alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects usage of certain functions and keywords that are used to manipulate security descriptors in order to potentially
Matching passage: Sigma rule: Detects usage of certain functions and keywords that are used to manipulate security descriptors in order to potentially. Logsource: windows / ps_script. Rule: title: Potential Persistence Via Security Descriptors - ScriptBlock id: 2f77047c-e6e9-4c11-b088-a3de399524cd status: test description: Detects usage of certain functions and keywords that are used to manipulate security descriptors in order to potentially set a backdoor. As seen used in the DAMP project. references: - https://github.com/HarmJ0y/DAMP author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-05 tags: - attack.persistence - attack.privilege-escalation - attack.defense-impairment logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - win32_Trustee - win32_Ace - .AccessMask - .AceType - .SetSecurityDescriptor ScriptBlockText|contains: - \Lsa\JD - \Lsa\Skew1 - \Lsa\Data - \Lsa\GBG condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "7za.dll". Logsource: windows / image_load. Rule: title: Potential 7za.DLL Sideloading id: 4f6edb78-5c21-42ab-a558-fd2a6fc1fd57 status: test description: Detects potential DLL sideloading of "7za.dll" references: - https://www.gov.pl/attachment/ee91f24d-3e67-436d-aa50-7fa56acf789d author: X__Junior date: 2023-06-09 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \7za.dll filter_main_legit_path: Image|startswith: - C:\Program Files (x86)\ - C:\Program Files\ ImageLoaded|startswith: - C:\Program Files (x86)\ - C:\Program Files\ condition: selection and not 1 of filter_main_* falsepositives: - Legitimate third party application located in "AppData" may leverage this DLL to offer 7z compression functionality and may generate false positives. Apply additional filters as needed. level: low
Query: describe CVE-2015-7897
Matching passage: CVE-2015-7897. CWE: CWE-119. CVSS: 7.5. The media scanning functionality in the face recognition library in android.media.process in Samsung Galaxy S6 Edge before G925VVRU4B0G9 allows remote attackers to gain privileges or cause a denial of service (memory corruption) via a crafted BMP image file.
Near-miss passage: CVE-2015-8285. CWE: CWE-119. CVSS: 7.5. The webssx.sys driver in QuickHeal 16.00 allows remote attackers to cause a denial of service.
Query: describe CVE-2015-8707
Matching passage: CVE-2015-8707. CWE: CWE-200. CVSS: 9.800000190734863. Password reset tokens in Magento CE before 1.9.2.2, and Magento EE before 1.14.2.2 are passed via a GET request and not canceled after use, which allows remote attackers to obtain user passwords via a crafted external service with access to the referrer field.
Near-miss passage: CVE-2015-9255. CWE: CWE-200. CVSS: 5.300000190734863. Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information about data, software versions, configuration, and virtual machines via a request to a Web Virtual Directory.
Query: detection rule: Detects DCShadow via create new SPN
Matching passage: Sigma rule: Detects DCShadow via create new SPN. Logsource: windows / security. Rule: title: Possible DC Shadow Attack id: 32e19d25-4aed-4860-a55a-be99cb0bf7ed related: - id: 611eab06-a145-4dfa-a295-3ccc5c20f59a type: derived status: test description: Detects DCShadow via create new SPN references: - https://twitter.com/gentilkiwi/status/1003236624925413376 - https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2 - https://web.archive.org/web/20180203014709/https://blog.alsid.eu/dcshadow-explained-4510f52fc19d?gi=c426ac876c48 author: Ilyas Ochkov, oscd.community, Chakib Gzenayi (@Chak092), Hosni Mribah date: 2019-10-25 modified: 2022-10-17 tags: - attack.credential-access - attack.defense-impairment - attack.t1207 logsource: product: windows service: security definition: The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule) detection: selection1: EventID: 4742 ServicePrincipalNames|contains: GC/ selection2: EventID: 5136 AttributeLDAPDisplayName: servicePrincipalName AttributeValue|startswith: GC/ condition: 1 of selection* falsepositives: - Valid on domain controllers; exclude known DCs level: medium
Near-miss passage: Sigma rule: Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use val. Logsource: windows / process_creation. Rule: title: New Remote Desktop Connection Initiated Via Mstsc.EXE id: 954f0af7-62dd-418f-b3df-a84bc2c7a774 status: test description: 'Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md#t1021001---remote-desktop-protocol - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mstsc author: frack113 date: 2022-01-07 modified: 2024-06-04 tags: - attack.lateral-movement - attack.t1021.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mstsc.exe - OriginalFileName: mstsc.exe selection_cli: CommandLine|contains|windash: ' /v:' filter_optional_wsl: ParentImage: C:\Windows\System32\lxss\wslhost.exe CommandLine|contains: C:\ProgramData\Microsoft\WSL\wslg.rdp condition: all of selection_* and not 1 of filter_optional_* falsepositives: - WSL (Windows Sub System For Linux) level: medium
Query: vulnerability: Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous befo
Matching passage: CVE-2015-7622. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-6685, CVE-2015-6686, CVE-2015-6693, CVE-2015-6694, and CVE-2015-6695.
