alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects the pattern of UAC Bypass using registry key manipulation of sdclt.exe (e.g. UACMe 53)
Matching passage: Sigma rule: Detects the pattern of UAC Bypass using registry key manipulation of sdclt.exe (e.g. UACMe 53). Logsource: windows / registry_set. Rule: title: UAC Bypass via Sdclt id: 5b872a46-3b90-45c1-8419-f675db8053aa status: test description: Detects the pattern of UAC Bypass using registry key manipulation of sdclt.exe (e.g. UACMe 53) references: - https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/ - https://github.com/hfiref0x/UACME author: Omer Yampel, Christian Burkard (Nextron Systems) date: 2017-03-17 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.t1548.002 - car.2019-04-001 logsource: category: registry_set product: windows detection: selection1: TargetObject|endswith: Software\Classes\exefile\shell\runas\command\isolatedCommand selection2: TargetObject|endswith: Software\Classes\Folder\shell\open\command\SymbolicLinkValue Details|re: -1[0-9]{3}\\Software\\Classes\\ condition: 1 of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of "getcap" binary. This is often used during recon activity to determine potential binaries that can be a. Logsource: linux / process_creation. Rule: title: Capabilities Discovery - Linux id: d8d97d51-122d-4cdd-9e2f-01b4b4933530 status: test description: Detects usage of "getcap" binary. This is often used during recon activity to determine potential binaries that can be abused as GTFOBins or other. references: - https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes - https://github.com/carlospolop/PEASS-ng - https://github.com/diego-treitos/linux-smart-enumeration author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-28 modified: 2026-01-24 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: linux detection: selection: Image|endswith: /getcap CommandLine|contains: ' -r ' condition: selection falsepositives: - Unknown level: low
Query: describe CVE-2015-10009
Matching passage: CVE-2015-10009. CWE: CWE-94. CVSS: 9.800000190734863. A vulnerability was found in nterchange up to 4.1.0. It has been rated as critical. This issue affects the function getContent of the file app/controllers/code_caller_controller.php. The manipulation of the argument q with the input %5C%27%29;phpinfo%28%29;/* leads to code injection. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.1 is able to address this issue. The patch is named fba7d89176fba8fe289edd58835fe45080797d99. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217187.
Near-miss passage: CVE-2015-9272. CWE: CWE-94. CVSS: 9.800000190734863. The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code.
Query: exploit The RESTful module 7.x-1.x before 7.x-1.3 for Drupal does not properly cache pages of authenticated users when using non-cookie authentication providers, which allows remote attack
Matching passage: CVE-2015-7228. CWE: UNKNOWN. CVSS: 5.0. The RESTful module 7.x-1.x before 7.x-1.3 for Drupal does not properly cache pages of authenticated users when using non-cookie authentication providers, which allows remote attackers to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-5652. CWE: UNKNOWN. CVSS: 7.199999809265137. Untrusted search path vulnerability in python.exe in Python through 3.5.0 on Windows allows local users to gain privileges via a Trojan horse readline.pyd file in the current working directory. NOTE: the vendor says "It was determined that this is a longtime behavior of Python that cannot really be altered at this point."
Query: risk of In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 400, SD 800, SD 820, and SD 820A, lack of input val
Matching passage: CVE-2015-9112. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 400, SD 800, SD 820, and SD 820A, lack of input validation in QSEE can cause potential buffer overflow.
Near-miss passage: CVE-2015-1144. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in the UniformTypeIdentifiers component in Apple OS X before 10.10.3 allows local users to gain privileges via a crafted Uniform Type Identifier.
Query: risk of Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0
Matching passage: CVE-2015-8064. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-0496. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote authenticated users to affect confidentiality via vectors related to PIA Search Functionality.
Query: describe CVE-2015-0840
Matching passage: CVE-2015-0840. CWE: CWE-284. CVSS: 4.300000190734863. The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc).
Near-miss passage: CVE-2015-9291. CWE: CWE-284. CVSS: 7.5. cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221).
Query: exploit Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.
Matching passage: CVE-2015-2293. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page.
Near-miss passage: CVE-2015-4586. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Alcatel-Lucent CellPipe 7130 RG 5Ae.M2013 HOL with firmware 1.0.0.20h.HOL allows remote attackers to hijack the authentication of administrators for requests that create a user account via an add_user action in a request to password.cmd.
