alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to
Matching passage: CVE-2015-4846. CWE: UNKNOWN. CVSS: 3.5999999046325684. Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect confidentiality and integrity via vectors related to SQL Extensions. NOTE: the previous information is from the October 2015 CPU. Oracle has not commented on third-party claims that this issue is a SQL injection vulnerability, which allows remote authenticated users to execute arbitrary SQL commands via a request involving the afamexts.sql SQL extension.
Near-miss passage: CVE-2015-4848. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality via unknown vectors related to Integration with Peoplesoft.
Query: Sigma rule for Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set
Matching passage: Sigma rule: Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set. Logsource: windows / msexchange-management. Rule: title: ProxyLogon MSExchange OabVirtualDirectory id: 550d3350-bb8a-4ff3-9533-2ba533f4a1c0 status: test description: Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set-OabVirtualDirectory references: - https://bi-zone.medium.com/hunting-down-ms-exchange-attacks-part-1-proxylogon-cve-2021-26855-26858-27065-26857-6e885c5f197c author: Florian Roth (Nextron Systems) date: 2021-08-09 modified: 2023-01-23 tags: - attack.t1587.001 - attack.resource-development logsource: product: windows service: msexchange-management detection: keywords_cmdlet: '|all': - OabVirtualDirectory - ' -ExternalUrl ' keywords_params: - eval(request - http://f/<script - '"unsafe"};' - function Page_Load() condition: keywords_cmdlet and keywords_params falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can ha. Logsource: azure / auditlogs. Rule: title: Change to Authentication Method id: 4d78a000-ab52-4564-88a5-7ab5242b20c7 status: test description: Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts author: AlertIQ date: 2021-10-10 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.credential-access - attack.defense-impairment - attack.t1556 - attack.persistence - attack.t1098 logsource: product: azure service: auditlogs detection: selection: LoggedByService: Authentication Methods Category: UserManagement OperationName: User registered security info condition: selection falsepositives: - Unknown level: medium
Query: detection rule: Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated
Matching passage: Sigma rule: Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated. Logsource: windows / network_connection. Rule: title: Uncommon Connection to Active Directory Web Services id: b3ad3c0f-c949-47a1-a30e-b0491ccae876 status: test description: 'Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management. ' references: - https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c - https://github.com/FalconForceTeam/FalconFriday/blob/a9219dfcfd89836f34660223f47d766982bdce46/Discovery/ADWS_Connection_from_Unexpected_Binary-Win.md author: '@kostastsale' date: 2024-01-26 tags: - attack.discovery - attack.t1087 logsource: category: network_connection product: windows detection: selection: Initiated: true DestinationPort: 9389 filter_main_dsac: Image: C:\Windows\system32\dsac.exe filter_main_ms_monitoring_agent: Image: C:\Program Files\Microsoft Monitoring Agent\ filter_main_powershell: Image|startswith: - C:\Program Files\PowerShell\7\pwsh.exe - C:\Program Files\PowerShell\7-preview\pwsh.ex - C:\Windows\System32\WindowsPowerShell\ - C:\Windows\SysWOW64\WindowsPowerShell\ condition: selection and not 1 of filter_main_* falsepositives: - ADWS is used by a number of legitimate applications that need to interact with Active Directory. These applications should be added to the allow-listing to avoid false positives. level: medium
Near-miss passage: Sigma rule: Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".. Logsource: windows / process_creation. Rule: title: User Added to Remote Desktop Users Group id: ffa28e60-bdb1-46e0-9f82-05f7a61cc06e related: - id: ad720b90-25ad-43ff-9b5e-5c841facc8e5 type: similar - id: 10fb649c-3600-4d37-b1e6-56ea90bb7e09 type: similar status: test description: Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember". references: - https://www.microsoft.com/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021/ author: Florian Roth (Nextron Systems) date: 2021-12-06 modified: 2022-09-09 tags: - attack.initial-access - attack.persistence - attack.lateral-movement - attack.t1133 - attack.t1136.001 - attack.t1021.001 logsource: category: process_creation product: windows detection: selection_main: - CommandLine|contains|all: - 'localgroup ' - ' /add' - CommandLine|contains|all: - 'Add-LocalGroupMember ' - ' -Group ' selection_group: CommandLine|contains: - Remote Desktop Users - Utilisateurs du Bureau à distance - Usuarios de escritorio remoto condition: all of selection_* falsepositives: - Administrative activity level: high
Query: Sigma rule for Detects execution of "curl.exe" with the "-c" flag in order to save cookie data.
