alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects the creation of a startup item plist file, that automatically get executed at boot initialization to establish p
Matching passage: Sigma rule: Detects the creation of a startup item plist file, that automatically get executed at boot initialization to establish p. Logsource: macos / file_event. Rule: title: Startup Item File Created - MacOS id: dfe8b941-4e54-4242-b674-6b613d521962 status: test description: 'Detects the creation of a startup item plist file, that automatically get executed at boot initialization to establish persistence. Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1037.005/T1037.005.md - https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html author: Alejandro Ortuno, oscd.community date: 2020-10-14 modified: 2024-08-11 tags: - attack.persistence - attack.privilege-escalation - attack.t1037.005 logsource: category: file_event product: macos detection: selection: TargetFilename|startswith: - /Library/StartupItems/ - /System/Library/StartupItems TargetFilename|endswith: .plist condition: selection falsepositives: - Legitimate administration activities level: low
Near-miss passage: Sigma rule: Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. S. Logsource: linux / process_creation. Rule: title: ESXi VSAN Information Discovery Via ESXCLI id: d54c2f06-aca9-4e2b-81c9-5317858f4b79 status: test description: Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide. references: - https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html - https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vsan.html author: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon date: 2023-09-04 tags: - attack.discovery - attack.execution - attack.t1033 - attack.t1007 - attack.t1059.012 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /esxcli CommandLine|contains: vsan selection_cli: CommandLine|contains: - ' get' - ' list' condition: all of selection_* falsepositives: - Legitimate administration activities level: medium
Query: CVE similar to CVE-2015-5321
Matching passage: CVE-2015-5321. CWE: CWE-200. CVSS: 5.0. The sidepanel widgets in the CLI command overview and help pages in Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to the pages.
Near-miss passage: CVE-2015-4450. CWE: CWE-200. CVSS: 5.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2014-8450, CVE-2015-4449, CVE-2015-5088, CVE-2015-5089, and CVE-2015-5092.
Query: describe CVE-2015-7672
Matching passage: CVE-2015-7672. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Centreon 2.6.1 (fixed in Centreon 18.10.0 and Centreon web 2.8.27).
Near-miss passage: CVE-2015-5630. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the NTT Broadband Platform Japan Connected-free Wi-Fi application 1.6.0 and earlier for Android and 1.0.2 and earlier for iOS allows remote attackers to inject arbitrary web script or HTML via a crafted SSID.
Query: patch priority for CVE-2015-7706
Matching passage: CVE-2015-7706. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in Secure Data Space SDS-API before 3.5.7 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO to api/v3/public/shares/downloads/, the (2) authType parameter to api/v3/auth/login, or the (3) login parameter to api/v3/auth/reset_password.
Near-miss passage: CVE-2015-2072. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in SAP HANA 73 (1.00.73.00.389160) and HANA Developer Edition 80 (1.00.80.00.391861) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) ide/core/plugins/editor/templates/trace/hanaTraceDetailService.xsjs or (2) xs/ide/editor/templates/trace/hanaTraceDetailService.xsjs, aka SAP Note 2069676.
Query: risk of Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gol
Matching passage: CVE-2015-0061. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly initialize memory for TIFF images, which allows remote attackers to obtain sensitive information from process memory via a crafted image file, aka "TIFF Processing Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-4735. CWE: CWE-200. CVSS: 5.0. Unspecified vulnerability in the Enterprise Manager for Oracle Database component in Oracle Enterprise Manager Grid Control EM Base Platform 11.1.0.1, and EM DB Control 11.2.0.3 and 11.2.0.4, allows remote attackers to affect confidentiality via vectors related to RAC Management.
