alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects when a repository or an organization is being transferred to another location.
Matching passage: Sigma rule: Detects when a repository or an organization is being transferred to another location.. Logsource: github / audit. Rule: title: Github Repository/Organization Transferred id: 04ad83ef-1a37-4c10-b57a-81092164bf33 status: test description: Detects when a repository or an organization is being transferred to another location. references: - https://docs.github.com/en/repositories/creating-and-managing-repositories/transferring-a-repository - https://docs.github.com/en/organizations/managing-organization-settings/transferring-organization-ownership - https://docs.github.com/en/migrations - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#migration author: Romain Gaillard (@romain-gaillard) date: 2024-07-29 tags: - attack.persistence - attack.exfiltration - attack.t1020 - attack.t1537 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action: - migration.create - org.transfer_outgoing - org.transfer - repo.transfer_outgoing condition: selection falsepositives: - Allowed administrative activities. level: medium
Near-miss passage: Sigma rule: The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows. Logsource: windows / process_creation. Rule: title: Arbitrary Shell Command Execution Via Settingcontent-Ms id: 24de4f3b-804c-4165-b442-5a06a2302c7e status: test description: The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries. references: - https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39 author: Sreeman date: 2020-03-13 modified: 2022-04-14 tags: - attack.t1204 - attack.t1566.001 - attack.execution - attack.initial-access logsource: category: process_creation product: windows detection: selection: CommandLine|contains: .SettingContent-ms filter: CommandLine|contains: immersivecontrolpanel condition: selection and not filter falsepositives: - Unknown level: medium
Query: exploit Siemens SICAM MIC devices with firmware before 2404 allow remote attackers to bypass authentication and obtain administrative access via unspecified HTTP requests.
Matching passage: CVE-2015-5386. CWE: CWE-20. CVSS: 9.300000190734863. Siemens SICAM MIC devices with firmware before 2404 allow remote attackers to bypass authentication and obtain administrative access via unspecified HTTP requests.
Near-miss passage: CVE-2015-8466. CWE: CWE-20. CVSS: 7.400000095367432. Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request that lacks a Date header.
Query: exploit The F1BookView ActiveX control in F1 Bookview in Schneider Electric ProClima before 6.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corru
Matching passage: CVE-2015-8561. CWE: CWE-119. CVSS: 6.800000190734863. The F1BookView ActiveX control in F1 Bookview in Schneider Electric ProClima before 6.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted integer value to the (1) AttachToSS, (2) CopyAll, (3) CopyRange, (4) CopyRangeEx, or (5) SwapTable method, a different vulnerability than CVE-2015-7918.
Near-miss passage: CVE-2015-1332. CWE: CWE-119. CVSS: 8.800000190734863. The oxide::JavaScriptDialogManager function in oxide-qt before 1.9.1 as packaged in Ubuntu 15.04 and Ubuntu 14.04 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted website.
Query: SOC runbook when seeing Outbound C2 pattern associated with Firmware
Matching passage: Playbook for T1592.003 Firmware. 1) Validate alert telemetry against T1592.003. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: reconnaissance. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may gather information about the victim's host firmware that can be used during targeting. Information about host firmware may include a variety of details such as type and versions on specific hosts, which may be used to infer more information about hosts in the environment (ex: configuration, purpose, age/patch level, etc.). Adversaries may gather this information in various ways, su
Near-miss passage: Playbook for T1592 Gather Victim Host Information. Different response path focused on reconnaissance.
Query: risk of Buffer overflow in Ricoh DL FTP Server 1.1.0.6 and earlier allows remote attackers to execute arbitrary code via a long USER command.
Matching passage: CVE-2015-6750. CWE: CWE-119. CVSS: 7.5. Buffer overflow in Ricoh DL FTP Server 1.1.0.6 and earlier allows remote attackers to execute arbitrary code via a long USER command.
Near-miss passage: CVE-2015-5818. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Query: risk of The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identificat
Matching passage: CVE-2015-1793. CWE: CWE-254. CVSS: 6.5. The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.
