alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel through 3.19.1 allows local users to bypass intended size restrictions and trigger read operations
Matching passage: CVE-2015-1420. CWE: CWE-362. CVSS: 1.899999976158142. Race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel through 3.19.1 allows local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handle_bytes value of a file handle during the execution of this function.
Near-miss passage: CVE-2015-1882. CWE: CWE-362. CVSS: 8.5. Multiple race conditions in IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user.
Query: rule covering Detects modifications to shell open registry keys that point to suspicious locations typically used by malware for persi
Matching passage: Sigma rule: Detects modifications to shell open registry keys that point to suspicious locations typically used by malware for persi. Logsource: windows / registry_set. Rule: title: Suspicious Shell Open Command Registry Modification id: 9e8894c0-0ae0-11ef-9d85-1f2942bec57c status: experimental description: 'Detects modifications to shell open registry keys that point to suspicious locations typically used by malware for persistence. Generally, modifications to the `*\shell\open\command` registry key can indicate an attempt to change the default action for opening files, and various UAC bypass or persistence techniques involve modifying these keys to execute malicious scripts or binaries. ' references: - https://www.trendmicro.com/en_us/research/25/f/water-curse.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-01-24 tags: - attack.privilege-escalation - attack.persistence - attack.t1548.002 - attack.t1546.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \shell\open\command\ Details|contains: - \$Recycle.Bin\ - \AppData\Local\Temp\ - \Contacts\ - \Music\ - \PerfLogs\ - \Photos\ - \Pictures\ - \Users\Public\ - \Videos\ - \Windows\Temp\ - '%AppData%' - '%LocalAppData%' - '%Temp%' - '%tmp%' condition: selection falsepositives: - Legitimate software installations or updates that modify the shell open command registry keys to these locations. level: medium
Near-miss passage: Sigma rule: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a netw. Logsource: windows / process_creation. Rule: title: Suspicious Scan Loop Network id: f8ad2e2c-40b6-4117-84d7-20b89896ab23 status: test description: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md - https://ss64.com/nt/for.html - https://ss64.com/ps/foreach-object.html author: frack113 date: 2022-03-12 tags: - attack.execution - attack.t1059 - attack.discovery - attack.t1018 logsource: category: process_creation product: windows detection: selection_loop: CommandLine|contains: - 'for ' - 'foreach ' selection_tools: CommandLine|contains: - nslookup - ping condition: all of selection_* falsepositives: - Legitimate script level: medium
Query: Suspicious System Language Discovery execution detected on endpoint
Matching passage: T1614.001 System Language Discovery. Tactics: discovery. Description: Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host. This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions. This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities.(Citation: Malware System Language Check) There are various sources of data an adversary could use to infer system language, such as system defaults and keyboard layouts. Specific checks will vary based on the target and/or adversary, but may involve behaviors such as [Query Registry](https://attack.mitre.org/techniques/T1012) and calls to [Native API](https://attack.mitre.org/techniques/T1106) functions.(Citation: CrowdStrike Ryuk January 2019) For example, on a Windows system adversaries may attempt to infer the language of a system by querying the registry key <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language</code> or parsing the outputs of Windows API functions <code>GetUserDefaultUILanguage</code>, <code>GetSystemDefaultUILanguage</code>, <code>GetKeyboardLayoutList</code> and <code>GetUserDefaultLangID</code>.(Citation: Darkside Ransomware Cybereason)(Citation: Securelist JSWorm)(Citation: SecureList SynAck Doppelgänging May 2018) On a macOS or Linux system, adversaries may query <code>locale</code> to retrieve the value of the <code>$LANG</code> environment variable.
Near-miss passage: T1614 System Location Discovery. Tactics: discovery. Description: Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from [System Location Discovery](https://attack.mitre.org/techniques/T1614) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.(Citation: FBI Ragnar Locker 2020)(Citation: Sophos Geolocation 2016)(Citation: Bleepingcomputer RAT malware 2020) Windows API functions such as <code>GetLocaleInfoW</code> can also be used to determine the locale of the host.(Citation: FBI Ragnar Locker 2020) In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.(Citation: AWS Instance Identity Documents)(Citation: Microsoft Azure Instance Metadata 2021) Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.(Citation: Securelist Trasparent Tribe 2020)(Citation: Sophos Geolocation 2016)
Query: CVE similar to CVE-2015-8871
Matching passage: CVE-2015-8871. CWE: CWE-416. CVSS: 9.800000190734863. Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors.
Near-miss passage: CVE-2015-3055. CWE: CWE-416. CVSS: 7.5. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3053, CVE-2015-3054, CVE-2015-3059, and CVE-2015-3075.
Query: patch priority for CVE-2015-7924
Matching passage: CVE-2015-7924. CWE: UNKNOWN. CVSS: 8.800000190734863. eWON devices with firmware before 10.1s0 do not trigger the discarding of browser session data in response to a log-off action, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
Near-miss passage: CVE-2015-1352. CWE: UNKNOWN. CVSS: 5.0. The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate token extraction for table names, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects when a user performs data exfiltration by using DataSvcUtil.exe. Logsource: windows / process_creation. Rule: title: LOLBAS Data Exfiltration by DataSvcUtil.exe id: e290b10b-1023-4452-a4a9-eb31a9013b3a status: test description: Detects when a user performs data exfiltration by using DataSvcUtil.exe references: - https://gist.github.com/teixeira0xfffff/837e5bfed0d1b0a29a7cb1e5dbdd9ca6 - https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/wcf-data-service-client-utility-datasvcutil-exe - https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/generating-the-data-service-client-library-wcf-data-services - https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/how-to-add-a-data-service-reference-wcf-data-services - https://lolbas-project.github.io/lolbas/Binaries/DataSvcUtil/ author: Ialle Teixeira @teixeira0xfffff, Austin Songer @austinsonger date: 2021-09-30 modified: 2022-05-16 tags: - attack.exfiltration - attack.t1567 logsource: category: process_creation product: windows detection: selection_cli: CommandLine|contains: - '/in:' - '/out:' - '/uri:' selection_img: - Image|endswith: \DataSvcUtil.exe - OriginalFileName: DataSvcUtil.exe condition: all of selection* falsepositives: - DataSvcUtil.exe being used may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - DataSvcUtil.exe being executed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects potential use of Rubeus via registered new trusted logon process. Logsource: windows / security. Rule: title: Register new Logon Process by Rubeus id: 12e6d621-194f-4f59-90cc-1959e21e69f7 status: test description: Detects potential use of Rubeus via registered new trusted logon process references: - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1 author: Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community date: 2019-10-24 modified: 2022-10-09 tags: - attack.lateral-movement - attack.privilege-escalation - attack.credential-access - attack.t1558.003 logsource: product: windows service: security detection: selection: EventID: 4611 LogonProcessName: User32LogonProcesss condition: selection falsepositives: - Unknown level: high
Query: vulnerability: Out-of-bounds memory read in the x509_decode_time function in x509_cert_parser.c in Linux kernels 4.3-rc1 and after.
Matching passage: CVE-2015-5327. CWE: CWE-125. CVSS: 6.5. Out-of-bounds memory read in the x509_decode_time function in x509_cert_parser.c in Linux kernels 4.3-rc1 and after.
Near-miss passage: CVE-2015-8743. CWE: CWE-125. CVSS: 7.099999904632568. QEMU (aka Quick Emulator) built with the NE2000 device emulation support is vulnerable to an OOB r/w access issue. It could occur while performing 'ioport' r/w operations. A privileged (CAP_SYS_RAWIO) user/process could use this flaw to leak or corrupt QEMU memory bytes.
Query: detection rule: Detects execution of renamed Remote Utilities (RURAT) via Product PE header field
Matching passage: Sigma rule: Detects execution of renamed Remote Utilities (RURAT) via Product PE header field. Logsource: windows / process_creation. Rule: title: Renamed Remote Utilities RAT (RURAT) Execution id: 9ef27c24-4903-4192-881a-3adde7ff92a5 status: test description: Detects execution of renamed Remote Utilities (RURAT) via Product PE header field references: - https://redcanary.com/blog/misbehaving-rats/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-19 modified: 2023-02-03 tags: - attack.collection - attack.command-and-control - attack.discovery - attack.stealth - attack.s0592 logsource: category: process_creation product: windows detection: selection: Product: Remote Utilities filter: Image|endswith: - \rutserv.exe - \rfusclient.exe condition: selection and not filter falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence. Logsource: windows / file_delete. Rule: title: IIS WebServer Access Logs Deleted id: 3eb8c339-a765-48cc-a150-4364c04652bf related: - id: 0649be4a-aeb0-45b0-b89e-7f1668f6d9c0 type: similar status: test description: Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence references: - https://www.elastic.co/guide/en/security/current/webserver-access-logs-deleted.html author: Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-09-16 modified: 2023-02-15 tags: - attack.stealth - attack.t1070 logsource: category: file_delete product: windows detection: selection: TargetFilename|contains: \inetpub\logs\LogFiles\ TargetFilename|endswith: .log condition: selection falsepositives: - During uninstallation of the IIS service - During log rotation level: medium
Query: CVE similar to CVE-2015-5323
Matching passage: CVE-2015-5323. CWE: CWE-264. CVSS: 6.5. Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API token of another user.
Near-miss passage: CVE-2015-3767. CWE: CWE-264. CVSS: 7.199999809265137. udf in Apple OS X before 10.10.5 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via a malformed DMG image.
