alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of The SNMPv2 implementation in Cisco IOS XR allows remote authenticated users to cause a denial of service (snmpd daemon reload) via a malformed SNMP packet, aka Bug ID CSCur25858.
Matching passage: CVE-2015-0661. CWE: CWE-20. CVSS: 4.0. The SNMPv2 implementation in Cisco IOS XR allows remote authenticated users to cause a denial of service (snmpd daemon reload) via a malformed SNMP packet, aka Bug ID CSCur25858.
Near-miss passage: CVE-2015-9069. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, the Secure File System can become corrupted.
Query: risk of Cross-site scripting (XSS) vulnerability in the Term Merge module before 7.x-1.2 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified
Matching passage: CVE-2015-3360. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Term Merge module before 7.x-1.2 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-6959. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Vindula 1.9.
Query: vulnerability: Terminology 0.7.0 allows remote attackers to execute arbitrary commands via escape sequences that modify the window title and then are written to the terminal, a similar issue to C
Matching passage: CVE-2015-8971. CWE: CWE-77. CVSS: 7.800000190734863. Terminology 0.7.0 allows remote attackers to execute arbitrary commands via escape sequences that modify the window title and then are written to the terminal, a similar issue to CVE-2003-0063.
Near-miss passage: CVE-2015-2846. CWE: CWE-77. CVSS: 9.300000190734863. BitTorrent Sync allows remote attackers to execute arbitrary commands via a crafted btsync: link.
Query: alert when Detects linux package removal using builtin tools such as "yum", "apt", "apt-get" or "dpkg".
Matching passage: Sigma rule: Detects linux package removal using builtin tools such as "yum", "apt", "apt-get" or "dpkg".. Logsource: linux / process_creation. Rule: title: Linux Package Uninstall id: 95d61234-7f56-465c-6f2d-b562c6fedbc4 status: test description: Detects linux package removal using builtin tools such as "yum", "apt", "apt-get" or "dpkg". references: - https://sysdig.com/blog/mitre-defense-evasion-falco - https://www.tutorialspoint.com/how-to-install-a-software-on-linux-using-yum-command - https://linuxhint.com/uninstall_yum_package/ - https://linuxhint.com/uninstall-debian-packages/ author: Tuan Le (NCSGroup), Nasreddine Bencherchali (Nextron Systems) date: 2023-03-09 tags: - attack.stealth - attack.t1070 logsource: product: linux category: process_creation detection: selection_yum: Image|endswith: /yum CommandLine|contains: - erase - remove selection_apt: Image|endswith: - /apt - /apt-get CommandLine|contains: - remove - purge selection_dpkg: Image|endswith: /dpkg CommandLine|contains: - '--remove ' - ' -r ' selection_rpm: Image|endswith: /rpm CommandLine|contains: ' -e ' condition: 1 of selection_* falsepositives: - Administrator or administrator scripts might delete packages for several reasons (debugging, troubleshooting). level: low
Near-miss passage: Sigma rule: Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged pro. Logsource: windows / process_creation. Rule: title: Bypass UAC via Fodhelper.exe id: 7f741dcf-fc22-4759-87b4-9ae8376676a2 status: test description: Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes. references: - https://eqllib.readthedocs.io/en/latest/analytics/e491ce22-792f-11e9-8f5c-d46d6d62a49e.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md author: E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community date: 2019-10-24 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \fodhelper.exe condition: selection falsepositives: - Legitimate use of fodhelper.exe utility by legitimate user level: high
Query: Sigma rule for Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.