Query: alert when Detects abusing Windows 10 Narrator's Feedback-Hub
Matching passage: Sigma rule: Detects abusing Windows 10 Narrator's Feedback-Hub. Logsource: windows / registry_event. Rule: title: Narrator's Feedback-Hub Persistence id: f663a6d9-9d1b-49b8-b2b1-0637914d199a status: test description: Detects abusing Windows 10 Narrator's Feedback-Hub references: - https://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html author: Dmitriy Lifanov, oscd.community date: 2019-10-25 modified: 2022-03-26 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_event product: windows detection: selection1: EventType: DeleteValue TargetObject|endswith: \AppXypsaf9f1qserqevf0sws76dx4k9a5206\Shell\open\command\DelegateExecute selection2: TargetObject|endswith: \AppXypsaf9f1qserqevf0sws76dx4k9a5206\Shell\open\command\(Default) condition: 1 of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of the 'Launch-VsDevShell.ps1' Microsoft signed script to execute commands.. Logsource: windows / process_creation. Rule: title: Launch-VsDevShell.PS1 Proxy Execution id: 45d3a03d-f441-458c-8883-df101a3bb146 status: test description: Detects the use of the 'Launch-VsDevShell.ps1' Microsoft signed script to execute commands. references: - https://twitter.com/nas_bench/status/1535981653239255040 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 tags: - attack.stealth - attack.t1216.001 logsource: category: process_creation product: windows detection: selection_script: CommandLine|contains: Launch-VsDevShell.ps1 selection_flags: CommandLine|contains: - 'VsWherePath ' - 'VsInstallationPath ' condition: all of selection_* falsepositives: - Legitimate usage of the script by a developer level: medium
Query: how to detect Communication Through Removable Media
Matching passage: T1092 Communication Through Removable Media. Tactics: command and control. Description: Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.(Citation: ESET Sednit USBStealer 2014) Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091). Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.
Near-miss passage: T1026 Multiband Communication. Tactics: command and control. Description: **This technique has been deprecated and should no longer be used.** Some adversaries may split communications between different protocols. There could be one protocol for inbound command and control and another for outbound data, allowing it to bypass certain firewall restrictions. The split could also be random to simply avoid data threshold alerts on any one communication.
Query: describe CVE-2015-5104
Matching passage: CVE-2015-5104. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3095, CVE-2015-5087, CVE-2015-5094, CVE-2015-5100, CVE-2015-5102, CVE-2015-5103, and CVE-2015-5115.
Near-miss passage: CVE-2015-8277. CWE: CWE-119. CVSS: 9.800000190734863. Multiple buffer overflows in (1) lmgrd and (2) Vendor Daemon in Flexera FlexNet Publisher before 11.13.1.2 Security Update 1 allow remote attackers to execute arbitrary code via a crafted packet with opcode (a) 0x107 or (b) 0x10a.
Query: risk of Cross-site scripting (XSS) vulnerability in MantisBT 1.2.13 and later before 1.2.20.
Matching passage: CVE-2015-2046. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in MantisBT 1.2.13 and later before 1.2.20.
Near-miss passage: CVE-2015-3988. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2015.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the metadata to a (1) Glance image, (2) Nova flavor or (3) Host Aggregate.
Query: actor TTPs: Archive Collected Data
Matching passage: T1560 Archive Collected Data. Tactics: collection. Description: An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.(Citation: DOJ GRU Indictment Jul 2018) Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender. Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.
Near-miss passage: T1560.001 Archive via Utility. Tactics: collection. Description: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport. Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as <code>tar</code> on Linux and macOS or <code>zip</code> on Windows systems. On Windows, <code>diantz</code> or <code> makecab</code> may be used to package collected files into a cabinet (.cab) file. <code>diantz</code> may also be used to download and compress files from remote locations (i.e. [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002)).(Citation: diantz.exe_lolbas) <code>xcopy</code> on Windows can copy files and directories with a variety of options. Additionally, adversaries may use [certutil](https://attack.mitre.org/software/S0160) to Base64 encode collected data before exfiltration. Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.(Citation: 7zip Homepage)(Citation: WinRAR Homepage)(Citation: WinZip Homepage)
Query: incident response steps for EDR alert: possible Modify Cloud Compute Configurations (T1578.005)
Matching passage: Playbook for T1578.005 Modify Cloud Compute Configurations. 1) Validate alert telemetry against T1578.005. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: defense impairment. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may modify settings that directly affect the size, locations, and resources available to cloud compute infrastructure in order to evade defenses. These settings may include service quotas, subscription associations, tenant-wide policies, or other configurations that impact available compute. Such modifications may allow adversaries to abuse the victim’s compute resources to achieve the
Near-miss passage: Playbook for T1578 Modify Cloud Compute Infrastructure. Different response path focused on defense impairment.
