alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an c
Matching passage: Sigma rule: Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an c. Logsource: windows / security. Rule: title: Suspicious Windows ANONYMOUS LOGON Local Account Created id: 1bbf25b9-8038-4154-a50b-118f2a32be27 status: test description: Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts. references: - https://twitter.com/SBousseaden/status/1189469425482829824 author: James Pemberton / @4A616D6573 date: 2019-10-31 modified: 2022-10-09 tags: - attack.persistence - attack.t1136.001 - attack.t1136.002 logsource: product: windows service: security detection: selection: EventID: 4720 SamAccountName|contains|all: - ANONYMOUS - LOGON condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects plugged/unplugged USB devices. Logsource: windows / driver-framework. Rule: title: USB Device Plugged id: 1a4bd6e3-4c6e-405d-a9a3-53a116e341d4 status: test description: Detects plugged/unplugged USB devices references: - https://df-stream.com/2014/01/the-windows-7-event-log-and-usb-device/ - https://www.techrepublic.com/article/how-to-track-down-usb-flash-drive-usage-in-windows-10s-event-viewer/ author: Florian Roth (Nextron Systems) date: 2017-11-09 modified: 2021-11-30 tags: - attack.initial-access - attack.t1200 logsource: product: windows service: driver-framework definition: Requires enabling and collection of the Microsoft-Windows-DriverFrameworks-UserMode/Operational eventlog detection: selection: EventID: - 2003 - 2100 - 2102 condition: selection falsepositives: - Legitimate administrative activity level: low
Query: Suspicious Proxy execution detected on endpoint
Matching passage: T1090 Proxy. Tactics: command and control. Description: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.
Near-miss passage: T1090.002 External Proxy. Tactics: command and control. Description: Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion. External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.
Query: vulnerability: Race condition in Microsoft Malicious Software Removal Tool (MSRT) before 5.26 allows local users to gain privileges via a crafted DLL, aka "MSRT Race Condition Vulnerability."
Matching passage: CVE-2015-2418. CWE: CWE-362. CVSS: 6.900000095367432. Race condition in Microsoft Malicious Software Removal Tool (MSRT) before 5.26 allows local users to gain privileges via a crafted DLL, aka "MSRT Race Condition Vulnerability."
Near-miss passage: CVE-2015-1340. CWE: CWE-362. CVSS: 8.100000381469727. LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.
Query: Sigma rule for Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a clust
Matching passage: Sigma rule: Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a clust. Logsource: kubernetes / application / audit. Rule: title: New Kubernetes Service Account Created id: e31bae15-83ed-473e-bf31-faf4f8a17d36 related: - id: 12d027c3-b48c-4d9d-8bb6-a732200034b2 type: derived status: test description: 'Detects creation of new Kubernetes service account, which could indicate an attacker''s attempt to persist within a cluster. ' references: - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/container%20service%20account/ author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.persistence - attack.t1136 logsource: category: application product: kubernetes service: audit detection: selection: verb: create objectRef.resource: serviceaccounts condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the. Logsource: windows / process_creation. Rule: title: Potential Persistence Via Powershell Search Order Hijacking - Task id: b66474aa-bd92-4333-a16c-298155b120df related: - id: 6e8811ee-90ba-441e-8486-5653e68b2299 type: similar status: test description: Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell "Get-Variable" technique as seen being used in Colibri Loader references: - https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/ author: pH-T (Nextron Systems), Florian Roth (Nextron Systems) date: 2022-04-08 modified: 2023-02-03 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.005 - attack.t1059.001 logsource: product: windows category: process_creation detection: selection: ParentImage: C:\WINDOWS\System32\svchost.exe ParentCommandLine|contains|all: - -k netsvcs - -s Schedule CommandLine|endswith: - ' -windowstyle hidden' - ' -w hidden' - ' -ep bypass' - ' -noni' condition: selection falsepositives: - Unknown level: high
Query: exploit Unquoted Windows search path vulnerability in the autorun value in Dell SonicWall NetExtender before 7.5.227 and 8.0.x before 8.0.238, as used in the SRA firmware before 7.5.1.2-40
Matching passage: CVE-2015-4173. CWE: CWE-428. CVSS: 6.900000095367432. Unquoted Windows search path vulnerability in the autorun value in Dell SonicWall NetExtender before 7.5.227 and 8.0.x before 8.0.238, as used in the SRA firmware before 7.5.1.2-40sv and 8.x before 8.0.0.3-23sv, allows local users to gain privileges via a Trojan horse program in the %SYSTEMDRIVE% folder.
Near-miss passage: CVE-2015-6647. CWE: CWE-264. CVSS: 7.800000190734863. The Widevine QSEE TrustZone application in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted application that leverages QSEECOM access, aka internal bug 24441554.
