alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Open redirect vulnerability in Cisco WebEx Node for Media Convergence Server (MCS) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via
Matching passage: CVE-2015-4297. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in Cisco WebEx Node for Media Convergence Server (MCS) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted HTTP request parameters, aka Bug ID CSCuv32136.
Near-miss passage: CVE-2015-4914. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 10.1.3.5, 11.1.1.7, 11.1.1.9, 12.1.2.0, and 12.1.3.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Web Listener.
Query: weakness Authorization Bypass Through User-Controlled Key
Matching passage: CWE-639 Authorization Bypass Through User-Controlled Key. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Near-miss passage: CWE-207 Observable Behavioral Discrepancy With Equivalent Products. The product operates in an environment in which its existence or specific identity should not be known, but it behaves differently than other products with equivalent functionality, in a way that is observable to an attacker.
Query: Lateral movement indicators for Serverless
Matching passage: T1583.007 Serverless. Tactics: resource development. Description: Adversaries may purchase and configure serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them. Once acquired, the serverless runtime environment can be leveraged to either respond directly to infected machines or to [Proxy](https://attack.mitre.org/techniques/T1090) traffic to an adversary-owned command and control server.(Citation: BlackWater Malware Cloudflare Workers)(Citation: AWS Lambda Redirector)(Citation: GWS Apps Script Abuse 2021) As traffic generated by these functions will appear to come from subdomains of common cloud providers, it may be difficult to distinguish from ordinary traffic to these providers - making it easier to [Hide Infrastructure](https://attack.mitre.org/techniques/T1665).(Citation: Detecting Command & Control in the Cloud)(Citation: BlackWater Malware Cloudflare Workers)
Near-miss passage: T1583.003 Virtual Private Server. Tactics: resource development. Description: Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. By utilizing a VPS, adversaries can make it difficult to physically tie back operations to them. The use of cloud infrastructure can also make it easier for adversaries to rapidly provision, modify, and shut down their infrastructure. Acquiring a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers. Adversaries may also acquire infrastructure from VPS service providers that are known for renting VPSs with minimal registration information, allowing for more anonymous acquisitions of infrastructure.(Citation: TrendmicroHideoutsLease)
Query: patch priority for CVE-2015-5087
Matching passage: CVE-2015-5087. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3095, CVE-2015-5094, CVE-2015-5100, CVE-2015-5102, CVE-2015-5103, CVE-2015-5104, and CVE-2015-5115.
Near-miss passage: CVE-2015-7696. CWE: CWE-119. CVSS: 6.800000190734863. Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly execute arbitrary code via a crafted password-protected ZIP archive, possibly related to an Extra-Field size value.
Query: explain CWE-762
Matching passage: CWE-762 Mismatched Memory Management Routines. The product attempts to return a memory resource to the system, but it calls a release function that is not compatible with the function that was originally used to allocate that resource.
Near-miss passage: CWE-1290 Incorrect Decoding of Security Identifiers. The product implements a decoding mechanism to decode certain bus-transaction signals to security identifiers. If the decoding is implemented incorrectly, then untrusted agents can now gain unauthorized access to the asset.
Query: CWE for Improper Validation of Certificate with Host Mismatch
Matching passage: CWE-297 Improper Validation of Certificate with Host Mismatch. The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.
Near-miss passage: CWE-234 Failure to Handle Missing Parameter. If too few arguments are sent to a function, the function will still pop the expected number of arguments from the stack. Potentially, a variable number of arguments could be exhausted in a function as well.
Query: weakness Improper Isolation or Compartmentalization
Matching passage: CWE-653 Improper Isolation or Compartmentalization. The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.
Near-miss passage: CWE-566 Authorization Bypass Through User-Controlled SQL Primary Key. The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in Quick Look in Apple OS X before 10.10.5 allows remote attackers to inject arbitrary web script or HTML via a previously visited web site
Matching passage: CVE-2015-3781. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Quick Look in Apple OS X before 10.10.5 allows remote attackers to inject arbitrary web script or HTML via a previously visited web site that is rendered during a Quick Look search.
