alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly execute arbitrary code via a crafted passwor
Matching passage: CVE-2015-7696. CWE: CWE-119. CVSS: 6.800000190734863. Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly execute arbitrary code via a crafted password-protected ZIP archive, possibly related to an Extra-Field size value.
Near-miss passage: CVE-2015-3748. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Query: exploit SQL injection vulnerability in mod1/index.php in the Akronymmanager (sb_akronymmanager) extension before 7.0.0 for TYPO3 allows remote authenticated users with permission to mainta
Matching passage: CVE-2015-2803. CWE: CWE-89. CVSS: 6.0. SQL injection vulnerability in mod1/index.php in the Akronymmanager (sb_akronymmanager) extension before 7.0.0 for TYPO3 allows remote authenticated users with permission to maintain acronyms to execute arbitrary SQL commands via the id parameter.
Near-miss passage: CVE-2015-0894. CWE: CWE-89. CVSS: 6.0. SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Query: CVE similar to CVE-2015-4318
Matching passage: CVE-2015-4318. CWE: CWE-399. CVSS: 5.0. Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows remote attackers to cause a denial of service via invalid variables in a GET request, aka Bug ID CSCuv40528.
Near-miss passage: CVE-2015-6292. CWE: CWE-399. CVSS: 7.800000190734863. The proxy-cache implementation in Cisco AsyncOS 8.0.x before 8.0.7-151, 8.1.x and 8.5.x before 8.5.2-004, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via multiple proxy connections, aka Bug ID CSCus10922.
Query: CWE for Missing Write Protection for Parametric Data Values
Matching passage: CWE-1314 Missing Write Protection for Parametric Data Values. The device does not write-protect the parametric data values for sensors that scale the sensor value, allowing untrusted software to manipulate the apparent result and potentially damage hardware or cause operational failure.
Near-miss passage: CWE-432 Dangerous Signal Handler not Disabled During Sensitive Operations. The product uses a signal handler that shares state with other signal handlers, but it does not properly mask or prevent those signal handlers from being invoked while the original signal handler is still running.
Query: Persistence mechanism resembling Malicious Library
Matching passage: T1204.005 Malicious Library. Tactics: execution. Description: Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may [Upload Malware](https://attack.mitre.org/techniques/T1608/001) to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that establishes persistence, steals data, or mines cryptocurrency.(Citation: Datadog Security Labs Malicious PyPi Packages 2024)(Citation: Fortinet Malicious NPM Packages 2023) In some cases, threat actors may compromise and backdoor existing popular libraries (i.e., [Compromise Software Dependencies and Development Tools](https://attack.mitre.org/techniques/T1195/001)). Alternatively, they may create entirely new packages and leverage behaviors such as typosquatting to encourage users to install them.
Near-miss passage: T1204.002 Malicious File. Tactics: execution. Description: An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001). Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.(Citation: Mandiant Trojanized Windows 10) Adversaries may employ various forms of [Masquerading](https://attack.mitre.org/techniques/T1036) and [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it.(Citation: Password Protected Word Docs) While [Malicious File](https://attack.mitre.org/techniques/T1204/002) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534).
Query: Outbound C2 pattern associated with Ignore Process Interrupts
Matching passage: T1564.011 Ignore Process Interrupts. Tactics: stealth. Description: Adversaries may evade defensive mechanisms by executing commands that hide from process interrupt signals. Many operating systems use signals to deliver messages to control process behavior. Command interpreters often include specific commands/flags that ignore errors and other hangups, such as when the user of the active session logs off.(Citation: Linux Signal Man) These interrupt signals may also be used by defensive tools and/or analysts to pause or terminate specified running processes. Adversaries may invoke processes using `nohup`, [PowerShell](https://attack.mitre.org/techniques/T1059/001) `-ErrorAction SilentlyContinue`, or similar commands that may be immune to hangups.(Citation: nohup Linux Man)(Citation: Microsoft PowerShell SilentlyContinue) This may enable malicious commands and malware to continue execution through system events that would otherwise terminate its execution, such as users logging off or the termination of its C2 network connection. Hiding from process interrupt signals may allow malware to continue execution, but unlike [Trap](https://attack.mitre.org/techniques/T1546/005) this does not establish [Persistence](https://attack.mitre.org/tactics/TA0003) since the process will not be re-invoked once actually terminated.
