alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-1647
Matching passage: CVE-2015-1647. CWE: CWE-20. CVSS: 2.0999999046325684. Virtual Machine Manager (VMM) in Hyper-V in Microsoft Windows 8.1 and Windows Server 2012 R2 allows guest OS users to cause a denial of service (VMM functionality loss) via a crafted application, aka "Windows Hyper-V DoS Vulnerability."
Near-miss passage: CVE-2015-0620. CWE: CWE-20. CVSS: 4.0. The XML parser in Cisco TelePresence Management Suite (TMS) 14.3(.2) and earlier does not properly handle external entities, which allows remote authenticated users to cause a denial of service via POST requests, aka Bug ID CSCus51494.
Query: patch priority for CVE-2015-1131
Matching passage: CVE-2015-1131. CWE: CWE-20. CVSS: 7.199999809265137. fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1132, CVE-2015-1133, CVE-2015-1134, and CVE-2015-1135.
Near-miss passage: CVE-2015-0228. CWE: CWE-20. CVSS: 5.0. The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function.
Query: detect Detects a ProcessHacker tool that elevated privileges to a very high level in logs
Matching passage: Sigma rule: Detects a ProcessHacker tool that elevated privileges to a very high level. Logsource: windows / system. Rule: title: ProcessHacker Privilege Elevation id: c4ff1eac-84ad-44dd-a6fb-d56a92fc43a9 status: test description: Detects a ProcessHacker tool that elevated privileges to a very high level references: - https://twitter.com/1kwpeter/status/1397816101455765504 author: Florian Roth (Nextron Systems) date: 2021-05-27 modified: 2022-12-25 tags: - attack.persistence - attack.execution - attack.privilege-escalation - attack.t1543.003 - attack.t1569.002 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ServiceName|startswith: ProcessHacker AccountName: LocalSystem condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects tampering with EventLog service "file" key. In order to change the default location of an Evtx file. This techni. Logsource: windows / registry_set. Rule: title: Potential EventLog File Location Tampering id: 0cb8d736-995d-4ce7-a31e-1e8d452a1459 status: test description: Detects tampering with EventLog service "file" key. In order to change the default location of an Evtx file. This technique is used to tamper with log collection and alerting references: - https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key author: D3F7A5105 date: 2023-01-02 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SYSTEM\CurrentControlSet\Services\EventLog\ TargetObject|endswith: \File filter: Details|contains: \System32\Winevt\Logs\ condition: selection and not filter falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-4235
Matching passage: CVE-2015-4235. CWE: CWE-264. CVSS: 9.0. Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.0(3o) and 1.1 before 1.1(1j) and Nexus 9000 ACI devices with software before 11.0(4o) and 11.1 before 11.1(1j) do not properly restrict access to the APIC filesystem, which allows remote authenticated users to obtain root privileges via unspecified use of the APIC cluster-management configuration feature, aka Bug IDs CSCuu72094 and CSCuv11991.
Near-miss passage: CVE-2015-5005. CWE: CWE-264. CVSS: 8.5. CSPOC in IBM PowerHA SystemMirror on AIX 6.1 and 7.1 allows remote authenticated users to perform an "su root" action by leveraging presence on the cluster-wide password-change list.
Query: CVE similar to CVE-2015-3610
Matching passage: CVE-2015-3610. CWE: CWE-310. CVSS: 5.400000095367432. The Siemens HomeControl for Room Automation application before 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information or modify data via a crafted certificate.
Near-miss passage: CVE-2015-0941. CWE: CWE-310. CVSS: 4.300000190734863. The Inetc plugin for Nullsoft Scriptable Install System (NSIS), as used in CERT/CC Failure Observation Engine (FOE) and other products, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and possibly execute arbitrary code by sending a crafted certificate in a download session for Windows executable files.