Near-miss passage: CVE-2015-6913. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the "Create download task via URL" feature in Synology Download Station before 3.5-2967 allows remote attackers to inject arbitrary web script or HTML via the urls parameter in an add_url_task action to dlm/downloadman.cgi.
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in the administrative user interface in EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 allow remote authenticate
Matching passage: CVE-2015-0513. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in the administrative user interface in EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging privileged access to set crafted values of unspecified fields.
Near-miss passage: CVE-2015-2944. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the URI, related to (1) org/apache/sling/api/servlets/HtmlResponse and (2) org/apache/sling/servlets/post/HtmlResponse.
Query: vulnerability: IDE Xcode Server in Apple Xcode before 7.0 does not ensure that server traffic is encrypted, which allows remote attackers to obtain sensitive information by sniffing the network.
Matching passage: CVE-2015-5910. CWE: CWE-200. CVSS: 3.299999952316284. IDE Xcode Server in Apple Xcode before 7.0 does not ensure that server traffic is encrypted, which allows remote attackers to obtain sensitive information by sniffing the network.
Near-miss passage: CVE-2015-3269. CWE: CWE-200. CVSS: 5.0. Apache Flex BlazeDS, as used in flex-messaging-core.jar in Adobe LiveCycle Data Services (LCDS) 3.0.x before 3.0.0.354170, 4.5 before 4.5.1.354169, 4.6.2 before 4.6.2.354169, and 4.7 before 4.7.0.354169 and other products, allows remote attackers to read arbitrary files via an AMF message containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Query: common weakness: Incorrect Calculation of Buffer Size
Matching passage: CWE-131 Incorrect Calculation of Buffer Size. The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
Near-miss passage: CWE-1116 Inaccurate Source Code Comments. The source code contains comments that do not accurately describe or explain aspects of the portion of the code with which the comment is associated.
Query: vulnerability: The ASN.1 decoder in Apple OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corru
Matching passage: CVE-2015-7059. CWE: CWE-119. CVSS: 6.800000190734863. The ASN.1 decoder in Apple OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate, a different vulnerability than CVE-2015-7060 and CVE-2015-7061.
Near-miss passage: CVE-2015-3703. CWE: CWE-119. CVSS: 6.800000190734863. ImageIO in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted TIFF image.
Query: hunt for LSASS Driver activity
Matching passage: T1547.008 LSASS Driver. Tactics: persistence, privilege escalation. Description: Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.(Citation: Microsoft Security Subsystem) Adversaries may target LSASS drivers to obtain persistence. By either replacing or adding illegitimate drivers (e.g., [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574)), an adversary can use LSA operations to continuously execute malicious payloads.
Near-miss passage: T1547.002 Authentication Package. Tactics: persistence, privilege escalation. Description: Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system.(Citation: MSDN Authentication Packages) Adversaries can use the autostart mechanism provided by LSA authentication packages for persistence by placing a reference to a binary in the Windows Registry location <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\</code> with the key value of <code>"Authentication Packages"=&lt;target binary&gt;</code>. The binary will then be executed by the system when the authentication packages are loaded.
Query: alert when Detects Obfuscated Powershell via VAR++ LAUNCHER
Matching passage: Sigma rule: Detects Obfuscated Powershell via VAR++ LAUNCHER. Logsource: windows / process_creation. Rule: title: Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION id: e9f55347-2928-4c06-88e5-1a7f8169942e status: test description: Detects Obfuscated Powershell via VAR++ LAUNCHER references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-13 modified: 2022-11-16 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - '&&set' - cmd - /c - -f CommandLine|contains: - '{0}' - '{1}' - '{2}' - '{3}' - '{4}' - '{5}' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: An application has been removed. Check if it is critical.. Logsource: windows / application. Rule: title: Application Uninstalled id: 570ae5ec-33dc-427c-b815-db86228ad43e status: test description: An application has been removed. Check if it is critical. references: - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/Microsoft-Windows-MsiServer.xml - https://learn.microsoft.com/en-us/windows/win32/msi/event-logging author: frack113 date: 2022-01-28 modified: 2022-09-17 tags: - attack.impact - attack.t1489 logsource: product: windows service: application detection: selection: Provider_Name: MsiInstaller EventID: - 1034 - 11724 condition: selection falsepositives: - Unknown level: low
Query: exploit Race condition in the relinquish_memory function in arch/arm/domain.c in Xen 4.6.x and earlier allows local domains with partial management control to cause a denial of service (ho
Matching passage: CVE-2015-7814. CWE: CWE-119. CVSS: 4.699999809265137. Race condition in the relinquish_memory function in arch/arm/domain.c in Xen 4.6.x and earlier allows local domains with partial management control to cause a denial of service (host crash) via vectors involving the destruction of a domain and using XENMEM_decrease_reservation to reduce the memory of the domain.
