alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects the execution of Radmin which can be abused by an adversary to remotely control Windows machines
Matching passage: Sigma rule: Detects the execution of Radmin which can be abused by an adversary to remotely control Windows machines. Logsource: windows / process_creation. Rule: title: PUA - Radmin Viewer Utility Execution id: 5817e76f-4804-41e6-8f1d-5fa0b3ecae2d status: test description: Detects the execution of Radmin which can be abused by an adversary to remotely control Windows machines references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1072/T1072.md - https://www.radmin.fr/ author: frack113 date: 2022-01-22 modified: 2023-12-11 tags: - attack.execution - attack.lateral-movement - attack.t1072 logsource: category: process_creation product: windows detection: selection: - Description: Radmin Viewer - Product: Radmin Viewer - OriginalFileName: Radmin.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects enumeration of local network configuration. Logsource: macos / process_creation. Rule: title: System Network Discovery - macOS id: 58800443-f9fc-4d55-ae0c-98a3966dfb97 status: test description: Detects enumeration of local network configuration references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md author: remotephone, oscd.community date: 2020-10-06 modified: 2024-08-29 tags: - attack.discovery - attack.t1016 logsource: product: macos category: process_creation detection: selection_1: Image|endswith: - /arp - /ifconfig - /netstat - /networksetup - /socketfilterfw selection_2: Image: /usr/bin/defaults CommandLine|contains|all: - /Library/Preferences/com.apple.alf - read filter_main_wifivelocityd: ParentImage|endswith: /wifivelocityd condition: 1 of selection_* and not 1 of filter_main_* falsepositives: - Legitimate administration activities level: informational
Query: risk of The PDF viewer in Google Chrome before 46.0.2490.86 does not properly restrict scripting messages and API exposure, which allows remote attackers to bypass the Same Origin Policy v
Matching passage: CVE-2015-1302. CWE: CWE-20. CVSS: 7.5. The PDF viewer in Google Chrome before 46.0.2490.86 does not properly restrict scripting messages and API exposure, which allows remote attackers to bypass the Same Origin Policy via an unintended embedder or unintended plugin loading, related to pdf.js and out_of_process_instance.cc.
Near-miss passage: CVE-2015-4284. CWE: CWE-20. CVSS: 5.0. The Concurrent Data Management Replication process in Cisco IOS XR 5.3.0 on ASR 9000 devices allows remote attackers to cause a denial of service (BGP process reload) via malformed BGPv4 packets, aka Bug ID CSCur70670.
Query: exploit The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to write to arbitrary files, and subsequently execute these files, via a crafted TCP pac
Matching passage: CVE-2015-1942. CWE: CWE-20. CVSS: 9.300000190734863. The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to write to arbitrary files, and subsequently execute these files, via a crafted TCP packet to an unspecified port.
Near-miss passage: CVE-2015-0597. CWE: CWE-20. CVSS: 5.0. The Forgot Password feature in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to enumerate administrative accounts via crafted packets, aka Bug IDs CSCuj67166 and CSCuj67159.
Query: SIEM correlation: collection activity consistent with Web Portal Capture
Matching passage: T1056.003 Web Portal Capture. Tactics: collection, credential access. Description: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through [External Remote Services](https://attack.mitre.org/techniques/T1133) and [Valid Accounts](https://attack.mitre.org/techniques/T1078) or as part of the initial compromise by exploitation of the externally facing web service.(Citation: Volexity Virtual Private Keylogging)
Near-miss passage: T1056 Input Capture. Tactics: collection, credential access. Description: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004)) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. [Web Portal Capture](https://attack.mitre.org/techniques/T1056/003)).
Query: risk of libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted
Matching passage: CVE-2015-7941. CWE: CWE-119. CVSS: 4.300000190734863. libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities.
Near-miss passage: CVE-2015-3743. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Query: exploit Zoho NetFlow Analyzer build 10250 and earlier does not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by lever
Matching passage: CVE-2015-4418. CWE: CWE-284. CVSS: 5.0. Zoho NetFlow Analyzer build 10250 and earlier does not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
Near-miss passage: CVE-2015-7263. CWE: CWE-284. CVSS: 7.5. The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a crafted host value.
Query: exploit Bamboo 2.2 before 5.8.5 and 5.9.x before 5.9.7 allows remote attackers with access to the Bamboo web interface to execute arbitrary Java code via an unspecified resource.
