alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approa
Matching passage: CVE-2015-8877. CWE: CWE-399. CVSS: 7.5. The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function.
Near-miss passage: CVE-2015-1747. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1732, CVE-2015-1742, CVE-2015-1750, and CVE-2015-1753.
Query: Sigma rule for Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed.
Matching passage: Sigma rule: Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed.. Logsource: windows / application. Rule: title: MSSQL XPCmdshell Option Change id: d08dd86f-681e-4a00-a92c-1db218754417 status: test description: 'Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed. ' references: - https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/ - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-12 modified: 2024-06-26 tags: - attack.execution logsource: product: windows service: application detection: selection: Provider_Name|contains: MSSQL EventID: 15457 Data|contains: xp_cmdshell condition: selection falsepositives: - Legitimate enable/disable of the setting - Note that since the event contain the change for both values. This means that this will trigger on both enable and disable level: high
Near-miss passage: Sigma rule: Detect when users are authenticating without MFA being required.. Logsource: azure / signinlogs. Rule: title: Azure AD Only Single Factor Authentication Required id: 28eea407-28d7-4e42-b0be-575d5ba60b2c status: test description: Detect when users are authenticating without MFA being required. references: - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts author: MikeDuddington, '@dudders1' date: 2022-07-27 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.credential-access - attack.stealth - attack.defense-impairment - attack.t1078.004 - attack.t1556.006 logsource: product: azure service: signinlogs detection: selection: Status: Success AuthenticationRequirement: singleFactorAuthentication condition: selection falsepositives: - If this was approved by System Administrator. level: low
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory. Logsource: windows / process_creation. Rule: title: Renamed CreateDump Utility Execution id: 1a1ed54a-2ba4-4221-94d5-01dee560d71e related: - id: 515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48 type: similar status: test description: Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory references: - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/ - https://twitter.com/bopin2020/status/1366400799199272960 author: Florian Roth (Nextron Systems) date: 2022-09-20 modified: 2023-02-14 tags: - attack.stealth - attack.t1036 - attack.t1003.001 - attack.credential-access logsource: category: process_creation product: windows detection: selection_pe: OriginalFileName: FX_VER_INTERNALNAME_STR selection_cli: - CommandLine|contains|all: - ' -u ' - ' -f ' - .dmp - CommandLine|contains|all: - ' --full ' - ' --name ' - .dmp filter: Image|endswith: \createdump.exe condition: 1 of selection_* and not filter falsepositives: - Command lines that use the same flags level: high
Near-miss passage: Sigma rule: Detects process creation events where the Image field lacks an absolute path, which occurs when the backing file no long. Logsource: windows / process_creation. Rule: title: Execution Of Non-Existing File id: 71158e3f-df67-472b-930e-7d287acaa3e1 status: test description: 'Detects process creation events where the Image field lacks an absolute path, which occurs when the backing file no longer exists on disk at the time of logging - commonly caused by Process Ghosting or other unorthodox process creation techniques. ' references: - https://pentestlaboratories.com/2021/12/08/process-ghosting/ - https://www.elastic.co/blog/process-ghosting-a-new-executable-image-tampering-attack author: Max Altgelt (Nextron Systems) date: 2021-12-09 modified: 2026-07-05 tags: - attack.stealth - attack.privilege-escalation - attack.t1055 logsource: category: process_creation product: windows detection: filter_main_image_absolute_path: Image|contains: \ filter_optional_null: Image: null filter_optional_empty: Image: - '-' - '' filter_optional_4688: - Image: - MemCompression - Registry - System - vmmem - vmmemWSL - CommandLine: - MemCompression - Registry - vmmem - vmmemWSL condition: not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Query: describe CVE-2015-2430
Matching passage: CVE-2015-2430. CWE: CWE-264. CVSS: 9.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow attackers to bypass an application sandbox protection mechanism and perform unspecified filesystem actions via a crafted application, aka "Windows Filesystem Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-8025. CWE: CWE-264. CVSS: 2.0999999046325684. driver/subprocs.c in XScreenSaver before 5.34 does not properly perform an internal consistency check, which allows physically proximate attackers to bypass the lock screen by hot swapping monitors.