Query: Lateral movement indicators for Domain Account
Matching passage: T1087.002 Domain Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges. Commands such as <code>net user /domain</code> and <code>net group /domain</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscacheutil -q group</code> on macOS, and <code>ldapsearch</code> on Linux can list domain users and groups. [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets including <code>Get-ADUser</code> and <code>Get-ADGroupMember</code> may enumerate members of Active Directory groups.(Citation: CrowdStrike StellarParticle January 2022)
Near-miss passage: T1087.003 Email Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists) In on-premises Exchange and Exchange Online, the <code>Get-GlobalAddressList</code> PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016) In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List)
Query: vulnerability: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect availability via vectors rel
Matching passage: CVE-2015-4749. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect availability via vectors related to JNDI.
Near-miss passage: CVE-2015-7636. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.
Query: patch priority for CVE-2015-6580
Matching passage: CVE-2015-6580. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google V8 before 4.5.103.29, as used in Google Chrome before 45.0.2454.85, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Near-miss passage: CVE-2015-8833. CWE: UNKNOWN. CVSS: 9.800000190734863. Use-after-free vulnerability in the create_smp_dialog function in gtk-dialog.c in the Off-the-Record Messaging (OTR) pidgin-otr plugin before 4.0.2 for Pidgin allows remote attackers to execute arbitrary code via vectors related to the "Authenticate buddy" menu item.
Query: exploit The SNMP implementation in Cisco Adaptive Security Appliance (ASA) Software 8.4(7) and 8.6(1.2) allows remote authenticated users to cause a denial of service (device reload) by se
Matching passage: CVE-2015-4238. CWE: CWE-399. CVSS: 6.800000190734863. The SNMP implementation in Cisco Adaptive Security Appliance (ASA) Software 8.4(7) and 8.6(1.2) allows remote authenticated users to cause a denial of service (device reload) by sending many SNMP requests during a time of high network traffic, aka Bug ID CSCul02601.
Near-miss passage: CVE-2015-4283. CWE: CWE-399. CVSS: 7.800000190734863. Cisco Videoscape Policy Resource Manager (PRM) 3.5.4 allows remote attackers to cause a denial of service (CPU and memory consumption, and TCP service outage) via (1) a SYN flood or (2) another type of TCP traffic flood, aka Bug IDs CSCuu35104 and CSCuu35128.
Query: exploit Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Ex
Matching passage: CVE-2015-2385. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2390, CVE-2015-2397, CVE-2015-2404, CVE-2015-2406, and CVE-2015-2422.
Near-miss passage: CVE-2015-3823. CWE: CWE-119. CVSS: 10.0. libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 21335999.
Query: CVE similar to CVE-2015-8604
Matching passage: CVE-2015-8604. CWE: CWE-89. CVSS: 8.800000190734863. SQL injection vulnerability in the host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via the cg_g parameter in a save action.
Near-miss passage: CVE-2015-5617. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in pub/m_pending_news/delete_pending_news.jsp in Enorth Webpublisher CMS allows remote attackers to execute arbitrary SQL commands via the cbNewsId parameter.
Query: patch priority for CVE-2015-3191
Matching passage: CVE-2015-3191. CWE: CWE-352. CVSS: 8.800000190734863. With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the change_email form in UAA is vulnerable to a CSRF attack. This allows an attacker to trigger an e-mail change for a user logged into a cloud foundry instance via a malicious link on a attacker controlled site. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.
Near-miss passage: CVE-2015-3655. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to hijack the authentication of administrators by leveraging improper enforcement of the anti-CSRF token.
Query: threat report mentioning Compile After Delivery
Matching passage: T1027.004 Compile After Delivery. Tactics: stealth. Description: Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe(Citation: ATTACK IQ), csc.exe, or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018) Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a [Phishing](https://attack.mitre.org/techniques/T1566). Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.(Citation: TrendMicro WindowsAppMac)
Near-miss passage: T1027.008 Stripped Payloads. Tactics: stealth. Description: Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information. Scripts and executables may contain variables names and other strings that help developers document code functionality. Symbols are often created by an operating system’s `linker` when executable payloads are compiled. Reverse engineers use these symbols and strings to analyze code and to identify functionality in payloads.(Citation: Mandiant golang stripped binaries explanation)(Citation: intezer stripped binaries elf files 2018) Adversaries may use stripped payloads in order to make malware analysis more difficult. For example, compilers and other tools may provide features to remove or obfuscate strings and symbols. Adversaries have also used stripped payload formats, such as run-only AppleScripts, a compiled and stripped version of [AppleScript](https://attack.mitre.org/techniques/T1059/002), to evade detection and analysis. The lack of human-readable information may directly hinder detection and analysis of payloads.(Citation: SentinelLabs reversing run-only applescripts 2021)