alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Qemu, when built with VNC display driver support, allows remote attackers to cause a denial of service (arithmetic exception and application crash) via crafted SetPixelFormat messa
Matching passage: CVE-2015-8504. CWE: CWE-369. CVSS: 6.5. Qemu, when built with VNC display driver support, allows remote attackers to cause a denial of service (arithmetic exception and application crash) via crafted SetPixelFormat messages from a client.
Near-miss passage: CVE-2015-7513. CWE: CWE-369. CVSS: 6.5. arch/x86/kvm/x86.c in the Linux kernel before 4.4 does not reset the PIT counter values during state restoration, which allows guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via a zero value, related to the kvm_vm_ioctl_set_pit and kvm_vm_ioctl_set_pit2 functions.
Query: CVE similar to CVE-2015-4093
Matching passage: CVE-2015-4093. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Elasticsearch Kibana 4.x before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-10092. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in Qtranslate Slug Plugin up to 1.1.16 on WordPress. It has been classified as problematic. Affected is the function add_slug_meta_box of the file includes/class-qtranslate-slug.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.1.17 is able to address this issue. The name of the patch is 74b3932696f9868e14563e51b7d0bb68c53bf5e4. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222324.
Query: rule covering Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a loc
Matching passage: Sigma rule: Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a loc. Logsource: windows / image_load. Rule: title: DLL Load By System Process From Suspicious Locations id: 9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c status: test description: Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a location with permissive permissions such as "C:\Users\Public" references: - https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC (Idea) author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-17 modified: 2023-09-18 tags: - attack.stealth - attack.t1070 logsource: product: windows category: image_load detection: selection: Image|startswith: C:\Windows\ ImageLoaded|startswith: - C:\Users\Public\ - C:\PerfLogs\ condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects shellshock expressions in log files. Logsource: linux. Rule: title: Shellshock Expression id: c67e0c98-4d39-46ee-8f6b-437ebf6b950e status: test description: Detects shellshock expressions in log files references: - https://owasp.org/www-pdf-archive/Shellshock_-_Tudor_Enache.pdf author: Florian Roth (Nextron Systems) date: 2017-03-14 modified: 2022-10-09 tags: - attack.persistence - attack.t1505.003 logsource: product: linux detection: keywords: - (){:;}; - () {:;}; - () { :;}; - () { :; }; condition: keywords falsepositives: - Unknown level: high
Query: vulnerability: Data Detectors Engine in Apple iOS before 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file.
Matching passage: CVE-2015-5829. CWE: CWE-119. CVSS: 6.800000190734863. Data Detectors Engine in Apple iOS before 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file.
Near-miss passage: CVE-2015-2557. CWE: CWE-119. CVSS: 9.300000190734863. Buffer overflow in Microsoft Visio 2007 SP3 and 2010 SP2 allows remote attackers to execute arbitrary code via crafted UML data in an Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: rule covering Detects changes to the NGenAssemblyUsageLog registry key. .NET Usage Log output location can be controlled by setting th
Matching passage: Sigma rule: Detects changes to the NGenAssemblyUsageLog registry key. .NET Usage Log output location can be controlled by setting th. Logsource: windows / registry_set. Rule: title: NET NGenAssemblyUsageLog Registry Key Tamper id: 28036918-04d3-423d-91c0-55ecf99fb892 status: test description: 'Detects changes to the NGenAssemblyUsageLog registry key. .NET Usage Log output location can be controlled by setting the NGenAssemblyUsageLog CLR configuration knob in the Registry or by configuring an environment variable (as described in the next section). By simplify specifying an arbitrary value (e.g. fake output location or junk data) for the expected value, a Usage Log file for the .NET execution context will not be created. ' references: - https://bohops.com/2021/03/16/investigating-net-clr-usage-log-tampering-techniques-for-edr-evasion/ author: frack113 date: 2022-11-18 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: SOFTWARE\Microsoft\.NETFramework\NGenAssemblyUsageLog condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of KrbRelay, a Kerberos relaying tool. Logsource: windows / process_creation. Rule: title: HackTool - KrbRelay Execution id: e96253b8-6b3b-4f90-9e59-3b24b99cf9b4 status: test description: Detects the use of KrbRelay, a Kerberos relaying tool references: - https://github.com/cube0x0/KrbRelay author: Florian Roth (Nextron Systems) date: 2022-04-27 modified: 2023-02-04 tags: - attack.credential-access - attack.t1558.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \KrbRelay.exe - OriginalFileName: KrbRelay.exe selection_cli_1: CommandLine|contains|all: - ' -spn ' - ' -clsid ' - ' -rbcd ' selection_cli_2: CommandLine|contains|all: - shadowcred - clsid - spn selection_cli_3: CommandLine|contains|all: - 'spn ' - 'session ' - 'clsid ' condition: 1 of selection_* falsepositives: - Unlikely level: high
Query: exploit QuickTime 7 in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file
Matching passage: CVE-2015-3789. CWE: CWE-119. CVSS: 6.800000190734863. QuickTime 7 in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-3765, CVE-2015-3779, CVE-2015-3788, CVE-2015-3790, CVE-2015-3791, CVE-2015-3792, CVE-2015-5751, CVE-2015-5753, and CVE-2015-5779.
