alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not 
Matching passage: CVE-2015-3752. CWE: CWE-200. CVSS: 5.0. The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly restrict cookie transmission for report requests, which allows remote attackers to obtain sensitive information via vectors involving (1) a cross-origin request or (2) a private-browsing request.
Near-miss passage: CVE-2015-6157. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."
Query: describe CVE-2015-1708
Matching passage: CVE-2015-1708. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-2491. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2485 and CVE-2015-2541.
Query: containment actions for Persistence mechanism resembling System Time Discovery
Matching passage: Playbook for T1124 System Time Discovery. 1) Validate alert telemetry against T1124. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: discovery. 5) Eradicate persistence and recover. Reference detection notes: An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or <code>systemsetup</code> on macOS.(Citation: MSDN System Time)(Citation: Technet Windows Time Service)(Citation: systemsetup mac time) These time settings may also be synchronized between systems and services
Near-miss passage: Playbook for T1087.002 Domain Account. Different response path focused on discovery.
Query: CVE similar to CVE-2015-4201
Matching passage: CVE-2015-4201. CWE: CWE-20. CVSS: 5.0. The Gateway General Packet Radio Service Support Node (GGSN) component on Cisco ASR 5000 devices with software 17.2.0.59184 and 18.0.L0.59219 allows remote attackers to cause a denial of service (Session Manager restart) via an invalid TCP/IP header, aka Bug ID CSCut68058.
Near-miss passage: CVE-2015-5568. CWE: CWE-20. CVSS: 10.0. Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to cause a denial of service (vector-length corruption) or possibly have unspecified other impact via unknown vectors.
Query: reconnaissance using Purchase Technical Data
Matching passage: T1597.002 Purchase Technical Data. Tactics: reconnaissance. Description: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure.(Citation: ZDNET Selling Data) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
Near-miss passage: T1597.001 Threat Intel Vendors. Tactics: reconnaissance. Description: Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures.(Citation: D3Secutrity CTI Feeds) Adversaries may search in private threat intelligence vendor data to gather actionable information. If a threat actor is searching for information on their own activities, that falls under [Search Threat Vendor Data](https://attack.mitre.org/techniques/T1681). Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Query: telemetry for T1495
Matching passage: T1495 Firmware Corruption. Tactics: impact. Description: Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying the availability to use the devices and/or the system.(Citation: Symantec Chernobyl W95.CIH) Firmware is software that is loaded and executed from non-volatile memory on hardware devices in order to initialize and manage device functionality. These devices may include the motherboard, hard drive, or video cards. In general, adversaries may manipulate, overwrite, or corrupt firmware in order to deny the use of the system or devices. For example, corruption of firmware responsible for loading the operating system for network devices may render the network devices inoperable.(Citation: dhs_threat_to_net_devices)(Citation: cisa_malware_orgs_ukraine) Depending on the device, this attack may also result in [Data Destruction](https://attack.mitre.org/techniques/T1485).
Near-miss passage: T1561 Disk Wipe. Tactics: impact. Description: Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources. With direct write access to a disk, adversaries may attempt to overwrite portions of disk data. Adversaries may opt to wipe arbitrary portions of disk data and/or wipe disk structures like the master boot record (MBR). A complete wipe of all disk sectors may be attempted. To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disks may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Novetta Blockbuster Destructive Malware) On network devices, adversaries may wipe configuration files and other data from the device using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `erase`.(Citation: erase_cmd_cisco)
Query: vulnerability: Multiple integer overflows in the addVorbisCodecInfo function in matroska/MatroskaExtractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allow remote attacke
Matching passage: CVE-2015-3861. CWE: CWE-189. CVSS: 5.0. Multiple integer overflows in the addVorbisCodecInfo function in matroska/MatroskaExtractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allow remote attackers to cause a denial of service (device inoperability) via crafted Matroska data, aka internal bug 21296336.
Near-miss passage: CVE-2015-2191. CWE: CWE-189. CVSS: 5.0. Integer overflow in the dissect_tnef function in epan/dissectors/packet-tnef.c in the TNEF dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted length field in a packet.
