alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit The HTTP connection-management functionality in Internet Pass-Thru (IPT) before 2.1.0.2 in IBM WebSphere MQ, when HTTPS is disabled, does not properly generate MQIPT Session IDs, w
Matching passage: CVE-2015-0173. CWE: CWE-17. CVSS: 4.300000190734863. The HTTP connection-management functionality in Internet Pass-Thru (IPT) before 2.1.0.2 in IBM WebSphere MQ, when HTTPS is disabled, does not properly generate MQIPT Session IDs, which makes it easier for remote attackers to bypass intended restrictions on MQ message data by predicting an ID value.
Near-miss passage: CVE-2015-0812. CWE: CWE-17. CVSS: 4.300000190734863. Mozilla Firefox before 37.0 does not require an HTTPS session for lightweight theme add-on installations, which allows man-in-the-middle attackers to bypass an intended user-confirmation requirement by deploying a crafted web site and conducting a DNS spoofing attack against a mozilla.org subdomain.
Query: CVE similar to CVE-2015-4263
Matching passage: CVE-2015-4263. CWE: CWE-200. CVSS: 4.0. The Control and Provisioning functionality in Cisco Mobility Services Engine (MSE) 10.0(0.1) allows remote authenticated users to obtain sensitive information by reading log files, aka Bug ID CSCut36851.
Near-miss passage: CVE-2015-1776. CWE: CWE-200. CVSS: 6.199999809265137. Apache Hadoop 2.6.x encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials file on disk when the Intermediate data encryption feature is enabled, which allows local users to obtain sensitive information by reading the file.
Query: exploit The ClickBank Affiliate Ads WordPress plugin through 1.20 does not have CSRF check when saving its settings, allowing attacker to make logged in admin change them via a CSRF attack
Matching passage: CVE-2015-20105. CWE: CWE-79. CVSS: 9.600000381469727. The ClickBank Affiliate Ads WordPress plugin through 1.20 does not have CSRF check when saving its settings, allowing attacker to make logged in admin change them via a CSRF attack. Furthermore, due to the lack of escaping when they are outputting, it could also lead to Stored Cross-Site Scripting issues
Near-miss passage: CVE-2015-0284. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7811.
Query: describe CVE-2015-2639
Matching passage: CVE-2015-2639. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Firewall.
Near-miss passage: CVE-2015-4906. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 8u60 and JavaFX 2.2.85 allows remote attackers to affect confidentiality via unknown vectors related to JavaFX, a different vulnerability than CVE-2015-4908 and CVE-2015-4916.
Query: detection engineering for Archive Collected Data
Matching passage: T1560 Archive Collected Data. Tactics: collection. Description: An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.(Citation: DOJ GRU Indictment Jul 2018) Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender. Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.
Near-miss passage: T1560.003 Archive via Custom Method. Tactics: collection. Description: An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.(Citation: ESET Sednit Part 2)
Query: describe CVE-2015-8113
Matching passage: CVE-2015-8113. CWE: UNKNOWN. CVSS: 7.199999809265137. Untrusted search path vulnerability in the client in Symantec Endpoint Protection (SEP) 12.1 before 12.1-RU6-MP3 allows local users to gain privileges via a Trojan horse DLL in a client install package. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1492.
Near-miss passage: CVE-2015-8401. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: write Sigma for Detects suspicious process command line that uses base64 encoded input for execution with a shell
Matching passage: Sigma rule: Detects suspicious process command line that uses base64 encoded input for execution with a shell. Logsource: linux / process_creation. Rule: title: Linux Base64 Encoded Pipe to Shell id: ba592c6d-6888-43c3-b8c6-689b8fe47337 status: test description: Detects suspicious process command line that uses base64 encoded input for execution with a shell references: - https://github.com/arget13/DDexec - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally author: pH-T (Nextron Systems) date: 2022-07-26 modified: 2023-06-16 tags: - attack.stealth - attack.t1140 logsource: product: linux category: process_creation detection: selection_base64: CommandLine|contains: 'base64 ' selection_exec: - CommandLine|contains: - '| bash ' - '| sh ' - '|bash ' - '|sh ' - CommandLine|endswith: - ' |sh' - '| bash' - '| sh' - '|bash' condition: all of selection_* falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects when storage bucket is enumerated in Google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud Storage Buckets Enumeration id: e2feb918-4e77-4608-9697-990a1aaf74c3 status: test description: Detects when storage bucket is enumerated in Google Cloud. references: - https://cloud.google.com/storage/docs/json_api/v1/buckets author: Austin Songer @austinsonger date: 2021-08-14 modified: 2022-10-09 tags: - attack.discovery logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name: - storage.buckets.list - storage.buckets.listChannels condition: selection falsepositives: - Storage Buckets being enumerated may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Storage Buckets enumerated from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Query: risk of Integer overflow in Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute ar
