alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service. Logsource: windows / process_creation. Rule: title: Suspicious Child Process Of Manage Engine ServiceDesk id: cea2b7ea-792b-405f-95a1-b903ea06458f status: test description: Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service references: - https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/ - https://github.com/horizon3ai/CVE-2022-47966/blob/3a51c6b72ebbd87392babd955a8fbeaee2090b35/CVE-2022-47966.py - https://blog.viettelcybersecurity.com/saml-show-stopper/ author: Florian Roth (Nextron Systems) date: 2023-01-18 modified: 2023-08-29 tags: - attack.command-and-control - attack.t1102 logsource: category: process_creation product: windows detection: selection: ParentImage|contains|all: - \ManageEngine\ServiceDesk\ - \java.exe Image|endswith: - \AppVLP.exe - \bash.exe - \bitsadmin.exe - \calc.exe - \certutil.exe - \cscript.exe - \curl.exe - \forfiles.exe - \mftrace.exe - \mshta.exe - \net.exe - \net1.exe - \notepad.exe - \powershell.exe - \pwsh.exe - \query.exe - \reg.exe - \schtasks.exe - \scrcons.exe - \sh.exe - \systeminfo.exe - \whoami.exe - \wmic.exe - \wscript.exe filter_main_net: Image|endswith: - \net.exe - \net1.exe CommandLine|contains: ' stop' condition: selection and not 1 of filter_main_* falsepositives: - Legitimate sub processes started by Manage Engine ServiceDesk Pro level: high
Near-miss passage: Sigma rule: Alerts on trust record modification within the registry, indicating usage of macros. Logsource: windows / registry_event. Rule: title: Windows Registry Trust Record Modification id: 295a59c1-7b79-4b47-a930-df12c15fc9c2 related: - id: a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd type: similar status: test description: Alerts on trust record modification within the registry, indicating usage of macros references: - https://outflank.nl/blog/2018/01/16/hunting-for-evil-detect-macros-being-executed/ - http://az4n6.blogspot.com/2016/02/more-on-trust-records-macros-and.html - https://twitter.com/inversecos/status/1494174785621819397 author: Antonlovesdnb, Trent Liffick (@tliffick) date: 2020-02-19 modified: 2023-06-21 tags: - attack.initial-access - attack.t1566.001 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: \Security\Trusted Documents\TrustRecords condition: selection falsepositives: - This will alert on legitimate macro usage as well, additional tuning is required level: medium
Query: describe CVE-2015-4856
Matching passage: CVE-2015-4856. CWE: UNKNOWN. CVSS: 4.900000095367432. Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.0.30, 4.1.38, 4.2.30, 4.3.26, and 5.0.0 allows local users to affect availability via unknown vectors related to Core.
Near-miss passage: CVE-2015-2028. CWE: UNKNOWN. CVSS: 4.300000190734863. CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.
Query: detect Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command li in logs
Matching passage: Sigma rule: Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command li. Logsource: windows / process_creation. Rule: title: HackTool - Certify Execution id: 762f2482-ff21-4970-8939-0aa317a886bb status: test description: Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments. references: - https://github.com/GhostPack/Certify author: pH-T (Nextron Systems) date: 2023-04-17 modified: 2023-04-25 tags: - attack.discovery - attack.credential-access - attack.t1649 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \Certify.exe - OriginalFileName: Certify.exe - Description|contains: Certify selection_cli_commands: CommandLine|contains: - '.exe cas ' - '.exe find ' - '.exe pkiobjects ' - '.exe request ' - '.exe download ' selection_cli_options: CommandLine|contains: - ' /vulnerable' - ' /template:' - ' /altname:' - ' /domain:' - ' /path:' - ' /ca:' condition: selection_img or all of selection_cli_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the networ. Logsource: windows / security. Rule: title: T1047 Wmiprvse Wbemcomn DLL Hijack id: f6c68d5f-e101-4b86-8c84-7d96851fd65c status: test description: Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario. references: - https://threathunterplaybook.com/hunts/windows/201009-RemoteWMIWbemcomnDLLHijack/notebook.html author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR) date: 2020-10-12 modified: 2022-02-24 tags: - attack.execution - attack.t1047 - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: security detection: selection: EventID: 5145 RelativeTargetName|endswith: \wbem\wbemcomn.dll filter: SubjectUserName|endswith: $ condition: selection and not filter falsepositives: - Unknown level: high
Query: risk of Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a differ
Matching passage: CVE-2015-8520. CWE: CWE-119. CVSS: 9.800000190734863. Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability than CVE-2015-8519, CVE-2015-8521, and CVE-2015-8522.