Query: detect Detects installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by in logs
Matching passage: Sigma rule: Detects installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by. Logsource: windows / process_creation. Rule: title: Potential Shim Database Persistence via Sdbinst.EXE id: 517490a7-115a-48c6-8862-1a481504d5a8 related: - id: 18ee686c-38a3-4f65-9f44-48a077141f42 type: similar status: test description: 'Detects installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims ' references: - https://www.mandiant.com/resources/blog/fin7-shim-databases-persistence author: Markus Neis date: 2019-01-16 modified: 2023-12-06 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.011 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \sdbinst.exe - OriginalFileName: sdbinst.exe selection_cli: CommandLine|contains: .sdb filter_optional_iis: ParentImage|endswith: \msiexec.exe CommandLine|contains: - :\Program Files (x86)\IIS Express\iisexpressshim.sdb - :\Program Files\IIS Express\iisexpressshim.sdb condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the modification of the registry to disable a system restore on the computer. Logsource: windows / registry_set. Rule: title: Registry Disable System Restore id: 5de03871-5d46-4539-a82d-3aa992a69a83 related: - id: 7c06ab9b-b1d2-4ba9-b06e-09491ded20d9 type: similar status: test description: Detects the modification of the registry to disable a system restore on the computer references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-9---disable-system-restore-through-registry author: frack113 date: 2022-04-04 modified: 2023-08-17 tags: - attack.impact - attack.t1490 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Policies\Microsoft\Windows NT\SystemRestore - \Microsoft\Windows NT\CurrentVersion\SystemRestore TargetObject|endswith: - DisableConfig - DisableSR Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_disable_system_restore/info.yml simulation: - type: atomic-red-team name: Disable System Restore Through Registry technique: T1490 atomic_guid: 66e647d1-8741-4e43-b7c1-334760c2047f
Query: describe CVE-2015-4073
Matching passage: CVE-2015-4073. CWE: CWE-89. CVSS: 9.800000190734863. Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) ticket_code or (2) email parameter or (3) remote authenticated users to execute arbitrary SQL commands via the filter_order parameter.
Near-miss passage: CVE-2015-7567. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary SQL commands via the "passwordreset&token" parameter.
Query: risk of SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery (contus-video-gallery) plugin before 2.8 for WordPress allows remote attackers to execute a
Matching passage: CVE-2015-2065. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery (contus-video-gallery) plugin before 2.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the vid parameter in a rss action to wp-admin/admin-ajax.php.
Near-miss passage: CVE-2015-2849. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in main.ant in the ANTlabs InnGate firmware on IG 3100, InnGate 3.01 E, InnGate 3.10 E, InnGate 3.10 M, SG 4, and SSG 4 devices, when https is used, allows remote attackers to execute arbitrary SQL commands via the ppli parameter.
Query: alert when Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the c
Matching passage: Sigma rule: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the c. Logsource: windows / system. Rule: title: Invoke-Obfuscation Obfuscated IEX Invocation - System id: 51aa9387-1c53-4153-91cc-d73c59ae1ca9 status: test description: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references references: - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888 author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community date: 2019-11-08 modified: 2022-11-27 tags: - attack.stealth - attack.t1027 logsource: product: windows service: system detection: selection_eid: EventID: 7045 selection_imagepath: - ImagePath|re: \$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\[ - ImagePath|re: \$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\[ - ImagePath|re: \$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\[ - ImagePath|re: \$env:ComSpec\[(\s*\d{1,3}\s*,){2} - ImagePath|re: \\*mdr\*\W\s*\)\.Name - ImagePath|re: \$VerbosePreference\.ToString\( - ImagePath|re: \String\]\s*\$VerbosePreference condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential tampering with Windows Defender settings such as adding exclusion using wmic. Logsource: windows / process_creation. Rule: title: Potential Windows Defender Tampering Via Wmic.EXE id: 51cbac1e-eee3-4a90-b1b7-358efb81fa0a status: test description: Detects potential tampering with Windows Defender settings such as adding exclusion using wmic references: - https://github.com/redcanaryco/atomic-red-team/blob/5c1e6f1b4fafd01c8d1ece85f510160fc1275fbf/atomics/T1562.001/T1562.001.md - https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/ - https://www.bleepingcomputer.com/news/security/iobit-forums-hacked-to-spread-ransomware-to-its-members/ author: frack113 date: 2022-12-11 modified: 2023-02-14 tags: - attack.execution - attack.defense-impairment - attack.t1047 - attack.t1685 logsource: product: windows category: process_creation detection: selection_img: - OriginalFileName: wmic.exe - Image|endswith: \WMIC.exe selection_cli: CommandLine|contains: /Namespace:\\\\root\\Microsoft\\Windows\\Defender condition: all of selection_* falsepositives: - Unknown level: high simulation: - type: atomic-red-team name: WMIC Tamper with Windows Defender Evade Scanning Folder technique: T1562.001 atomic_guid: 59d386fc-3a4b-41b8-850d-9e3eee24dfe4 regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_namespace_defender/info.yml
Query: CVE similar to CVE-2015-7395
Matching passage: CVE-2015-7395. CWE: CWE-284. CVSS: 4.0. IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX005, and 7.6.0 before 7.6.0.2 FP002; Maximo Asset Management 7.5.0 before 7.5.0.8 IFIX005, 7.5.1, and 7.6.0 before 7.6.0.2 FP002 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allow remote authenticated users to bypass intended work-order change restrictions via unspecified vectors.
Near-miss passage: CVE-2015-7265. CWE: CWE-284. CVSS: 7.5. Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypass ACL checks.
