alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects when a memory process image does not match the disk image, indicative of process hollowing.
Matching passage: Sigma rule: Detects when a memory process image does not match the disk image, indicative of process hollowing.. Logsource: windows / process_tampering. Rule: title: Potential Process Hollowing Activity id: c4b890e5-8d8c-4496-8c66-c805753817cd status: test description: Detects when a memory process image does not match the disk image, indicative of process hollowing. references: - https://twitter.com/SecurePeacock/status/1486054048390332423?s=20 - https://www.bleepingcomputer.com/news/microsoft/microsoft-sysmon-now-detects-malware-process-tampering-attempts/ author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Sittikorn S date: 2022-01-25 modified: 2023-11-28 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.012 logsource: product: windows category: process_tampering detection: selection: Type: Image is replaced filter_main_generic: Image|contains: - :\Program Files (x86) - :\Program Files\ - :\Windows\System32\wbem\WMIADAP.exe - :\Windows\SysWOW64\wbem\WMIADAP.exe filter_optional_opera: Image|contains: \AppData\Local\Programs\Opera\ Image|endswith: \opera.exe filter_optional_edge: Image|endswith: \WindowsApps\MicrosoftEdge.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: Session Manager Autorun Keys Modification id: 046218bd-e0d8-4113-a3c3-895a12b2b298 related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: obsolete status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 - attack.t1546.009 logsource: category: registry_set product: windows detection: session_manager_base: TargetObject|contains: \System\CurrentControlSet\Control\Session Manager session_manager: TargetObject|contains: - \SetupExecute - \S0InitialCommand - \KnownDlls - \Execute - \BootExecute - \AppCertDlls filter: Details: (Empty) condition: session_manager_base and session_manager and not filter falsepositives: - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason - Legitimate administrator sets up autorun keys for legitimate reason level: medium
Query: describe CVE-2015-0277
Matching passage: CVE-2015-0277. CWE: CWE-284. CVSS: 6.0. The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users' accounts via a crafted SAML assertion. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6254 for lack of validation for the Destination attribute in a Response element in a SAML assertion.
Near-miss passage: CVE-2015-6984. CWE: CWE-284. CVSS: 8.800000190734863. libarchive in Apple OS X before 10.11.1 allows attackers to write to arbitrary files via a crafted app that conducts an unspecified symlink attack.
Query: CWE for Integer Overflow or Wraparound
Matching passage: CWE-190 Integer Overflow or Wraparound. The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
Near-miss passage: CWE-560 Use of umask() with chmod-style Argument. The product calls umask() with an incorrect argument that is specified as if it is an argument to chmod().
Query: Lateral movement indicators for Exfiltration Over Webhook
Matching passage: T1567.004 Exfiltration Over Webhook. Tactics: exfiltration. Description: Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server.(Citation: RedHat Webhooks) Many public and commercial services, such as Discord, Slack, and `webhook.site`, support the creation of webhook endpoints that can be used by other services, such as Github, Jira, or Trello.(Citation: Discord Intro to Webhooks) When changes happen in the linked services (such as pushing a repository update or modifying a ticket), these services will automatically post the data to the webhook endpoint for use by the consuming application. Adversaries may link an adversary-owned environment to a victim-owned SaaS service to achieve repeated [Automated Exfiltration](https://attack.mitre.org/techniques/T1020) of emails, chat messages, and other data.(Citation: Push Security SaaS Attacks Repository Webhooks) Alternatively, instead of linking the webhook endpoint to a service, an adversary can manually post staged data directly to the URL in order to exfiltrate it.(Citation: Microsoft SQL Server) Access to webhook endpoints is often over HTTPS, which gives the adversary an additional level of protection. Exfiltration leveraging webhooks can also blend in with normal network traffic if the webhook endpoint points to a commonly used SaaS application or collaboration service.(Citation: CyberArk Labs Discord)(Citation: Talos Discord Webhook Abuse)(Citation: Checkmarx Webhooks)
Near-miss passage: T1567.001 Exfiltration to Code Repository. Tactics: exfiltration. Description: Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection. Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network.
Query: exploit IBM Spectrum Scale 4.1.1.x before 4.1.1.3 and General Parallel File System (GPFS) 3.5.x before 3.5.0.29 and 4.1.x through 4.1.0.8 on AIX allow local users to cause a denial of serv
Matching passage: CVE-2015-7403. CWE: UNKNOWN. CVSS: 4.0. IBM Spectrum Scale 4.1.1.x before 4.1.1.3 and General Parallel File System (GPFS) 3.5.x before 3.5.0.29 and 4.1.x through 4.1.0.8 on AIX allow local users to cause a denial of service (incorrect pointer dereference and node crash) via unspecified vectors.
Near-miss passage: CVE-2015-5563. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5564, and CVE-2015-5565.
Query: CVE similar to CVE-2015-8593
Matching passage: CVE-2015-8593. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in 1x call processing.
