alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-5750
Matching passage: CVE-2015-5750. CWE: CWE-119. CVSS: 7.5. Data Detectors Engine in Apple OS X before 10.10.5 allows attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted series of Unicode characters.
Near-miss passage: CVE-2015-6676. CWE: CWE-119. CVSS: 10.0. Buffer overflow in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-6678.
Query: CVE similar to CVE-2015-3179
Matching passage: CVE-2015-3179. CWE: CWE-264. CVSS: 3.5. login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions by leveraging access to an unconfirmed suspended account.
Near-miss passage: CVE-2015-0057. CWE: CWE-264. CVSS: 7.199999809265137. win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Query: Sigma rule for Detects suspicious Spring framework exceptions that could indicate exploitation attempts
Matching passage: Sigma rule: Detects suspicious Spring framework exceptions that could indicate exploitation attempts. Logsource: spring / application. Rule: title: Spring Framework Exceptions id: ae48ab93-45f7-4051-9dfe-5d30a3f78e33 status: stable description: Detects suspicious Spring framework exceptions that could indicate exploitation attempts references: - https://docs.spring.io/spring-security/site/docs/current/api/overview-tree.html author: Thomas Patzke date: 2017-08-06 modified: 2020-09-01 tags: - attack.initial-access - attack.t1190 logsource: category: application product: spring detection: keywords: - AccessDeniedException - CsrfException - InvalidCsrfTokenException - MissingCsrfTokenException - CookieTheftException - InvalidCookieException - RequestRejectedException condition: keywords falsepositives: - Application bugs level: medium
Near-miss passage: Sigma rule: Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon. Logsource: windows / process_access. Rule: title: HackTool - SysmonEnte Execution id: d29ada0f-af45-4f27-8f32-f7b77c3dbc4e status: test description: Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon references: - https://codewhitesec.blogspot.com/2022/09/attacks-on-sysmon-revisited-sysmonente.html - https://github.com/codewhitesec/SysmonEnte/ - https://github.com/codewhitesec/SysmonEnte/blob/fe267690fcc799fbda15398243615a30451d9099/screens/1.png author: Florian Roth (Nextron Systems) date: 2022-09-07 modified: 2026-06-29 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: process_access product: windows detection: selection_sysmon: TargetImage|contains: - :\Windows\Sysmon.exe - :\Windows\Sysmon64.exe - :\Windows\Sysmon64a.exe GrantedAccess: '0x1400' selection_calltrace: CallTrace: Ente filter_main_generic: SourceImage|contains: - :\Program Files (x86)\ - :\Program Files\ - :\Windows\System32\ - :\Windows\SysWOW64\ filter_main_msdefender: SourceImage|contains: :\ProgramData\Microsoft\Windows Defender\Platform\ SourceImage|endswith: \MsMpEng.exe condition: ( selection_sysmon and not 1 of filter_main_* ) or selection_calltrace falsepositives: - Unknown level: high
Query: SOC runbook when seeing Encoded PowerShell / command-line abuse matching Data Encrypted for Impact
Matching passage: Playbook for T1486 Data Encrypted for Impact. 1) Validate alert telemetry against T1486. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: impact. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption
Near-miss passage: Playbook for T1496.002 Bandwidth Hijacking. Different response path focused on impact.
Query: how to detect Malicious Link
Matching passage: T1204.001 Malicious Link. Tactics: execution. Description: An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002). Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203). Links may also lead users to download files that require execution via [Malicious File](https://attack.mitre.org/techniques/T1204/002).
Near-miss passage: T1204.005 Malicious Library. Tactics: execution. Description: Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may [Upload Malware](https://attack.mitre.org/techniques/T1608/001) to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that establishes persistence, steals data, or mines cryptocurrency.(Citation: Datadog Security Labs Malicious PyPi Packages 2024)(Citation: Fortinet Malicious NPM Packages 2023) In some cases, threat actors may compromise and backdoor existing popular libraries (i.e., [Compromise Software Dependencies and Development Tools](https://attack.mitre.org/techniques/T1195/001)). Alternatively, they may create entirely new packages and leverage behaviors such as typosquatting to encourage users to install them.