Near-miss passage: CVE-2015-3658. CWE: CWE-254. CVSS: 6.800000190734863. The Page Loading functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly consider redirects during decisions about sending an Origin header, which makes it easier for remote attackers to bypass CSRF protection mechanisms via a crafted web site.
Query: Outbound C2 pattern associated with Netsh Helper DLL
Matching passage: T1546.007 Netsh Helper DLL. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility.(Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at <code>HKLM\SOFTWARE\Microsoft\Netsh</code>. Adversaries can use netsh.exe helper DLLs to trigger execution of arbitrary code in a persistent manner. This execution would take place anytime netsh.exe is executed, which could happen automatically, with another persistence technique, or if other software (ex: VPN) is present on the system that executes netsh.exe as part of its normal functionality.(Citation: Github Netsh Helper CS Beacon)(Citation: Demaske Netsh Persistence)
Near-miss passage: T1546.016 Installer Packages. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence and elevate privileges by using an installer to trigger the execution of malicious content. Installer packages are OS specific and contain the resources an operating system needs to install applications on a system. Installer packages can include scripts that run prior to installation as well as after installation is complete. Installer scripts may inherit elevated permissions when executed. Developers often use these scripts to prepare the environment for installation, check requirements, download dependencies, and remove files after installation.(Citation: Installer Package Scripting Rich Trouton) Using legitimate applications, adversaries have distributed applications with modified installer scripts to execute malicious content. When a user installs the application, they may be required to grant administrative permissions to allow the installation. At the end of the installation process of the legitimate application, content such as macOS `postinstall` scripts can be executed with the inherited elevated permissions. Adversaries can use these scripts to execute a malicious executable or install other malicious components (such as a [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)) with the elevated permissions.(Citation: Application Bundle Manipulation Brandon Dalton)(Citation: wardle evilquest parti)(Citation: Windows AppleJeus GReAT)(Citation: Debian Manual Maintainer Scripts) Depending on the distribution, Linux versions of package installer scripts are sometimes called maintainer scripts or post installation scripts. These scripts can include `preinst`, `postinst`, `prerm`, `postrm` scripts and run as root when executed. For Windows, the Microsoft Installer services uses `.msi` files to manage the installing, updating, and uninstalling of applications. These installation routines may also include instructions to perform additional actions that may be abused by adversaries.(Citation: Microsoft Installation Pro
Query: vulnerability: Cross-site scripting (XSS) vulnerability in Cisco IM and Presence Service before 10.5 MR1 allows remote attackers to inject arbitrary web script or HTML by constructing a crafted U
Matching passage: CVE-2015-4294. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Cisco IM and Presence Service before 10.5 MR1 allows remote attackers to inject arbitrary web script or HTML by constructing a crafted URL that leverages incomplete filtering of HTML elements, aka Bug ID CSCut41766.
Near-miss passage: CVE-2015-1888. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Content Navigator 2.0.2 before 2.0.2-ICN-FP007 and 2.0.3 before 2.0.3-ICN-FP003, as used in Content Manager, FileNet Content Manager, Content Foundation, Content Manager OnDemand, and other products, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: risk of The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged 
Matching passage: CVE-2015-10001. CWE: CWE-352. CVSS: 4.300000190734863. The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads
Near-miss passage: CVE-2015-5170. CWE: CWE-352. CVSS: 8.800000190734863. Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attackers to conduct cross-site request forgery (CSRF) attacks on PWS and log a user into an arbitrary account by leveraging lack of CSRF checks.
Query: Sigma rule for Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.
