alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / registry_event
Matching passage: Sigma rule: Detects value modification of registry key containing path to binary used as screensaver.. Logsource: windows / registry_event. Rule: title: Path To Screensaver Binary Modified id: 67a6c006-3fbe-46a7-9074-2ba3b82c3000 status: test description: Detects value modification of registry key containing path to binary used as screensaver. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.002/T1546.002.md - https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf author: Bartlomiej Czyz @bczyz1, oscd.community date: 2020-10-11 modified: 2021-11-27 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.002 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: \Control Panel\Desktop\SCRNSAVE.EXE filter: Image|endswith: - \rundll32.exe - \explorer.exe condition: selection and not filter falsepositives: - Legitimate modification of screensaver level: medium
Near-miss passage: Sigma rule: Detects keywords from well-known PowerShell exploitation frameworks. Logsource: windows / ps_script. Rule: title: Malicious PowerShell Keywords id: f62176f3-8128-4faa-bf6c-83261322e5eb status: test description: Detects keywords from well-known PowerShell exploitation frameworks references: - https://adsecurity.org/?p=2921 author: Sean Metcalf (source), Florian Roth (Nextron Systems) date: 2017-03-05 modified: 2023-06-20 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - AdjustTokenPrivileges - IMAGE_NT_OPTIONAL_HDR64_MAGIC - Metasploit - Microsoft.Win32.UnsafeNativeMethods - Mimikatz - MiniDumpWriteDump - PAGE_EXECUTE_READ - ReadProcessMemory.Invoke - SE_PRIVILEGE_ENABLED - SECURITY_DELEGATION - TOKEN_ADJUST_PRIVILEGES - TOKEN_ALL_ACCESS - TOKEN_ASSIGN_PRIMARY - TOKEN_DUPLICATE - TOKEN_ELEVATION - TOKEN_IMPERSONATE - TOKEN_INFORMATION_CLASS - TOKEN_PRIVILEGES - TOKEN_QUERY condition: selection falsepositives: - Depending on the scripts, this rule might require some initial tuning to fit the environment level: medium
Query: secure coding against Improper Validation of Syntactic Correctness of Input
Matching passage: CWE-1286 Improper Validation of Syntactic Correctness of Input. The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.
Near-miss passage: CWE-455 Non-exit on Failed Initialization. The product does not exit or otherwise modify its operation when security-relevant errors occur during initialization, such as when a configuration file has a format error or a hardware security module (HSM) cannot be activated, which can cause the product to execute in a less secure fashion than intended by the administrator.
Query: Sigma rule for Detects loading of kernel modules with insmod command. Loadable Kernel Modules (LKMs) are pieces of code that can be loa
Matching passage: Sigma rule: Detects loading of kernel modules with insmod command. Loadable Kernel Modules (LKMs) are pieces of code that can be loa. Logsource: linux / auditd. Rule: title: Loading of Kernel Module via Insmod id: 106d7cbd-80ff-4985-b682-a7043e5acb72 status: test description: 'Detects loading of kernel modules with insmod command. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Adversaries may use LKMs to obtain persistence within the system or elevate the privileges. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.006/T1547.006.md - https://linux.die.net/man/8/insmod - https://man7.org/linux/man-pages/man8/kmod.8.html author: Pawel Mazur date: 2021-11-02 modified: 2022-12-25 tags: - attack.persistence - attack.privilege-escalation - attack.t1547.006 logsource: product: linux service: auditd detection: selection: type: SYSCALL comm: insmod exe: /usr/bin/kmod condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a suspicious process spawning from an Outlook process.. Logsource: windows / process_creation. Rule: title: Suspicious Outlook Child Process id: 208748f7-881d-47ac-a29c-07ea84bf691d related: - id: 438025f9-5856-4663-83f7-52f878a70a50 type: derived - id: e212d415-0e93-435f-9e1a-f29005bb4723 type: derived status: test description: Detects a suspicious process spawning from an Outlook process. references: - https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100 - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html author: Michael Haag, Florian Roth (Nextron Systems), Markus Neis, Elastic, FPT.EagleEye Team date: 2022-02-28 modified: 2023-02-04 tags: - attack.execution - attack.t1204.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \OUTLOOK.EXE Image|endswith: - \AppVLP.exe - \bash.exe - \cmd.exe - \cscript.exe - \forfiles.exe - \hh.exe - \mftrace.exe - \msbuild.exe - \msdt.exe - \mshta.exe - \msiexec.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \schtasks.exe - \scrcons.exe - \scriptrunner.exe - \sh.exe - \svchost.exe - \wmic.exe - \wscript.exe condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-3294
Matching passage: CVE-2015-3294. CWE: CWE-19. CVSS: 6.400000095367432. The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply function, which allows remote attackers to read process memory and cause a denial of service (out-of-bounds read and crash) via a malformed DNS request.
