alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 20
Matching passage: CVE-2015-1671. CWE: UNKNOWN. CVSS: 7.800000190734863. The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; Lync Basic 2013 SP1; Silverlight 5 before 5.1.40416.00; and Silverlight 5 Developer Runtime before 5.1.40416.00, allows remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability."
Near-miss passage: CVE-2015-2578. CWE: UNKNOWN. CVSS: 7.099999904632568. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows remote attackers to affect availability via vectors related to Kernel IDMap.
Query: exploit X.Org Server (aka xserver and xorg-server) before 1.16.3 and 1.17.x before 1.17.1 allows remote attackers to obtain sensitive information from process memory or cause a denial of s
Matching passage: CVE-2015-0255. CWE: CWE-200. CVSS: 6.400000095367432. X.Org Server (aka xserver and xorg-server) before 1.16.3 and 1.17.x before 1.17.1 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (crash) via a crafted string length value in a XkbSetGeometry request.
Near-miss passage: CVE-2015-5070. CWE: CWE-200. CVSS: 3.0999999046325684. The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensitive filesystem is used, allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5069.
Query: risk of Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Ex
Matching passage: CVE-2015-0031. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0022, CVE-2015-0026, CVE-2015-0030, CVE-2015-0036, and CVE-2015-0041.
Near-miss passage: CVE-2015-4318. CWE: CWE-399. CVSS: 5.0. Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows remote attackers to cause a denial of service via invalid variables in a GET request, aka Bug ID CSCuv40528.
Query: vulnerability: filter/mediaplugin/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to cause a denial of service
Matching passage: CVE-2015-0217. CWE: CWE-399. CVSS: 6.800000190734863. filter/mediaplugin/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to cause a denial of service (CPU consumption or partial outage) via a crafted string that is matched against an improper regular expression.
Near-miss passage: CVE-2015-3961. CWE: CWE-399. CVSS: 3.5. The web-server component in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches allows remote authenticated users to cause a denial of service (memory corruption and reboot) via a crafted URL.
Query: CVE similar to CVE-2015-9466
Matching passage: CVE-2015-9466. CWE: CWE-89. CVSS: 9.800000190734863. The wti-like-post plugin before 1.4.3 for WordPress has WtiLikePostProcessVote SQL injection via the HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR, HTTP_X_FORWARDED, HTTP_FORWARDED_FOR, or HTTP_FORWARDED variable.
Near-miss passage: CVE-2015-1518. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the search_post function in includes/search.php in Redaxscript before 2.3.0 allows remote attackers to execute arbitrary SQL commands via the search_terms parameter.
Query: CWE for Improper Neutralization of Special Elements in Data Query Logic
Matching passage: CWE-943 Improper Neutralization of Special Elements in Data Query Logic. The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
Near-miss passage: CWE-1060 Excessive Number of Inefficient Server-Side Data Accesses. The product performs too many data queries without using efficient data processing functionality such as stored procedures.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects execution of "odbcconf" with the "-f" flag in order to load a response file with a non-".rsp" extension.. Logsource: windows / process_creation. Rule: title: Suspicious Response File Execution Via Odbcconf.EXE id: 2d32dd6f-3196-4093-b9eb-1ad8ab088ca5 related: - id: 5f03babb-12db-4eec-8c82-7b4cb5580868 type: derived - id: 65d2be45-8600-4042-b4c0-577a1ff8a60e type: obsolete status: test description: Detects execution of "odbcconf" with the "-f" flag in order to load a response file with a non-".rsp" extension. references: - https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16 - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/ - https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-22 modified: 2024-03-13 tags: - attack.stealth - attack.t1218.008 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \odbcconf.exe - OriginalFileName: odbcconf.exe selection_cli: CommandLine|contains|windash: ' -f ' filter_main_rsp_ext: CommandLine|contains: .rsp filter_main_runonce_odbc: ParentImage: C:\Windows\System32\runonce.exe Image: C:\Windows\System32\odbcconf.exe CommandLine|contains: .exe /E /F "C:\WINDOWS\system32\odbcconf.tmp" condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the use of the find command to execute a shell. Such behavior may be associated with privilege escalation, unaut. Logsource: linux / process_creation. Rule: title: Shell Execution via Find - Linux id: 6adfbf8f-52be-4444-9bac-81b539624146 status: test description: 'Detects the use of the find command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or exploitation attempt. ' references: - https://gtfobins.github.io/gtfobins/find/#shell - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-09-02 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /find CommandLine|contains|all: - ' . ' - -exec selection_cli: CommandLine|contains: - /bin/bash - /bin/dash - /bin/fish - /bin/sh - /bin/zsh condition: all of selection_* falsepositives: - Unknown level: high
Query: exploit The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066.