Query: Sigma rule for Detects SSTI attempts sent via GET requests in access logs
Matching passage: Sigma rule: Detects SSTI attempts sent via GET requests in access logs. Logsource: webserver. Rule: title: Server Side Template Injection Strings id: ada3bc4f-f0fd-42b9-ba91-e105e8af7342 status: test description: Detects SSTI attempts sent via GET requests in access logs references: - https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection - https://github.com/payloadbox/ssti-payloads author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-14 tags: - attack.stealth - attack.t1221 logsource: category: webserver detection: select_method: cs-method: GET keywords: - ={{ - =%7B%7B - =${ - =$%7B - =<%= - =%3C%25= - =@( - freemarker.template.utility.Execute - .getClass().forName('javax.script.ScriptEngineManager') - T(org.apache.commons.io.IOUtils) filter: sc-status: 404 condition: select_method and keywords and not filter falsepositives: - User searches in search boxes of the respective website - Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as "User Agent" strings and more response codes level: high
Near-miss passage: Sigma rule: Detects disabling of the Windows Defender virus scanning feature. Logsource: windows / windefend. Rule: title: Windows Defender Virus Scanning Feature Disabled id: 686c0b4b-9dd3-4847-9077-d6c1bbe36fcb related: - id: fe34868f-6e0e-4882-81f6-c43aa8f15b62 type: obsolete status: stable description: Detects disabling of the Windows Defender virus scanning feature references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5012 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/ author: Ján Trenčanský, frack113 date: 2020-07-28 modified: 2023-11-22 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: 5012 condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-4886
Matching passage: CVE-2015-4886. CWE: UNKNOWN. CVSS: 6.400000095367432. Unspecified vulnerability in the Oracle Report Manager component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Reports Security. NOTE: the previous information is from the October 2015 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability, which allows remote attackers to read arbitrary files, cause a denial of service, or conduct SMB Relay attacks via a crafted DTD in an XML request involving the OA_HTML/copxml servlet.
Near-miss passage: CVE-2015-0497. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the PeopleSoft Enterprise Portal Interaction Hub component in Oracle PeopleSoft Products 9.1.00 allows remote attackers to affect integrity via unknown vectors related to Enterprise Portal.
Query: patch priority for CVE-2015-6581
Matching passage: CVE-2015-6581. CWE: UNKNOWN. CVSS: 7.5. Double free vulnerability in the opj_j2k_copy_default_tcp_and_create_tcd function in j2k.c in OpenJPEG before r3002, as used in PDFium in Google Chrome before 45.0.2454.85, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by triggering a memory-allocation failure.
Near-miss passage: CVE-2015-4755. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 12.1.0.2 allows remote attackers to affect confidentiality via unknown vectors.
Query: how to detect Bind Mounts
Matching passage: T1564.013 Bind Mounts. Tactics: stealth. Description: Adversaries may abuse bind mounts on file structures to hide their activity and artifacts from native utilities. A bind mount maps a directory or file from one location on the filesystem to another, similar to a shortcut on Windows. It’s commonly used to provide access to specific files or directories across different environments, such as inside containers or chroot environments, and requires sudo access. Adversaries may use bind mounts to map either an empty directory or a benign `/proc` directory to a malicious process’s `/proc` directory. Using the commands `mount –o bind /proc/benign-process /proc/malicious-process` (or `mount –B`), the malicious process's `/proc` directory is overlayed with the contents of a benign process's `/proc` directory. When system utilities query process activity, such as `ps` and `top`, the kernel follows the bind mount and presents the benign directory’s contents instead of the malicious process's actual `/proc` directory. As a result, these utilities display information that appears to come from the benign process, effectively hiding the malicious process's metadata, executable, or other artifacts from detection.(Citation: Cado Security Commando Cat 2024)(Citation: Ahn Lab CoinMiner 2023)
Near-miss passage: T1564.005 Hidden File System. Tactics: stealth. Description: Adversaries may use a hidden file system to conceal malicious activity from users and security tools. File systems provide a structure to store and access data from physical storage. Typically, a user engages with a file system through applications that allow them to access files and directories, which are an abstraction from their physical location (ex: disk sector). Standard file systems include FAT, NTFS, ext4, and APFS. File systems can also contain other structures, such as the Volume Boot Record (VBR) and Master File Table (MFT) in NTFS.(Citation: MalwareTech VFS Nov 2014) Adversaries may use their own abstracted file system, separate from the standard file system present on the infected system. In doing so, adversaries can hide the presence of malicious components and file input/output from security tools. Hidden file systems, sometimes referred to as virtual file systems, can be implemented in numerous ways. One implementation would be to store a file system in reserved disk space unused by disk structures or standard file system partitions.(Citation: MalwareTech VFS Nov 2014)(Citation: FireEye Bootkits) Another implementation could be for an adversary to drop their own portable partition image as a file on top of the standard file system.(Citation: ESET ComRAT May 2020) Adversaries may also fragment files across the existing file system structure in non-standard ways.(Citation: Kaspersky Equation QA)