Near-miss passage: CVE-2015-5776. CWE: CWE-119. CVSS: 7.5. Libinfo in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by leveraging use of an AF_INET6 socket.
Query: CVE similar to CVE-2015-7316
Matching passage: CVE-2015-7316. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1.
Near-miss passage: CVE-2015-6909. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the "Create download task via file upload" feature in Synology Download Station before 3.5-2962 allows remote attackers to inject arbitrary web script or HTML via the name element in the Info dictionary in a torrent file.
Query: Lateral movement indicators for Cloud Service Hijacking
Matching passage: T1496.004 Cloud Service Hijacking. Tactics: impact. Description: Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability. For example, adversaries may leverage email and messaging services, such as AWS Simple Email Service (SES), AWS Simple Notification Service (SNS), SendGrid, and Twilio, in order to send large quantities of spam / [Phishing](https://attack.mitre.org/techniques/T1566) emails and SMS messages.(Citation: Invictus IR DangerDev 2024)(Citation: Permiso SES Abuse 2023)(Citation: SentinelLabs SNS Sender 2024) Alternatively, they may engage in LLMJacking by leveraging reverse proxies to hijack the power of cloud-hosted AI models.(Citation: Sysdig LLMJacking 2024)(Citation: Lacework LLMJacking 2024) In some cases, adversaries may leverage services that the victim is already using. In others, particularly when the service is part of a larger cloud platform, they may first enable the service.(Citation: Sysdig LLMJacking 2024) Leveraging SaaS applications may cause the victim to incur significant financial costs, use up service quotas, and otherwise impact availability.
Near-miss passage: T1496.001 Compute Hijacking. Tactics: impact. Description: Adversaries may leverage the compute resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. One common purpose for [Compute Hijacking](https://attack.mitre.org/techniques/T1496/001) is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive.(Citation: Kaspersky Lazarus Under The Hood Blog 2017) Servers and cloud-based systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for [Compute Hijacking](https://attack.mitre.org/techniques/T1496/001) and cryptocurrency mining.(Citation: CloudSploit - Unused AWS Regions) Containerized environments may also be targeted due to the ease of deployment via exposed APIs and the potential for scaling mining activities by deploying or compromising multiple containers within an environment or cluster.(Citation: Unit 42 Hildegard Malware)(Citation: Trend Micro Exposed Docker APIs) Additionally, some cryptocurrency mining malware identify then kill off processes for competing malware to ensure it’s not competing for resources.(Citation: Trend Micro War of Crypto Miners)
Query: exploit Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Serv
Matching passage: CVE-2015-4830. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Privileges.
Near-miss passage: CVE-2015-8048. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: describe CVE-2015-0836
Matching passage: CVE-2015-0836. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Near-miss passage: CVE-2015-0453. CWE: UNKNOWN. CVSS: 3.299999952316284. Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote attackers to affect confidentiality via vectors related to PORTAL.