Matching passage: Sigma rule: Detects execution of "curl.exe" with the "-c" flag in order to save cookie data.. Logsource: windows / process_creation. Rule: title: Potential Cookies Session Hijacking id: 5a6e1e16-07de-48d8-8aae-faa766c05e88 status: test description: Detects execution of "curl.exe" with the "-c" flag in order to save cookie data. references: - https://curl.se/docs/manpage.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-07-27 tags: - attack.execution logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \curl.exe - OriginalFileName: curl.exe selection_cli: - CommandLine|re: \s-c\s - CommandLine|contains: --cookie-jar condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_cookie_hijacking/info.yml
Near-miss passage: Sigma rule: Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Via JsSchHlp id: 68654bf0-4412-43d5-bfe8-5eaa393cd939 status: test description: Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor references: - https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/ - http://www.windowexe.com/bbs/board.php?q=jsschhlp-exe-c-program-files-common-files-justsystem-jsschhlp-jsschhlp author: frack113 date: 2022-12-14 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \JSESPR.dll filter: ImageLoaded|startswith: C:\Program Files\Common Files\Justsystem\JsSchHlp\ condition: selection and not filter falsepositives: - Unknown level: medium
Query: vulnerability: The EFI component in Apple OS X before 10.11 allows physically proximate attackers to modify firmware during the EFI update process by inserting an Apple Ethernet Thunderbolt adapt
Matching passage: CVE-2015-5914. CWE: CWE-17. CVSS: 4.699999809265137. The EFI component in Apple OS X before 10.11 allows physically proximate attackers to modify firmware during the EFI update process by inserting an Apple Ethernet Thunderbolt adapter with crafted code in an Option ROM, aka a "Thunderstrike" issue. NOTE: this issue exists because of an incomplete fix for CVE-2014-4498.
Near-miss passage: CVE-2015-6758. CWE: CWE-17. CVSS: 6.800000190734863. The CPDF_Document::GetPage function in fpdfapi/fpdf_parser/fpdf_parser_document.cpp in PDFium, as used in Google Chrome before 46.0.2490.71, does not properly perform a cast of a dictionary object, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.
Query: threat report mentioning Port Monitors
Matching passage: T1547.010 Port Monitors. Tactics: persistence, privilege escalation. Description: Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the <code>AddMonitor</code> API call to set a DLL to be loaded at startup.(Citation: AddMonitor) This DLL can be located in <code>C:\Windows\System32</code> and will be loaded and run by the print spooler service, `spoolsv.exe`, under SYSTEM level permissions on boot.(Citation: Bloxham) Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to the `Driver` value of an existing or new arbitrarily named subkey of <code>HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors</code>. The Registry key contains entries for the following: * Local Port * Standard TCP/IP Port * USB Monitor * WSD Port
Near-miss passage: T1547.006 Kernel Modules and Extensions. Tactics: persistence, privilege escalation. Description: Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system.(Citation: Linux Kernel Programming) When used maliciously, LKMs can be a type of kernel-mode [Rootkit](https://attack.mitre.org/techniques/T1014) that run with the highest operating system privilege (Ring 0).(Citation: Linux Kernel Module Programming Guide) Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors, and enabling root access to non-privileged users.(Citation: iDefense Rootkit Overview) Kernel extensions, also called kext, are used in macOS to load functionality onto a system similar to LKMs for Linux. Since the kernel is responsible for enforcing security and the kernel extensions run as apart of the kernel, kexts are not governed by macOS security policies. Kexts are loaded and unloaded through <code>kextload</code> and <code>kextunload</code> commands. Kexts need to be signed with a developer ID that is granted privileges by Apple allowing it to sign Kernel extensions. Developers without these privileges may still sign kexts but they will not load unless SIP is disabled. If SIP is enabled, the kext signature is verified before being added to the AuxKC.(Citation: System and kernel extensions in macOS) Since macOS Catalina 10.15, kernel extensions have been deprecated in favor of System Extensions. However, kexts are still allowed as "Legacy System Extensions" since there is no System Extension for Kernel Programming Interfaces.(Citation: Apple Kernel Extension Deprecation) Adversaries can use LKMs and kexts to conduct [Persistence](https
Query: CVE similar to CVE-2015-5864
Matching passage: CVE-2015-5864. CWE: CWE-200. CVSS: 2.0999999046325684. IOAudioFamily in Apple OS X before 10.11 allows local users to obtain sensitive kernel memory-layout information via unspecified vectors.
Near-miss passage: CVE-2015-5863. CWE: CWE-200. CVSS: 2.0999999046325684. IOStorageFamily in Apple iOS before 9 does not properly initialize an unspecified data structure, which allows local users to obtain sensitive information from kernel memory via unknown vectors.