Query: detection rule: Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM reg
Matching passage: Sigma rule: Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM reg. Logsource: windows / process_creation. Rule: title: Sensitive File Access Via Volume Shadow Copy Backup id: f57f8d16-1f39-4dcb-a604-6c73d9b54b3d status: test description: 'Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM registry hives or the AD database (ntds.dit) ' references: - https://twitter.com/vxunderground/status/1423336151860002816?s=20 - https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection - https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/ author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems) date: 2021-08-09 modified: 2024-01-18 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_1: CommandLine|contains: \\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy selection_2: CommandLine|contains: - \\NTDS.dit - \\SYSTEM - \\SECURITY condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects execution of wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) from non default loc. Logsource: windows / process_creation. Rule: title: Wab Execution From Non Default Location id: 395907ee-96e5-4666-af2e-2ca91688e151 status: test description: Detects execution of wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) from non default locations as seen with bumblebee activity references: - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime - https://thedfirreport.com/2022/09/26/bumblebee-round-two/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-12 modified: 2022-09-27 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection: Image|endswith: - \wab.exe - \wabmig.exe filter: Image|startswith: - C:\Windows\WinSxS\ - C:\Program Files\Windows Mail\ - C:\Program Files (x86)\Windows Mail\ condition: selection and not filter falsepositives: - Unknown level: high
Query: exploit WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application cras
Matching passage: CVE-2015-5796. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-7091. CWE: CWE-119. CVSS: 6.599999904632568. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7092, and CVE-2015-7117.
Query: risk of KENT-WEB Clip Board before 4.1 allows remote attackers to delete arbitrary files via unspecified vectors.
Matching passage: CVE-2015-0888. CWE: UNKNOWN. CVSS: 6.400000095367432. KENT-WEB Clip Board before 4.1 allows remote attackers to delete arbitrary files via unspecified vectors.
Near-miss passage: CVE-2015-0889. CWE: UNKNOWN. CVSS: 7.5. KENT-WEB Joyful Note before 5.3 allows remote attackers to delete files or write to files, and consequently execute arbitrary code, via vectors involving an article.
Query: describe CVE-2015-2554
Matching passage: CVE-2015-2554. CWE: CWE-264. CVSS: 7.199999809265137. The kernel in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Windows Object Reference Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-0761. CWE: CWE-264. CVSS: 7.199999809265137. Cisco AnyConnect Secure Mobility Client before 3.1(8009) and 4.x before 4.0(2052) on Linux does not properly implement unspecified internal functions, which allows local users to obtain root privileges via crafted vpnagent options, aka Bug ID CSCus86790.
Query: containment actions for Suspicious File Deletion execution detected on endpoint
Matching passage: Playbook for T1070.004 File Deletion. 1) Validate alert telemetry against T1070.004. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrus
Near-miss passage: Playbook for T1070 Indicator Removal. Different response path focused on stealth.
Query: what is T1220
Matching passage: T1220 XSL Script Processing. Tactics: stealth. Description: Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. To support complex operations, the XSL standard includes support for embedded scripting in various languages. (Citation: Microsoft XSLT Script Mar 2017) Adversaries may abuse this functionality to execute arbitrary files while potentially bypassing application control. Similar to [Trusted Developer Utilities Proxy Execution](https://attack.mitre.org/techniques/T1127), the Microsoft common line transformation utility binary (msxsl.exe) (Citation: Microsoft msxsl.exe) can be installed and used to execute malicious JavaScript embedded within local or remote (URL referenced) XSL files. (Citation: Penetration Testing Lab MSXSL July 2017) Since msxsl.exe is not installed by default, an adversary will likely need to package it with dropped files. (Citation: Reaqta MSXSL Spearphishing MAR 2018) Msxsl.exe takes two main arguments, an XML source file and an XSL stylesheet. Since the XSL file is valid XML, the adversary may call the same XSL file twice. When using msxsl.exe adversaries may also give the XML/XSL files an arbitrary file extension.(Citation: XSL Bypass Mar 2019) Command-line examples:(Citation: Penetration Testing Lab MSXSL July 2017)(Citation: XSL Bypass Mar 2019) * <code>msxsl.exe customers[.]xml script[.]xsl</code> * <code>msxsl.exe script[.]xsl script[.]xsl</code> * <code>msxsl.exe script[.]jpeg script[.]jpeg</code> Another variation of this technique, dubbed “Squiblytwo”, involves using [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) to invoke JScript or VBScript within an XSL file.(Citation: LOLBAS Wmic) This technique can also execute local/remote scripts and, similar to its [Regsvr32](https://attack.mitre.org/techniques/T1218/010)/ "Squiblydoo" counterpart, leverages a trusted, built-in W
Near-miss passage: T1574 Hijack Execution Flow. Tactics: stealth, execution. Description: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.
Query: patch priority for CVE-2015-3313
Matching passage: CVE-2015-3313. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in WordPress Community Events plugin before 1.4.
Near-miss passage: CVE-2015-1479. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to execute arbitrary SQL commands via the site parameter.
Query: risk of NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to bypass the origin timestamp validation via a packet with an origin timestamp set to zero.