Matching passage: CVE-2015-6576. CWE: CWE-94. CVSS: 8.800000190734863. Bamboo 2.2 before 5.8.5 and 5.9.x before 5.9.7 allows remote attackers with access to the Bamboo web interface to execute arbitrary Java code via an unspecified resource.
Near-miss passage: CVE-2015-5243. CWE: CWE-94. CVSS: 9.800000190734863. phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.
Query: CVE similar to CVE-2015-0979
Matching passage: CVE-2015-0979. CWE: CWE-119. CVSS: 9.0. Heap-based buffer overflow in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via a crafted packet.
Near-miss passage: CVE-2015-8317. CWE: CWE-119. CVSS: 5.0. The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive information via an (1) unterminated encoding value or (2) incomplete XML declaration in XML data, which triggers an out-of-bounds heap read.
Query: exploit QEMU does not properly restrict write access to the PCI config space for certain PCI pass-through devices, which might allow local x86 HVM guests to gain privileges, cause a denial
Matching passage: CVE-2015-4106. CWE: CWE-863. CVSS: 4.599999904632568. QEMU does not properly restrict write access to the PCI config space for certain PCI pass-through devices, which might allow local x86 HVM guests to gain privileges, cause a denial of service (host crash), obtain sensitive information, or possibly have other unspecified impact via unknown vectors.
Near-miss passage: CVE-2015-1780. CWE: CWE-863. CVSS: 6.5. oVirt users with MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data-center
Query: alert when Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may the
Matching passage: Sigma rule: Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may the. Logsource: windows / process_creation. Rule: title: HackTool - WinRM Access Via Evil-WinRM id: a197e378-d31b-41c0-9635-cfdf1c1bb423 status: test description: Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.006/T1021.006.md#atomic-test-3---winrm-access-with-evil-winrm - https://github.com/Hackplayers/evil-winrm author: frack113 date: 2022-01-07 modified: 2023-02-13 tags: - attack.lateral-movement - attack.t1021.006 logsource: category: process_creation product: windows detection: selection: Image|endswith: \ruby.exe CommandLine|contains|all: - '-i ' - '-u ' - '-p ' condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for re. Logsource: linux / process_creation. Rule: title: Print History File Contents id: d7821ff1-4527-4e33-9f84-d0d57fa2fb66 status: test description: Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance references: - https://github.com/sleventyeleven/linuxprivchecker/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md author: Florian Roth (Nextron Systems) date: 2022-06-20 modified: 2022-09-15 tags: - attack.reconnaissance - attack.t1592.004 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /cat - /head - /tail - /more selection_history: - CommandLine|contains: - /.bash_history - /.zsh_history - CommandLine|endswith: - _history - .history - zhistory condition: all of selection* falsepositives: - Legitimate administration activities level: medium
Query: vulnerability: The admin pages for power types and key types in Beaker before 20.1 do not have any access controls, which allows remote authenticated users to modify power types and key types via
Matching passage: CVE-2015-3163. CWE: CWE-284. CVSS: 4.300000190734863. The admin pages for power types and key types in Beaker before 20.1 do not have any access controls, which allows remote authenticated users to modify power types and key types via navigating to $BEAKER/powertypes and $BEAKER/keytypes respectively.
Near-miss passage: CVE-2015-3675. CWE: CWE-284. CVSS: 5.0. The default configuration of the Apache HTTP Server on Apple OS X before 10.10.4 does not enable the mod_hfs_apple module, which allows remote attackers to bypass HTTP authentication via a crafted URL.
Query: risk of The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitrary SQL commands via a crafted query.
Matching passage: CVE-2015-7695. CWE: CWE-89. CVSS: 9.800000190734863. The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitrary SQL commands via a crafted query.
Near-miss passage: CVE-2015-3314. CWE: CWE-89. CVSS: 8.100000381469727. SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5.
