alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for
Matching passage: CVE-2015-0226. CWE: CWE-327. CVSS: 7.5. Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487.
Near-miss passage: CVE-2015-2808. CWE: CWE-327. CVSS: 3.700000047683716. The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.
Query: write Sigma for Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Wind
Matching passage: Sigma rule: Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Wind. Logsource: windows / ps_script. Rule: title: Potential Invoke-Mimikatz PowerShell Script id: 189e3b02-82b2-4b90-9662-411eb64486d4 status: test description: Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords. references: - https://www.elastic.co/guide/en/security/current/potential-invoke-mimikatz-powershell-script.html#potential-invoke-mimikatz-powershell-script author: Tim Rauch, Elastic (idea) date: 2022-09-28 tags: - attack.credential-access - attack.t1003 logsource: category: ps_script product: windows detection: selection_1: ScriptBlockText|contains|all: - DumpCreds - DumpCerts selection_2: ScriptBlockText|contains: sekurlsa::logonpasswords selection_3: ScriptBlockText|contains|all: - crypto::certificates - CERT_SYSTEM_STORE_LOCAL_MACHINE condition: 1 of selection* falsepositives: - Mimikatz can be useful for testing the security of networks level: high
Near-miss passage: Sigma rule: Detects the execution of DeviceCredentialDeployment to hide a process from view.. Logsource: windows / process_creation. Rule: title: DeviceCredentialDeployment Execution id: b8b1b304-a60f-4999-9a6e-c547bde03ffd status: test description: 'Detects the execution of DeviceCredentialDeployment to hide a process from view. ' references: - https://github.com/LOLBAS-Project/LOLBAS/pull/147 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: Image|endswith: \DeviceCredentialDeployment.exe condition: selection falsepositives: - Unlikely level: medium
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Detects Obfuscated use of stdin to execute PowerShell. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation STDIN+ Launcher - Powershell id: 779c8c12-0eb1-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of stdin to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|re: cmd.{0,5}(?:/c|/r).+powershell.+(?:\$?\{?input\}?|noexit).+" condition: selection_4104 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent rem. Logsource: macos / process_creation. Rule: title: Creation Of A Local User Account id: 51719bf5-e4fd-4e44-8ba8-b830e7ac0731 status: test description: Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.001/T1136.001.md - https://ss64.com/osx/sysadminctl.html author: Alejandro Ortuno, oscd.community date: 2020-10-06 modified: 2023-02-18 tags: - attack.t1136.001 - attack.persistence logsource: category: process_creation product: macos detection: selection_dscl: Image|endswith: /dscl CommandLine|contains: create selection_sysadminctl: Image|endswith: /sysadminctl CommandLine|contains: addUser condition: 1 of selection_* falsepositives: - Legitimate administration activities level: low
Query: risk of The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.
Matching passage: CVE-2015-9308. CWE: CWE-352. CVSS: 8.800000190734863. The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.
Near-miss passage: CVE-2015-6966. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Nibbleblog before 4.0.5 allow remote attackers to hijack the authentication of administrators for requests that (1) create a post via a new_simple action to admin.php or (2) conduct cross-site scripting (XSS) attacks via the content parameter in a new_simple action to admin.php.
Query: CVE similar to CVE-2015-6317
Matching passage: CVE-2015-6317. CWE: CWE-284. CVSS: 6.5. Cisco Identity Services Engine (ISE) before 2.0 allows remote authenticated users to bypass intended web-resource access restrictions via a direct request, aka Bug ID CSCuu45926.
Near-miss passage: CVE-2015-0694. CWE: CWE-284. CVSS: 5.0. Cisco ASR 9000 devices with software 5.3.0.BASE do not recognize that certain ACL entries have a single-host constraint, which allows remote attackers to bypass intended network-resource access restrictions by using an address that was not supposed to have been allowed, aka Bug ID CSCur28806.
Query: patch priority for CVE-2015-8940
Matching passage: CVE-2015-8940. CWE: CWE-264. CVSS: 7.800000190734863. Integer overflow in sound/soc/msm/qdsp6v2/q6lsm.c in the Qualcomm components in Android before 2016-08-05 on Nexus 6 devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28813987 and Qualcomm internal bug CR792367.