Query: risk of Heap-based buffer overflow in chrony before 1.31.1 allows remote authenticated users to cause a denial of service (chronyd crash) or possibly execute arbitrary code by configuring 
Matching passage: CVE-2015-1821. CWE: CWE-119. CVSS: 6.5. Heap-based buffer overflow in chrony before 1.31.1 allows remote authenticated users to cause a denial of service (chronyd crash) or possibly execute arbitrary code by configuring the (1) NTP or (2) cmdmon access with a subnet size that is indivisible by four and an address with a nonzero bit in the subnet remainder.
Near-miss passage: CVE-2015-2452. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2441.
Query: CVE similar to CVE-2015-7894
Matching passage: CVE-2015-7894. CWE: CWE-119. CVSS: 8.800000190734863. The DCMProvider service in Samsung LibQjpeg on a Samsung SM-G925V device running build number LRX22G.G925VVRU1AOE2 allows remote attackers to cause a denial of service (segmentation fault and process crash) and execute arbitrary code via a crafted JPG.
Near-miss passage: CVE-2015-3828. CWE: CWE-119. CVSS: 10.0. The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM), which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted 3GPP metadata, aka internal bug 20923261, a related issue to CVE-2015-3826.
Query: detect Detects file access requests to the Windows Credential History File by an uncommon application. This can be a sign of cr in logs
Matching passage: Sigma rule: Detects file access requests to the Windows Credential History File by an uncommon application. This can be a sign of cr. Logsource: windows / file_access. Rule: title: Access To Windows Credential History File By Uncommon Applications id: 7a2a22ea-a203-4cd3-9abf-20eb1c5c6cd2 status: test description: 'Detects file access requests to the Windows Credential History File by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function ' references: - https://tools.thehacker.recipes/mimikatz/modules/dpapi/credhist - https://www.passcape.com/windows_password_recovery_dpapi_credhist author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-17 modified: 2024-07-29 tags: - attack.credential-access - attack.t1555.004 logsource: category: file_access product: windows definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider' detection: selection: FileName|endswith: \Microsoft\Protect\CREDHIST filter_main_system_folders: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ - C:\Windows\system32\ - C:\Windows\SysWOW64\ filter_main_explorer: Image: C:\Windows\explorer.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of the BitLocker Access Agent Update Utility (baaupdate.exe) which is not a common parent process. Logsource: windows / process_creation. Rule: title: Suspicious BitLocker Access Agent Update Utility Execution id: 9f38c1db-e2ae-40bf-81d0-5b68f73fb512 related: - id: 6e8fe0a8-ba0b-4a93-8f9e-82657e7a5984 type: similar status: experimental description: 'Detects the execution of the BitLocker Access Agent Update Utility (baaupdate.exe) which is not a common parent process for other processes. Suspicious child processes spawned by baaupdate.exe could indicate an attempt at lateral movement via BitLocker DCOM & COM Hijacking. ' references: - https://github.com/rtecCyberSec/BitlockMove author: andrewdanis, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-10-18 tags: - attack.stealth - attack.t1218 - attack.lateral-movement - attack.t1021.003 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \baaupdate.exe Image|endswith: - \bitsadmin.exe - \cmd.exe - \cscript.exe - \mshta.exe - \powershell_ise.exe - \powershell.exe - \regsvr32.exe - \rundll32.exe - \schtasks.exe - \wmic.exe - \wscript.exe condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-2216
Matching passage: CVE-2015-2216. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in ecomm-sizes.php in the Photocrati theme 4.x for WordPress allows remote attackers to execute arbitrary SQL commands via the prod_id parameter.
Near-miss passage: CVE-2015-6512. CWE: CWE-89. CVSS: 5.0. SQL injection vulnerability in the get_messages function in server/plugins/chatroom/chatroom.php in FreiChat 9.6 allows remote attackers to execute arbitrary SQL commands via the time parameter to server/freichat.php.
Query: describe CVE-2015-3989
Matching passage: CVE-2015-3989. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to private messages or other unspecified vectors.