Query: detection engineering for RDP Hijacking
Matching passage: T1563.002 RDP Hijacking. Tactics: lateral movement. Description: Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services) Adversaries may perform RDP session hijacking which involves stealing a legitimate user's remote session. Typically, a user is notified when someone else is trying to steal their session. With System permissions and using Terminal Services Console, `c:\windows\system32\tscon.exe [session number to be stolen]`, an adversary can hijack a session without the need for credentials or prompts to the user.(Citation: RDP Hijacking Korznikov) This can be done remotely or locally and with active or disconnected sessions.(Citation: RDP Hijacking Medium) It can also lead to [Remote System Discovery](https://attack.mitre.org/techniques/T1018) and Privilege Escalation by stealing a Domain Admin or higher privileged account session. All of this can be done by using native Windows commands, but it has also been added as a feature in red teaming tools.(Citation: Kali Redsnarf)
Near-miss passage: T1563.001 SSH Hijacking. Tactics: lateral movement. Description: Adversaries may hijack a legitimate user's SSH session to move laterally within an environment. Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems. It allows a user to connect to another system via an encrypted tunnel, commonly authenticating through a password, certificate or the use of an asymmetric encryption key pair. In order to move laterally from a compromised host, adversaries may take advantage of trust relationships established with other systems via public key authentication in active SSH sessions by hijacking an existing connection to another system. This may occur through compromising the SSH agent itself or by having access to the agent's socket. If an adversary is able to obtain root access, then hijacking SSH sessions is likely trivial.(Citation: Slideshare Abusing SSH)(Citation: SSHjack Blackhat)(Citation: Clockwork SSH Agent Hijacking)(Citation: Breach Post-mortem SSH Hijack) [SSH Hijacking](https://attack.mitre.org/techniques/T1563/001) differs from use of [SSH](https://attack.mitre.org/techniques/T1021/004) because it hijacks an existing SSH session rather than creating a new session using [Valid Accounts](https://attack.mitre.org/techniques/T1078).
Query: write Sigma for Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse that feature to establish a reverse shell or pe
Matching passage: Sigma rule: Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse that feature to establish a reverse shell or pe. Logsource: windows / dns_query. Rule: title: Cloudflared Tunnels Related DNS Requests id: a1d9eec5-33b2-4177-8d24-27fe754d0812 related: - id: 7cd1dcdc-6edf-4896-86dc-d1f19ad64903 type: similar status: test description: 'Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. ' references: - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/ - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-12-20 tags: - attack.command-and-control - attack.t1071.001 - attack.t1572 logsource: category: dns_query product: windows detection: selection: QueryName|endswith: - .v2.argotunnel.com - protocol-v2.argotunnel.com - trycloudflare.com - update.argotunnel.com condition: selection falsepositives: - Legitimate use of cloudflare tunnels will also trigger this. level: medium
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer). Logsource: windows / image_load. Rule: title: Potential Iviewers.DLL Sideloading id: 4c21b805-4dd7-469f-b47d-7383a8fcb437 status: test description: Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer) references: - https://www.secureworks.com/research/shadowpad-malware-analysis author: X__Junior (Nextron Systems) date: 2023-03-21 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \iviewers.dll filter: ImageLoaded|startswith: - C:\Program Files (x86)\Windows Kits\ - C:\Program Files\Windows Kits\ condition: selection and not filter falsepositives: - Unknown level: high
Query: vulnerability: Cisco Adaptive Security Appliance (ASA) software 7.2 and 8.2 before 8.2(5.58), 8.3 and 8.4 before 8.4(7.29), 8.5 through 8.7 before 8.7(1.17), 9.0 before 9.0(4.37), 9.1 before 9.1(
Matching passage: CVE-2015-6325. CWE: CWE-399. CVSS: 7.099999904632568. Cisco Adaptive Security Appliance (ASA) software 7.2 and 8.2 before 8.2(5.58), 8.3 and 8.4 before 8.4(7.29), 8.5 through 8.7 before 8.7(1.17), 9.0 before 9.0(4.37), 9.1 before 9.1(6.4), 9.2 before 9.2(4), 9.3 before 9.3(3.1), and 9.4 before 9.4(1.1) allows remote attackers to cause a denial of service (device reload) via a crafted DNS response, aka Bug ID CSCut03495.
Near-miss passage: CVE-2015-8087. CWE: CWE-399. CVSS: 5.0. Huawei NE20E-S, NE40E-M, and NE40E-M2 routers with software before V800R007C10SPC100 and NE40E and NE80E routers with software before V800R007C00SPC100 allows remote attackers to send packets to other VPNs and conduct flooding attacks via a crafted MPLS forwarding packet, aka a "VPN routing and forwarding (VRF) hopping vulnerability."