Near-miss passage: CVE-2015-0695. CWE: CWE-19. CVSS: 7.800000190734863. Cisco IOS XR 4.3.4 through 5.3.0 on ASR 9000 devices, when uRPF, PBR, QoS, or an ACL is configured, does not properly handle bridge-group virtual interface (BVI) traffic, which allows remote attackers to cause a denial of service (chip and card hangs and reloads) by triggering use of a BVI interface for IPv4 packets, aka Bug ID CSCur62957.
Query: CVE similar to CVE-2015-1528
Matching passage: CVE-2015-1528. CWE: CWE-189. CVSS: 9.300000190734863. Integer overflow in the native_handle_create function in libcutils/native_handle.c in Android before 5.1.1 LMY48M allows attackers to obtain a different application's privileges or cause a denial of service (Binder heap memory corruption) via a crafted application, aka internal bug 19334482.
Near-miss passage: CVE-2015-7674. CWE: CWE-189. CVSS: 6.800000190734863. Integer overflow in the pixops_scale_nearest function in pixops/pixops.c in gdk-pixbuf before 2.32.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted GIF image file, which triggers a heap-based buffer overflow.
Query: vulnerability: The Nitro API in Citrix NetScaler before 10.5 build 52.3nc uses an incorrect Content-Type when returning an error message, which allows remote attackers to conduct cross-site scrip
Matching passage: CVE-2015-2839. CWE: CWE-79. CVSS: 4.300000190734863. The Nitro API in Citrix NetScaler before 10.5 build 52.3nc uses an incorrect Content-Type when returning an error message, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the file_name JSON member in params/xen_hotfix/0 to nitro/v1/config/xen_hotfix.
Near-miss passage: CVE-2015-3432. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in Pydio (formerly AjaXplorer) before 6.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Pydio XSS Vulnerabilities."
Query: Sigma rule for Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file
Matching passage: Sigma rule: Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file. Logsource: windows / ps_script. Rule: title: User Discovery And Export Via Get-ADUser Cmdlet - PowerShell id: c2993223-6da8-4b1a-88ee-668b8bf315e9 related: - id: 1114e048-b69c-4f41-bc20-657245ae6e3f type: similar status: test description: Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file references: - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-17 tags: - attack.discovery - attack.t1033 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'Get-ADUser ' - ' -Filter \*' ScriptBlockText|contains: - ' > ' - ' | Select ' - Out-File - Set-Content - Add-Content condition: selection falsepositives: - Legitimate admin scripts may use the same technique, it's better to exclude specific computers or users who execute these commands or scripts often level: medium
Near-miss passage: Sigma rule: Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used. Logsource: windows / process_creation. Rule: title: Suspicious PowerShell Mailbox Export to Share id: 889719ef-dd62-43df-86c3-768fb08dc7c0 status: test description: Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations references: - https://youtu.be/5mqid-7zp8k?t=2481 - https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html - https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1 - https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/ author: Florian Roth (Nextron Systems) date: 2021-08-07 modified: 2022-10-26 tags: - attack.exfiltration logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - New-MailboxExportRequest - ' -Mailbox ' - ' -FilePath \\\\' condition: selection falsepositives: - Unknown level: critical
Query: CVE similar to CVE-2015-6384
Matching passage: CVE-2015-6384. CWE: CWE-264. CVSS: 4.300000190734863. The Cisco WebEx Meetings application before 8.5.1 for Android improperly initializes custom application permissions, which allows attackers to bypass intended access restrictions via a crafted application, aka Bug ID CSCuw86442.
Near-miss passage: CVE-2015-0002. CWE: CWE-264. CVSS: 7.199999809265137. The AhcVerifyAdminContext function in ahcache.sys in the Application Compatibility component in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not verify that an impersonation token is associated with an administrative account, which allows local users to gain privileges by running AppCompatCache.exe with a crafted DLL file, aka MSRC ID 20544 or "Microsoft Application Compatibility Infrastructure Elevation of Privilege Vulnerability."
Query: describe CVE-2015-5667
Matching passage: CVE-2015-5667. CWE: CWE-79. CVSS: 2.5999999046325684. Cross-site scripting (XSS) vulnerability in the HTML-Scrubber module before 0.15 for Perl, when the comment feature is enabled, allows remote attackers to inject arbitrary web script or HTML via a crafted comment.
Near-miss passage: CVE-2015-3362. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Video module before 7.x-2.11 for Drupal, when using the video WYSIWYG plugin, allows remote authenticated users to inject arbitrary web script or HTML via a node title.
Query: CVE similar to CVE-2015-4293
Matching passage: CVE-2015-4293. CWE: CWE-399. CVSS: 5.0. The packet-reassembly implementation in Cisco IOS XE 3.13S and earlier allows remote attackers to cause a denial of service (CPU consumption or packet loss) via fragmented (1) IPv4 or (2) IPv6 packets that trigger ATTN-3-SYNC_TIMEOUT errors after reassembly failures, aka Bug ID CSCuo37957.
Near-miss passage: CVE-2015-8877. CWE: CWE-399. CVSS: 7.5. The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function.
Query: describe CVE-2015-2677
Matching passage: CVE-2015-2677. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in ocPortal before 9.0.17 allow remote authenticated users to inject arbitrary web script or HTML via the (1) title or (2) text field in the cms_calendar page to cms/index.php; unspecified fields in (3) the cms_polls page to cms/index.php or (4) a new topic in the topics page to forum/index.php; or (5) a new PT (private topic/private message) in the topics page to forum/index.php.
Near-miss passage: CVE-2015-3219. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.
Query: vulnerability: Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality, integrity, and availability via vectors related to NSCD.
Matching passage: CVE-2015-4891. CWE: UNKNOWN. CVSS: 4.599999904632568. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality, integrity, and availability via vectors related to NSCD.
Near-miss passage: CVE-2015-7043. CWE: UNKNOWN. CVSS: 4.300000190734863. The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to cause a denial of service via a crafted app, a different vulnerability than CVE-2015-7040, CVE-2015-7041, and CVE-2015-7042.
Query: patch priority for CVE-2015-7214
Matching passage: CVE-2015-7214. CWE: CWE-200. CVSS: 5.0. Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to bypass the Same Origin Policy via data: and view-source: URIs.
Near-miss passage: CVE-2015-2206. CWE: CWE-200. CVSS: 5.0. libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
Query: patch priority for CVE-2015-0707
Matching passage: CVE-2015-0707. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in Cisco FireSIGHT System Software 5.3.1.1 and 6.0.0 in FireSIGHT Management Center allows remote authenticated users to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCus85425.
Near-miss passage: CVE-2015-4490. CWE: CWE-79. CVSS: 4.300000190734863. The nsCSPHostSrc::permits function in dom/security/nsCSPUtils.cpp in Mozilla Firefox before 40.0 does not implement the Content Security Policy Level 2 exceptions for the blob, data, and filesystem URL schemes during wildcard source-expression matching, which might make it easier for remote attackers to conduct cross-site scripting (XSS) attacks by leveraging unexpected policy-enforcement behavior.
Query: patch priority for CVE-2015-0609
Matching passage: CVE-2015-0609. CWE: CWE-362. CVSS: 7.099999904632568. Race condition in the Common Classification Engine (CCE) in the Measurement, Aggregation, and Correlation Engine (MACE) implementation in Cisco IOS 15.4(2)T3 and earlier allows remote attackers to cause a denial of service (device reload) via crafted network traffic that triggers improper handling of the timing of process switching and Cisco Express Forwarding (CEF) switching, aka Bug ID CSCuj96752.
Near-miss passage: CVE-2015-0245. CWE: CWE-362. CVSS: 1.899999976158142. D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.
Query: what is T1134.001
Matching passage: T1134.001 Token Impersonation/Theft. Tactics: stealth, privilege escalation. Description: Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`.(Citation: DuplicateToken function) The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread. An adversary may perform [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) when they have a specific, existing process they want to assign the duplicated token to. For example, this may be useful for when the target user has a non-network logon session on the system. When an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally [Create Process with Token](https://attack.mitre.org/techniques/T1134/002) using `CreateProcessWithTokenW` or `CreateProcessAsUserW`. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) is also distinct from [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) in that it refers to duplicating an existing token, rather than creating a new one.
Near-miss passage: T1134.002 Create Process with Token. Tactics: stealth, privilege escalation. Description: Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as <code>CreateProcessWithTokenW</code> and <code>runas</code>.(Citation: Microsoft RunAs) Creating processes with a token not associated with the current user may require the credentials of the target user, specific privileges to impersonate that user, or access to the token to be used. For example, the token could be duplicated via [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) or created via [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) before being used to create a process. While this technique is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001), the techniques can be used in conjunction where a token is duplicated and then used to create a new process.
Query: risk of The REST layer on HP SDN VAN Controller devices 2.5 and earlier allows remote attackers to cause a denial of service via network traffic to the REST port.
Matching passage: CVE-2015-2122. CWE: CWE-399. CVSS: 7.800000190734863. The REST layer on HP SDN VAN Controller devices 2.5 and earlier allows remote attackers to cause a denial of service via network traffic to the REST port.
Near-miss passage: CVE-2015-0042. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0038 and CVE-2015-0046.
Query: common weakness: Insufficient UI Warning of Dangerous Operations
Matching passage: CWE-357 Insufficient UI Warning of Dangerous Operations. The user interface provides a warning to a user regarding dangerous or sensitive operations, but the warning is not noticeable enough to warrant attention.
Near-miss passage: CWE-73 External Control of File Name or Path. The product allows user input to control or influence paths or file names that are used in filesystem operations.
Query: Sigma rule for Detects inline Windows shell commands redirecting output via the ">" symbol to a suspicious location. This technique is
Matching passage: Sigma rule: Detects inline Windows shell commands redirecting output via the ">" symbol to a suspicious location. This technique is. Logsource: windows / process_creation. Rule: title: Potentially Suspicious CMD Shell Output Redirect id: 8e0bb260-d4b2-4fff-bb8d-3f82118e6892 related: - id: aa2efee7-34dd-446e-8a37-40790a66efd7 type: derived - id: 4f4eaa9f-5ad4-410c-a4be-bc6132b0175a type: similar status: test description: 'Detects inline Windows shell commands redirecting output via the ">" symbol to a suspicious location. This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration. ' references: - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-12 modified: 2024-03-19 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cli_1: CommandLine|contains: - '>?%APPDATA%\' - '>?%TEMP%\' - '>?%TMP%\' - '>?%USERPROFILE%\' - '>?C:\ProgramData\' - '>?C:\Temp\' - '>?C:\Users\Public\' - '>?C:\Windows\Temp\' selection_cli_2: CommandLine|contains: - ' >' - '">' - '''>' CommandLine|contains|all: - C:\Users\ - \AppData\Local\ condition: selection_img and 1 of selection_cli_* falsepositives: - Legitimate admin or third party scripts used for diagnostic collection might generate some false positives level: medium
Near-miss passage: Sigma rule: Detects execution of a the file "execve_hijack" which is used by the Triple Cross rootkit as a way to elevate privileges. Logsource: linux / process_creation. Rule: title: Triple Cross eBPF Rootkit Execve Hijack id: 0326c3c8-7803-4a0f-8c5c-368f747f7c3e status: test description: Detects execution of a the file "execve_hijack" which is used by the Triple Cross rootkit as a way to elevate privileges references: - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/src/helpers/execve_hijack.c#L275 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-05 tags: - attack.privilege-escalation - attack.stealth logsource: category: process_creation product: linux detection: selection: Image|endswith: /sudo CommandLine|contains: execve_hijack condition: selection falsepositives: - Unlikely level: high
Query: weakness Incomplete Design Documentation
Matching passage: CWE-1110 Incomplete Design Documentation. The product's design documentation does not adequately describe control flow, data flow, system initialization, relationships between tasks, components, rationales, or other important aspects of the design.
Near-miss passage: CWE-1434 Insecure Setting of Generative AI/ML Model Inference Parameters. The product has a component that relies on a generative AI/ML model configured with inference parameters that produce an unacceptably high rate of erroneous or unexpected outputs.