Query: patch priority for CVE-2015-3012
Matching passage: CVE-2015-3012. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in WebODF before 0.5.5, as used in ownCloud, allow remote attackers to inject arbitrary web script or HTML via a (1) style or (2) font name or (3) javascript or (4) data URI.
Near-miss passage: CVE-2015-1053. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the administrative backend in Croogo before 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to admin/file_manager/file_manager/editfile.
Query: describe CVE-2015-0401
Matching passage: CVE-2015-0401. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle Directory Server Enterprise Edition component in Oracle Fusion Middleware 7.0 and 11.1.1.7 allows remote authenticated users to affect integrity via unknown vectors related to Admin Console.
Near-miss passage: CVE-2015-0361. CWE: UNKNOWN. CVSS: 7.800000190734863. Use-after-free vulnerability in Xen 4.2.x, 4.3.x, and 4.4.x allows remote domains to cause a denial of service (system crash) via a crafted hypercall during HVM guest teardown.
Query: risk of The animations property implementation in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acr
Matching passage: CVE-2015-6704. CWE: CWE-772. CVSS: 4.300000190734863. The animations property implementation in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to obtain sensitive information from process memory via a function call, a different vulnerability than CVE-2015-6697, CVE-2015-6699, CVE-2015-6700, CVE-2015-6701, CVE-2015-6702, and CVE-2015-6703.
Near-miss passage: CVE-2015-6697. CWE: CWE-772. CVSS: 6.800000190734863. Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to obtain sensitive information about color objects from process memory by reading a light object's RGB data, a different vulnerability than CVE-2015-6699, CVE-2015-6700, CVE-2015-6701, CVE-2015-6702, CVE-2015-6703, and CVE-2015-6704.
Query: risk of Absolute path traversal vulnerability in mysqldump_download.php in the WordPress Rename plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname
Matching passage: CVE-2015-4703. CWE: CWE-22. CVSS: 5.300000190734863. Absolute path traversal vulnerability in mysqldump_download.php in the WordPress Rename plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the dumpfname parameter.
Near-miss passage: CVE-2015-9464. CWE: CWE-22. CVSS: 7.5. The s3bubble-amazon-s3-html-5-video-with-adverts plugin 0.7 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path parameter.
Query: threat report mentioning Hide Artifacts
Matching passage: T1564 Hide Artifacts. Tactics: stealth. Description: Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.(Citation: Sofacy Komplex Trojan)(Citation: Cybereason OSX Pirrit)(Citation: MalwareBytes ADS July 2015) Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation, such as through the use of virtualization technology.(Citation: Sophos Ragnar May 2020)
Near-miss passage: T1564.005 Hidden File System. Tactics: stealth. Description: Adversaries may use a hidden file system to conceal malicious activity from users and security tools. File systems provide a structure to store and access data from physical storage. Typically, a user engages with a file system through applications that allow them to access files and directories, which are an abstraction from their physical location (ex: disk sector). Standard file systems include FAT, NTFS, ext4, and APFS. File systems can also contain other structures, such as the Volume Boot Record (VBR) and Master File Table (MFT) in NTFS.(Citation: MalwareTech VFS Nov 2014) Adversaries may use their own abstracted file system, separate from the standard file system present on the infected system. In doing so, adversaries can hide the presence of malicious components and file input/output from security tools. Hidden file systems, sometimes referred to as virtual file systems, can be implemented in numerous ways. One implementation would be to store a file system in reserved disk space unused by disk structures or standard file system partitions.(Citation: MalwareTech VFS Nov 2014)(Citation: FireEye Bootkits) Another implementation could be for an adversary to drop their own portable partition image as a file on top of the standard file system.(Citation: ESET ComRAT May 2020) Adversaries may also fragment files across the existing file system structure in non-standard ways.(Citation: Kaspersky Equation QA)