Near-miss passage: T1564.009 Resource Forking. Tactics: stealth. Description: Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.(Citation: macOS Hierarchical File System Overview) Usage of a resource fork is identifiable when displaying a file’s extended attributes, using <code>ls -l@</code> or <code>xattr -l</code> commands. Resource forks have been deprecated and replaced with the application bundle structure. Non-localized resources are placed at the top level directory of an application bundle, while localized resources are placed in the <code>/Resources</code> folder.(Citation: Resource and Data Forks)(Citation: ELC Extended Attributes) Adversaries can use resource forks to hide malicious data that may otherwise be stored directly in files. Adversaries can execute content with an attached resource fork, at a specified offset, that is moved to an executable location then invoked. Resource fork content may also be obfuscated/encrypted until execution.(Citation: sentinellabs resource named fork 2020)(Citation: tau bundlore erika noerenberg 2020)
Query: exploit LibTIFF before 4.0.7 allows remote attackers to cause a denial of service (memory consumption and crash) via a crafted tiff file.
Matching passage: CVE-2015-7313. CWE: CWE-399. CVSS: 5.5. LibTIFF before 4.0.7 allows remote attackers to cause a denial of service (memory consumption and crash) via a crafted tiff file.
Near-miss passage: CVE-2015-0731. CWE: CWE-399. CVSS: 6.099999904632568. The ISDN implementation in Cisco IOS 15.3S allows remote attackers to cause a denial of service (device reload) via malformed Q931 SETUP messages, aka Bug ID CSCut37890.
Query: Lateral movement indicators for Polymorphic Code
Matching passage: T1027.014 Polymorphic Code. Tactics: stealth. Description: Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection. Polymorphic code is a type of software capable of changing its runtime footprint during code execution.(Citation: polymorphic-blackberry) With each execution of the software, the code is mutated into a different version of itself that achieves the same purpose or objective as the original. This functionality enables the malware to evade traditional signature-based defenses, such as antivirus and antimalware tools.(Citation: polymorphic-sentinelone) Other obfuscation techniques can be used in conjunction with polymorphic code to accomplish the intended effects, including using mutation engines to conduct actions such as [Software Packing](https://attack.mitre.org/techniques/T1027/002), [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010), or [Encrypted/Encoded File](https://attack.mitre.org/techniques/T1027/013).(Citation: polymorphic-linkedin)(Citation: polymorphic-medium)
Near-miss passage: T1027 Obfuscated Files or Information. Tactics: stealth. Description: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.(Citation: Volexity PowerDuke November 2016) Adversaries may also use compressed or archived scripts, such as JavaScript. Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery.(Citation: Linux/Cdorked.A We Live Security Analysis) Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.(Citation: Carbon Black Obfuscation Sept 2016) Adversaries may also abuse [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010) to obscure commands executed from payloads or directly via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017)
Query: Sigma rule for Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the spec
Matching passage: Sigma rule: Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the spec. Logsource: aws / cloudtrail. Rule: title: AWS EC2 Startup Shell Script Change id: 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df status: test description: Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up. references: - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/ec2__startup_shell_script/main.py#L9 author: faloker date: 2020-02-12 modified: 2022-06-07 tags: - attack.execution - attack.t1059.001 - attack.t1059.003 - attack.t1059.004 logsource: product: aws service: cloudtrail detection: selection_source: eventSource: ec2.amazonaws.com requestParameters.attribute: userData eventName: ModifyInstanceAttribute condition: selection_source falsepositives: - Valid changes to the startup script level: high
Near-miss passage: Sigma rule: Detects suspicious usage of the ShellExec_RunDLL function to launch other commands as seen in the the raspberry-robin at. Logsource: windows / process_creation. Rule: title: Suspicious Usage Of ShellExec_RunDLL id: d87bd452-6da1-456e-8155-7dc988157b7d related: - id: 36c5146c-d127-4f85-8e21-01bf62355d5a type: obsolete - id: 8823e85d-31d8-473e-b7f4-92da070f0fc6 type: similar status: test description: Detects suspicious usage of the ShellExec_RunDLL function to launch other commands as seen in the the raspberry-robin attack references: - https://redcanary.com/blog/raspberry-robin/ - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - https://github.com/SigmaHQ/sigma/issues/1009 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-01 modified: 2022-12-30 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_openasrundll: CommandLine|contains: ShellExec_RunDLL selection_suspcli: CommandLine|contains: - \Desktop\ - \Temp\ - \Users\Public\ - comspec - iex - Invoke- - msiexec - odbcconf - regsvr32 condition: all of selection_* falsepositives: - Unknown level: high
Query: risk of IBM Sterling B2B Integrator 5.2 allows local users to obtain sensitive cleartext web-services information by leveraging database access.
Matching passage: CVE-2015-7438. CWE: CWE-200. CVSS: 4.699999809265137. IBM Sterling B2B Integrator 5.2 allows local users to obtain sensitive cleartext web-services information by leveraging database access.