Query: vulnerability: A vulnerability was found in PictureThisWebServer and classified as critical. This issue affects the function router.post of the file routes/user.js. The manipulation of the argume
Matching passage: CVE-2015-10055. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in PictureThisWebServer and classified as critical. This issue affects the function router.post of the file routes/user.js. The manipulation of the argument username/password leads to sql injection. The patch is named 68b9dc346e88b494df00d88c7d058e96820e1479. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218399.
Near-miss passage: CVE-2015-2102. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in view_item.php in ClipBucket 2.7 RC3 (2.7.0.4.v2929-rc3) allows remote attackers to execute arbitrary SQL commands via the item parameter.
Query: CVE similar to CVE-2015-8272
Matching passage: CVE-2015-8272. CWE: CWE-476. CVSS: 6.5. RTMPDump 2.4 allows remote attackers to trigger a denial of service (NULL pointer dereference and process crash).
Near-miss passage: CVE-2015-3839. CWE: CWE-476. CVSS: 5.5. The updateMessageStatus function in Android 5.1.1 and earlier allows local users to cause a denial of service (NULL pointer exception and process crash).
Query: rule covering Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location
Matching passage: Sigma rule: Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location. Logsource: linux / process_creation. Rule: title: Potentially Suspicious Named Pipe Created Via Mkfifo id: 999c3b12-0a8c-40b6-8e13-dd7d62b75c7a related: - id: 9d779ce8-5256-4b13-8b6f-b91c602b43f4 type: derived status: test description: Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location references: - https://dev.to/0xbf/use-mkfifo-to-create-named-pipe-linux-tips-5bbk - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-16 tags: - attack.execution logsource: category: process_creation product: linux detection: selection: Image|endswith: /mkfifo CommandLine|contains: ' /tmp/' condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects HTTP requests to low reputation TLDs (e.g. .xyz, .top, .ru) or ending in suspicious file extensions (.exe, .dll,. Logsource: zeek / http. Rule: title: HTTP Request to Low Reputation TLD or Suspicious File Extension id: 68c2c604-92ad-468b-bf4a-aac49adad08c status: experimental description: 'Detects HTTP requests to low reputation TLDs (e.g. .xyz, .top, .ru) or ending in suspicious file extensions (.exe, .dll, .hta), which may indicate malicious activity. ' references: - https://www.howtogeek.com/137270/50-file-extensions-that-are-potentially-dangerous-on-windows - https://www.spamhaus.org/reputation-statistics/cctlds/domains/ author: '@signalblur, Corelight' date: 2025-02-26 tags: - attack.initial-access - attack.command-and-control logsource: product: zeek service: http detection: selection_suspicious_tld: host|endswith: - .bid - .by - .cf - .click - .cm - .ga - .gq - .ir - .kp - .loan - .ml - .mm - .party - .pw - .ru - .su - .sy - .tk - .top - .tv - .ve - .work - .xyz selection_malicious_ext: uri|endswith: - .bat - .bin - .cmd - .cpl - .dll - .dylib - .elf - .exe - .hta - .iso - .jar - .js - .lnk - .msi - .pif - .ps1 - .py - .reg - .scr - .sh - .so - .vbs - .wsf selection_malicious_mime: resp_mime_types: - application/vnd.microsoft.portable-executable - application/x-bat - application/x-dosexec - application/x-elf - application/x-iso9660-image - application/x-java-archive - application/x-ms-shortcut - application/x-msdos-program - application/x-msdownload - application/x-python-code - application/x-sh condition: selection_suspicious_tld and 1 of selection_malicious_* falsepositives: - Rare legitimate software downloads from low quality TLDs level: medium
Query: execution using Systemctl
Matching passage: T1569.003 Systemctl. Tactics: execution. Description: Adversaries may abuse systemctl to execute commands or programs. Systemctl is the primary interface for systemd, the Linux init system and service manager. Typically invoked from a shell, Systemctl can also be integrated into scripts or applications. Adversaries may use systemctl to execute commands or programs as [Systemd Service](https://attack.mitre.org/techniques/T1543/002)s. Common subcommands include: `systemctl start`, `systemctl stop`, `systemctl enable`, `systemctl disable`, and `systemctl status`.(Citation: Red Hat Systemctl 2022)
Near-miss passage: T1569.002 Service Execution. Tactics: execution. Description: Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and [Net](https://attack.mitre.org/software/S0039). [PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals) Tools such as [PsExec](https://attack.mitre.org/software/S0029) and <code>sc.exe</code> can accept remote servers as arguments and may be used to conduct remote execution. Adversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.