Matching passage: Sigma rule: Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.. Logsource: windows / security. Rule: title: External Remote RDP Logon from Public IP id: 259a9cdf-c4dd-4fa2-b243-2269e5ab18a2 related: - id: 78d5cab4-557e-454f-9fb9-a222bd0d5edc type: derived status: test description: Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port. references: - https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html - https://twitter.com/Purp1eW0lf/status/1616144561965002752 author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity) date: 2023-01-19 modified: 2024-03-11 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.credential-access - attack.stealth - attack.t1133 - attack.t1078 - attack.t1110 logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 10 filter_main_local_ranges: IpAddress|cidr: - ::1/128 - 10.0.0.0/8 - 127.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - fc00::/7 - fe80::/10 filter_main_empty: IpAddress: '-' condition: selection and not 1 of filter_main_* falsepositives: - Legitimate or intentional inbound connections from public IP addresses on the RDP port. level: medium
Near-miss passage: Sigma rule: Detect enable rdp feature to allow specific user to rdp connect on the targeted machine. Logsource: windows / registry_set. Rule: title: Allow RDP Remote Assistance Feature id: 37b437cf-3fc5-4c8e-9c94-1d7c9aff842b status: test description: Detect enable rdp feature to allow specific user to rdp connect on the targeted machine references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md author: frack113 date: 2022-08-19 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: System\CurrentControlSet\Control\Terminal Server\fAllowToGetHelp Details: DWORD (0x00000001) condition: selection falsepositives: - Legitimate use of the feature (alerts should be investigated either way) level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_allow_rdp_remote_assistance_feature/info.yml simulation: - type: atomic-red-team name: Allow RDP Remote Assistance Feature technique: T1112 atomic_guid: 86677d0e-0b5e-4a2b-b302-454175f9aa9e
Query: vulnerability: WebKit in Apple iOS before 9 allows remote attackers to trigger a dialing action via a crafted (1) tel://, (2) facetime://, or (3) facetime-audio:// URL.
Matching passage: CVE-2015-5820. CWE: CWE-20. CVSS: 4.300000190734863. WebKit in Apple iOS before 9 allows remote attackers to trigger a dialing action via a crafted (1) tel://, (2) facetime://, or (3) facetime-audio:// URL.
Near-miss passage: CVE-2015-8946. CWE: CWE-20. CVSS: 3.299999952316284. ecryptfs-setup-swap in eCryptfs before 111 does not prevent the unencrypted swap partition from activating during boot when using GPT partitioning and certain versions of systemd, which allows local users to obtain sensitive information via unspecified vectors.
Query: risk of Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF09 allows remote attackers to inject arbitrary web script or H
Matching passage: CVE-2015-7457. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF09 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-0774. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Cisco Application and Content Networking System (ACNS) 5.5(9) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuu70650.
Query: Sigma rule for Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM reg
Matching passage: Sigma rule: Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM reg. Logsource: windows / process_creation. Rule: title: Sensitive File Access Via Volume Shadow Copy Backup id: f57f8d16-1f39-4dcb-a604-6c73d9b54b3d status: test description: 'Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM registry hives or the AD database (ntds.dit) ' references: - https://twitter.com/vxunderground/status/1423336151860002816?s=20 - https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection - https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/ author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems) date: 2021-08-09 modified: 2024-01-18 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_1: CommandLine|contains: \\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy selection_2: CommandLine|contains: - \\NTDS.dit - \\SYSTEM - \\SECURITY condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.. Logsource: windows / process_creation. Rule: title: Cloudflared Tunnel Connections Cleanup id: 7050bba1-1aed-454e-8f73-3f46f09ce56a status: test description: Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections. references: - https://github.com/cloudflare/cloudflared - https://developers.cloudflare.com/cloudflare-one/connections/connect-apps author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-17 modified: 2023-12-21 tags: - attack.command-and-control - attack.t1102 - attack.t1090 - attack.t1572 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - ' tunnel ' - 'cleanup ' CommandLine|contains: - '-config ' - '-connector-id ' condition: selection falsepositives: - Legitimate usage of Cloudflared. level: medium
Query: playbook for alert: Outbound C2 pattern associated with Token Impersonation/Theft
Matching passage: Playbook for T1134.001 Token Impersonation/Theft. 1) Validate alert telemetry against T1134.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth, privilege escalation. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`.(Citation: DuplicateToken function) The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context,
Near-miss passage: Playbook for T1134.004 Parent PID Spoofing. Different response path focused on stealth, privilege escalation.
Query: risk of WebSphereOauth20SP.ear in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, 8.5 Liberty Profile before 8.5.5.5, and 8.5 Full Profile before 8.5.5.6, 
Matching passage: CVE-2015-1885. CWE: CWE-264. CVSS: 9.300000190734863. WebSphereOauth20SP.ear in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, 8.5 Liberty Profile before 8.5.5.5, and 8.5 Full Profile before 8.5.5.6, when the OAuth grant type requires sending a password, allows remote attackers to gain privileges via unspecified vectors.
Near-miss passage: CVE-2015-8966. CWE: CWE-264. CVSS: 7.800000190734863. arch/arm/kernel/sys_oabi-compat.c in the Linux kernel before 4.4 allows local users to gain privileges via a crafted (1) F_OFD_GETLK, (2) F_OFD_SETLK, or (3) F_OFD_SETLKW command in an fcntl64 system call.