Near-miss passage: CVE-2015-1817. CWE: CWE-119. CVSS: 9.800000190734863. Stack-based buffer overflow in the inet_pton function in network/inet_pton.c in musl libc 0.9.15 through 1.0.4, and 1.1.0 through 1.1.7 allows attackers to have unspecified impact via unknown vectors.
Query: vulnerability: Cisco WebEx Meeting Center places a meeting's access number in a URL, which allows remote attackers to obtain sensitive information and bypass intended attendance restrictions by v
Matching passage: CVE-2015-4207. CWE: CWE-200. CVSS: 5.0. Cisco WebEx Meeting Center places a meeting's access number in a URL, which allows remote attackers to obtain sensitive information and bypass intended attendance restrictions by visiting a meeting-registration page, aka Bug ID CSCus62147.
Near-miss passage: CVE-2015-0271. CWE: CWE-200. CVSS: 4.0. The log-viewing function in the Red Hat redhat-access-plugin before 6.0.3 for OpenStack Dashboard (horizon) allows remote attackers to read arbitrary files via a crafted path.
Query: rule covering Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access
Matching passage: Sigma rule: Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access. Logsource: windows / process_creation. Rule: title: Suspicious Invoke-WebRequest Execution With DirectIP id: 1edff897-9146-48d2-9066-52e8d8f80a2f status: test description: Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access references: - https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-21 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - powershell_ise.EXE - PowerShell.EXE - pwsh.dll selection_commands: CommandLine|contains: - 'curl ' - Invoke-RestMethod - Invoke-WebRequest - ' irm ' - 'iwr ' - 'wget ' selection_ip: CommandLine|contains: - ://1 - ://2 - ://3 - ://4 - ://5 - ://6 - ://7 - ://8 - ://9 condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic ev. Logsource: windows / file_delete. Rule: title: Exchange PowerShell Cmdlet History Deleted id: a55349d8-9588-4c5a-8e3b-1925fe2a4ffe status: test description: Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence references: - https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-26 modified: 2022-12-30 tags: - attack.stealth - attack.t1070 logsource: category: file_delete product: windows detection: selection: TargetFilename|startswith: \Logging\CmdletInfra\LocalPowerShell\Cmdlet\ TargetFilename|contains: _Cmdlet_ condition: selection falsepositives: - Possible FP during log rotation level: high
Query: patch priority for CVE-2015-4929
Matching passage: CVE-2015-4929. CWE: CWE-200. CVSS: 4.0. IBM License Metric Tool 9 before 9.2.1.0 and Endpoint Manager for Software Use Analysis 9 before 9.2.1.0 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information via a REST API request.
Near-miss passage: CVE-2015-5711. CWE: CWE-200. CVSS: 4.0. TIBCO Managed File Transfer Internet Server before 7.2.5, Managed File Transfer Command Center before 7.2.5, Slingshot before 1.9.4, and Vault before 2.0.1 allow remote authenticated users to obtain sensitive information via a crafted HTTP request.
