alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects appending of zip file to image in logs
Matching passage: Sigma rule: Detects appending of zip file to image. Logsource: linux / auditd. Rule: title: Steganography Hide Zip Information in Picture File id: 45810b50-7edc-42ca-813b-bdac02fb946b status: test description: Detects appending of zip file to image references: - https://zerotoroot.me/steganography-hiding-a-zip-in-a-jpeg-file/ author: Pawel Mazur date: 2021-09-09 modified: 2022-10-09 tags: - attack.stealth - attack.t1027.003 logsource: product: linux service: auditd detection: commands: type: EXECVE a0: cat a1: a1|endswith: - .jpg - .png a2: a2|endswith: .zip condition: commands and a1 and a2 falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing. Logsource: windows / process_creation. Rule: title: Potential Windows Defender AV Bypass Via Dump64.EXE Rename id: 129966c9-de17-4334-a123-8b58172e664d status: test description: 'Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing it in the Visual Studio folder. Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage. ' references: - https://twitter.com/mrd0x/status/1460597833917251595 author: Austin Songer @austinsonger, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-11-26 modified: 2024-06-21 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: process_creation detection: selection_dump: Image|startswith: :\Program Files Image|contains: \Microsoft Visual Studio\ Image|endswith: \dump64.exe selection_tools_procdump: - OriginalFileName: procdump - CommandLine|contains: - ' -ma ' - ' -mp ' condition: selection_dump and 1 of selection_tools_* falsepositives: - Unknown level: high
Query: risk of jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses
Matching passage: CVE-2015-9251. CWE: CWE-79. CVSS: 6.099999904632568. jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
Near-miss passage: CVE-2015-6372. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka Bug ID CSCux10614.
Query: describe CVE-2015-7894
Matching passage: CVE-2015-7894. CWE: CWE-119. CVSS: 8.800000190734863. The DCMProvider service in Samsung LibQjpeg on a Samsung SM-G925V device running build number LRX22G.G925VVRU1AOE2 allows remote attackers to cause a denial of service (segmentation fault and process crash) and execute arbitrary code via a crafted JPG.
Near-miss passage: CVE-2015-3828. CWE: CWE-119. CVSS: 10.0. The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM), which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted 3GPP metadata, aka internal bug 20923261, a related issue to CVE-2015-3826.
Query: write Sigma for Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. W
Matching passage: Sigma rule: Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. W. Logsource: windows / dns_query. Rule: title: DNS Query Request To OneLaunch Update Service id: df68f791-ad95-447f-a271-640a0dab9cf8 status: test description: 'Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. When the OneLaunch application is installed it will attempt to get updates from this domain. ' references: - https://www.malwarebytes.com/blog/detections/pup-optional-onelaunch-silentcf - https://www.myantispyware.com/2020/12/14/how-to-uninstall-onelaunch-browser-removal-guide/ - https://malware.guide/browser-hijacker/remove-onelaunch-virus/ author: Josh Nickels date: 2024-02-26 tags: - attack.credential-access - attack.collection - attack.t1056 logsource: category: dns_query product: windows detection: selection: QueryName: update.onelaunch.com Image|endswith: \OneLaunch.exe condition: selection falsepositives: - Unlikely level: low
Near-miss passage: Sigma rule: Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe. Logsource: windows / process_creation. Rule: title: Regedit as Trusted Installer id: 883835a7-df45-43e4-bf1d-4268768afda4 status: test description: Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe references: - https://twitter.com/1kwpeter/status/1397816101455765504 author: Florian Roth (Nextron Systems) date: 2021-05-27 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548 logsource: category: process_creation product: windows detection: selection: Image|endswith: \regedit.exe ParentImage|endswith: - \TrustedInstaller.exe - \ProcessHacker.exe condition: selection falsepositives: - Unlikely level: high
Query: risk of Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7.x-1.x before 7.x-1.8
Matching passage: CVE-2015-7943. CWE: CWE-601. CVSS: 6.099999904632568. Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7.x-1.x before 7.x-1.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3233.