Near-miss passage: CVE-2015-1458. CWE: CWE-264. CVSS: 6.900000095367432. Fortinet FortiAuthenticator 3.0.0 allows local users to bypass intended restrictions and gain privileges by creating /tmp/privexec/dbgcore_enable_shell_access and executing the "shell" command.
Query: CWE for Missing Reference to Active Allocated Resource
Matching passage: CWE-771 Missing Reference to Active Allocated Resource. The product does not properly maintain a reference to a resource that has been allocated, which prevents the resource from being reclaimed.
Near-miss passage: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'). The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server acce. Logsource: windows / process_creation. Rule: title: Microsoft IIS Connection Strings Decryption id: 97dbf6e2-e436-44d8-abee-4261b24d3e41 status: test description: Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command. references: - https://www.elastic.co/guide/en/security/current/microsoft-iis-connection-strings-decryption.html author: Tim Rauch, Elastic (idea) date: 2022-09-28 modified: 2022-12-30 tags: - attack.credential-access - attack.t1003 logsource: category: process_creation product: windows detection: selection_name: - Image|endswith: \aspnet_regiis.exe - OriginalFileName: aspnet_regiis.exe selection_args: CommandLine|contains|all: - connectionStrings - ' -pdf' condition: all of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects access to ADMIN$ network share. Logsource: windows / security. Rule: title: Access To ADMIN$ Network Share id: 098d7118-55bc-4912-a836-dc6483a8d150 status: test description: Detects access to ADMIN$ network share references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140 author: Florian Roth (Nextron Systems) date: 2017-03-04 modified: 2024-01-16 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: security definition: 'Requirements: The advanced audit policy setting "Object Access > Audit File Share" must be configured for Success/Failure' detection: selection: EventID: 5140 ShareName: Admin$ filter_main_computer_account: SubjectUserName|endswith: $ condition: selection and not 1 of filter_* falsepositives: - Legitimate administrative activity level: low
Query: exploit The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to have unspecified impact via a crafted (1) commit or (2) confirm message, which triggers an out-of-boun
Matching passage: CVE-2015-8763. CWE: CWE-125. CVSS: 8.100000381469727. The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to have unspecified impact via a crafted (1) commit or (2) confirm message, which triggers an out-of-bounds read.
Near-miss passage: CVE-2015-9383. CWE: CWE-125. CVSS: 6.5. FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.
Query: what is T1213.006
Matching passage: T1213.006 Databases. Tactics: collection. Description: Adversaries may leverage databases to mine valuable information. These databases may be hosted on-premises or in the cloud (both in platform-as-a-service and software-as-a-service environments). Examples of databases from which information may be collected include MySQL, PostgreSQL, MongoDB, Amazon Relational Database Service, Azure SQL Database, Google Firebase, and Snowflake. Databases may include a variety of information of interest to adversaries, such as usernames, hashed passwords, personally identifiable information, and financial data. Data collected from databases may be used for [Lateral Movement](https://attack.mitre.org/tactics/TA0008), [Command and Control](https://attack.mitre.org/tactics/TA0011), or [Exfiltration](https://attack.mitre.org/tactics/TA0010). Data exfiltrated from databases may also be used to extort victims or may be sold for profit.(Citation: Google Cloud Threat Intelligence UNC5537 Snowflake 2024)
Near-miss passage: T1213.003 Code Repositories. Tactics: collection. Description: Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git. Once adversaries gain access to a victim network or a private code repository, they may collect sensitive information such as proprietary source code or [Unsecured Credentials](https://attack.mitre.org/techniques/T1552) contained within software's source code. Having access to software's source code may allow adversaries to develop [Exploits](https://attack.mitre.org/techniques/T1587/004), while credentials may provide access to additional resources using [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: Wired Uber Breach)(Citation: Krebs Adobe) **Note:** This is distinct from [Code Repositories](https://attack.mitre.org/techniques/T1593/003), which focuses on conducting [Reconnaissance](https://attack.mitre.org/tactics/TA0043) via public code repositories.