Matching passage: CVE-2015-8138. CWE: CWE-20. CVSS: 5.300000190734863. NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to bypass the origin timestamp validation via a packet with an origin timestamp set to zero.
Near-miss passage: CVE-2015-0633. CWE: CWE-20. CVSS: 6.800000190734863. The Integrated Management Controller (IMC) in Cisco Unified Computing System (UCS) 1.4(7h) and earlier on C-Series servers allows remote attackers to bypass intended access restrictions by sending crafted DHCP response packets on the local network, aka Bug ID CSCuf52876.
Query: Sigma rule for Detects execution of the IEExec utility to download and execute files
Matching passage: Sigma rule: Detects execution of the IEExec utility to download and execute files. Logsource: windows / process_creation. Rule: title: File Download And Execution Via IEExec.EXE id: 9801abb8-e297-4dbf-9fbd-57dde0e830ad status: test description: Detects execution of the IEExec utility to download and execute files references: - https://lolbas-project.github.io/lolbas/Binaries/Ieexec/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-05-16 modified: 2023-11-09 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \IEExec.exe - OriginalFileName: IEExec.exe selection_cli: CommandLine|contains: - http:// - https:// condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of the "touch" process in service file.. Logsource: linux / process_creation. Rule: title: Touch Suspicious Service File id: 31545105-3444-4584-bebf-c466353230d2 status: test description: Detects usage of the "touch" process in service file. references: - https://blogs.blackberry.com/ - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144 author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-01-11 tags: - attack.stealth - attack.t1070.006 logsource: product: linux category: process_creation detection: selection: Image|endswith: /touch CommandLine|contains: ' -t ' CommandLine|endswith: .service condition: selection falsepositives: - Admin changing date of files. level: medium
Query: risk of WebKit, as used in Apple iTunes before 12.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via
Matching passage: CVE-2015-5815. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iTunes before 12.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-4932. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a different vulnerability than CVE-2015-4931, CVE-2015-4933, CVE-2015-4934, and CVE-2015-4935.
Query: exploit QT Media Foundation in Apple QuickTime before 7.7.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a differe
Matching passage: CVE-2015-3664. CWE: CWE-119. CVSS: 6.800000190734863. QT Media Foundation in Apple QuickTime before 7.7.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3665 and CVE-2015-3669.
Near-miss passage: CVE-2015-1859. CWE: CWE-119. CVSS: 6.800000190734863. Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted ICO image.
Query: execution using Malicious Library
Matching passage: T1204.005 Malicious Library. Tactics: execution. Description: Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may [Upload Malware](https://attack.mitre.org/techniques/T1608/001) to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that establishes persistence, steals data, or mines cryptocurrency.(Citation: Datadog Security Labs Malicious PyPi Packages 2024)(Citation: Fortinet Malicious NPM Packages 2023) In some cases, threat actors may compromise and backdoor existing popular libraries (i.e., [Compromise Software Dependencies and Development Tools](https://attack.mitre.org/techniques/T1195/001)). Alternatively, they may create entirely new packages and leverage behaviors such as typosquatting to encourage users to install them.
Near-miss passage: T1204 User Execution. Tactics: execution. Description: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of [Phishing](https://attack.mitre.org/techniques/T1566). While [User Execution](https://attack.mitre.org/techniques/T1204) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534). Adversaries may also deceive users into performing actions such as: * Enabling [Remote Access Tools](https://attack.mitre.org/techniques/T1219), allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539)s(Citation: Talos Roblox Scam 2023)(Citation: Krebs Discord Bookmarks 2023) * Downloading and executing malware for [User Execution](https://attack.mitre.org/techniques/T1204) * Coerceing users to copy, paste, and execute malicious code manually(Citation: Reliaquest-execution)(Citation: proofpoint-selfpwn) For example, tech support scams can be facilitated through [Phishing](https://attack.mitre.org/techniques/T1566), vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or [Remote Access Tools](https://attack.mitre.org/techniques/T1219).(Citation: Telephone Attack Delivery)
Query: explain CWE-400
Matching passage: CWE-400 Uncontrolled Resource Consumption. The product does not properly control the allocation and maintenance of a limited resource.
Near-miss passage: CWE-1311 Improper Translation of Security Attributes by Fabric Bridge. The bridge incorrectly translates security attributes from either trusted to untrusted or from untrusted to trusted when converting from one fabric protocol to another.
Query: CVE similar to CVE-2015-2768
Matching passage: CVE-2015-2768. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Websense TRITON AP-EMAIL before 8.0.0 and V-Series 7.7 appliances allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-7307. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the configuration page.