Near-miss passage: CVE-2015-4668. CWE: CWE-601. CVSS: 6.099999904632568. Open redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirurl parameter.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detect suspicious parent processes of well-known Windows processes. Logsource: windows / process_creation. Rule: title: Windows Processes Suspicious Parent Directory id: 96036718-71cc-4027-a538-d1587e0006a7 status: test description: Detect suspicious parent processes of well-known Windows processes references: - https://web.archive.org/web/20180718061628/https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2 - https://www.carbonblack.com/2014/06/10/screenshot-demo-hunt-evil-faster-than-ever-with-carbon-black/ - https://www.13cubed.com/downloads/windows_process_genealogy_v2.pdf author: vburov date: 2019-02-23 modified: 2025-03-06 tags: - attack.stealth - attack.t1036.003 - attack.t1036.005 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \svchost.exe - \taskhost.exe - \lsm.exe - \lsass.exe - \services.exe - \lsaiso.exe - \csrss.exe - \wininit.exe - \winlogon.exe filter_sys: - ParentImage|endswith: - \SavService.exe - \ngen.exe - ParentImage|contains: - \System32\ - \SysWOW64\ filter_msmpeng: ParentImage|contains: - \Windows Defender\ - \Microsoft Security Client\ ParentImage|endswith: \MsMpEng.exe filter_null: - ParentImage: null - ParentImage: - '' - '-' condition: selection and not 1 of filter_* falsepositives: - Some security products seem to spawn these level: low
Near-miss passage: Sigma rule: Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a OneNote atta. Logsource: windows / process_creation. Rule: title: OneNote.EXE Execution of Malicious Embedded Scripts id: 84b1706c-932a-44c4-ae28-892b28a25b94 status: test description: 'Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a OneNote attachment and then on the malicious link inside the ".one" file, it exports and executes the malicious embedded script from specific directories. ' references: - https://bazaar.abuse.ch/browse/tag/one/ author: '@kostastsale' date: 2023-02-02 tags: - attack.stealth - attack.t1218.001 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \onenote.exe Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \wscript.exe CommandLine|contains: - \exported\ - \onenoteofflinecache_files\ condition: selection falsepositives: - Unlikely level: high
Query: describe CVE-2015-8433
Matching passage: CVE-2015-8433. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-3910. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google V8 before 4.3.61.21, as used in Google Chrome before 43.0.2357.65, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Query: patch priority for CVE-2015-8384
Matching passage: CVE-2015-8384. CWE: CWE-119. CVSS: 7.5. PCRE before 8.38 mishandles the /(?J)(?'d'(?'d'\g{d}))/ pattern and related patterns with certain recursive back references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8392 and CVE-2015-8395.
Near-miss passage: CVE-2015-4521. CWE: CWE-119. CVSS: 7.5. The ConvertDialogOptions function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.
Query: exploit The tm_reclaim_thread function in arch/powerpc/kernel/process.c in the Linux kernel before 4.4.1 on powerpc platforms does not ensure that TM suspend mode exists before proceeding 
Matching passage: CVE-2015-8845. CWE: CWE-284. CVSS: 5.5. The tm_reclaim_thread function in arch/powerpc/kernel/process.c in the Linux kernel before 4.4.1 on powerpc platforms does not ensure that TM suspend mode exists before proceeding with a tm_reclaim call, which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application.
Near-miss passage: CVE-2015-6552. CWE: CWE-284. CVSS: 9.800000190734863. The management-services protocol implementation in Veritas NetBackup 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2 and NetBackup Appliance through 2.5.4, 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, and 2.7.x before 2.7.2 allows remote attackers to make arbitrary RPC calls via unspecified vectors.
Query: EDR alert: possible Weaken Encryption (T1600)
Matching passage: T1600 Weaken Encryption. Tactics: defense impairment. Description: Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications.(Citation: Cisco Synful Knock Evolution) Encryption can be used to protect transmitted network traffic to maintain its confidentiality (protect against unauthorized disclosure) and integrity (protect against unauthorized changes). Encryption ciphers are used to convert a plaintext message to ciphertext and can be computationally intensive to decipher without the associated decryption key. Typically, longer keys increase the cost of cryptanalysis, or decryption without the key. Adversaries can compromise and manipulate devices that perform encryption of network traffic. For example, through behaviors such as [Modify System Image](https://attack.mitre.org/techniques/T1601), [Reduce Key Space](https://attack.mitre.org/techniques/T1600/001), and [Disable Crypto Hardware](https://attack.mitre.org/techniques/T1600/002), an adversary can negatively effect and/or eliminate a device’s ability to securely encrypt network traffic. This poses a greater risk of unauthorized disclosure and may help facilitate data manipulation, Credential Access, or Collection efforts.(Citation: Cisco Blog Legacy Device Attacks)
Near-miss passage: T1600.001 Reduce Key Space. Tactics: defense impairment. Description: Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.(Citation: Cisco Synful Knock Evolution) Adversaries can weaken the encryption software on a compromised network device by reducing the key size used by the software to convert plaintext to ciphertext (e.g., from hundreds or thousands of bytes to just a couple of bytes). As a result, adversaries dramatically reduce the amount of effort needed to decrypt the protected information without the key. Adversaries may modify the key size used and other encryption parameters using specialized commands in a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) introduced to the system through [Modify System Image](https://attack.mitre.org/techniques/T1601) to change the configuration of the device. (Citation: Cisco Blog Legacy Device Attacks)
Query: rule covering Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.
Matching passage: Sigma rule: Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.. Logsource: windows / registry_set. Rule: title: Potential SentinelOne Shell Context Menu Scan Command Tampering id: 6c304b02-06e6-402d-8be4-d5833cdf8198 status: test description: Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne. references: - https://mrd0x.com/sentinelone-persistence-via-menu-context/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-03-06 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \shell\SentinelOneScan\command\ filter_main_sentinelone_default_scan_binary: Details|startswith: - C:\Program Files\SentinelOne\Sentinel Agent - C:\Program Files (x86)\SentinelOne\Sentinel Agent Details|contains: \SentinelScanFromContextMenu.exe filter_main_sentinelone_binary: Image|endswith: - C:\Program Files\SentinelOne\ - C:\Program Files (x86)\SentinelOne\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content in it.. Logsource: windows / process_creation. Rule: title: Suspicious File Execution From Internet Hosted WebDav Share id: f0507c0f-a3a2-40f5-acc6-7f543c334993 status: test description: Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content in it. As seen being used in malicious LNK files references: - https://twitter.com/ShadowChasing1/status/1552595370961944576 - https://www.virustotal.com/gui/file/a63376ee1dba76361df73338928e528ca5b20171ea74c24581605366dcaa0104/behavior author: pH-T (Nextron Systems) date: 2022-09-01 modified: 2023-02-21 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|contains: \cmd.exe - OriginalFileName: Cmd.EXE selection_base: CommandLine|contains|all: - ' net use http' - '& start /b ' - \DavWWWRoot\ selection_ext: CommandLine|contains: - '.exe ' - '.dll ' - '.bat ' - '.vbs ' - '.ps1 ' condition: all of selection_* falsepositives: - Unknown level: high
Query: exploit time.htm in the web interface on SerVision HVG Video Gateway devices with firmware before 2.2.26a78 allows remote attackers to bypass authentication and obtain administrative acces
Matching passage: CVE-2015-0929. CWE: CWE-284. CVSS: 10.0. time.htm in the web interface on SerVision HVG Video Gateway devices with firmware before 2.2.26a78 allows remote attackers to bypass authentication and obtain administrative access by leveraging a cookie received in an HTTP response.
Near-miss passage: CVE-2015-6478. CWE: CWE-284. CVSS: 6.800000190734863. Unitronics VisiLogic OPLC IDE before 9.8.02 does not properly restrict access to ActiveX controls, which allows remote attackers to have an unspecified impact via a crafted web site.