Near-miss passage: CVE-2015-8007. CWE: CWE-200. CVSS: 4.0. The Echo extension for MediWiki does not properly implement the hideuser functionality, which allows remote authenticated users to see hidden usernames in "non-revision based" notifications, as demonstrated by viewing a hidden username in a Thanks notification.
Query: patch priority for CVE-2015-0526
Matching passage: CVE-2015-0526. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Validation Manager (RVM) 3.2 before build 201 allow remote attackers to inject arbitrary web script or HTML via the (1) displayMode or (2) wrapPreDisplayMode parameter.
Near-miss passage: CVE-2015-0549. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in EMC Documentum D2 before 4.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Query: exploit The CFNetwork Proxies component in Apple iOS before 9 does not properly handle a Set-Cookie header within a response to an HTTP CONNECT request, which allows remote proxy servers t
Matching passage: CVE-2015-5841. CWE: CWE-74. CVSS: 5.0. The CFNetwork Proxies component in Apple iOS before 9 does not properly handle a Set-Cookie header within a response to an HTTP CONNECT request, which allows remote proxy servers to conduct cookie-injection attacks via a crafted response.
Near-miss passage: CVE-2015-0116. CWE: CWE-74. CVSS: 3.5. IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 does not properly restrict the addition of links, which makes it easier for remote authenticated users to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.
Query: risk of sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is defined using multiple wildcards in /etc/sudoers, as demonstr
Matching passage: CVE-2015-5602. CWE: CWE-264. CVSS: 7.199999809265137. sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by "/home/*/*/file.txt."
Near-miss passage: CVE-2015-4304. CWE: CWE-264. CVSS: 9.0. The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended access restrictions, and create administrative accounts or read data from arbitrary tenant domains, via a crafted URL, aka Bug IDs CSCus62671 and CSCus62652.
Query: explain CWE-154
Matching passage: CWE-154 Improper Neutralization of Variable Name Delimiters. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as variable name delimiters when they are sent to a downstream component.
Near-miss passage: CWE-487 Reliance on Package-level Scope. Java packages are not inherently closed; therefore, relying on them for code security is not a good practice.
Query: detect Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location in logs
Matching passage: Sigma rule: Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location. Logsource: windows / image_load. Rule: title: Microsoft Excel Add-In Loaded From Uncommon Location id: af4c4609-5755-42fe-8075-4effb49f5d44 related: - id: c5f4b5cb-4c25-4249-ba91-aa03626e3185 type: derived status: test description: Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location references: - https://www.mandiant.com/resources/blog/lnk-between-browsers - https://wazuh.com/blog/detecting-xll-files-used-for-dropping-fin7-jssloader-with-wazuh/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-12 tags: - attack.execution - attack.t1204.002 logsource: category: image_load product: windows detection: selection: Image|endswith: \excel.exe ImageLoaded|contains: - \Desktop\ - \Downloads\ - \Perflogs\ - \Temp\ - \Users\Public\ - \Windows\Tasks\ ImageLoaded|endswith: .xll condition: selection falsepositives: - Some tuning might be required to allow or remove certain locations used by the rule if you consider them as safe locations level: medium
Near-miss passage: Sigma rule: Detects potential process patterns related to Cobalt Strike beacon activity. Logsource: windows / process_creation. Rule: title: Potential CobaltStrike Process Patterns id: f35c5d71-b489-4e22-a115-f003df287317 status: test description: Detects potential process patterns related to Cobalt Strike beacon activity references: - https://hausec.com/2021/07/26/cobalt-strike-and-tradecraft/ - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-07-27 modified: 2023-03-29 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_generic_1: CommandLine|endswith: cmd.exe /C whoami ParentImage|startswith: C:\Temp\ selection_generic_2: ParentImage|endswith: - \runonce.exe - \dllhost.exe CommandLine|contains|all: - cmd.exe /c echo - '> \\\\.\\pipe' selection_conhost_1: ParentCommandLine|contains|all: - cmd.exe /C echo - ' > \\\\.\\pipe' CommandLine|endswith: conhost.exe 0xffffffff -ForceV1 selection_conhost_2: ParentCommandLine|endswith: /C whoami CommandLine|endswith: conhost.exe 0xffffffff -ForceV1 condition: 1 of selection_* falsepositives: - Unknown level: high
Query: exploit Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.0.1 and 3.1.2 allows remote attackers to affect confidentiality via unknown vectors
Matching passage: CVE-2015-4899. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.0.1 and 3.1.2 allows remote attackers to affect confidentiality via unknown vectors related to Security.
Near-miss passage: CVE-2015-8068. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.