Query: write Sigma for Detects the image load of VSS DLL by uncommon executables
Matching passage: Sigma rule: Detects the image load of VSS DLL by uncommon executables. Logsource: windows / image_load. Rule: title: Suspicious Volume Shadow Copy Vssapi.dll Load id: 37774c23-25a1-4adb-bb6d-8bb9fd59c0f8 related: - id: 333cdbe8-27bb-4246-bf82-b41a0dca4b70 type: similar - id: 48bfd177-7cf2-412b-ad77-baf923489e82 type: similar status: test description: Detects the image load of VSS DLL by uncommon executables references: - https://github.com/ORCx41/DeleteShadowCopies author: frack113 date: 2022-10-31 modified: 2026-05-18 tags: - attack.impact - attack.t1490 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \vssapi.dll filter_main_windows: - Image: - C:\Windows\explorer.exe - C:\Windows\ImmersiveControlPanel\SystemSettings.exe - Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\Temp\{ - C:\Windows\WinSxS\ - C:\$WinREAgent\Scratch\ filter_main_program_files: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ filter_main_null_image: Image: null filter_optional_programdata_packagecache: Image|startswith: C:\ProgramData\Package Cache\ filter_optional_avira: Image|contains|all: - \temp\is- - \avira_system_speedup.tmp condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Activ. Logsource: windows / ps_script. Rule: title: Manipulation of User Computer or Group Security Principals Across AD id: b29a93fb-087c-4b5b-a84d-ee3309e69d08 status: test description: 'Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain.. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.002/T1136.002.md#atomic-test-3---create-a-new-domain-account-using-powershell - https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.accountmanagement?view=net-8.0 author: frack113 date: 2021-12-28 tags: - attack.persistence - attack.t1136.002 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: System.DirectoryServices.AccountManagement condition: selection falsepositives: - Legitimate administrative script level: medium
Query: Suspicious Command Obfuscation execution detected on endpoint
Matching passage: T1027.010 Command Obfuscation. Tactics: stealth. Description: Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., [Phishing](https://attack.mitre.org/techniques/T1566) and [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)) or interactively via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).(Citation: Akamai JS)(Citation: Malware Monday VBE) For example, adversaries may abuse syntax that utilizes various symbols and escape characters (such as spacing, `^`, `+`. `$`, and `%`) to make commands difficult to analyze while maintaining the same intended functionality.(Citation: RC PowerShell) Many languages support built-in obfuscation in the form of base64 or URL encoding.(Citation: Microsoft PowerShellB64) Adversaries may also manually implement command obfuscation via string splitting (`“Wor”+“d.Application”`), order and casing of characters (`rev <<<'dwssap/cte/ tac'`), globing (`mkdir -p '/tmp/:&$NiA'`), as well as various tricks involving passing strings through tokens/environment variables/input streams.(Citation: Bashfuscator Command Obfuscators)(Citation: FireEye Obfuscation June 2017) Adversaries may also use tricks such as directory traversals to obfuscate references to the binary being invoked by a command (`C:\voi\pcw\..\..\Windows\tei\qs\k\..\..\..\system32\erool\..\wbem\wg\je\..\..\wmic.exe shadowcopy delete`).(Citation: Twitter Richard WMIC) Tools such as <code>Invoke-Obfuscation</code> and <code>Invoke-DOSfucation</code> have also been used to obfuscate commands.(Citation: Invoke-DOSfuscation)(Citation: Invoke-Obfuscation)
Near-miss passage: T1027.005 Indicator Removal from Tools. Tactics: stealth. Description: Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems. A good example of this is when malware is detected with a file signature and quarantined by anti-virus software. An adversary who can determine that the malware was quarantined because of its file signature may modify the file to explicitly avoid that signature, and then re-use the malware.