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute. Logsource: windows / process_creation. Rule: title: Perl Inline Command Execution id: f426547a-e0f7-441a-b63e-854ac5bdf54d status: test description: Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute live perl code. references: - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet - https://www.revshells.com/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-02 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \perl.exe - OriginalFileName: perl.exe selection_cli: CommandLine|contains: ' -e' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects attempts to disable the Windows Firewall using PowerShell. Logsource: windows / process_creation. Rule: title: Windows Firewall Disabled via PowerShell id: 12f6b752-042d-483e-bf9c-915a6d06ad75 related: - id: 488b44e7-3781-4a71-888d-c95abfacf44d type: similar status: test description: Detects attempts to disable the Windows Firewall using PowerShell references: - https://www.elastic.co/guide/en/security/current/windows-firewall-disabled-via-powershell.html author: Tim Rauch, Elastic (idea) date: 2022-09-14 modified: 2023-02-13 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_name: - Image|endswith: - \powershell.exe - \pwsh.exe - \powershell_ise.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_args: CommandLine|contains|all: - 'Set-NetFirewallProfile ' - ' -Enabled ' - ' False' selection_opt: CommandLine|contains: - ' -All ' - Public - Domain - Private condition: all of selection_* falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-1740
Matching passage: CVE-2015-1740. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1735, CVE-2015-1744, CVE-2015-1745, and CVE-2015-1766.
Near-miss passage: CVE-2015-0671. CWE: CWE-399. CVSS: 5.0. The DNS implementation in Cisco Videoscape Distribution Suite for Internet Streaming (VDS-IS) 3.2(1) allows remote attackers to cause a denial of service (CPU consumption and network-resource consumption) via crafted packets, aka Bug ID CSCun15911.
Query: detect Detects when an account makes changes to the ingress or egress rules of a security group. This can indicate that an atta in logs
Matching passage: Sigma rule: Detects when an account makes changes to the ingress or egress rules of a security group. This can indicate that an atta. Logsource: aws / cloudtrail. Rule: title: Ingress/Egress Security Group Modification id: 6fb77778-040f-4015-9440-572aa9b6b580 status: test description: 'Detects when an account makes changes to the ingress or egress rules of a security group. This can indicate that an attacker is attempting to open up new attack vectors in the account, that they are trying to exfiltrate data over the network, or that they are trying to allow machines in that VPC/Subnet to contact a C&C server. ' references: - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/ author: jamesc-grafana date: 2024-07-11 tags: - attack.initial-access - attack.t1190 logsource: product: aws service: cloudtrail detection: selection: eventSource: ec2.amazonaws.com eventName: - AuthorizeSecurityGroupEgress - AuthorizeSecurityGroupIngress - RevokeSecurityGroupEgress - RevokeSecurityGroupIngress condition: selection falsepositives: - New VPCs and Subnets being setup requiring a different security profile to those already defined - A single port being opened for a new service that is known to be deploying - Administrators closing unused ports to reduce the attack surface level: medium
Near-miss passage: Sigma rule: Detects failed logon attempts from clients to MSSQL server.. Logsource: windows / application. Rule: title: MSSQL Server Failed Logon id: 218d2855-2bba-4f61-9c85-81d0ea63ac71 related: - id: ebfe73c2-5bc9-4ed9-aaa8-8b54b2b4777d type: similar status: test description: Detects failed logon attempts from clients to MSSQL server. references: - https://cybersecthreat.com/2020/07/08/enable-mssql-authentication-log-to-eventlog/ - https://www.experts-exchange.com/questions/27800944/EventID-18456-Failed-to-open-the-explicitly-specified-database.html author: Nasreddine Bencherchali (Nextron Systems), j4son date: 2023-10-11 modified: 2024-06-26 tags: - attack.credential-access - attack.t1110 logsource: product: windows service: application definition: 'Requirements: Must enable MSSQL authentication.' detection: selection: Provider_Name|contains: MSSQL EventID: 18456 condition: selection falsepositives: - This event could stem from users changing an account's password that's used to authenticate via a job or an automated process. Investigate the source of such events and mitigate them level: low
Query: describe CVE-2015-2734
Matching passage: CVE-2015-2734. CWE: CWE-17. CVSS: 10.0. The CairoTextureClientD3D9::BorrowDrawTarget function in the Direct3D 9 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors.