Query: Sigma rule for Detects the stopping of a Windows service via the "sc.exe" utility
Matching passage: Sigma rule: Detects the stopping of a Windows service via the "sc.exe" utility. Logsource: windows / process_creation. Rule: title: Stop Windows Service Via Sc.EXE id: 81bcb81b-5b1f-474b-b373-52c871aaa7b1 related: - id: eb87818d-db5d-49cc-a987-d5da331fbd90 type: obsolete status: test description: Detects the stopping of a Windows service via the "sc.exe" utility references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc742107(v=ws.11) author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2023-03-05 modified: 2024-01-18 tags: - attack.impact - attack.t1489 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: sc.exe - Image|endswith: \sc.exe selection_cli: CommandLine|contains: ' stop ' condition: all of selection_* falsepositives: - There are many legitimate reasons to stop a service. This rule isn't looking for any suspicious behavior in particular. Filter legitimate activity accordingly level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_sc_stop_service/info.yml
Near-miss passage: Sigma rule: Detects extraction of files with usage of steghide binary, the adversaries may use this technique to prevent the detecti. Logsource: linux / auditd. Rule: title: Steganography Extract Files with Steghide id: a5a827d9-1bbe-4952-9293-c59d897eb41b status: test description: Detects extraction of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information. references: - https://vitux.com/how-to-hide-confidential-files-in-images-on-debian-using-steganography/ author: Pawel Mazur date: 2021-09-11 modified: 2022-10-09 tags: - attack.stealth - attack.t1027.003 logsource: product: linux service: auditd detection: selection: type: EXECVE a0: steghide a1: extract a2: -sf a3|endswith: - .jpg - .png condition: selection falsepositives: - Unknown level: low
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in BEdita before 3.6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) cfg[projectName] parameter to i
Matching passage: CVE-2015-6809. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in BEdita before 3.6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) cfg[projectName] parameter to index.php/admin/saveConfig, the (2) data[stats_provider_url] parameter to index.php/areas/saveArea, or the (3) data[description] parameter to index.php/areas/saveSection.
Near-miss passage: CVE-2015-9355. CWE: CWE-79. CVSS: 6.099999904632568. The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.
Query: patch priority for CVE-2015-2969
Matching passage: CVE-2015-2969. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in index.php in LEMON-S PHP Simple Oekaki BBS before 1.21 allows remote attackers to inject arbitrary web script or HTML via the oekakis parameter.
Near-miss passage: CVE-2015-0967. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in SearchBlox before 8.2 allow remote attackers to inject arbitrary web script or HTML via (1) the search field in plugin/index.html or (2) the title field in the Create Featured Result form in admin/main.jsp.
Query: describe CVE-2015-7182
Matching passage: CVE-2015-7182. CWE: CWE-119. CVSS: 9.800000190734863. Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data.
Near-miss passage: CVE-2015-5940. CWE: CWE-119. CVSS: 6.800000190734863. The Accelerate Framework component in Apple iOS before 9.1 and OS X before 10.11.1, when multi-threading is enabled, omits certain validation and locking steps, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Query: Sigma rule for Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location. These files are use
Matching passage: Sigma rule: Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location. These files are use. Logsource: windows / file_event. Rule: title: Self Extraction Directive File Created In Potentially Suspicious Location id: 760e75d8-c3b5-409b-a9bf-6130b4c4603f related: - id: ab90dab8-c7da-4010-9193-563528cfa347 type: derived status: test description: 'Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location. These files are used by the "iexpress.exe" utility in order to create self extracting packages. Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries. ' references: - https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html - https://en.wikipedia.org/wiki/IExpress - https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2024-02-05 tags: - attack.stealth - attack.t1218 logsource: category: file_event product: windows detection: selection: TargetFilename|contains: - :\ProgramData\ - :\Temp\ - :\Windows\System32\Tasks\ - :\Windows\Tasks\ - :\Windows\Temp\ - \AppData\Local\Temp\ TargetFilename|endswith: .sed condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of. Logsource: windows / image_load. Rule: title: Clfs.SYS Loaded By Process Located In a Potential Suspicious Location id: fb4e2211-6d08-426b-8e6f-0d4a161e3b1d status: experimental description: Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File. references: - https://ssd-disclosure.com/ssd-advisory-common-log-file-system-clfs-driver-pe/ - https://x.com/Threatlabz/status/1879956781360976155 author: X__Junior date: 2025-01-20 tags: - attack.execution - attack.t1059 logsource: category: image_load product: windows detection: selection_dll: ImageLoaded|endswith: \clfs.sys selection_folders_1: Image|contains: - :\Perflogs\ - :\Users\Public\ - \Temporary Internet - \Windows\Temp\ selection_folders_2: - Image|contains|all: - :\Users\ - \Favorites\ - Image|contains|all: - :\Users\ - \Favourites\ - Image|contains|all: - :\Users\ - \Contacts\ - Image|contains|all: - :\Users\ - \Pictures\ condition: selection_dll and 1 of selection_folders_* falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-9399
Matching passage: CVE-2015-9399. CWE: CWE-89. CVSS: 7.199999809265137. The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection.
Near-miss passage: CVE-2015-10056. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in 2071174A vinylmap. It has been classified as critical. Affected is the function contact of the file recordstoreapp/views.py. The manipulation leads to sql injection. The name of the patch is b07b79a1e92cc62574ba0492cce000ef4a7bd25f. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218400.
Query: CVE similar to CVE-2015-4366
Matching passage: CVE-2015-4366. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Mover module 6.x-1.0 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-3429. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HTML via a fragment identifier.
Query: common weakness: Reliance on a Single Factor in a Security Decision
Matching passage: CWE-654 Reliance on a Single Factor in a Security Decision. A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.
Near-miss passage: CWE-544 Missing Standardized Error Handling Mechanism. The product does not use a standardized method for handling errors throughout the code, which might introduce inconsistent error handling and resultant weaknesses.
Query: risk of pax 1:20140703 allows remote attackers to write to arbitrary files via a symlink attack in an archive.
Matching passage: CVE-2015-1194. CWE: CWE-59. CVSS: 4.300000190734863. pax 1:20140703 allows remote attackers to write to arbitrary files via a symlink attack in an archive.
Near-miss passage: CVE-2015-1331. CWE: CWE-59. CVSS: 4.900000095367432. lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*.
Query: describe CVE-2015-6143
Matching passage: CVE-2015-6143. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6140, CVE-2015-6142, CVE-2015-6153, CVE-2015-6158, CVE-2015-6159, and CVE-2015-6160.
Near-miss passage: CVE-2015-0324. CWE: CWE-119. CVSS: 10.0. Buffer overflow in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Query: exploit Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote attackers to affect availability via unknown vectors related to Server : Re
Matching passage: CVE-2015-0382. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote attackers to affect availability via unknown vectors related to Server : Replication, a different vulnerability than CVE-2015-0381.
Near-miss passage: CVE-2015-3077. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-3084 and CVE-2015-3086.
Query: risk of eWON devices with firmware before 10.1s0 do not trigger the discarding of browser session data in response to a log-off action, which makes it easier for remote attackers to obtain
Matching passage: CVE-2015-7924. CWE: UNKNOWN. CVSS: 8.800000190734863. eWON devices with firmware before 10.1s0 do not trigger the discarding of browser session data in response to a log-off action, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
Near-miss passage: CVE-2015-1352. CWE: UNKNOWN. CVSS: 5.0. The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate token extraction for table names, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name.
Query: rule covering Detects backup catalog deletions
Matching passage: Sigma rule: Detects backup catalog deletions. Logsource: windows / application. Rule: title: Backup Catalog Deleted id: 9703792d-fd9a-456d-a672-ff92efe4806a status: test description: Detects backup catalog deletions references: - https://technet.microsoft.com/en-us/library/cc742154(v=ws.11).aspx - https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100 author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection) date: 2017-05-12 modified: 2022-12-25 tags: - attack.stealth - attack.t1070.004 logsource: product: windows service: application detection: selection: EventID: 524 Provider_Name: Microsoft-Windows-Backup condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the use of Replace.exe which can be used to replace file with another file. Logsource: windows / process_creation. Rule: title: Replace.exe Usage id: 9292293b-8496-4715-9db6-37028dcda4b3 status: test description: Detects the use of Replace.exe which can be used to replace file with another file references: - https://lolbas-project.github.io/lolbas/Binaries/Replace/ - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/replace author: frack113 date: 2022-03-06 modified: 2024-03-13 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection: Image|endswith: \replace.exe argument: CommandLine|contains|windash: -a condition: selection and argument falsepositives: - Unknown level: medium
Query: describe CVE-2015-4974
Matching passage: CVE-2015-4974. CWE: CWE-77. CVSS: 7.199999809265137. IBM General Parallel File System (GPFS) 3.5.x before 3.5.0.27 and 4.1.x before 4.1.1.2 and Spectrum Scale 4.1.1.x before 4.1.1.2 allow local users to obtain root privileges for command execution via unspecified vectors.
Near-miss passage: CVE-2015-20108. CWE: CWE-77. CVSS: 9.800000190734863. xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.
Query: explain CWE-334
Matching passage: CWE-334 Small Space of Random Values. The number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks.
Near-miss passage: CWE-256 Plaintext Storage of a Password. The product stores a password in plaintext within resources such as memory or files.
Query: risk of The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the password.
Matching passage: CVE-2015-2180. CWE: CWE-74. CVSS: 8.800000190734863. The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the password.
Near-miss passage: CVE-2015-3013. CWE: CWE-74. CVSS: 6.0. ownCloud Server before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allows remote authenticated users to bypass the file blacklist and upload arbitrary files via a file path with UTF-8 encoding, as demonstrated by uploading a .htaccess file.