Query: detect Detects various indicators of Microsoft Connection Manager Profile Installer execution in logs
Matching passage: Sigma rule: Detects various indicators of Microsoft Connection Manager Profile Installer execution. Logsource: windows / process_access. Rule: title: CMSTP Execution Process Access id: 3b4b232a-af90-427c-a22f-30b0c0837b95 status: stable description: Detects various indicators of Microsoft Connection Manager Profile Installer execution references: - https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/ author: Nik Seetharaman date: 2018-07-16 modified: 2021-06-27 tags: - attack.stealth - attack.t1218.003 - attack.execution - attack.t1559.001 - attack.g0069 - attack.g0080 - car.2019-04-001 logsource: product: windows category: process_access detection: selection: CallTrace|contains: cmlua.dll condition: selection falsepositives: - Legitimate CMSTP use (unlikely in modern enterprise environments) level: high
Near-miss passage: Sigma rule: Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file. Logsource: windows / file_event. Rule: title: HackTool - NPPSpy Hacktool Usage id: cad1fe90-2406-44dc-bd03-59d0b58fe722 status: test description: Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003/T1003.md#atomic-test-2---credential-dumping-with-nppspy - https://twitter.com/0gtweet/status/1465282548494487554 author: Florian Roth (Nextron Systems) date: 2021-11-29 modified: 2024-06-27 tags: - attack.credential-access logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \NPPSpy.txt - \NPPSpy.dll condition: selection falsepositives: - Unknown level: high
Query: write Sigma for An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it p
Matching passage: Sigma rule: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it p. Logsource: linux / auditd. Rule: title: Data Compressed id: a3b5e3e9-1b49-4119-8b8e-0344a01f21ee status: test description: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. references: - https://github.com/redcanaryco/atomic-red-team/blob/a78b9ed805ab9ea2e422e1aa7741e9407d82d7b1/atomics/T1560.001/T1560.001.md author: Timur Zinniatullin, oscd.community date: 2019-10-21 modified: 2023-07-28 tags: - attack.exfiltration - attack.collection - attack.t1560.001 logsource: product: linux service: auditd detection: selection1: type: execve a0: zip selection2: type: execve a0: gzip a1: -k selection3: type: execve a0: tar a1|contains: -c condition: 1 of selection* falsepositives: - Legitimate use of archiving tools by legitimate user. level: low
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using pkgmgr.exe and dism.exe (UACMe 23). Logsource: windows / process_creation. Rule: title: UAC Bypass Using PkgMgr and DISM id: a743ceba-c771-4d75-97eb-8a90f7f4844c status: test description: Detects the pattern of UAC Bypass using pkgmgr.exe and dism.exe (UACMe 23) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-23 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \pkgmgr.exe Image|endswith: \dism.exe IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-2334
Matching passage: CVE-2015-2334. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Admin Control Panel (ACP) login in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Near-miss passage: CVE-2015-2701. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in CS-Cart 4.2.4 allows remote attackers to hijack the authentication of users for requests that change a user password via a request to profiles-update/.
Query: describe CVE-2015-4233
Matching passage: CVE-2015-4233. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in Cisco Unified MeetingPlace 8.6(1.2) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuu54037.
Near-miss passage: CVE-2015-1605. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in Dell ScriptLogic Asset Manager (aka Quest Workspace Asset Manager) before 9.5 allow remote attackers to execute arbitrary SQL commands via unspecified vectors to (1) GetClientPackage.aspx or (2) GetProcessedPackage.aspx.
Query: vulnerability: Candlepin allows remote attackers to obtain sensitive information by obtaining Java exception statements as a result of excessive web traffic.
Matching passage: CVE-2015-5187. CWE: CWE-200. CVSS: 6.5. Candlepin allows remote attackers to obtain sensitive information by obtaining Java exception statements as a result of excessive web traffic.
Near-miss passage: CVE-2015-6671. CWE: CWE-200. CVSS: 5.900000095367432. Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup.