alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote atta
Matching passage: CVE-2015-4142. CWE: CWE-119. CVSS: 4.300000190734863. Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote attackers to cause a denial of service (crash) via a crafted frame, which triggers an out-of-bounds read.
Near-miss passage: CVE-2015-6599. CWE: CWE-119. CVSS: 10.0. libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23416608.
Query: Suspicious Identify Business Tempo execution detected on endpoint
Matching passage: T1591.003 Identify Business Tempo. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's business tempo that can be used during targeting. Information about an organization’s business tempo may include a variety of details, including operational hours/days of the week. This information may also reveal times/dates of purchases and shipments of the victim’s hardware and software resources. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about business tempo may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199))
Near-miss passage: T1591 Gather Victim Org Information. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's organization that can be used during targeting. Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about an organization may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak)(Citation: SEC EDGAR Search) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Query: detect Detects the use of the "nice" utility to execute a shell. Such behavior may be associated with privilege escalation, una in logs
Matching passage: Sigma rule: Detects the use of the "nice" utility to execute a shell. Such behavior may be associated with privilege escalation, una. Logsource: linux / process_creation. Rule: title: Shell Execution via Nice - Linux id: 093d68c7-762a-42f4-9f46-95e79142571a status: test description: 'Detects the use of the "nice" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. ' references: - https://gtfobins.github.io/gtfobins/nice/#shell - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-09-02 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: linux detection: selection: Image|endswith: /nice CommandLine|endswith: - /bin/bash - /bin/dash - /bin/fish - /bin/sh - /bin/zsh condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebe. Logsource: windows / process_creation. Rule: title: ImagingDevices Unusual Parent/Child Processes id: f11f2808-adb4-46c0-802a-8660db50fa99 status: test description: Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebee activity references: - https://thedfirreport.com/2022/09/26/bumblebee-round-two/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-27 modified: 2022-12-29 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \WmiPrvSE.exe - \svchost.exe - \dllhost.exe Image|endswith: \ImagingDevices.exe selection_child: ParentImage|endswith: \ImagingDevices.exe condition: 1 of selection_* falsepositives: - Unknown level: high
Query: explain T1137.004 Outlook Home Page
Matching passage: T1137.004 Outlook Home Page. Tactics: persistence. Description: Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system. Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders. This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened. A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page.(Citation: SensePost Outlook Home Page) Once malicious home pages have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious Home Pages will execute when the right Outlook folder is loaded/reloaded.(Citation: SensePost Outlook Home Page)
Near-miss passage: T1137.003 Outlook Forms. Tactics: persistence. Description: Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system. Outlook forms are used as templates for presentation and functionality in Outlook messages. Custom Outlook forms can be created that will execute code when a specifically crafted email is sent by an adversary utilizing the same custom Outlook form.(Citation: SensePost Outlook Forms) Once malicious forms have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious forms will execute when an adversary sends a specifically crafted email to the user.(Citation: SensePost Outlook Forms)
Query: threat report mentioning Disable or Modify Cloud Log
Matching passage: T1685.002 Disable or Modify Cloud Log. Tactics: defense impairment. Description: An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities. For example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity. They may alternatively tamper with logging functionality, for example, by removing any associated SNS topics, disabling multi-region logging, or disabling settings that validate and/or encrypt log files.(Citation: AWS Cloud Trail)(Citation: Pacu Detection Disruption Module) In Office 365, an adversary may disable logging on mail collection activities for specific users by using the Set-MailboxAuditBypassAssociation cmdlet, by disabling M365 Advanced Auditing for the user, or by downgrading the user’s license from an Enterprise E5 to an Enterprise E3 license.(Citation: Dark Reading)
Near-miss passage: T1685.005 Clear Windows Event Logs. Tactics: defense impairment. Description: Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit. With administrator privileges, the event logs can be cleared with the following utility commands: * `wevtutil cl system` * `wevtutil cl application` * `wevtutil cl security` These logs may also be cleared through other mechanisms, such as the event viewer GUI or [PowerShell](https://attack.mitre.org/techniques/T1059/001). For example, adversaries may use the PowerShell command `Remove-EventLog -LogName Security` to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot.(Citation: disable_win_evt_logging) Adversaries may also attempt to clear logs by directly deleting the stored log files within `C:\Windows\System32\winevt\logs\`.