Matching passage: CVE-2015-9353. CWE: CWE-89. CVSS: 7.199999809265137. The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066.
Near-miss passage: CVE-2015-10056. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in 2071174A vinylmap. It has been classified as critical. Affected is the function contact of the file recordstoreapp/views.py. The manipulation leads to sql injection. The name of the patch is b07b79a1e92cc62574ba0492cce000ef4a7bd25f. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218400.
Query: SOC runbook when seeing SIEM correlation: defense impairment activity consistent with Cloud Firewall
Matching passage: Playbook for T1686.001 Cloud Firewall. 1) Validate alert telemetry against T1686.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: defense impairment. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols. An adversary with appropriate permissions may introduce new firewall rules or policies to allo
Near-miss passage: Playbook for T1686 Disable or Modify System Firewall. Different response path focused on defense impairment.
Query: CVE similar to CVE-2015-1127
Matching passage: CVE-2015-1127. CWE: CWE-200. CVSS: 2.0999999046325684. The private-browsing implementation in WebKit in Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 places browsing history into an index, which might allow local users to obtain sensitive information by reading index entries.
Near-miss passage: CVE-2015-1901. CWE: CWE-200. CVSS: 1.899999976158142. The installer in IBM InfoSphere Information Server 8.5 through 11.3 before 11.3.1.2 allows local users to obtain sensitive information via unspecified commands.
Query: EDR alert: possible Delete Cloud Instance (T1578.003)
Matching passage: T1578.003 Delete Cloud Instance. Tactics: defense impairment. Description: An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence. Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable. An adversary may also [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and later terminate the instance after achieving their objectives.(Citation: Mandiant M-Trends 2020)
Near-miss passage: T1578 Modify Cloud Compute Infrastructure. Tactics: defense impairment. Description: An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots. Permissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure. Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence.(Citation: Mandiant M-Trends 2020)
Query: risk of SQL injection vulnerability on the Grandstream GXV3611_HD camera with firmware before 1.0.3.9 beta allows remote attackers to execute arbitrary SQL commands by attempting to establ
Matching passage: CVE-2015-2866. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability on the Grandstream GXV3611_HD camera with firmware before 1.0.3.9 beta allows remote attackers to execute arbitrary SQL commands by attempting to establish a TELNET session with a crafted username.
Near-miss passage: CVE-2015-3313. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in WordPress Community Events plugin before 1.4.
Query: write Sigma for Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.
Matching passage: Sigma rule: Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.. Logsource: windows / process_creation. Rule: title: Suspicious File Downloaded From Direct IP Via Certutil.EXE id: 13e6fe51-d478-4c7e-b0f2-6da9b400a829 related: - id: 19b08b1c-861d-4e75-a1ef-ea0c1baf202b type: similar - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794 type: similar status: test description: Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil - https://forensicitguy.github.io/agenttesla-vba-certutil-download/ - https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/ - https://twitter.com/egre55/status/1087685529016193025 - https://lolbas-project.github.io/lolbas/Binaries/Certutil/ - https://twitter.com/_JohnHammond/status/1708910264261980634 - https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-15 modified: 2025-12-01 tags: - attack.stealth - attack.t1027 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certutil.exe - OriginalFileName: CertUtil.exe selection_flags: CommandLine|contains: - 'urlcache ' - 'verifyctl ' - 'URL ' selection_http: CommandLine|contains: - ://1 - ://2 - ://3 - ://4 - ://5 - ://6 - ://7 - ://8 - ://9 filter_main_seven_zip: CommandLine|contains: ://7- condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_download_direct_ip/info.yml
Near-miss passage: Sigma rule: Identifies when a DNS Zone is modified or deleted in Google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud DNS Zone Modified or Deleted id: 28268a8f-191f-4c17-85b2-f5aa4fa829c3 status: test description: Identifies when a DNS Zone is modified or deleted in Google Cloud. references: - https://cloud.google.com/dns/docs/reference/v1/managedZones author: Austin Songer @austinsonger date: 2021-08-15 modified: 2022-10-09 tags: - attack.impact logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name: - Dns.ManagedZones.Delete - Dns.ManagedZones.Update - Dns.ManagedZones.Patch condition: selection falsepositives: - Unknown level: medium
Query: describe CVE-2015-9014
Matching passage: CVE-2015-9014. CWE: CWE-264. CVSS: 9.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393750.