Query: exploit Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of service (guest OS crash) or
Matching passage: CVE-2015-7512. CWE: CWE-120. CVSS: 9.0. Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet.
Near-miss passage: CVE-2015-10065. CWE: CWE-120. CVSS: 9.800000190734863. A vulnerability classified as critical was found in AenBleidd FiND. This vulnerability affects the function init_result of the file validator/my_validator.cpp. The manipulation leads to buffer overflow. The patch is identified as ee2eef34a83644f286c9adcaf30437f92e9c48f1. It is recommended to apply a patch to fix this issue. VDB-218458 is the identifier assigned to this vulnerability.
Query: campaign using Active Scanning
Matching passage: T1595 Active Scanning. Tactics: reconnaissance. Description: Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction. Adversaries may perform different forms of active scanning depending on what information they seek to gather. These scans can also be performed in various ways, including using native features of network protocols such as ICMP.(Citation: Botnet Scan)(Citation: OWASP Fingerprinting) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).
Near-miss passage: T1595.003 Wordlist Scanning. Tactics: reconnaissance. Description: Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques. While this technique employs similar methods to [Brute Force](https://attack.mitre.org/techniques/T1110), its goal is the identification of content and infrastructure rather than the discovery of valid credentials. Wordlists used in these scans may contain generic, commonly used names and file extensions or terms specific to a particular software. Adversaries may also create custom, target-specific wordlists using data gathered from other Reconnaissance techniques (ex: [Gather Victim Org Information](https://attack.mitre.org/techniques/T1591), or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)). For example, adversaries may use web content discovery tools such as Dirb, DirBuster, and GoBuster and generic or custom wordlists to enumerate a website’s pages and directories.(Citation: ClearSky Lebanese Cedar Jan 2021) This can help them to discover old, vulnerable pages or hidden administrative portals that could become the target of further operations (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [Brute Force](https://attack.mitre.org/techniques/T1110)). As cloud storage solutions typically use globally unique names, adversaries may also use target-specific wordlists and tools such as s3recon and GCPBucketBrute to enumerate public and private buckets on cloud infrastructure.(Citation: S3Recon GitHub)(Citation: GCPBucketBrute) Once storage objects are discovered, adversaries may leverage [Data from Cloud Storage](https://attack.mitre.org/techniques/T1530) to access valuable information that can be exfiltrated or used to escalate privileges and move laterally.
Query: explain CWE-344
Matching passage: CWE-344 Use of Invariant Value in Dynamically Changing Context. The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.
Near-miss passage: CWE-327 Use of a Broken or Risky Cryptographic Algorithm. The product uses a broken or risky cryptographic algorithm or protocol.
Query: CVE similar to CVE-2015-5779
Matching passage: CVE-2015-5779. CWE: CWE-119. CVSS: 7.5. QuickTime 7 in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-3765, CVE-2015-3779, CVE-2015-3788, CVE-2015-3789, CVE-2015-3790, CVE-2015-3791, CVE-2015-3792, CVE-2015-5751, and CVE-2015-5753.
Near-miss passage: CVE-2015-0826. CWE: CWE-119. CVSS: 6.800000190734863. The nsTransformedTextRun::SetCapitalization function in Mozilla Firefox before 36.0 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read of heap memory) via a crafted Cascading Style Sheets (CSS) token sequence that triggers a restyle or reflow operation.
Query: patch priority for CVE-2015-9285
Matching passage: CVE-2015-9285. CWE: CWE-79. CVSS: 6.099999904632568. esoTalk 1.0.0g4 has XSS via the PATH_INFO to the conversations/ URI.
Near-miss passage: CVE-2015-9369. CWE: CWE-79. CVSS: 6.099999904632568. Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Query: risk of In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 
Matching passage: CVE-2015-9176. CWE: CWE-119. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, Input_address is registered as a shared buffer and is not properly checked before use in OEMCrypto_Generic_Sign(). This allows addresses to be accessed that reside in secure/CP memory.