Near-miss passage: CVE-2015-3117. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3123, CVE-2015-3130, CVE-2015-3133, CVE-2015-3134, and CVE-2015-4431.
Query: SIEM correlation: command and control activity consistent with Dead Drop Resolver
Matching passage: T1102.001 Dead Drop Resolver. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
Near-miss passage: T1102.002 Bidirectional Communication. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Query: patch priority for CVE-2015-5568
Matching passage: CVE-2015-5568. CWE: CWE-20. CVSS: 10.0. Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to cause a denial of service (vector-length corruption) or possibly have unspecified other impact via unknown vectors.
Near-miss passage: CVE-2015-1047. CWE: CWE-20. CVSS: 5.0. vpxd in VMware vCenter Server 5.0 before u3e, 5.1 before u3, and 5.5 before u2 allows remote attackers to cause a denial of service via a long heartbeat message.
Query: CVE similar to CVE-2015-0878
Matching passage: CVE-2015-0878. CWE: CWE-22. CVSS: 5.800000190734863. Directory traversal vulnerability in CREAR AL-Mail32 before 1.13d allows remote attackers to write to arbitrary files via a crafted filename of an attachment.
Near-miss passage: CVE-2015-9406. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary files via a .. (dot dot) in the files parameter to css/css.php.
Query: CVE similar to CVE-2015-7666
Matching passage: CVE-2015-7666. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_int_message_list.inc.php in the Payment Form for PayPal Pro plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the cal parameter.
Near-miss passage: CVE-2015-1512. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in FancyFon FAMOC before 3.17.4 allow remote attackers to inject arbitrary web script or HTML via the (1) LoginForm[username] to ui/system/login or the (2) order or (3) myorgs to index.php.
Query: CWE for Omitted Break Statement in Switch
Matching passage: CWE-484 Omitted Break Statement in Switch. The product omits a break statement within a switch or similar construct, causing code associated with multiple conditions to execute. This can cause problems when the programmer only intended to execute code associated with one condition.
Near-miss passage: CWE-1065 Runtime Resource Management Control Element in a Component Built to Run on Application Servers. The product uses deployed components from application servers, but it also uses low-level functions/methods for management of resources, instead of the API provided by the application server.
Query: patch priority for CVE-2015-4724
Matching passage: CVE-2015-4724. CWE: CWE-89. CVSS: 8.800000190734863. SQL injection vulnerability in Concrete5 5.7.3.1.
Near-miss passage: CVE-2015-4222. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in Cisco Unified Communications Manager IM and Presence Service 9.1(1) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuq46325.
Query: patch priority for CVE-2015-6829
Matching passage: CVE-2015-6829. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in the getip function in wp-limit-login-attempts.php in the WP Limit Login Attempts plugin before 2.0.1 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) X-Forwarded-For or (2) Client-IP HTTP header.
Near-miss passage: CVE-2015-3993. CWE: CWE-89. CVSS: 6.5. Actian Matrix 5.1.x through 5.1.2.4 and 5.2.x through 5.2.0.1 allows remote authenticated users to bypass intended write-access restrictions and execute an UPDATE statement by referencing a table.
Query: detect Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation in logs
Matching passage: Sigma rule: Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation. Logsource: windows / system. Rule: title: Meterpreter or Cobalt Strike Getsystem Service Installation - System id: 843544a7-56e0-4dcc-a44f-5cc266dd97d6 status: test description: Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment - https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/ author: Teymur Kheirkhabarov, Ecco, Florian Roth (Nextron Systems) date: 2019-10-26 modified: 2023-11-15 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.001 - attack.t1134.002 logsource: product: windows service: system detection: selection_id: Provider_Name: Service Control Manager EventID: 7045 selection_cli_cmd: ImagePath|contains|all: - /c - echo - \pipe\ ImagePath|contains: - cmd - '%COMSPEC%' selection_cli_rundll: ImagePath|contains|all: - rundll32 - .dll,a - '/p:' selection_cli_share: ImagePath|startswith: \\\\127.0.0.1\\ADMIN$\ condition: selection_id and 1 of selection_cli_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects potential execution of MeshAgent which is a tool used for remote access. Historical data shows that threat actor. Logsource: windows / process_creation. Rule: title: Remote Access Tool - Potential MeshAgent Execution - Windows id: 2fbbe9ff-0afc-470b-bdc0-592198339968 related: - id: 22c45af6-f590-4d44-bab3-b5b2d2a2b6d9 type: similar status: experimental description: 'Detects potential execution of MeshAgent which is a tool used for remote access. Historical data shows that threat actors rename MeshAgent binary to evade detection. Matching command lines with the ''--meshServiceName'' argument can indicate that the MeshAgent is being used for remote access. ' references: - https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access - https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/ - https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/ - https://www.security.com/threat-intelligence/medusa-ransomware-attacks author: Norbert Jaśniewicz (AlphaSOC) date: 2025-05-19 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: --meshServiceName condition: selection falsepositives: - Environments that legitimately use MeshAgent level: medium
Query: exploit The JavaServer Pages (JSP) component in Cisco Integrated Management Controller (IMC) Supervisor before 1.0.0.1 and UCS Director (formerly Cloupia Unified Infrastructure Controller)
Matching passage: CVE-2015-6259. CWE: CWE-20. CVSS: 9.399999618530273. The JavaServer Pages (JSP) component in Cisco Integrated Management Controller (IMC) Supervisor before 1.0.0.1 and UCS Director (formerly Cloupia Unified Infrastructure Controller) before 5.2.0.1 allows remote attackers to write to arbitrary files via crafted HTTP requests, aka Bug IDs CSCus36435 and CSCus62625.
Near-miss passage: CVE-2015-7993. CWE: CWE-20. CVSS: 7.5. The Extended Application Services (aka XS or XS Engine) in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to execute arbitrary code via unspecified vectors related to "HTTP Login," aka SAP Security Note 2197397.
Query: vulnerability: Multiple unquoted Windows search path vulnerabilities in the (1) Client Management and (2) Gateway in McAfee ePO Deep Command 2.1 and 2.2 before HF 1058831 allow local users to gai
Matching passage: CVE-2015-3987. CWE: CWE-426. CVSS: 7.199999809265137. Multiple unquoted Windows search path vulnerabilities in the (1) Client Management and (2) Gateway in McAfee ePO Deep Command 2.1 and 2.2 before HF 1058831 allow local users to gain privileges via unspecified vectors.
Near-miss passage: CVE-2015-6305. CWE: CWE-426. CVSS: 7.199999809265137. Untrusted search path vulnerability in the CMainThread::launchDownloader function in vpndownloader.exe in Cisco AnyConnect Secure Mobility Client 2.0 through 4.1 on Windows allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by dbghelp.dll, aka Bug ID CSCuv01279. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-4211.
Query: vulnerability: Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect availability via vectors related to Kernel Zones virtualized NIC driver.
Matching passage: CVE-2015-2651. CWE: UNKNOWN. CVSS: 3.799999952316284. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect availability via vectors related to Kernel Zones virtualized NIC driver.
Near-miss passage: CVE-2015-7620. CWE: UNKNOWN. CVSS: 6.800000190734863. The ANSendForBrowserReview method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, and CVE-2015-7623.