Query: Sigma rule for Detects execution of Remote Utilities RAT (RURAT) from an unusual location (outside of 'C:\Program Files')
Matching passage: Sigma rule: Detects execution of Remote Utilities RAT (RURAT) from an unusual location (outside of 'C:\Program Files'). Logsource: windows / process_creation. Rule: title: Remote Access Tool - RURAT Execution From Unusual Location id: e01fa958-6893-41d4-ae03-182477c5e77d status: test description: Detects execution of Remote Utilities RAT (RURAT) from an unusual location (outside of 'C:\Program Files') references: - https://redcanary.com/blog/misbehaving-rats/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-19 modified: 2023-03-05 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \rutserv.exe - \rfusclient.exe - Product: Remote Utilities filter: Image|startswith: - C:\Program Files\Remote Utilities - C:\Program Files (x86)\Remote Utilities condition: selection and not filter falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location.. Logsource: windows / image_load. Rule: title: Potential RjvPlatform.DLL Sideloading From Non-Default Location id: 0e0bc253-07ed-43f1-816d-e1b220fe8971 status: test description: Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location. references: - https://twitter.com/0gtweet/status/1666716511988330499 author: X__Junior (Nextron Systems) date: 2023-06-09 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \RjvPlatform.dll Image: \SystemResetPlatform.exe filter_main_legit_path: Image|startswith: C:\Windows\System32\SystemResetPlatform\ condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Query: secure coding against Use of Password Hash With Insufficient Computational Effort
Matching passage: CWE-916 Use of Password Hash With Insufficient Computational Effort. The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
Near-miss passage: CWE-1103 Use of Platform-Dependent Third Party Components. The product relies on third-party components that do not provide equivalent functionality across all desirable platforms.
Query: CVE similar to CVE-2015-2513
Matching passage: CVE-2015-2513. CWE: CWE-20. CVSS: 9.300000190734863. Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted .jnt file, aka "Windows Journal RCE Vulnerability," a different vulnerability than CVE-2015-2514 and CVE-2015-2530.
Near-miss passage: CVE-2015-9052. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached while processing a downlink message.
Query: risk of The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-for-instagram-settin
Matching passage: CVE-2015-9432. CWE: CWE-352. CVSS: 6.5. The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-for-instagram-settings tab parameter.
Near-miss passage: CVE-2015-4089. CWE: CWE-352. CVSS: 8.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPress allow remote attackers to hijack the authentication of unspecified victims for requests that call the (1) saveOption, (2) deleteCache, (3) deleteCssAndJsCache, or (4) addCacheTimeout method via the wpFastestCachePage parameter in the WpFastestCacheOptions/ page.
Query: risk of The Microsoft (1) VBScript 5.6 through 5.8 and (2) JScript 5.6 through 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to bypass t
Matching passage: CVE-2015-1686. CWE: CWE-200. CVSS: 4.300000190734863. The Microsoft (1) VBScript 5.6 through 5.8 and (2) JScript 5.6 through 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "VBScript and JScript ASLR Bypass."
Near-miss passage: CVE-2015-7487. CWE: CWE-200. CVSS: 4.099999904632568. IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 IFIX002, and 7.6.0 before 7.6.0.3 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9 IFIX002, 7.5.1, and 7.6.0 before 7.6.0.3 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allow local users to obtain sensitive information by leveraging administrative privileges and reading log files.
Query: risk of The ANTlabs InnGate firmware on IG 3100, IG 3101, InnGate 3.00 E, InnGate 3.01 E, InnGate 3.02 E, InnGate 3.10 E, InnGate 3.01 G, and InnGate 3.10 G devices does not require authen
Matching passage: CVE-2015-0932. CWE: CWE-264. CVSS: 10.0. The ANTlabs InnGate firmware on IG 3100, IG 3101, InnGate 3.00 E, InnGate 3.01 E, InnGate 3.02 E, InnGate 3.10 E, InnGate 3.01 G, and InnGate 3.10 G devices does not require authentication for rsync sessions, which allows remote attackers to read or write to arbitrary files via TCP traffic on port 873.