Near-miss passage: CVE-2015-0275. CWE: CWE-17. CVSS: 4.900000095367432. The ext4_zero_range function in fs/ext4/extents.c in the Linux kernel before 4.1 allows local users to cause a denial of service (BUG) via a crafted fallocate zero-range request.
Query: patch priority for CVE-2015-8068
Matching passage: CVE-2015-8068. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-5359. CWE: UNKNOWN. CVSS: 7.099999904632568. Juniper Junos OS 12.1X44 before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R9, 12.3X48 before 12.3X48-D10, 13.2 before 13.2R7, 13.3 before 13.3R5, 14.1R3 before 14.1R3-S2, 14.1 before 14.1R4, 14.2 before 14.2R2, and 15.1 before 15.1R1 allows remote attackers to cause a denial of service (NULL pointer dereference and RDP crash) via a large number of BGP-VPLS advertisements with updated BGP local preference values.
Query: describe CVE-2015-0636
Matching passage: CVE-2015-0636. CWE: CWE-20. CVSS: 7.800000190734863. The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS 12.2, 12.4, 15.0, 15.2, 15.3, and 15.4 and IOS XE 3.10.xS through 3.13.xS before 3.13.1S allows remote attackers to cause a denial of service (disrupted domain access) via spoofed AN messages that reset a finite state machine, aka Bug ID CSCup62293.
Near-miss passage: CVE-2015-3411. CWE: CWE-20. CVSS: 6.5. PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument load method, (2) the xmlwriter_open_uri function, (3) the finfo_file function, or (4) the hash_hmac_file function, as demonstrated by a filename\0.xml attack that bypasses an intended configuration in which client users may read only .xml files.
Query: common weakness: Dangling Database Cursor ('Cursor Injection')
Matching passage: CWE-619 Dangling Database Cursor ('Cursor Injection'). If a database cursor is not closed properly, then it could become accessible to other users while retaining the same privileges that were originally assigned, leaving the cursor dangling.
Near-miss passage: CWE-570 Expression is Always False. The product contains an expression that will always evaluate to false.
Query: risk of ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE and ZXV10 W300 devices W300V1.0.0f_ER1_PE allow remote authenticated users to bypass intended access restrictions, and d
Matching passage: CVE-2015-8703. CWE: CWE-200. CVSS: 6.5. ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE and ZXV10 W300 devices W300V1.0.0f_ER1_PE allow remote authenticated users to bypass intended access restrictions, and discover credentials and keys, by reading the configuration file, a different vulnerability than CVE-2015-7248.
Near-miss passage: CVE-2015-2997. CWE: CWE-200. CVSS: 5.0. SysAid Help Desk before 15.2 allows remote attackers to obtain sensitive information via an invalid value in the accountid parameter to getAgentLogFile, as demonstrated by a large directory traversal sequence, which reveals the installation path in an error message.
Query: exploit Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different v
Matching passage: CVE-2015-7795. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7796, CVE-2015-7797, CVE-2015-7798, CVE-2016-1149, and CVE-2016-1150.
Near-miss passage: CVE-2015-1617. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Query: describe CVE-2015-8257
Matching passage: CVE-2015-8257. CWE: CWE-77. CVSS: 8.800000190734863. The devtools.sh script in AXIS network cameras allows remote authenticated users to execute arbitrary commands via shell metacharacters in the app parameter to (1) app_license.shtml, (2) app_license_custom.shtml, (3) app_index.shtml, or (4) app_params.shtml.
Near-miss passage: CVE-2015-20108. CWE: CWE-77. CVSS: 9.800000190734863. xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.