Near-miss passage: CVE-2015-2281. CWE: CWE-119. CVSS: 7.5. Stack-based buffer overflow in collectoragent.exe in Fortinet Single Sign On (FSSO) before build 164 allows remote attackers to execute arbitrary code via a large PROCESS_HELLO message to the Message Dispatcher on TCP port 8000.
Query: describe CVE-2015-0695
Matching passage: CVE-2015-0695. CWE: CWE-19. CVSS: 7.800000190734863. Cisco IOS XR 4.3.4 through 5.3.0 on ASR 9000 devices, when uRPF, PBR, QoS, or an ACL is configured, does not properly handle bridge-group virtual interface (BVI) traffic, which allows remote attackers to cause a denial of service (chip and card hangs and reloads) by triggering use of a BVI interface for IPv4 packets, aka Bug ID CSCur62957.
Near-miss passage: CVE-2015-0613. CWE: CWE-19. CVSS: 7.099999904632568. The Connection Conversation Manager (aka CuCsMgr) process in Cisco Unity Connection 8.5 before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, 9.x before 9.1(2)SU2, and 10.0 before 10.0(1)SU1, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (core dump and restart) via crafted SIP INVITE messages, aka Bug ID CSCul20444.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in OpenDocMan before 1.3.4 allows remote attackers to inject arbitrary web script or HTML via the redirection parameter.
Matching passage: CVE-2015-5625. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in OpenDocMan before 1.3.4 allows remote attackers to inject arbitrary web script or HTML via the redirection parameter.
Near-miss passage: CVE-2015-5326. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the slave offline status message.
Query: ATT&CK technique for Remote Desktop Software
Matching passage: T1219.002 Remote Desktop Software. Tactics: command and control. Description: An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) Remote access modules/features may also exist as part of otherwise existing software such as Zoom or Google Chrome’s Remote Desktop.(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)
Near-miss passage: T1219.001 IDE Tunneling. Tactics: command and control. Description: Adversaries may abuse Integrated Development Environment (IDE) software with remote development features to establish an interactive command and control channel on target systems within a network. IDE tunneling combines SSH, port forwarding, file sharing, and debugging into a single secure connection, letting developers work on remote systems as if they were local. Unlike SSH and port forwarding, IDE tunneling encapsulates an entire session and may use proprietary tunneling protocols alongside SSH, allowing adversaries to blend in with legitimate development workflows. Some IDEs, like Visual Studio Code, also provide CLI tools (e.g., `code tunnel`) that adversaries may use to programmatically establish tunnels and generate web-accessible URLs for remote access. These tunnels can be authenticated through accounts such as GitHub, enabling the adversary to control the compromised system via a legitimate developer portal.(Citation: sentinelone operationDigitalEye Dec 2024)(Citation: Unit42 Chinese VSCode 06 September 2024)(Citation: Thornton tutorial VSCode shell September 2023) Additionally, adversaries may use IDE tunneling for persistence. Some IDEs, such as Visual Studio Code and JetBrains, support automatic reconnection. Adversaries may configure the IDE to auto-launch at startup, re-establishing the tunnel upon execution. Compromised developer machines may also be exploited as jump hosts to move further into the network. IDE tunneling tools may be built-in or installed as [IDE Extensions](https://attack.mitre.org/techniques/T1176/002).