Query: campaign using Exfiltration Over C2 Channel
Matching passage: T1041 Exfiltration Over C2 Channel. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
Near-miss passage: T1020 Automated Exfiltration. Tactics: exfiltration. Description: Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.(Citation: ESET Gamaredon June 2020) When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).
Query: threat report mentioning Exfiltration to Text Storage Sites
Matching passage: T1567.003 Exfiltration to Text Storage Sites. Tactics: exfiltration. Description: Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as <code>pastebin[.]com</code>, are commonly used by developers to share code and other information. Text storage sites are often used to host malicious code for C2 communication (e.g., [Stage Capabilities](https://attack.mitre.org/techniques/T1608)), but adversaries may also use these sites to exfiltrate collected data. Furthermore, paid features and encryption options may allow adversaries to conceal and store data more securely.(Citation: Pastebin EchoSec) **Note:** This is distinct from [Exfiltration to Code Repository](https://attack.mitre.org/techniques/T1567/001), which highlight access to code repositories via APIs.
Near-miss passage: T1567.004 Exfiltration Over Webhook. Tactics: exfiltration. Description: Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server.(Citation: RedHat Webhooks) Many public and commercial services, such as Discord, Slack, and `webhook.site`, support the creation of webhook endpoints that can be used by other services, such as Github, Jira, or Trello.(Citation: Discord Intro to Webhooks) When changes happen in the linked services (such as pushing a repository update or modifying a ticket), these services will automatically post the data to the webhook endpoint for use by the consuming application. Adversaries may link an adversary-owned environment to a victim-owned SaaS service to achieve repeated [Automated Exfiltration](https://attack.mitre.org/techniques/T1020) of emails, chat messages, and other data.(Citation: Push Security SaaS Attacks Repository Webhooks) Alternatively, instead of linking the webhook endpoint to a service, an adversary can manually post staged data directly to the URL in order to exfiltrate it.(Citation: Microsoft SQL Server) Access to webhook endpoints is often over HTTPS, which gives the adversary an additional level of protection. Exfiltration leveraging webhooks can also blend in with normal network traffic if the webhook endpoint points to a commonly used SaaS application or collaboration service.(Citation: CyberArk Labs Discord)(Citation: Talos Discord Webhook Abuse)(Citation: Checkmarx Webhooks)
Query: CVE similar to CVE-2015-6710
Matching passage: CVE-2015-6710. CWE: UNKNOWN. CVSS: 6.800000190734863. The CBBBRInit method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Near-miss passage: CVE-2015-2296. CWE: UNKNOWN. CVSS: 6.800000190734863. The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.
Query: describe CVE-2015-3220
Matching passage: CVE-2015-3220. CWE: CWE-119. CVSS: 7.5. The tlslite library before 0.4.9 for Python allows remote attackers to trigger a denial of service (runtime exception and process crash).
Near-miss passage: CVE-2015-9224. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear, and Small Cell SoC FSM9055, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, and SDX20, lack of input Validation in QURTK_write() can cause potential buffer overflow.
Query: detect Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system pe in logs
Matching passage: Sigma rule: Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system pe. Logsource: windows / ps_module. Rule: title: Suspicious Get Local Groups Information id: cef24b90-dddc-4ae1-a09a-8764872f69fc related: - id: fa6a5a45-3ee2-4529-aa14-ee5edc9e29cb type: similar status: test description: 'Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.001/T1069.001.md author: frack113 date: 2021-12-12 modified: 2025-08-22 tags: - attack.discovery - attack.t1069.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_localgroup: - Payload|contains: - 'get-localgroup ' - 'get-localgroupmember ' - ContextInfo|contains: - 'get-localgroup ' - 'get-localgroupmember ' selection_wmi_module: - Payload|contains: - 'get-wmiobject ' - 'gwmi ' - 'get-ciminstance ' - 'gcim ' - ContextInfo|contains|all: - 'get-wmiobject ' - 'gwmi ' - 'get-ciminstance ' - 'gcim ' selection_wmi_class: - Payload|contains: win32_group - ContextInfo|contains: win32_group condition: selection_localgroup or all of selection_wmi_* falsepositives: - Administrator script level: low
Near-miss passage: Sigma rule: Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned D. Logsource: windows / security-mitigations. Rule: title: Microsoft Defender Blocked from Loading Unsigned DLL id: 0b0ea3cc-99c8-4730-9c53-45deee2a4c86 status: test description: Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs which may be an attempt to sideload arbitrary DLL references: - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool author: Bhabesh Raj date: 2022-08-02 modified: 2022-09-28 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows service: security-mitigations detection: selection: EventID: - 11 - 12 ProcessPath|endswith: - \MpCmdRun.exe - \NisSrv.exe condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-1650
Matching passage: CVE-2015-1650. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Component Use After Free Vulnerability."