Matching passage: CVE-2015-0338. CWE: UNKNOWN. CVSS: 10.0. Integer overflow in Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-6791. CWE: UNKNOWN. CVSS: 10.0. Multiple unspecified vulnerabilities in Google Chrome before 47.0.2526.80 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Query: campaign using Masquerade Task or Service
Matching passage: T1036.004 Masquerade Task or Service. Tactics: stealth. Description: Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.(Citation: TechNet Schtasks)(Citation: Systemd Service Units) Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones. Tasks or services contain other fields, such as a description, that adversaries may attempt to make appear legitimate.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Fysbis Dr Web Analysis)
Near-miss passage: T1036.003 Rename Legitimate Utilities. Tactics: stealth. Description: Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython.(Citation: LOLBAS Main Site)(Citation: Huntress Python Malware 2025)(Citation: The DFIR Report AutoHotKey 2023)(Citation: Splunk Detect Renamed PSExec) It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename <code>rundll32.exe</code>).(Citation: Elastic Masquerade Ball) An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.(Citation: F-Secure CozyDuke)
Query: detect Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host in logs
Matching passage: Sigma rule: Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host. Logsource: windows / security. Rule: title: WCE wceaux.dll Access id: 1de68c67-af5c-4097-9c85-fe5578e09e67 status: test description: Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host references: - https://www.jpcert.or.jp/english/pub/sr/ir_research.html - https://jpcertcc.github.io/ToolAnalysisResultSheet author: Thomas Patzke date: 2017-06-14 modified: 2025-01-30 tags: - attack.credential-access - attack.t1003 - attack.s0005 logsource: product: windows service: security detection: selection: EventID: - 4656 - 4663 ObjectName|endswith: \wceaux.dll condition: selection falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52). Logsource: windows / process_creation. Rule: title: UAC Bypass Abusing Winsat Path Parsing - Process id: 7a01183d-71a2-46ad-ad5c-acd989ac1793 status: test description: Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 ParentImage|endswith: \AppData\Local\Temp\system32\winsat.exe ParentCommandLine|contains: C:\Windows \system32\winsat.exe condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-3316
Matching passage: CVE-2015-3316. CWE: UNKNOWN. CVSS: 4.599999904632568. CA Common Services, as used in CA Client Automation r12.5 SP01, r12.8, and r12.9; CA Network and Systems Management r11.0, r11.1, and r11.2; CA NSM Job Management Option r11.0, r11.1, and r11.2; CA Universal Job Management Agent; CA Virtual Assurance for Infrastructure Managers (aka SystemEDGE) 12.6, 12.7, 12.8, and 12.9; and CA Workload Automation AE r11, r11.3, r11.3.5, and r11.3.6 on UNIX, allows local users to gain privileges via an unspecified environment variable.
Near-miss passage: CVE-2015-0352. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043.
Query: Lateral movement indicators for Trap
Matching passage: T1546.005 Trap. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. The <code>trap</code> command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like <code>ctrl+c</code> and <code>ctrl+d</code>. Adversaries can use this to register code to be executed when the shell encounters specific interrupts as a persistence mechanism. Trap commands are of the following format <code>trap 'command list' signals</code> where "command list" will be executed when "signals" are received.(Citation: Trap Manual)(Citation: Cyberciti Trap Statements)
Near-miss passage: T1546.009 AppCert DLLs. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the <code>AppCertDLLs</code> Registry key under <code>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\</code> are loaded into every process that calls the ubiquitously used application programming interface (API) functions <code>CreateProcess</code>, <code>CreateProcessAsUser</code>, <code>CreateProcessWithLoginW</code>, <code>CreateProcessWithTokenW</code>, or <code>WinExec</code>. (Citation: Elastic Process Injection July 2017) Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), this value can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. Malicious AppCert DLLs may also provide persistence by continuously being triggered by API activity.
Query: CVE similar to CVE-2015-9414
Matching passage: CVE-2015-9414. CWE: CWE-79. CVSS: 6.099999904632568. The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter.
Near-miss passage: CVE-2015-8349. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in SourceBans before 2.0 pre-alpha allows remote attackers to inject arbitrary web script or HTML via the advSearch parameter to index.php.
Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects when an attacker or tool disables the Windows Defender service (WinDefend) via the registry. Logsource: windows / registry_set. Rule: title: Windows Defender Service Disabled - Registry id: e1aa95de-610a-427d-b9e7-9b46cfafbe6a status: test description: Detects when an attacker or tool disables the Windows Defender service (WinDefend) via the registry references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://gist.github.com/anadr/7465a9fde63d41341136949f14c21105 author: Ján Trenčanský, frack113, AlertIQ, Nasreddine Bencherchali date: 2022-08-01 modified: 2024-03-25 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: \Services\WinDefend\Start Details: DWORD (0x00000004) condition: selection falsepositives: - Administrator actions level: high
Near-miss passage: Sigma rule: Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type. Logsource: windows / process_creation. Rule: title: Suspicious Schtasks Schedule Type With High Privileges id: 7a02e22e-b885-4404-b38b-1ddc7e65258a related: - id: 24c8392b-aa3c-46b7-a545-43f71657fe98 type: similar status: test description: Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-change - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-31 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_time: CommandLine|contains: - ' ONLOGON ' - ' ONSTART ' - ' ONCE ' - ' ONIDLE ' selection_privs: CommandLine|contains: - NT AUT - ' SYSTEM' - HIGHEST condition: all of selection_* falsepositives: - Some installers were seen using this method of creation unfortunately. Filter them in your environment level: medium
Query: risk of The stock Android browser address bar in all Android operating systems suffers from Address Bar Spoofing, which allows remote attackers to trick a victim by displaying a malicious 
Matching passage: CVE-2015-3830. CWE: CWE-20. CVSS: 6.5. The stock Android browser address bar in all Android operating systems suffers from Address Bar Spoofing, which allows remote attackers to trick a victim by displaying a malicious page for legitimate domain names.
Near-miss passage: CVE-2015-1855. CWE: CWE-20. CVSS: 5.900000095367432. verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.
Query: rule covering Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Prope
Matching passage: Sigma rule: Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Prope. Logsource: azure / auditlogs. Rule: title: CA Policy Updated by Non Approved Actor id: 50a3c7aa-ec29-44a4-92c1-fce229eef6fc status: test description: Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access author: Corissa Koopmans, '@corissalea' date: 2022-07-19 modified: 2024-05-28 tags: - attack.privilege-escalation - attack.credential-access - attack.persistence - attack.defense-impairment - attack.t1548 - attack.t1556 logsource: product: azure service: auditlogs detection: selection: properties.message: Update conditional access policy condition: selection falsepositives: - Misconfigured role permissions - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. level: medium
Near-miss passage: Sigma rule: Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule. Logsource: windows / process_creation. Rule: title: New Port Forwarding Rule Added Via Netsh.EXE id: 322ed9ec-fcab-4f67-9a34-e7c6aef43614 status: test description: Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule references: - https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html - https://adepts.of0x.cc/netsh-portproxy-code/ - https://www.dfirnotes.net/portproxy_detection/ author: Florian Roth (Nextron Systems), omkar72, oscd.community, Swachchhanda Shrawan Poudel date: 2019-01-29 modified: 2023-09-01 tags: - attack.lateral-movement - attack.command-and-control - attack.t1090 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli_1: CommandLine|contains|all: - interface - portproxy - add - v4tov4 selection_cli_2: CommandLine|contains|all: - 'i ' - 'p ' - 'a ' - 'v ' selection_cli_3: CommandLine|contains|all: - connectp - listena - c= condition: selection_img and 1 of selection_cli_* falsepositives: - Legitimate administration activity - WSL2 network bridge PowerShell script used for WSL/Kubernetes/Docker (e.g. https://github.com/microsoft/WSL/issues/4150#issuecomment-504209723) level: medium
Query: vulnerability: The CFNetwork Proxies component in Apple iOS before 9 does not properly handle a Set-Cookie header within a response to an HTTP CONNECT request, which allows remote proxy servers t
Matching passage: CVE-2015-5841. CWE: CWE-74. CVSS: 5.0. The CFNetwork Proxies component in Apple iOS before 9 does not properly handle a Set-Cookie header within a response to an HTTP CONNECT request, which allows remote proxy servers to conduct cookie-injection attacks via a crafted response.
Near-miss passage: CVE-2015-0116. CWE: CWE-74. CVSS: 3.5. IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 does not properly restrict the addition of links, which makes it easier for remote authenticated users to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.
Query: explain CWE-1321
Matching passage: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Near-miss passage: CWE-410 Insufficient Resource Pool. The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.
Query: vulnerability: The web management interface on Belkin F9K1102 2 devices with firmware 2.10.17 has a blank password, which allows remote attackers to obtain administrative privileges by leveraging
Matching passage: CVE-2015-5988. CWE: CWE-255. CVSS: 9.800000190734863. The web management interface on Belkin F9K1102 2 devices with firmware 2.10.17 has a blank password, which allows remote attackers to obtain administrative privileges by leveraging a LAN session.
Near-miss passage: CVE-2015-4966. CWE: CWE-255. CVSS: 6.5. IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 FP009, and 7.6.0 before 7.6.0.2 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9 FP009, 7.5.1, and 7.6.0 before 7.6.0.2 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products have a default administrator account, which makes it easier for remote authenticated users to obtain access via unspecified vectors.