Query: secure coding against Privilege Context Switching Error
Matching passage: CWE-270 Privilege Context Switching Error. The product does not properly manage privileges while it is switching between different contexts that have different privileges or spheres of control.
Near-miss passage: CWE-507 Trojan Horse. The product appears to contain benign or useful functionality, but it also contains code that is hidden from normal operation that violates the intended security policy of the user or the system administrator.
Query: Outbound C2 pattern associated with Sharepoint
Matching passage: T1213.002 Sharepoint. Tactics: collection. Description: Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint: * Policies, procedures, and standards * Physical / logical network diagrams * System architecture diagrams * Technical system documentation * Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)) * Work / project schedules * Source code snippets * Links to network shares and other internal resources
Near-miss passage: T1213.004 Customer Relationship Management Software. Tactics: collection. Description: Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable information. CRM software is used to assist organizations in tracking and managing customer interactions, as well as storing customer data. Once adversaries gain access to a victim organization, they may mine CRM software for customer data. This may include personally identifiable information (PII) such as full names, emails, phone numbers, and addresses, as well as additional details such as purchase histories and IT support interactions. By collecting this data, an adversary may be able to send personalized [Phishing](https://attack.mitre.org/techniques/T1566) emails, engage in SIM swapping, or otherwise target the organization’s customers in ways that enable financial gain or the compromise of additional organizations.(Citation: Bleeping Computer US Cellular Hack 2022)(Citation: Bleeping Computer Mint Mobile Hack 2021)(Citation: Bleeping Computer Bank Hack 2020) CRM software may be hosted on-premises or in the cloud. Information stored in these solutions may vary based on the specific instance or environment. Examples of CRM software include Microsoft Dynamics 365, Salesforce, Zoho, Zendesk, and HubSpot.
Query: detect Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data. in logs
Matching passage: Sigma rule: Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.. Logsource: windows / process_creation. Rule: title: Portable Gpg.EXE Execution id: 77df53a5-1d78-4f32-bc5a-0e7465bd8f41 status: test description: Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data. references: - https://www.trendmicro.com/vinfo/vn/threat-encyclopedia/malware/ransom.bat.zarlock.a - https://securelist.com/locked-out/68960/ - https://github.com/redcanaryco/atomic-red-team/blob/c4097dc7ed14d7f7d08c89d148c4307097e8c294/atomics/T1486/T1486.md author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-08-06 modified: 2023-11-10 tags: - attack.impact - attack.t1486 logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \gpg.exe - \gpg2.exe - OriginalFileName: gpg.exe - Description: GnuPG’s OpenPGP tool filter_main_legit_location: Image|contains: - :\Program Files (x86)\GNU\GnuPG\bin\ - :\Program Files (x86)\GnuPG VS-Desktop\ - :\Program Files (x86)\GnuPG\bin\ - :\Program Files (x86)\Gpg4win\bin\ condition: selection and not 1 of filter_main_* level: medium
Near-miss passage: Sigma rule: Detects the execution of a renamed "ftp.exe" binary based on the PE metadata fields. Logsource: windows / process_creation. Rule: title: Renamed FTP.EXE Execution id: 277a4393-446c-449a-b0ed-7fdc7795244c status: test description: Detects the execution of a renamed "ftp.exe" binary based on the PE metadata fields references: - https://lolbas-project.github.io/lolbas/Binaries/Ftp/ author: Victor Sergeev, oscd.community date: 2020-10-09 modified: 2023-02-03 tags: - attack.execution - attack.stealth - attack.t1059 - attack.t1202 logsource: category: process_creation product: windows detection: selection_original: OriginalFileName: ftp.exe filter_img: Image|endswith: \ftp.exe condition: selection_original and not filter_img falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_ftp/info.yml
Query: exploit The event scripts in Automatic Bug Reporting Tool (ABRT) uses world-readable permission on a copy of sosreport file in problem directories, which allows local users to obtain sensi
Matching passage: CVE-2015-1870. CWE: CWE-200. CVSS: 5.5. The event scripts in Automatic Bug Reporting Tool (ABRT) uses world-readable permission on a copy of sosreport file in problem directories, which allows local users to obtain sensitive information from /var/log/messages via unspecified vectors.