Near-miss passage: CVE-2015-1702. CWE: CWE-264. CVSS: 6.900000095367432. The Service Control Manager (SCM) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Service Control Manager Elevation of Privilege Vulnerability."
Query: vulnerability: The Remote Desktop Protocol (RDP) server service in Microsoft Windows 7 SP1, Windows 8, and Windows Server 2012 allows remote attackers to execute arbitrary code via a series of cr
Matching passage: CVE-2015-2373. CWE: CWE-19. CVSS: 10.0. The Remote Desktop Protocol (RDP) server service in Microsoft Windows 7 SP1, Windows 8, and Windows Server 2012 allows remote attackers to execute arbitrary code via a series of crafted packets, aka "Remote Desktop Protocol (RDP) Remote Code Execution Vulnerability."
Near-miss passage: CVE-2015-1229. CWE: CWE-19. CVSS: 5.0. net/http/proxy_client_socket.cc in Google Chrome before 41.0.2272.76 does not properly handle a 407 (aka Proxy Authentication Required) HTTP status code accompanied by a Set-Cookie header, which allows remote proxy servers to conduct cookie-injection attacks via a crafted response.
Query: rule covering Uses the .NET InstallUtil.exe application in order to execute image without log
Matching passage: Sigma rule: Uses the .NET InstallUtil.exe application in order to execute image without log. Logsource: windows / process_creation. Rule: title: Suspicious Execution of InstallUtil Without Log id: d042284c-a296-4988-9be5-f424fadcc28c status: test description: Uses the .NET InstallUtil.exe application in order to execute image without log references: - https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/ - https://learn.microsoft.com/en-us/dotnet/framework/tools/installutil-exe-installer-tool author: frack113 date: 2022-01-23 modified: 2022-02-04 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: Image|endswith: \InstallUtil.exe Image|contains: Microsoft.NET\Framework CommandLine|contains|all: - '/logfile= ' - /LogToConsole=false condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Identifies when a application gateway is modified or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Application Gateway Modified or Deleted id: ad87d14e-7599-4633-ba81-aeb60cfe8cd6 status: test description: Identifies when a application gateway is modified or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer date: 2021-08-16 modified: 2022-08-23 tags: - attack.impact logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.NETWORK/APPLICATIONGATEWAYS/WRITE - MICROSOFT.NETWORK/APPLICATIONGATEWAYS/DELETE condition: selection falsepositives: - Application gateway being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Application gateway modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: exploit Cross-site scripting (XSS) vulnerability in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allows remote authenticated us
Matching passage: CVE-2015-2760. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-9279. CWE: CWE-79. CVSS: 6.099999904632568. MailEnable before 8.60 allows Stored XSS via malformed use of "<img/src" with no ">" character in the body of an e-mail message.
Query: patch priority for CVE-2015-6403
Matching passage: CVE-2015-6403. CWE: CWE-20. CVSS: 7.199999809265137. The TFTP implementation on Cisco Small Business SPA30x, SPA50x, SPA51x phones 7.5.7 improperly validates firmware-image file integrity, which allows local users to load a Trojan horse image by leveraging shell access, aka Bug ID CSCut67400.
Near-miss passage: CVE-2015-4020. CWE: CWE-20. CVSS: 4.300000190734863. RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack." NOTE: this vulnerability exists because to an incomplete fix for CVE-2015-3900.
Query: describe CVE-2015-4649
Matching passage: CVE-2015-4649. CWE: CWE-284. CVSS: 7.199999809265137. Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to gain root privileges via unspecified vectors, a different vulnerability than CVE-2015-3654.
Near-miss passage: CVE-2015-5826. CWE: CWE-284. CVSS: 4.300000190734863. WebKit in Apple iOS before 9 does not properly select the cases in which a Cascading Style Sheets (CSS) document is required to have the text/css content type, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.