Matching passage: Sigma rule: Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.. Logsource: windows / ps_classic_start. Rule: title: Nslookup PowerShell Download Cradle id: 999bff6d-dc15-44c9-9f5c-e1051bfc86e1 related: - id: 1b3b01c7-84e9-4072-86e5-fc285a41ff23 type: similar status: test description: Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records. references: - https://twitter.com/Alh4zr3d/status/1566489367232651264 author: Sai Prashanth Pulisetti @pulisettis, Aishwarya Singam date: 2022-12-10 modified: 2025-02-25 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_classic_start detection: selection: Data|contains|all: - powershell - nslookup - '[1]' Data|contains: - -q=txt http - -querytype=txt http - -type=txt http condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'r. Logsource: windows / process_creation. Rule: title: Potential Renamed Rundll32 Execution id: 2569ed8c-1147-498a-9b8c-2ad3656b10ed related: - id: 0ba1da6d-b6ce-4366-828c-18826c9de23e type: derived status: test description: Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection references: - https://twitter.com/swisscom_csirt/status/1331634525722521602?s=20 - https://app.any.run/tasks/f74c5157-8508-4ac6-9805-d63fe7b0d399/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-22 modified: 2023-02-03 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: CommandLine|contains: DllRegisterServer filter: Image|endswith: \rundll32.exe condition: selection and not filter falsepositives: - Unlikely level: high
Query: risk of Use-after-free vulnerability in the DNS server in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via cra
Matching passage: CVE-2015-6125. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in the DNS server in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted requests, aka "Windows DNS Use After Free Vulnerability."
Near-miss passage: CVE-2015-3272. CWE: UNKNOWN. CVSS: 7.400000095367432. Open redirect vulnerability in the clean_param function in lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving an HTTP Referer header that has a substring match with a local URL.
Query: patch priority for CVE-2015-6463
Matching passage: CVE-2015-6463. CWE: UNKNOWN. CVSS: 5.800000190734863. CodeWrights HART Comm DTM components, as used with Endress+Hauser FieldCare, allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a longtag XML schema containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Near-miss passage: CVE-2015-4863. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in the Portable Clusterware component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Query: containment actions for Outbound C2 pattern associated with Udev Rules
Matching passage: Playbook for T1546.017 Udev Rules. 1) Validate alert telemetry against T1546.017. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: persistence, privilege escalation. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may maintain persistence through executing malicious content triggered using udev rules. Udev is the Linux kernel device manager that dynamically manages device nodes, handles access to pseudo-device files in the `/dev` directory, and responds to hardware events, such as when external devices like hard drives or keyboards are plugged in or removed. Udev uses rule files with `match keys
Near-miss passage: Playbook for T1546.009 AppCert DLLs. Different response path focused on privilege escalation, persistence.
Query: how to detect Audio-Visual Content
Matching passage: T1683.002 Audio-Visual Content. Tactics: resource development. Description: Adversaries may create or manipulate audio, image, and video content to support targeting and malicious operations. Adversaries may also use synthetic voice recordings, real-time altered audio or video during live interactions, fabricated profile photos and identity documents, or video content depicting fabricated or impersonated individuals.(Citation: Nov AI Threat Tracker) Content may be produced manually through editing tools, generated using AI-assisted tools, or produced using third-party synthetic services.(Citation: FBI 2025 AI Generate Content)(Citation: Europol Deepfakes) AI-assisted tools have enabled adversaries to produce synthetic media at scale and generate content that is more difficult to identify as inauthentic. Audio-visual content produced through these methods may be used in support of other techniques, such as [Phishing](https://attack.mitre.org/techniques/T1660), [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003), [Phishing for Information](https://attack.mitre.org/techniques/T1598), [Internal Spearphishing](https://attack.mitre.org/techniques/T1534), [Social Engineering](https://attack.mitre.org/techniques/T1684), [Financial Theft](https://attack.mitre.org/techniques/T1657), or [Establish Accounts](https://attack.mitre.org/techniques/T1585).