Query: patch priority for CVE-2015-4228
Matching passage: CVE-2015-4228. CWE: CWE-399. CVSS: 5.400000095367432. Cisco Digital Content Manager (DCM) 15.0.0 might allow remote ad servers to cause a denial of service (reboot) via malformed ad messages, aka Bug ID CSCur13999.
Near-miss passage: CVE-2015-4239. CWE: CWE-399. CVSS: 6.099999904632568. Cisco Adaptive Security Appliance (ASA) Software 9.3(2.243) and 100.13(0.21) allows remote attackers to cause a denial of service (device reload) by sending crafted OSPFv2 packets on the local network, aka Bug ID CSCus84220.
Query: vulnerability: The RSM (aka RSMWinService) service in SolarWinds N-Able N-Central before 9.5.1.4514 uses the same password decryption key across different customers' installations, which makes it
Matching passage: CVE-2015-5610. CWE: CWE-200. CVSS: 4.0. The RSM (aka RSMWinService) service in SolarWinds N-Able N-Central before 9.5.1.4514 uses the same password decryption key across different customers' installations, which makes it easier for remote authenticated users to obtain the cleartext domain-administrator password by locating the encrypted password within HTML source code and then leveraging knowledge of this key from another installation.
Near-miss passage: CVE-2015-1064. CWE: CWE-200. CVSS: 1.899999976158142. Springboard in Apple iOS before 8.2 allows physically proximate attackers to bypass an intended activation requirement and read the home screen by leveraging an application crash during the activation process.
Query: risk of MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A directory traversal vulnerability was discovered (fixed and publicly disclosed in 2015) in Len
Matching passage: CVE-2015-8535. CWE: CWE-22. CVSS: 7.800000190734863. MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A directory traversal vulnerability was discovered (fixed and publicly disclosed in 2015) in Lenovo Solution Center (LSC) prior to version 3.3.002 that could allow a user to execute arbitrary code with elevated privileges.
Near-miss passage: CVE-2015-8798. CWE: CWE-22. CVSS: 8.0. Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0 before MP1, Critical System Protection (SCSP) before 5.2.9 MP6, Data Center Security: Server Advanced Server (DCS:SA) 6.x before 6.5 MP1 and 6.6 before MP1, and Data Center Security: Server Advanced Server and Agents (DCS:SA) through 6.6 MP1 allows remote authenticated users to execute arbitrary code via unspecified vectors.
Query: alert when Identifies when a new cloudshell is created inside of Azure portal.
Matching passage: Sigma rule: Identifies when a new cloudshell is created inside of Azure portal.. Logsource: azure / activitylogs. Rule: title: Azure New CloudShell Created id: 72af37e2-ec32-47dc-992b-bc288a2708cb status: test description: Identifies when a new cloudshell is created inside of Azure portal. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer date: 2021-09-21 modified: 2022-08-23 tags: - attack.execution - attack.t1059 logsource: product: azure service: activitylogs detection: selection: operationName: MICROSOFT.PORTAL/CONSOLES/WRITE condition: selection falsepositives: - A new cloudshell may be created by a system administrator. level: medium
Near-miss passage: Sigma rule: Detects a service installed by a client which has PID 0 or whose parent has PID 0. Logsource: windows / system. Rule: title: Service Installed By Unusual Client - System id: 71c276aa-49cd-43d2-b920-2dcd3e6962d5 related: - id: c4e92a97-a9ff-4392-9d2d-7a4c642768ca type: similar status: test description: Detects a service installed by a client which has PID 0 or whose parent has PID 0 references: - https://www.elastic.co/guide/en/security/current/windows-service-installed-via-an-unusual-client.html author: Tim Rauch (Nextron Systems), Elastic (idea) date: 2022-09-15 modified: 2023-01-04 tags: - attack.persistence - attack.privilege-escalation - attack.t1543 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ProcessId: 0 condition: selection falsepositives: - Unknown level: high