Query: Sigma rule for Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activit
Matching passage: Sigma rule: Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activit. Logsource: windows / process_creation. Rule: title: Privilege Escalation via Named Pipe Impersonation id: 9bd04a79-dabe-4f1f-a5ff-92430265c96b related: - id: f35c5d71-b489-4e22-a115-f003df287317 type: derived status: test description: Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity. references: - https://www.elastic.co/guide/en/security/current/privilege-escalation-via-named-pipe-impersonation.html author: Tim Rauch, Elastic (idea) date: 2022-09-27 modified: 2022-12-30 tags: - attack.lateral-movement - attack.t1021 logsource: category: process_creation product: windows detection: selection_name: - Image|endswith: - \cmd.exe - \powershell.exe - OriginalFileName: - Cmd.Exe - PowerShell.EXE selection_args: CommandLine|contains|all: - echo - '>' - \\\\.\\pipe\\ condition: all of selection* falsepositives: - Other programs that cause these patterns (please report) level: high
Near-miss passage: Sigma rule: Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.. Logsource: opencanary / application. Rule: title: OpenCanary - MSSQL Login Attempt Via Windows Authentication id: 6e78f90f-0043-4a01-ac41-f97681613a66 status: test description: 'Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication. ' references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.credential-access - attack.collection - attack.t1003 - attack.t1213 logsource: category: application product: opencanary detection: selection: logtype: 9002 condition: selection falsepositives: - Unlikely level: high
Query: rule covering Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions
Matching passage: Sigma rule: Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions. Logsource: linux / process_creation. Rule: title: ESXi Admin Permission Assigned To Account Via ESXCLI id: 9691f58d-92c1-4416-8bf3-2edd753ec9cf status: test description: Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account. references: - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-04 tags: - attack.persistence - attack.execution - attack.privilege-escalation - attack.t1059.012 - attack.t1098 logsource: category: process_creation product: linux detection: selection: Image|endswith: /esxcli CommandLine|contains: system CommandLine|contains|all: - ' permission ' - ' set' - Admin condition: selection falsepositives: - Legitimate administration activities level: high
Near-miss passage: Sigma rule: Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths. Logsource: windows / process_creation. Rule: title: Suspicious New Service Creation id: 17a1be64-8d88-40bf-b5ff-a4f7a50ebcc8 related: - id: 7fe71fc9-de3b-432a-8d57-8c809efc10ab type: derived status: test description: Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md - https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-14 modified: 2022-11-18 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: category: process_creation product: windows detection: selection_sc: Image|endswith: \sc.exe CommandLine|contains|all: - create - binPath= selection_posh: CommandLine|contains|all: - New-Service - -BinaryPathName susp_binpath: CommandLine|contains: - powershell - mshta - wscript - cscript - svchost - dllhost - 'cmd ' - cmd.exe /c - cmd.exe /k - cmd.exe /r - rundll32 - C:\Users\Public - \Downloads\ - \Desktop\ - \Microsoft\Windows\Start Menu\Programs\Startup\ - C:\Windows\TEMP\ - \AppData\Local\Temp condition: 1 of selection* and susp_binpath falsepositives: - Unlikely level: high
Query: ATT&CK technique for SVG Smuggling
Matching passage: T1027.017 SVG Smuggling. Tactics: stealth. Description: Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG files.(Citation: Trustwave SVG Smuggling 2025) SVGs, or Scalable Vector Graphics, are vector-based image files constructed using XML. As such, they can legitimately include `<script>` tags that enable adversaries to include malicious JavaScript payloads. However, SVGs may appear less suspicious to users than other types of executable files, as they are often treated as image files. SVG smuggling can take a number of forms. For example, threat actors may include content that: * Assembles malicious payloads(Citation: Talos SVG Smuggling 2022) * Downloads malicious payloads(Citation: Cofense SVG Smuggling 2024) * Redirects users to malicious websites(Citation: Bleeping Computer SVG Smuggling 2024) * Displays interactive content to users, such as fake login forms and download buttons.(Citation: Bleeping Computer SVG Smuggling 2024) SVG Smuggling may be used in conjunction with [HTML Smuggling](https://attack.mitre.org/techniques/T1027/006) where an SVG with a malicious payload is included inside an HTML file.(Citation: Talos SVG Smuggling 2022) SVGs may also be included in other types of documents, such as PDFs.
Near-miss passage: T1027.005 Indicator Removal from Tools. Tactics: stealth. Description: Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems. A good example of this is when malware is detected with a file signature and quarantined by anti-virus software. An adversary who can determine that the malware was quarantined because of its file signature may modify the file to explicitly avoid that signature, and then re-use the malware.
Query: secure coding against Creation of Emergent Resource
Matching passage: CWE-1229 Creation of Emergent Resource. The product manages resources or behaves in a way that indirectly creates a new, distinct resource that can be used by attackers in violation of the intended policy.
Near-miss passage: CWE-1059 Insufficient Technical Documentation. The product does not contain sufficient technical or engineering documentation (whether on paper or in electronic form) that contains descriptions of all the relevant software/hardware elements of the product, such as its usage, structure, architectural components, interfaces, design, implementation, configuration, operation, etc.