Query: explain T1561 Disk Wipe
Matching passage: T1561 Disk Wipe. Tactics: impact. Description: Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources. With direct write access to a disk, adversaries may attempt to overwrite portions of disk data. Adversaries may opt to wipe arbitrary portions of disk data and/or wipe disk structures like the master boot record (MBR). A complete wipe of all disk sectors may be attempted. To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disks may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Novetta Blockbuster Destructive Malware) On network devices, adversaries may wipe configuration files and other data from the device using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `erase`.(Citation: erase_cmd_cisco)
Near-miss passage: T1561.001 Disk Content Wipe. Tactics: impact. Description: Adversaries may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and network resources. Adversaries may partially or completely overwrite the contents of a storage device rendering the data irrecoverable through the storage interface.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)(Citation: DOJ Lazarus Sony 2018) Instead of wiping specific disk structures or files, adversaries with destructive intent may wipe arbitrary portions of disk content. To wipe disk content, adversaries may acquire direct access to the hard drive in order to overwrite arbitrarily sized portions of disk with random data.(Citation: Novetta Blockbuster Destructive Malware) Adversaries have also been observed leveraging third-party drivers like [RawDisk](https://attack.mitre.org/software/S0364) to directly access disk content.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware) This behavior is distinct from [Data Destruction](https://attack.mitre.org/techniques/T1485) because sections of the disk are erased instead of individual files. To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disk content may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Novetta Blockbuster Destructive Malware)
Query: describe CVE-2015-5735
Matching passage: CVE-2015-5735. CWE: CWE-264. CVSS: 7.199999809265137. The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allow local users to write to arbitrary memory locations via a 0x226108 ioctl call.
Near-miss passage: CVE-2015-8222. CWE: CWE-264. CVSS: 4.599999904632568. The lxd-unix.socket systemd unit file in the Ubuntu lxd package before 0.20-0ubuntu4.1 uses world-readable permissions for /var/lib/lxd/unix.socket, which allows local users to gain privileges via unspecified vectors.
Query: vulnerability: The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.
Matching passage: CVE-2015-8239. CWE: CWE-362. CVSS: 7.0. The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.
Near-miss passage: CVE-2015-7553. CWE: CWE-362. CVSS: 4.699999809265137. Race condition in the kernel in Red Hat Enterprise Linux 7, kernel-rt and Red Hat Enterprise MRG 2, when the nfnetlink_log module is loaded, allows local users to cause a denial of service (panic) by creating netlink sockets.
Query: indicators of Scan Databases
Matching passage: T1596.005 Scan Databases. Tactics: reconnaissance. Description: Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners.(Citation: Shodan) Adversaries may search scan databases to gather actionable information. Threat actors can use online resources and lookup tools to harvest information from these services. Adversaries may seek information about their already identified targets, or use these datasets to discover opportunities for successful breaches. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).
Near-miss passage: T1596.003 Digital Certificates. Tactics: reconnaissance. Description: Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content. These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location. Adversaries may search digital certificate data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about certificates.(Citation: SSLShopper Lookup) Digital certificate data may also be available from artifacts signed by the organization (ex: certificates used from encrypted web traffic are served with content).(Citation: Medium SSL Cert) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Query: CVE similar to CVE-2015-1173
Matching passage: CVE-2015-1173. CWE: CWE-284. CVSS: 7.5. Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 does not properly restrict access to the (1) Design Mode and (2) Debug Logger mode modules, which allows remote attackers to gain privileges via crafted "received parameters."
Near-miss passage: CVE-2015-4051. CWE: CWE-284. CVSS: 9.0. Beckhoff IPC Diagnostics before 1.8 does not properly restrict access to functions in /config, which allows remote attackers to cause a denial of service (reboot or shutdown), create arbitrary users, or possibly have unspecified other impact via a crafted request, as demonstrated by a beckhoff.com:service:cxconfig:1#Write SOAP action to /upnpisapi.
Query: CVE similar to CVE-2015-3342
Matching passage: CVE-2015-3342. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the Ubercart Currency Conversion module before 6.x-1.2 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination query parameter.
Near-miss passage: CVE-2015-2659. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 8u45 and Java SE Embedded 8u33 allows remote attackers to affect availability via unknown vectors related to Security.
Query: CWE for Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations
Matching passage: CWE-1235 Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations. The code uses boxed primitives, which may introduce inefficiencies into performance-critical operations.
Near-miss passage: CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input. The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the server[] parameter to services_ntpd.php.
Matching passage: CVE-2015-6511. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the server[] parameter to services_ntpd.php.
Near-miss passage: CVE-2015-1390. CWE: CWE-79. CVSS: 6.099999904632568. Aruba AirWave before 8.0.7 allows XSS attacks agsinat an administrator.