Near-miss passage: T1683 Generate Content. Tactics: resource development. Description: Adversaries may create or generate content to support targeting and operations. This content may be used to establish personas, impersonate known individuals or organizations, and support [Social Engineering](https://attack.mitre.org/techniques/T1684), fraud, or influence activities. Written materials, audio, images, video, or other media may be developed and tailored to the target and objective.(Citation: IBM AI-Generated Content) Content development may occur prior to or during an operation. Adversaries may develop or generate content in-house, source it through third parties, or produce it using AI-assisted tools. Adversaries may use AI to research targets, develop pretexts, and better understand the organizations and individuals they intend to target or deceive prior to generating content (i.e., [Query Public AI Services](https://attack.mitre.org/techniques/T1682)); for obtaining access to AI tools used in content generation, see [Artificial Intelligence](https://attack.mitre.org/techniques/T1588/007). Content may be leveraged in support of techniques such as [Phishing](https://attack.mitre.org/techniques/T1566), [Phishing for Information](https://attack.mitre.org/techniques/T1598), [Social Engineering](https://attack.mitre.org/techniques/T1684), [Financial Theft](https://attack.mitre.org/techniques/T1657), or [Establish Accounts](https://attack.mitre.org/techniques/T1585). Generated or developed content does not include malicious code or scripts (i.e., [Develop Capabilities](https://attack.mitre.org/techniques/T1587) and [Artificial Intelligence](https://attack.mitre.org/techniques/T1588/007)).
Query: describe CVE-2015-0122
Matching passage: CVE-2015-0122. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Rational Team Concert 2.x and 3.x before 3.0.1.6 iFix 5, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-0123.
Near-miss passage: CVE-2015-3883. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in qdPM 8.3 allow remote attackers to inject arbitrary web script or HTML via the (1) search[keywords] parameter to index.php/users page; the (2) "Name of application" on index.php/configuration; (3) a new project name on index.php/projects; (4) the task name on index.php/tasks; (5) ticket name on index.php/tickets; (6) discussion name on index.php/discussions; (7) report name on index.php/projectReports; or (8) event name on index.php/scheduler/personal.
Query: rule covering Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain
Matching passage: Sigma rule: Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain. Logsource: windows / security. Rule: title: DPAPI Domain Master Key Backup Attempt id: 39a94fd1-8c9a-4ff6-bf22-c058762f8014 status: test description: Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain Controller. references: - https://threathunterplaybook.com/hunts/windows/190620-DomainDPAPIBackupKeyExtraction/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-08-10 modified: 2023-03-15 tags: - attack.credential-access - attack.t1003.004 logsource: product: windows service: security detection: selection: EventID: 4692 condition: selection falsepositives: - If a computer is a member of a domain, DPAPI has a backup mechanism to allow unprotection of the data. Which will trigger this event. level: medium
Near-miss passage: Sigma rule: Detects remote RPC calls to get event log information via EVEN or EVEN6. Logsource: rpc_firewall / application. Rule: title: Remote Event Log Recon id: 2053961f-44c7-4a64-b62d-f6e72800af0d status: test description: Detects remote RPC calls to get event log information via EVEN or EVEN6 references: - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.discovery logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:82273fdc-e32a-18c3-3f78-827929dc23ea and uuid:f6beaff7-1e19-4fbb-9f8f-b89e2018337c"' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: - 82273fdc-e32a-18c3-3f78-827929dc23ea - f6beaff7-1e19-4fbb-9f8f-b89e2018337c condition: selection falsepositives: - Remote administrative tasks on Windows Events level: high
Query: describe CVE-2015-9296
Matching passage: CVE-2015-9296. CWE: CWE-79. CVSS: 6.099999904632568. The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.
Near-miss passage: CVE-2015-8687. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in the Management Console in Alcatel-Lucent Motive Home Device Manager (HDM) before 4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) deviceTypeID parameter to DeviceType/getDeviceType.do; the (2) policyActionClass or (3) policyActionName parameter to PolicyAction/findPolicyActions.do; the deviceID parameter to (4) SingleDeviceMgmt/getDevice.do or (5) device/editDevice.do; the operation parameter to (6) ajax.do or (7) xmlHttp.do; or the (8) policyAction, (9) policyClass, or (10) policyName parameter to policy/findPolicies.do.