Query: CVE similar to CVE-2015-5201
Matching passage: CVE-2015-5201. CWE: CWE-306. CVSS: 7.5. VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117.0 as packaged in Red Hat Enterprise Virtualization before 3.5.6 when VSDM is run with -spice disable-ticketing and a VM is suspended and then restored, allows remote attackers to log in without authentication via unspecified vectors.
Near-miss passage: CVE-2015-7559. CWE: CWE-306. CVSS: 2.700000047683716. It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects potential network sniffing via use of network tools such as "tshark", "windump". Network sniffing refers to usin. Logsource: windows / process_creation. Rule: title: Potential Network Sniffing Activity Using Network Tools id: ba1f7802-adc7-48b4-9ecb-81e227fddfd5 status: test description: 'Detects potential network sniffing via use of network tools such as "tshark", "windump". Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1040/T1040.md author: Timur Zinniatullin, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2019-10-21 modified: 2023-02-20 tags: - attack.credential-access - attack.discovery - attack.t1040 logsource: category: process_creation product: windows detection: selection_tshark: Image|endswith: \tshark.exe CommandLine|contains: -i selection_windump: Image|endswith: \windump.exe condition: 1 of selection_* falsepositives: - Legitimate administration activity to troubleshoot network issues level: medium
Near-miss passage: Sigma rule: Detects WmiPrvSE spawning a process. Logsource: windows / process_creation. Rule: title: WmiPrvSE Spawned A Process id: d21374ff-f574-44a7-9998-4a8c8bf33d7d related: - id: 8a582fe2-0882-4b89-a82a-da6b2dc32937 type: similar - id: 692f0bec-83ba-4d04-af7e-e884a96059b6 type: similar status: stable description: Detects WmiPrvSE spawning a process references: - https://threathunterplaybook.com/hunts/windows/190815-RemoteServiceInstallation/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-08-15 modified: 2023-03-23 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \WmiPrvSe.exe filter_logonid: LogonId: - '0x3e7' - 'null' filter_system_user: User|contains: - AUTHORI - AUTORI filter_wmiprvse: Image|endswith: \WmiPrvSE.exe filter_werfault: Image|endswith: \WerFault.exe filter_null: LogonId: null condition: selection and not 1 of filter_* falsepositives: - False positives are expected (e.g. in environments where WinRM is used legitimately) level: medium
Query: exploit Labtech before 100.237 on Linux uses world-writable permissions for root-executed scripts, which allows local users to gain privileges by modifying a script file.
Matching passage: CVE-2015-0926. CWE: CWE-284. CVSS: 6.800000190734863. Labtech before 100.237 on Linux uses world-writable permissions for root-executed scripts, which allows local users to gain privileges by modifying a script file.
Near-miss passage: CVE-2015-9047. CWE: CWE-284. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in GNSS when performing a scan after bootup.
Query: risk of Mozilla Firefox before 43.0 stores cookies containing vertical tab characters, which allows remote attackers to obtain sensitive information by reading HTTP Cookie headers.
Matching passage: CVE-2015-7208. CWE: CWE-200. CVSS: 5.0. Mozilla Firefox before 43.0 stores cookies containing vertical tab characters, which allows remote attackers to obtain sensitive information by reading HTTP Cookie headers.
Near-miss passage: CVE-2015-0089. CWE: CWE-200. CVSS: 5.0. Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to obtain sensitive information from kernel memory, and possibly bypass the KASLR protection mechanism, via a crafted font, aka "Adobe Font Driver Information Disclosure Vulnerability," a different vulnerability than CVE-2015-0087.
Query: exploit The createFromParcel method in the com.absolute.android.persistence.MethodSpec class in Samsung Galaxy S5s allows remote attackers to execute arbitrary files via a crafted Parcelab
Matching passage: CVE-2015-4034. CWE: CWE-284. CVSS: 7.900000095367432. The createFromParcel method in the com.absolute.android.persistence.MethodSpec class in Samsung Galaxy S5s allows remote attackers to execute arbitrary files via a crafted Parcelable object in a serialized MethodSpec object.
Near-miss passage: CVE-2015-9337. CWE: CWE-284. CVSS: 7.5. The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.
Query: risk of Directory traversal vulnerability in IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to write t
Matching passage: CVE-2015-0171. CWE: CWE-22. CVSS: 5.5. Directory traversal vulnerability in IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to write to arbitrary files via unspecified vectors.
Near-miss passage: CVE-2015-5531. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.