Query: Sigma YAML for proxy
Matching passage: Sigma rule: Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.. Logsource: proxy. Rule: title: Potential Base64 Encoded User-Agent id: 894a8613-cf12-48b3-8e57-9085f54aa0c3 related: - id: d443095b-a221-4957-a2c4-cd1756c9b747 type: derived status: test description: Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding. references: - https://blogs.jpcert.or.jp/en/2022/07/yamabot.html - https://deviceatlas.com/blog/list-of-user-agent-strings#desktop author: Florian Roth (Nextron Systems), Brian Ingram (update) date: 2022-07-08 modified: 2023-05-04 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent|endswith: '=' condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects SSTI attempts sent via GET requests in access logs. Logsource: webserver. Rule: title: Server Side Template Injection Strings id: ada3bc4f-f0fd-42b9-ba91-e105e8af7342 status: test description: Detects SSTI attempts sent via GET requests in access logs references: - https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection - https://github.com/payloadbox/ssti-payloads author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-14 tags: - attack.stealth - attack.t1221 logsource: category: webserver detection: select_method: cs-method: GET keywords: - ={{ - =%7B%7B - =${ - =$%7B - =<%= - =%3C%25= - =@( - freemarker.template.utility.Execute - .getClass().forName('javax.script.ScriptEngineManager') - T(org.apache.commons.io.IOUtils) filter: sc-status: 404 condition: select_method and keywords and not filter falsepositives: - User searches in search boxes of the respective website - Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as "User Agent" strings and more response codes level: high
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Detects the use of PowerShell to identify the current logged user.. Logsource: windows / ps_script. Rule: title: Suspicious PowerShell Get Current User id: 4096a49c-7de4-4da0-a230-c66ccd56ea5a status: test description: Detects the use of PowerShell to identify the current logged user. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md#atomic-test-4---user-discovery-with-env-vars-powershell-script - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md#atomic-test-5---getcurrent-user-with-powershell-script author: frack113 date: 2022-04-04 tags: - attack.discovery - attack.t1033 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - '[System.Environment]::UserName' - $env:UserName - '[System.Security.Principal.WindowsIdentity]::GetCurrent()' condition: selection falsepositives: - Legitimate PowerShell scripts level: low
Near-miss passage: Sigma rule: Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule. Logsource: windows / process_creation. Rule: title: New Port Forwarding Rule Added Via Netsh.EXE id: 322ed9ec-fcab-4f67-9a34-e7c6aef43614 status: test description: Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule references: - https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html - https://adepts.of0x.cc/netsh-portproxy-code/ - https://www.dfirnotes.net/portproxy_detection/ author: Florian Roth (Nextron Systems), omkar72, oscd.community, Swachchhanda Shrawan Poudel date: 2019-01-29 modified: 2023-09-01 tags: - attack.lateral-movement - attack.command-and-control - attack.t1090 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli_1: CommandLine|contains|all: - interface - portproxy - add - v4tov4 selection_cli_2: CommandLine|contains|all: - 'i ' - 'p ' - 'a ' - 'v ' selection_cli_3: CommandLine|contains|all: - connectp - listena - c= condition: selection_img and 1 of selection_cli_* falsepositives: - Legitimate administration activity - WSL2 network bridge PowerShell script used for WSL/Kubernetes/Docker (e.g. https://github.com/microsoft/WSL/issues/4150#issuecomment-504209723) level: medium
Query: describe CVE-2015-6755
Matching passage: CVE-2015-6755. CWE: CWE-264. CVSS: 7.5. The ContainerNode::parserInsertBefore function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 46.0.2490.71, proceeds with a DOM tree insertion in certain cases where a parent node no longer contains a child node, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.
Near-miss passage: CVE-2015-2263. CWE: CWE-264. CVSS: 3.299999952316284. Cloudera Manager 4.x, 5.0.x before 5.0.6, 5.1.x before 5.1.5, 5.2.x before 5.2.5, and 5.3.x before 5.3.3 uses global read permissions for files in its configuration directory when starting YARN NodeManager, which allows local users to obtain sensitive information by reading the files, as demonstrated by yarn.keytab or ssl-server.xml in /var/run/cloudera-scm-agent/process.