code>@rpath</code>, which allows developers to use relative paths to specify an array of search paths used at runtime based on the location of the executable. Additionally, if weak linking is used, such as the <code>LC_LOAD_WEAK_DYLIB</code> function, an application will still execute even if an expected dylib is not present. Weak linking enables developers to run an application on multiple macOS versions as new APIs are added. Adversaries may gain execution by inserting malicious dylibs with the name of the missing dylib in the identified path.(Citation: Wardle Dylib Hijack Vulnerable Apps)(Citation: Wardle Dylib Hijacking OSX 2015)(Citation: Github EmpireProject HijackScanner)(Citation: Github EmpireProject CreateHijacker Dylib) Dylibs are loaded into an application's address space allowing the malicious dylib to inherit the application's privilege level and resources. Based on the application, this could result in privilege escalation and uninhibited network access. This method may also evade detection from security products since the execution is masked under a legitimate process.(Citation: Writing Bad Malware for OSX)(Citation: wardle artofmalware volume1)(Citation: MalwareUnicorn macOS Dylib Injection MachO)
Query: exploit The (1) VBScript and (2) JScript engines in Microsoft Internet Explorer 8 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a cr
Matching passage: CVE-2015-2493. CWE: CWE-119. CVSS: 9.300000190734863. The (1) VBScript and (2) JScript engines in Microsoft Internet Explorer 8 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-7073. CWE: CWE-119. CVSS: 6.800000190734863. Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted SSL handshake.
Query: hunt for Remote Email Collection activity
Matching passage: T1114.002 Remote Email Collection. Tactics: collection. Description: Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords.
Near-miss passage: T1114.001 Local Email Collection. Tactics: collection. Description: Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files. Outlook stores data locally in offline data files with an extension of .ost. Outlook 2010 and later supports .ost file sizes up to 50GB, while earlier versions of Outlook support up to 20GB.(Citation: Outlook File Sizes) IMAP accounts in Outlook 2013 (and earlier) and POP accounts use Outlook Data Files (.pst) as opposed to .ost, whereas IMAP accounts in Outlook 2016 (and later) use .ost files. Both types of Outlook data files are typically stored in `C:\Users\<username>\Documents\Outlook Files` or `C:\Users\<username>\AppData\Local\Microsoft\Outlook`.(Citation: Microsoft Outlook Files)