Near-miss passage: CVE-2015-2742. CWE: CWE-200. CVSS: 4.300000190734863. Mozilla Firefox before 39.0 on OS X includes native key press information during the logging of crashes, which allows remote attackers to obtain sensitive information by leveraging access to a crash-reporting data stream.
Query: describe CVE-2015-6735
Matching passage: CVE-2015-6735. CWE: CWE-17. CVSS: 5.0. The reset functionality in the TimedMediaHandler extension for MediaWiki does not create a new transcode, which allows remote attackers to cause a denial of service (transcode deletion) by resetting a transcode.
Near-miss passage: CVE-2015-0240. CWE: CWE-17. CVSS: 10.0. The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, which allows remote attackers to execute arbitrary code via crafted Netlogon packets that use the ServerPasswordSet RPC API, as demonstrated by packets reaching the _netr_ServerPasswordSet function in rpc_server/netlogon/srv_netlog_nt.c.
Query: risk of The MIDI subsystem in Google Chrome before 47.0.2526.106 does not properly handle the sending of data, which allows remote attackers to execute arbitrary code or cause a denial of 
Matching passage: CVE-2015-6792. CWE: UNKNOWN. CVSS: 9.800000190734863. The MIDI subsystem in Google Chrome before 47.0.2526.106 does not properly handle the sending of data, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors, related to midi_manager.cc, midi_manager_alsa.cc, and midi_manager_mac.cc, a different vulnerability than CVE-2015-8664.
Near-miss passage: CVE-2015-2641. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Privileges.
Query: write Sigma for ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High Integrity
Matching passage: Sigma rule: ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High Integrity. Logsource: windows / process_creation. Rule: title: Suspicious High IntegrityLevel Conhost Legacy Option id: 3037d961-21e9-4732-b27a-637bcc7bf539 status: test description: ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context. references: - https://cybercryptosec.medium.com/covid-19-cyber-infection-c615ead7c29 - https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/ - https://learn.microsoft.com/en-us/windows/win32/secauthz/mandatory-integrity-control author: frack113 date: 2022-12-09 modified: 2024-12-01 tags: - attack.stealth - attack.t1202 logsource: product: windows category: process_creation detection: selection: IntegrityLevel: - High - S-1-16-12288 CommandLine|contains|all: - conhost.exe - '0xffffffff' - -ForceV1 condition: selection falsepositives: - Very Likely, including launching cmd.exe via Run As Administrator level: informational
Near-miss passage: Sigma rule: Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instan. Logsource: windows / process_creation. Rule: title: Suspicious Chromium Browser Instance Executed With Custom Extension id: 27ba3207-dd30-4812-abbf-5d20c57d474e related: - id: 88d6e60c-759d-4ac1-a447-c0f1466c2d21 type: similar status: test description: Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instance with a custom extension references: - https://redcanary.com/blog/chromeloader/ - https://emkc.org/s/RJjuLa - https://www.mandiant.com/resources/blog/lnk-between-browsers author: Aedan Russell, frack113, X__Junior (Nextron Systems) date: 2022-06-19 modified: 2023-11-28 tags: - attack.persistence - attack.t1176.001 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe Image|endswith: - \brave.exe - \chrome.exe - \msedge.exe - \opera.exe - \vivaldi.exe CommandLine|contains: --load-extension= condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_susp_load_extension/info.yml
Query: CVE similar to CVE-2015-6995
Matching passage: CVE-2015-6995. CWE: CWE-119. CVSS: 6.800000190734863. The Disk Images component in Apple iOS before 9.1 and OS X before 10.11.1 misparses images, which allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app.
Near-miss passage: CVE-2015-8520. CWE: CWE-119. CVSS: 9.800000190734863. Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability than CVE-2015-8519, CVE-2015-8521, and CVE-2015-8522.
Query: CVE similar to CVE-2015-5529
Matching passage: CVE-2015-5529. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Free Reprintables ArticleFR 3.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) name parameter to dashboard/settings/categories/, (2) title or (3) rel parameter to dashboard/settings/links/, or (4) url parameter to dashboard/tools/pingservers/.
Near-miss passage: CVE-2015-7726. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in role deletion in the Web-based Development Workbench in SAP HANA DB 1.00.091.00.1418659308 allows remote authenticated users to inject arbitrary web script or HTML via the role name, aka SAP Security Note 2153898.