Query: alert when Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.
Matching passage: Sigma rule: Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.. Logsource: azure / auditlogs. Rule: title: PIM Approvals And Deny Elevation id: 039a7469-0296-4450-84c0-f6966b16dc6d status: test description: Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H' date: 2022-08-09 tags: - attack.persistence - attack.initial-access - attack.privilege-escalation - attack.stealth - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: properties.message: Request Approved/Denied condition: selection falsepositives: - Actual admin using PIM. level: high
Near-miss passage: Sigma rule: Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping. Logsource: zeek / dce_rpc. Rule: title: MITRE BZAR Indicators for Persistence id: 53389db6-ba46-48e3-a94c-e0f2cefe1583 status: test description: Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE. references: - https://github.com/mitre-attack/bzar#indicators-for-attck-persistence author: '@neu5ron, SOC Prime' date: 2020-03-19 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.004 logsource: product: zeek service: dce_rpc detection: op1: endpoint: spoolss operation: RpcAddMonitor op2: endpoint: spoolss operation: RpcAddPrintProcessor op3: endpoint: IRemoteWinspool operation: RpcAsyncAddMonitor op4: endpoint: IRemoteWinspool operation: RpcAsyncAddPrintProcessor op5: endpoint: ISecLogon operation: SeclCreateProcessWithLogonW op6: endpoint: ISecLogon operation: SeclCreateProcessWithLogonExW condition: 1 of op* falsepositives: - Windows administrator tasks or troubleshooting - Windows management scripts or software level: medium
Query: CVE similar to CVE-2015-5500
Matching passage: CVE-2015-5500. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Navigate module for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-6942. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Coremail XT3.0 allows remote attackers to inject arbitrary web script or HTML via a hyperlink in a document attachment.
Query: rule covering Detects a method often used by ransomware. Which combines the "ping" to wait a couple of seconds and then "del" to delet
Matching passage: Sigma rule: Detects a method often used by ransomware. Which combines the "ping" to wait a couple of seconds and then "del" to delet. Logsource: windows / process_creation. Rule: title: Suspicious Ping/Del Command Combination id: 54786ddc-5b8a-11ed-9b6a-0242ac120002 status: test description: Detects a method often used by ransomware. Which combines the "ping" to wait a couple of seconds and then "del" to delete the file in question. Its used to hide the file responsible for the initial infection for example references: - https://blog.sygnia.co/kaseya-ransomware-supply-chain-attack - https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf - https://www.acronis.com/en-us/blog/posts/lockbit-ransomware/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware author: Ilya Krestinichev date: 2022-11-03 modified: 2024-03-05 tags: - attack.stealth - attack.t1070.004 logsource: category: process_creation product: windows detection: selection_count: CommandLine|contains|windash: ' -n ' selection_nul: CommandLine|contains: Nul selection_del_param: CommandLine|contains|windash: - ' -f ' - ' -q ' selection_all: CommandLine|contains|all: - ping - 'del ' condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects relevant commands often related to malware or hacking activity. Logsource: linux / auditd. Rule: title: Suspicious Commands Linux id: 1543ae20-cbdf-4ec1-8d12-7664d667a825 status: test description: Detects relevant commands often related to malware or hacking activity references: - Internal Research - mostly derived from exploit code including code in MSF author: Florian Roth (Nextron Systems) date: 2017-12-12 modified: 2022-10-05 tags: - attack.execution - attack.t1059.004 logsource: product: linux service: auditd detection: cmd1: type: EXECVE a0: chmod a1: 777 cmd2: type: EXECVE a0: chmod a1: u+s cmd3: type: EXECVE a0: cp a1: /bin/ksh cmd4: type: EXECVE a0: cp a1: /bin/sh condition: 1 of cmd* falsepositives: - Admin activity level: medium
Query: patch priority for CVE-2015-3446
Matching passage: CVE-2015-3446. CWE: CWE-94. CVSS: 9.300000190734863. The Framework Daemon in AlienVault Unified Security Management before 4.15 allows remote attackers to execute arbitrary Python code via a crafted plugin configuration file (.cfg).
Near-miss passage: CVE-2015-5243. CWE: CWE-94. CVSS: 9.800000190734863. phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.
Query: risk of Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014 does not prevent use of uninitialized memory in certain attempts to execute virtual functions
Matching passage: CVE-2015-1763. CWE: CWE-284. CVSS: 8.5. Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014 does not prevent use of uninitialized memory in certain attempts to execute virtual functions, which allows remote authenticated users to execute arbitrary code via a crafted query, aka "SQL Server Remote Code Execution Vulnerability."
Near-miss passage: CVE-2015-3224. CWE: CWE-284. CVSS: 4.300000190734863. request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.