Near-miss passage: CVE-2015-3056. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-9161, CVE-2015-3046, CVE-2015-3049, CVE-2015-3050, CVE-2015-3051, CVE-2015-3052, CVE-2015-3057, CVE-2015-3070, and CVE-2015-3076.
Query: describe CVE-2015-7484
Matching passage: CVE-2015-7484. CWE: CWE-200. CVSS: 4.300000190734863. IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1 and 4.0 before 4.0.7 iFix10 allow remote authenticated users with access to lifecycle projects to obtain sensitive information by sending a crafted URL to the Lifecycle Query Engine. IBM X-Force ID: 108619.
Near-miss passage: CVE-2015-7421. CWE: CWE-200. CVSS: 3.700000047683716. Unspecified vulnerability in GSKit on IBM MQ M2000 appliances before 8.0.0.4 allows remote attackers to obtain sensitive information via unknown vectors, a different vulnerability than CVE-2015-7420.
Query: write Sigma for Detects the installation of the anydesk software service. Which could be an indication of anydesk abuse if you the softw
Matching passage: Sigma rule: Detects the installation of the anydesk software service. Which could be an indication of anydesk abuse if you the softw. Logsource: windows / system. Rule: title: Anydesk Remote Access Software Service Installation id: 530a6faa-ff3d-4022-b315-50828e77eef5 status: test description: Detects the installation of the anydesk software service. Which could be an indication of anydesk abuse if you the software isn't already used. references: - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ - https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/ author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2022-08-11 modified: 2025-02-24 tags: - attack.persistence logsource: product: windows service: system detection: selection_provider: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ServiceName|contains|all: - AnyDesk - Service - ImagePath|contains: AnyDesk condition: all of selection_* falsepositives: - Legitimate usage of the anydesk tool level: medium
Near-miss passage: Sigma rule: Detects a method to load DLL via LSASS process using an undocumented Registry key. Logsource: windows / registry_event. Rule: title: DLL Load via LSASS id: b3503044-60ce-4bf4-bbcb-e3db98788823 status: test description: Detects a method to load DLL via LSASS process using an undocumented Registry key references: - https://blog.xpnsec.com/exploring-mimikatz-part-1/ - https://twitter.com/SBousseaden/status/1183745981189427200 author: Florian Roth (Nextron Systems) date: 2019-10-16 modified: 2022-04-21 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1547.008 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: - \CurrentControlSet\Services\NTDS\DirectoryServiceExtPt - \CurrentControlSet\Services\NTDS\LsaDbExtPt filter_domain_controller: Image: C:\Windows\system32\lsass.exe Details: - '%%systemroot%%\system32\ntdsa.dll' - '%%systemroot%%\system32\lsadb.dll' condition: selection and not 1 of filter_* falsepositives: - Unknown level: high
Query: secure coding against Sensitive Non-Volatile Information Not Protected During Debug
Matching passage: CWE-1243 Sensitive Non-Volatile Information Not Protected During Debug. Access to security-sensitive information stored in fuses is not limited during debug.
Near-miss passage: CWE-653 Improper Isolation or Compartmentalization. The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.
Query: patch priority for CVE-2015-7077
Matching passage: CVE-2015-7077. CWE: CWE-119. CVSS: 7.199999809265137. The Intel Graphics Driver component in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (out-of-bounds memory access) via unspecified vectors.
Near-miss passage: CVE-2015-9195. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, MDM9650, MDM9655, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 808, SD 810, and SDX20, in a QTEE syscall handler, HLOS can cause a buffer overflow to occur.
Query: patch priority for CVE-2015-7183
Matching passage: CVE-2015-7183. CWE: CWE-119. CVSS: 7.5. Integer overflow in the PL_ARENA_ALLOCATE implementation in Netscape Portable Runtime (NSPR) in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.
Near-miss passage: CVE-2015-2379. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: exploit WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corru
Matching passage: CVE-2015-7012. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1, APPLE-SA-2015-10-21-3, and APPLE-SA-2015-10-21-5.
Near-miss passage: CVE-2015-5778. CWE: CWE-119. CVSS: 6.800000190734863. CoreMedia Playback in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-5777.