Near-miss passage: CVE-2015-7638. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.
Query: detection rule: Detect the harvesting of wifi credentials using netsh.exe
Matching passage: Sigma rule: Detect the harvesting of wifi credentials using netsh.exe. Logsource: windows / process_creation. Rule: title: Harvesting Of Wifi Credentials Via Netsh.EXE id: 42b1a5b8-353f-4f10-b256-39de4467faff status: test description: Detect the harvesting of wifi credentials using netsh.exe references: - https://blog.malwarebytes.com/threat-analysis/2020/04/new-agenttesla-variant-steals-wifi-credentials/ author: Andreas Hunkeler (@Karneades), oscd.community date: 2020-04-20 modified: 2023-02-13 tags: - attack.discovery - attack.credential-access - attack.t1040 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: CommandLine|contains|all: - wlan - ' s' - ' p' - ' k' - =clear condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects encoded base64 MZ header in the commandline. Logsource: windows / process_creation. Rule: title: Base64 MZ Header In CommandLine id: 22e58743-4ac8-4a9f-bf19-00a0428d8c5f status: test description: Detects encoded base64 MZ header in the commandline references: - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-12 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - TVqQAAMAAAAEAAAA - TVpQAAIAAAAEAA8A - TVqAAAEAAAAEABAA - TVoAAAAAAAAAAAAA - TVpTAQEAAAAEAAAA condition: selection falsepositives: - Unlikely level: high
Query: CVE similar to CVE-2015-9031
Matching passage: CVE-2015-9031. CWE: CWE-200. CVSS: 3.299999952316284. In all Android releases from CAF using the Linux kernel, a TZ memory address is exposed to HLOS by HDCP.
Near-miss passage: CVE-2015-1677. CWE: CWE-200. CVSS: 2.0999999046325684. The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to bypass the ASLR protection mechanism via a crafted function call, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability," a different vulnerability than CVE-2015-1676, CVE-2015-1678, CVE-2015-1679, and CVE-2015-1680.
Query: describe CVE-2015-2325
Matching passage: CVE-2015-2325. CWE: CWE-125. CVSS: 7.800000190734863. The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier.
Near-miss passage: CVE-2015-8629. CWE: CWE-125. CVSS: 5.300000190734863. The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensitive information or cause a denial of service (out-of-bounds read) via a crafted string.
Query: exploit Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related 
Matching passage: CVE-2015-0469. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
Near-miss passage: CVE-2015-1276. CWE: UNKNOWN. CVSS: 9.800000190734863. Use-after-free vulnerability in content/browser/indexed_db/indexed_db_backing_store.cc in the IndexedDB implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging an abort action before a certain write operation.
Query: CVE similar to CVE-2015-6805
Matching passage: CVE-2015-6805. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the MDC Private Message plugin 1.0.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the message field in a private message.
Near-miss passage: CVE-2015-8861. CWE: CWE-79. CVSS: 6.099999904632568. The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted.
Query: CWE for Use of getlogin() in Multithreaded Application
Matching passage: CWE-558 Use of getlogin() in Multithreaded Application. The product uses the getlogin() function in a multithreaded context, potentially causing it to return incorrect values.
Near-miss passage: CWE-1055 Multiple Inheritance from Concrete Classes. The product contains a class with inheritance from more than one concrete class.