Near-miss passage: CVE-2015-2694. CWE: CWE-264. CVSS: 5.800000190734863. The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1) zero bytes of data or (2) an arbitrary realm name, related to plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit_srv.c.
Query: patch priority for CVE-2015-7419
Matching passage: CVE-2015-7419. CWE: CWE-399. CVSS: 7.800000190734863. IBM WebSphere Portal 8.0.0.1 before CF19 and 8.5.0 before CF09 allows remote attackers to cause a denial of service (memory consumption) via crafted requests.
Near-miss passage: CVE-2015-2338. CWE: CWE-399. CVSS: 6.099999904632568. TPview.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory, which allows guest OS users to cause a host OS denial of service via unspecified vectors, a different vulnerability than CVE-2015-2339.
Query: vulnerability: huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a speciall
Matching passage: CVE-2015-9261. CWE: CWE-476. CVSS: 5.5. huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file.
Near-miss passage: CVE-2015-9132. CWE: CWE-476. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Small Cell SoC FSM9055, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 800, and SD 810, possible arbitrary memory read due to untrusted pointer dereference when handling HLOS controlled values passed to the QSEE syscall helper.
Query: SIEM correlation: stealth activity consistent with CMSTP
Matching passage: T1218.003 CMSTP. Tactics: stealth. Description: Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections. Adversaries may supply CMSTP.exe with INF files infected with malicious commands. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010) / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs (Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets (SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate binary that may be signed by Microsoft. CMSTP.exe can also be abused to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018)
Near-miss passage: T1218.001 Compiled HTML File. Tactics: stealth. Description: Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program) A custom CHM file containing embedded payloads could be delivered to a victim then triggered by [User Execution](https://attack.mitre.org/techniques/T1204). CHM execution may also bypass application application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe. (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017)
Query: Sigma YAML for windows / application
Matching passage: Sigma rule: Detects MSI package installation from suspicious locations. Logsource: windows / application. Rule: title: MSI Installation From Suspicious Locations id: c7c8aa1c-5aff-408e-828b-998e3620b341 status: test description: Detects MSI package installation from suspicious locations references: - https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-31 modified: 2023-10-23 tags: - attack.execution logsource: product: windows service: application detection: selection: Provider_Name: MsiInstaller EventID: - 1040 - 1042 Data|contains: - :\Windows\TEMP\ - \\\\ - \Desktop\ - \PerfLogs\ - \Users\Public\ filter_winget: Data|contains: \AppData\Local\Temp\WinGet\ filter_updhealthtools: Data|contains: C:\Windows\TEMP\UpdHealthTools.msi condition: selection and not 1 of filter_* falsepositives: - False positives may occur if you allow installation from folders such as the desktop, the public folder or remote shares. A baseline is required before production use. level: medium
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "appverifUI.dll". Logsource: windows / image_load. Rule: title: Potential appverifUI.DLL Sideloading id: ee6cea48-c5b6-4304-a332-10fc6446f484 status: test description: Detects potential DLL sideloading of "appverifUI.dll" references: - https://web.archive.org/web/20220519091349/https://fatrodzianko.com/2020/02/15/dll-side-loading-appverif-exe/ author: X__Junior (Nextron Systems) date: 2023-06-20 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \appverifUI.dll filter_main_legit_path: Image: - C:\Windows\SysWOW64\appverif.exe - C:\Windows\System32\appverif.exe ImageLoaded|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high