Near-miss passage: CVE-2015-2244. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Webshop hun 1.062S allow remote attackers to inject arbitrary web script or HTML via the (1) param, (2) center, (3) lap, (4) termid, or (5) nyelv_id parameter to index.php.
Query: vulnerability: Stack-based buffer overflow in the Initialize function in an ActiveX control in IBM SPSS Statistics 19 and 20 before 20.0.0.2-IF0008, 21 before 21.0.0.2-IF0010, 22 before 22.0.0.2-
Matching passage: CVE-2015-8530. CWE: CWE-119. CVSS: 6.5. Stack-based buffer overflow in the Initialize function in an ActiveX control in IBM SPSS Statistics 19 and 20 before 20.0.0.2-IF0008, 21 before 21.0.0.2-IF0010, 22 before 22.0.0.2-IF0011, 23 before 23.0.0.3-IF0001, and 24 before 24.0.0.0-IF0003 allows remote authenticated users to execute arbitrary code via a long argument.
Near-miss passage: CVE-2015-8319. CWE: CWE-119. CVSS: 7.800000190734863. Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application, a different vulnerability than CVE-2015-8318.
Query: describe CVE-2015-1312
Matching passage: CVE-2015-1312. CWE: CWE-264. CVSS: 7.5. The Dealer Portal in SAP ERP does not properly restrict access, which allows remote attackers to obtain sensitive information, gain privileges, and possibly have other unspecified impact via unknown vectors, aka SAP Note 2000401. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Near-miss passage: CVE-2015-4182. CWE: CWE-264. CVSS: 5.5. The administrative web interface in Cisco Identity Services Engine (ISE) before 1.3 allows remote authenticated users to bypass intended access restrictions, and obtain sensitive information or change settings, via unspecified vectors, aka Bug ID CSCui72087.
Query: describe CVE-2015-6862
Matching passage: CVE-2015-6862. CWE: CWE-200. CVSS: 8.399999618530273. HPE UCMDB Browser before 4.02 allows remote attackers to obtain sensitive information or bypass intended access restrictions via unspecified vectors.
Near-miss passage: CVE-2015-6858. CWE: CWE-200. CVSS: 3.700000047683716. HP Insight Control server provisioning before 7.5.0 RabbitMQ allows remote attackers to obtain sensitive information via unspecified vectors.
Query: risk of Unspecified vulnerability in Oracle Java SE 7u76 and 8u40, and JavaFX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a 
Matching passage: CVE-2015-0492. CWE: UNKNOWN. CVSS: 9.300000190734863. Unspecified vulnerability in Oracle Java SE 7u76 and 8u40, and JavaFX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0484.
Near-miss passage: CVE-2015-2789. CWE: UNKNOWN. CVSS: 4.400000095367432. Unquoted Windows search path vulnerability in the Foxit Cloud Safe Update Service in the Cloud plugin in Foxit Reader 6.1 through 7.0.6.1126 allows local users to gain privileges via a Trojan horse program in the %SYSTEMDRIVE% folder.
Query: describe CVE-2015-0543
Matching passage: CVE-2015-0543. CWE: CWE-20. CVSS: 5.800000190734863. EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Near-miss passage: CVE-2015-9051. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached due to an improper bound on a length in a System Information message.
Query: vulnerability: XSS in filedownload v1.4 wordpress plugin
Matching passage: CVE-2015-1000004. CWE: CWE-79. CVSS: 6.099999904632568. XSS in filedownload v1.4 wordpress plugin
Near-miss passage: CVE-2015-6402. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the management interface on Cisco EPC3928 devices with EDVA 5.5.10, 5.5.11, and 5.7.1 allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCux24935.
Query: patch priority for CVE-2015-0059
Matching passage: CVE-2015-0059. CWE: CWE-264. CVSS: 6.900000095367432. win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted TrueType font, aka "TrueType Font Parsing Remote Code Execution Vulnerability."
Near-miss passage: CVE-2015-2489. CWE: CWE-264. CVSS: 4.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to gain privileges via a crafted web site, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Elevation of Privilege Vulnerability."