Near-miss passage: CVE-2015-3742. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Query: detection rule: This rule detects the execution of Run Once task as configured in the registry
Matching passage: Sigma rule: This rule detects the execution of Run Once task as configured in the registry. Logsource: windows / process_creation. Rule: title: Run Once Task Execution as Configured in Registry id: 198effb6-6c98-4d0c-9ea3-451fa143c45c status: test description: This rule detects the execution of Run Once task as configured in the registry references: - https://twitter.com/pabraeken/status/990717080805789697 - https://lolbas-project.github.io/lolbas/Binaries/Runonce/ - https://twitter.com/0gtweet/status/1602644163824156672?s=20&t=kuxbUnZPltpvFPZdCrqPXA author: Avneet Singh @v3t0_, oscd.community, Christopher Peacock @SecurePeacock (updated) date: 2020-10-18 modified: 2022-12-13 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \runonce.exe - Description: Run Once Wrapper selection_cli: - CommandLine|contains: /AlternateShellStartup - CommandLine|endswith: /r condition: all of selection_* falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects the creation of a file with an uncommon extension in an Office application startup folder. Logsource: windows / file_event. Rule: title: Uncommon File Created In Office Startup Folder id: a10a2c40-2c4d-49f8-b557-1a946bc55d9d status: test description: Detects the creation of a file with an uncommon extension in an Office application startup folder references: - https://app.any.run/tasks/d6fe6624-6ef8-485d-aa75-3d1bdda2a08c/ - http://addbalance.com/word/startup.htm - https://answers.microsoft.com/en-us/msoffice/forum/all/document-in-word-startup-folder-doesnt-open-when/44ab0932-2917-4150-8cdc-2f2cf39e86f3 - https://en.wikipedia.org/wiki/List_of_Microsoft_Office_filename_extensions author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-06-05 modified: 2023-12-13 tags: - attack.resource-development - attack.t1587.001 logsource: product: windows category: file_event detection: selection_word_paths: - TargetFilename|contains: \Microsoft\Word\STARTUP - TargetFilename|contains|all: - \Office - \Program Files - \STARTUP filter_exclude_word_ext: TargetFilename|endswith: - .docb - .docm - .docx - .dotm - .mdb - .mdw - .pdf - .wll - .wwl selection_excel_paths: - TargetFilename|contains: \Microsoft\Excel\XLSTART - TargetFilename|contains|all: - \Office - \Program Files - \XLSTART filter_exclude_excel_ext: TargetFilename|endswith: - .xll - .xls - .xlsm - .xlsx - .xlt - .xltm - .xlw filter_main_office_click_to_run: Image|contains: :\Program Files\Common Files\Microsoft Shared\ClickToRun\ Image|endswith: \OfficeClickToRun.exe filter_main_office_apps: Image|contains: - :\Program Files\Microsoft Office\ - :\Program Files (x86)\Microsoft Office\ Image|endswith: - \winword.exe - \excel.exe condition: ((selection_word_paths and not filter_exclude_word_ext) or (selection_excel_paths and not filter_exclude_excel_ext)) and not 1 of filter_main_* falsepositives: - False positive might stem from rare extensions used by other Office utilities. level: high
Query: risk of IOAcceleratorFamily in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
Matching passage: CVE-2015-5848. CWE: CWE-119. CVSS: 7.199999809265137. IOAcceleratorFamily in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
Near-miss passage: CVE-2015-1473. CWE: CWE-119. CVSS: 6.400000095367432. The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service (segmentation violation) or overwrite memory locations beyond the stack boundary via a long line containing wide characters that are improperly handled in a wscanf call.
Query: EDR alert: possible Exfiltration Over Webhook (T1567.004)
Matching passage: T1567.004 Exfiltration Over Webhook. Tactics: exfiltration. Description: Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server.(Citation: RedHat Webhooks) Many public and commercial services, such as Discord, Slack, and `webhook.site`, support the creation of webhook endpoints that can be used by other services, such as Github, Jira, or Trello.(Citation: Discord Intro to Webhooks) When changes happen in the linked services (such as pushing a repository update or modifying a ticket), these services will automatically post the data to the webhook endpoint for use by the consuming application. Adversaries may link an adversary-owned environment to a victim-owned SaaS service to achieve repeated [Automated Exfiltration](https://attack.mitre.org/techniques/T1020) of emails, chat messages, and other data.(Citation: Push Security SaaS Attacks Repository Webhooks) Alternatively, instead of linking the webhook endpoint to a service, an adversary can manually post staged data directly to the URL in order to exfiltrate it.(Citation: Microsoft SQL Server) Access to webhook endpoints is often over HTTPS, which gives the adversary an additional level of protection. Exfiltration leveraging webhooks can also blend in with normal network traffic if the webhook endpoint points to a commonly used SaaS application or collaboration service.(Citation: CyberArk Labs Discord)(Citation: Talos Discord Webhook Abuse)(Citation: Checkmarx Webhooks)
Near-miss passage: T1567.002 Exfiltration to Cloud Storage. Tactics: exfiltration. Description: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet. Examples of cloud storage services include Dropbox and Google Docs. Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service.
Query: describe CVE-2015-0028
Matching passage: CVE-2015-0028. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0048.
Near-miss passage: CVE-2015-0021. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Query: patch priority for CVE-2015-0601
Matching passage: CVE-2015-0601. CWE: CWE-20. CVSS: 4.599999904632568. Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allow local users to cause a denial of service (device reload) via crafted commands, aka Bug ID CSCup92790.
Near-miss passage: CVE-2015-9147. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, SD 400, and SD 800, userspace-provided pointer arguments are not validated.
Query: detection rule: Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system pe
Matching passage: Sigma rule: Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system pe. Logsource: windows / ps_module. Rule: title: Suspicious Get Local Groups Information id: cef24b90-dddc-4ae1-a09a-8764872f69fc related: - id: fa6a5a45-3ee2-4529-aa14-ee5edc9e29cb type: similar status: test description: 'Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.001/T1069.001.md author: frack113 date: 2021-12-12 modified: 2025-08-22 tags: - attack.discovery - attack.t1069.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_localgroup: - Payload|contains: - 'get-localgroup ' - 'get-localgroupmember ' - ContextInfo|contains: - 'get-localgroup ' - 'get-localgroupmember ' selection_wmi_module: - Payload|contains: - 'get-wmiobject ' - 'gwmi ' - 'get-ciminstance ' - 'gcim ' - ContextInfo|contains|all: - 'get-wmiobject ' - 'gwmi ' - 'get-ciminstance ' - 'gcim ' selection_wmi_class: - Payload|contains: win32_group - ContextInfo|contains: win32_group condition: selection_localgroup or all of selection_wmi_* falsepositives: - Administrator script level: low
Near-miss passage: Sigma rule: Detects the execution of wmic with the "qfe" flag in order to obtain information about installed hotfix updates on the s. Logsource: windows / process_creation. Rule: title: Windows Hotfix Updates Reconnaissance Via Wmic.EXE id: dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45 status: test description: Detects the execution of wmic with the "qfe" flag in order to obtain information about installed hotfix updates on the system. This is often used by pentester and attacker enumeration scripts references: - https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat - https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-20 modified: 2023-02-14 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: wmic.exe - Image|endswith: \WMIC.exe selection_cli: CommandLine|contains: ' qfe' condition: all of selection* falsepositives: - Unknown level: medium simulation: - type: atomic-red-team name: WMI Reconnaissance Software technique: T1047 atomic_guid: 718aebaa-d0e0-471a-8241-c5afa69c7414 regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_hotfix/info.yml
Query: vulnerability: A Command Injection vulnerability exists in FortiManager 5.2.1 and earlier and FortiManager 5.0.10 and earlier via unspecified vectors, which could let a malicious user run systems
Matching passage: CVE-2015-3611. CWE: CWE-78. CVSS: 8.800000190734863. A Command Injection vulnerability exists in FortiManager 5.2.1 and earlier and FortiManager 5.0.10 and earlier via unspecified vectors, which could let a malicious user run systems commands when executing a report.
Near-miss passage: CVE-2015-7310. CWE: CWE-78. CVSS: 6.5. McAfee Enterprise Security Manager (ESM), Enterprise Security Manager/Log Manager (ESMLM), and Enterprise Security Manager/Receiver (ESMREC) before 9.3.2MR18, 9.4.x before 9.4.2MR8, and 9.5.x before 9.5.0MR7 allow remote authenticated users to execute arbitrary OS commands via a crafted filename, which is not properly handled when downloading the file.
Query: secure coding against Improper Neutralization of Macro Symbols
Matching passage: CWE-152 Improper Neutralization of Macro Symbols. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as macro symbols when they are sent to a downstream component.
Near-miss passage: CWE-1220 Insufficient Granularity of Access Control. The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in adv_pwd_cgi in the web management interface on Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125
Matching passage: CVE-2015-7290. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in adv_pwd_cgi in the web management interface on Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 allows remote attackers to inject arbitrary web script or HTML via the pwd parameter.
Near-miss passage: CVE-2015-9295. CWE: CWE-79. CVSS: 6.099999904632568. The contact-form-plugin plugin before 3.96 for WordPress has XSS.
Query: exploit core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode attribute, which allows remote attackers to bypass the Same 
Matching passage: CVE-2015-1254. CWE: CWE-264. CVSS: 5.0. core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the availability of editing.
Near-miss passage: CVE-2015-5301. CWE: CWE-264. CVSS: 5.5. providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).
Query: exploit Heap-based buffer overflow in the ExponentialFunction::ExponentialFunction function in Poppler before 0.40.0 allows remote attackers to cause a denial of service (memory corruption
Matching passage: CVE-2015-8868. CWE: CWE-119. CVSS: 7.800000190734863. Heap-based buffer overflow in the ExponentialFunction::ExponentialFunction function in Poppler before 0.40.0 allows remote attackers to cause a denial of service (memory corruption and crash) or possibly execute arbitrary code via an invalid blend mode in the ExtGState dictionary in a crafted PDF document.
Near-miss passage: CVE-2015-7048. CWE: CWE-119. CVSS: 6.800000190734863. WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.
Query: exploit Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memo
Matching passage: CVE-2015-0028. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0048.
Near-miss passage: CVE-2015-0021. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."