Query: rule covering Detects the usage of "reg.exe" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusi
Matching passage: Sigma rule: Detects the usage of "reg.exe" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusi. Logsource: windows / process_creation. Rule: title: Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE id: 48917adc-a28e-4f5d-b729-11e75da8941f status: test description: Detects the usage of "reg.exe" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusions for folders within AppData and ProgramData. references: - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ - https://redcanary.com/threat-detection-report/threats/qbot/ author: frack113 date: 2022-02-13 modified: 2023-02-04 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection: Image|endswith: \reg.exe CommandLine|contains: - SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths - SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths CommandLine|contains|all: - 'ADD ' - '/t ' - 'REG_DWORD ' - '/v ' - '/d ' - '0' condition: selection falsepositives: - Legitimate use level: medium
Near-miss passage: Sigma rule: Detects execution of "reg.exe" to disable security services such as Windows Defender.. Logsource: windows / process_creation. Rule: title: Security Service Disabled Via Reg.EXE id: 5e95028c-5229-4214-afae-d653d573d0ec status: test description: Detects execution of "reg.exe" to disable security services such as Windows Defender. references: - https://twitter.com/JohnLaTwC/status/1415295021041979392 - https://github.com/gordonbay/Windows-On-Reins/blob/e587ac7a0407847865926d575e3c46f68cf7c68d/wor.ps1 - https://vms.drweb.fr/virus/?i=24144899 - https://bidouillesecurity.com/disable-windows-defender-in-powershell/ author: Florian Roth (Nextron Systems), John Lambert (idea), elhoim date: 2021-07-14 modified: 2023-06-05 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_reg_add: CommandLine|contains|all: - reg - add selection_cli_reg_start: CommandLine|contains|all: - d 4 - v Start CommandLine|contains: - \AppIDSvc - \MsMpSvc - \NisSrv - \SecurityHealthService - \Sense - \UsoSvc - \WdBoot - \WdFilter - \WdNisDrv - \WdNisSvc - \WinDefend - \wscsvc - \wuauserv condition: all of selection_* falsepositives: - Unlikely level: high
Query: CVE similar to CVE-2015-5814
Matching passage: CVE-2015-5814. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-8317. CWE: CWE-119. CVSS: 5.0. The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive information via an (1) unterminated encoding value or (2) incomplete XML declaration in XML data, which triggers an out-of-bounds heap read.
Query: vulnerability: The Dictionary app in Apple OS X before 10.10.5 does not use HTTPS, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof word d
Matching passage: CVE-2015-3774. CWE: CWE-20. CVSS: 4.800000190734863. The Dictionary app in Apple OS X before 10.10.5 does not use HTTPS, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof word definitions by modifying the client-server data stream.
Near-miss passage: CVE-2015-0717. CWE: CWE-20. CVSS: 6.900000095367432. Cisco Unified Communications Manager 10.0(1.10000.12) allows local users to gain privileges via a command string in an unspecified parameter, aka Bug ID CSCut19546.
Query: CVE similar to CVE-2015-4496
Matching passage: CVE-2015-4496. CWE: CWE-189. CVSS: 9.300000190734863. Multiple integer overflows in libstagefright in Mozilla Firefox before 38.0 allow remote attackers to execute arbitrary code via crafted sample metadata in an MPEG-4 video file, a related issue to CVE-2015-1538.
Near-miss passage: CVE-2015-7674. CWE: CWE-189. CVSS: 6.800000190734863. Integer overflow in the pixops_scale_nearest function in pixops/pixops.c in gdk-pixbuf before 2.32.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted GIF image file, which triggers a heap-based buffer overflow.
Query: threat report mentioning Communication Through Removable Media
Matching passage: T1092 Communication Through Removable Media. Tactics: command and control. Description: Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.(Citation: ESET Sednit USBStealer 2014) Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091). Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.
Near-miss passage: T1132 Data Encoding. Tactics: command and control. Description: Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.(Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.
Query: CVE similar to CVE-2015-5120
Matching passage: CVE-2015-5120. CWE: CWE-119. CVSS: 10.0. Adobe Shockwave Player before 12.1.9.159 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5121.
Near-miss passage: CVE-2015-1930. CWE: CWE-119. CVSS: 7.800000190734863. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects attempts to enumerate file shares, printer shares and sessions using "net.exe" with the "view" flag.. Logsource: windows / process_creation. Rule: title: Share And Session Enumeration Using Net.EXE id: 62510e69-616b-4078-b371-847da438cc03 status: stable description: Detects attempts to enumerate file shares, printer shares and sessions using "net.exe" with the "view" flag. references: - https://eqllib.readthedocs.io/en/latest/analytics/b8a94d2f-dc75-4630-9d73-1edc6bd26fff.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md author: Endgame, JHasenbusch (ported for oscd.community) date: 2018-10-30 modified: 2023-02-21 tags: - attack.discovery - attack.t1018 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: CommandLine|contains: view filter: CommandLine|contains: \\\\ condition: all of selection_* and not filter falsepositives: - Legitimate use of net.exe utility by legitimate user level: low
Near-miss passage: Sigma rule: Detects the execution of wmic with the "qfe" flag in order to obtain information about installed hotfix updates on the s. Logsource: windows / process_creation. Rule: title: Windows Hotfix Updates Reconnaissance Via Wmic.EXE id: dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45 status: test description: Detects the execution of wmic with the "qfe" flag in order to obtain information about installed hotfix updates on the system. This is often used by pentester and attacker enumeration scripts references: - https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat - https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-20 modified: 2023-02-14 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: wmic.exe - Image|endswith: \WMIC.exe selection_cli: CommandLine|contains: ' qfe' condition: all of selection* falsepositives: - Unknown level: medium simulation: - type: atomic-red-team name: WMI Reconnaissance Software technique: T1047 atomic_guid: 718aebaa-d0e0-471a-8241-c5afa69c7414 regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_hotfix/info.yml
Query: exploit The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 attempts to use memset for a memory region of negative length during interaction with the mozil
Matching passage: CVE-2015-0806. CWE: CWE-17. CVSS: 7.5. The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 attempts to use memset for a memory region of negative length during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors that trigger rendering of 2D graphics content.
Near-miss passage: CVE-2015-2270. CWE: CWE-17. CVSS: 4.300000190734863. lib/moodlelib.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4, when the theme uses the blocks-regions feature, establishes the course state at an incorrect point in the login-validation process, which allows remote attackers to obtain sensitive course information via unspecified vectors.
Query: risk of The process_add_entry function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a cra
Matching passage: CVE-2015-8928. CWE: CWE-125. CVSS: 5.5. The process_add_entry function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file.
Near-miss passage: CVE-2015-2697. CWE: CWE-125. CVSS: 4.0. The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\0' character in a long realm field within a TGS request.
Query: common weakness: Insecure Automated Optimizations
Matching passage: CWE-1038 Insecure Automated Optimizations. The product uses a mechanism that automatically optimizes code, e.g. to improve a characteristic such as performance, but the optimizations can have an unintended side effect that might violate an intended security assumption.
Near-miss passage: CWE-512 Spyware. The product collects personally identifiable information about a human user or the user's activities, but the product accesses this information using other resources besides itself, and it does not require that user's explicit approval or direct input into the product.
Query: patch priority for CVE-2015-2291
Matching passage: CVE-2015-2291. CWE: CWE-20. CVSS: 7.800000190734863. (1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call.
Near-miss passage: CVE-2015-3237. CWE: CWE-20. CVSS: 6.400000095367432. The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.
Query: risk of ImageIO in Apple OS X before 10.10.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .sgi file.
Matching passage: CVE-2015-1139. CWE: CWE-20. CVSS: 6.800000190734863. ImageIO in Apple OS X before 10.10.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .sgi file.
Near-miss passage: CVE-2015-2776. CWE: CWE-20. CVSS: 4.300000190734863. The parse_SST function in FreeXL before 1.0.0i allows remote attackers to cause a denial of service (memory consumption) via a crafted shared strings table in a workbook.
Query: exploit The Update Installer in IBM WebSphere Commerce Enterprise 7.0.0.8 and 7.0.0.9 does not properly replicate the search index, which allows attackers to obtain sensitive information v
Matching passage: CVE-2015-7444. CWE: CWE-200. CVSS: 5.300000190734863. The Update Installer in IBM WebSphere Commerce Enterprise 7.0.0.8 and 7.0.0.9 does not properly replicate the search index, which allows attackers to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-2804. CWE: CWE-200. CVSS: 4.300000190734863. The management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400, and 6855 with firmware before 6.6.4.309.R01 and 6.6.5.x before 6.6.5.80.R02 generates weak session identifiers, which allows remote attackers to hijack arbitrary sessions via a brute force attack.
Query: Sigma rule for Detects Silence EmpireDNSAgent as described in the Group-IP report
Matching passage: Sigma rule: Detects Silence EmpireDNSAgent as described in the Group-IP report. Logsource: windows / ps_script. Rule: title: Silence.EDA Detection id: 3ceb2083-a27f-449a-be33-14ec1b7cc973 status: test description: Detects Silence EmpireDNSAgent as described in the Group-IP report references: - https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf author: Alina Stepchenkova, Group-IB, oscd.community date: 2019-11-01 modified: 2023-04-03 tags: - attack.execution - attack.t1059.001 - attack.command-and-control - attack.t1071.004 - attack.t1572 - attack.impact - attack.t1529 - attack.g0091 - attack.s0363 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: empire: ScriptBlockText|contains|all: - System.Diagnostics.Process - Stop-Computer - Restart-Computer - Exception in execution - $cmdargs - Close-Dnscat2Tunnel dnscat: ScriptBlockText|contains|all: - set type=$LookupType`nserver - $Command | nslookup 2>&1 | Out-String - New-RandomDNSField - '[Convert]::ToString($SYNOptions, 16)' - $Session.Dead = $True - $Session["Driver"] -eq condition: empire and dnscat falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects file creation events with filename patterns used by CrackMapExec.. Logsource: windows / file_event. Rule: title: HackTool - CrackMapExec File Indicators id: 736ffa74-5f6f-44ca-94ef-1c0df4f51d2a related: - id: 9433ff9c-5d3f-4269-99f8-95fc826ea489 type: obsolete status: test description: Detects file creation events with filename patterns used by CrackMapExec. references: - https://github.com/byt3bl33d3r/CrackMapExec/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-03-11 modified: 2024-06-27 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: file_event detection: selection_path: TargetFilename|startswith: C:\Windows\Temp\ selection_names_str: TargetFilename|endswith: - \temp.ps1 - \msol.ps1 selection_names_re: - TargetFilename|re: \\[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.txt$ - TargetFilename|re: \\[a-zA-Z]{8}\.tmp$ condition: selection_path and 1 of selection_names_* falsepositives: - Unknown level: high
Query: explain T1132 Data Encoding
Matching passage: T1132 Data Encoding. Tactics: command and control. Description: Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.(Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.
Near-miss passage: T1132.002 Non-Standard Encoding. Tactics: command and control. Description: Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a non-standard data encoding system that diverges from existing protocol specifications. Non-standard data encoding schemes may be based on or related to standard data encoding schemes, such as a modified Base64 encoding for the message body of an HTTP request.(Citation: Wikipedia Binary-to-text Encoding)(Citation: Wikipedia Character Encoding)
Query: CVE similar to CVE-2015-3283
Matching passage: CVE-2015-3283. CWE: CWE-264. CVSS: 6.800000190734863. OpenAFS before 1.6.13 allows remote attackers to spoof bos commands via unspecified vectors.
Near-miss passage: CVE-2015-4596. CWE: CWE-264. CVSS: 7.800000190734863. Lenovo Mouse Suite before 6.73 allows local users to run arbitrary code with administrator privileges.
Query: exploit Quassel before 0.12-rc1 uses an incorrect data-type size when splitting a message, which allows remote attackers to cause a denial of service (crash) via a long CTCP query containi
Matching passage: CVE-2015-2778. CWE: CWE-399. CVSS: 5.0. Quassel before 0.12-rc1 uses an incorrect data-type size when splitting a message, which allows remote attackers to cause a denial of service (crash) via a long CTCP query containing only multibyte characters.
Near-miss passage: CVE-2015-1730. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Query: CVE similar to CVE-2015-1869
Matching passage: CVE-2015-1869. CWE: CWE-59. CVSS: 7.800000190734863. The default event handling scripts in Automatic Bug Reporting Tool (ABRT) allow local users to gain privileges as demonstrated by a symlink attack on a var_log_messages file.
Near-miss passage: CVE-2015-7723. CWE: CWE-59. CVSS: 7.800000190734863. AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack.