alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-4743
Matching passage: CVE-2015-4743. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 12.2.3 allows remote authenticated users to affect confidentiality via unknown vectors related to AD Utilities.
Near-miss passage: CVE-2015-4851. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the Oracle iSupplier Portal component in Oracle E-Business Suite 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to XML input. NOTE: the previous information is from the October 2015 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability, which allows remote attackers to read arbitrary files, cause a denial of service, or conduct SMB Relay attacks via a crafted DTD in an XML request to OA_HTML/oramipp_lpr.
Query: describe CVE-2015-3660
Matching passage: CVE-2015-3660. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the PDF functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL in embedded PDF content.
Near-miss passage: CVE-2015-0634. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the administrative interface in Cisco WebEx Meetings Server 2.5 and 2.5.0.997 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuq86310.
Query: describe CVE-2015-2980
Matching passage: CVE-2015-2980. CWE: CWE-78. CVSS: 6.800000190734863. The Yodobashi application 1.2.1.0 and earlier for Android allows remote attackers to execute arbitrary Java methods, and consequently obtain sensitive information or execute OS commands, via a crafted HTML document.
Near-miss passage: CVE-2015-6380. CWE: CWE-78. CVSS: 6.5. An unspecified script in the web interface in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows remote authenticated users to execute arbitrary OS commands via crafted parameters, aka Bug ID CSCux10622.
Query: rule covering Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local pr
Matching passage: Sigma rule: Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local pr. Logsource: windows / process_creation. Rule: title: PUA - Ngrok Execution id: ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31 status: test description: 'Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available. Involved domains are bin.equinox.io for download and *.ngrok.io for connections. ' references: - https://ngrok.com/docs - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html - https://stackoverflow.com/questions/42442320/ssh-tunnel-to-ngrok-and-initiate-rdp - https://www.virustotal.com/gui/file/58d21840d915aaf4040ceb89522396124c82f325282f805d1085527e1e2ccfa1/detection - https://cybleinc.com/2021/02/15/ngrok-platform-abused-by-hackers-to-deliver-a-new-wave-of-phishing-attacks/ - https://twitter.com/xorJosh/status/1598646907802451969 - https://www.softwaretestinghelp.com/how-to-use-ngrok/ author: Florian Roth (Nextron Systems) date: 2021-05-14 modified: 2023-02-21 tags: - attack.command-and-control - attack.t1572 logsource: category: process_creation product: windows detection: selection1: CommandLine|contains: - ' tcp 139' - ' tcp 445' - ' tcp 3389' - ' tcp 5985' - ' tcp 5986' selection2: CommandLine|contains|all: - ' start ' - --all - --config - .yml selection3: Image|endswith: ngrok.exe CommandLine|contains: - ' tcp ' - ' http ' - ' authtoken ' selection4: CommandLine|contains: - '.exe authtoken ' - .exe start --all condition: 1 of selection* falsepositives: - Another tool that uses the command line switches of Ngrok - Ngrok http 3978 (https://learn.microsoft.com/en-us/azure/bot-service/bot-service-debug-channel-ngrok?view=azure-bot-service-4.0) level: high
Near-miss passage: Sigma rule: Detects process dump via legitimate sqldumper.exe binary. Logsource: windows / process_creation. Rule: title: Dumping Process via Sqldumper.exe id: 23ceaf5c-b6f1-4a32-8559-f2ff734be516 status: test description: Detects process dump via legitimate sqldumper.exe binary references: - https://twitter.com/countuponsec/status/910977826853068800 - https://twitter.com/countuponsec/status/910969424215232518 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqldumper/ author: Kirill Kiryanov, oscd.community date: 2020-10-08 modified: 2021-11-27 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: \sqldumper.exe CommandLine|contains: - '0x0110' - 0x01100:40 condition: selection falsepositives: - Legitimate MSSQL Server actions level: medium
Query: incident response steps for Outbound C2 pattern associated with Hijack Execution Flow
Matching passage: Playbook for T1574 Hijack Execution Flow. 1) Validate alert telemetry against T1574. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth, execution. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. There are many ways an advers
Near-miss passage: Playbook for T1574.010 Services File Permissions Weakness. Different response path focused on stealth, execution.
Query: write Sigma for Detects nltest commands that can be used for information discovery
Matching passage: Sigma rule: Detects nltest commands that can be used for information discovery. Logsource: windows / process_creation. Rule: title: Nltest.EXE Execution id: 903076ff-f442-475a-b667-4f246bcc203b related: - id: 5cc90652-4cbd-4241-aa3b-4b462fa5a248 type: similar - id: eeb66bbb-3dde-4582-815a-584aee9fe6d1 type: obsolete status: test description: Detects nltest commands that can be used for information discovery references: - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/nltest.htm author: Arun Chauhan date: 2023-02-03 tags: - attack.discovery - attack.t1016 - attack.t1018 - attack.t1482 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \nltest.exe - OriginalFileName: nltestrk.exe condition: selection falsepositives: - Legitimate administration activity level: low
Near-miss passage: Sigma rule: Identifies potential full network packet capture in gcp. This feature can potentially be abused to read sensitive data f. Logsource: gcp / gcp.audit. Rule: title: Google Full Network Traffic Packet Capture id: 980a7598-1e7f-4962-9372-2d754c930d0e status: test description: Identifies potential full network packet capture in gcp. This feature can potentially be abused to read sensitive data from unencrypted internal traffic. references: - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging - https://developers.google.com/resources/api-libraries/documentation/compute/v1/java/latest/com/google/api/services/compute/Compute.PacketMirrorings.html author: Austin Songer @austinsonger date: 2021-08-13 modified: 2022-10-09 tags: - attack.collection - attack.t1074 logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name: - v*.Compute.PacketMirrorings.Get - v*.Compute.PacketMirrorings.Delete - v*.Compute.PacketMirrorings.Insert - v*.Compute.PacketMirrorings.Patch - v*.Compute.PacketMirrorings.List - v*.Compute.PacketMirrorings.aggregatedList condition: selection falsepositives: - Full Network Packet Capture may be done by a system or network administrator. - If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities. Logsource: windows / process_creation. Rule: title: Potential AMSI Bypass Using NULL Bits id: 92a974db-ab84-457f-9ec0-55db83d7a825 related: - id: fa2559c8-1197-471d-9cdd-05a0273d4522 type: similar status: test description: Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities references: - https://github.com/r00t-3xp10it/hacking-material-books/blob/43cb1e1932c16ff1f58b755bc9ab6b096046853f/obfuscation/simple_obfuscation.md#amsi-bypass-using-null-bits-satoshi author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-04 modified: 2023-05-09 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - if(0){{{0}}}' -f $(0 -as [char]) + - '#<NULL>' condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch. Logsource: windows / process_creation. Rule: title: Suspicious ShellExec_RunDLL Call Via Ordinal id: 8823e85d-31d8-473e-b7f4-92da070f0fc6 related: - id: d87bd452-6da1-456e-8155-7dc988157b7d type: derived status: test description: 'Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch other commands. Adversary might only use the ordinal number in order to bypass existing detection that alert on usage of ShellExec_RunDLL on CommandLine. ' references: - https://redcanary.com/blog/raspberry-robin/ - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - https://github.com/SigmaHQ/sigma/issues/1009 - https://strontic.github.io/xcyclopedia/library/shell32.dll-65DA072F25DE83D9F83653E3FEA3644D.html author: Swachchhanda Shrawan Poudel date: 2024-12-01 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection_parent_img: ParentCommandLine|contains: SHELL32.DLL selection_parent_ordinal: ParentCommandLine|contains: - '#568' - '#570' - '#572' - '#576' selection_susp_cli_parent: - ParentCommandLine|contains: - comspec - iex - Invoke- - msiexec - odbcconf - regsvr32 - ParentCommandLine|contains: - \Desktop\ - \ProgramData\ - \Temp\ - \Users\Public\ selection_susp_child_img: Image|endswith: - \bash.exe - \bitsadmin.exe - \cmd.exe - \cscript.exe - \curl.exe - \mshta.exe - \msiexec.exe - \msxsl.exe - \odbcconf.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \schtasks.exe - \wmic.exe - \wscript.exe condition: all of selection_parent_* and 1 of selection_susp_* falsepositives: - Unknown level: high
Query: exploit The convolution implementation in Skia, as used in Google Chrome before 47.0.2526.73, does not properly constrain row lengths, which allows remote attackers to cause a denial of se
Matching passage: CVE-2015-6773. CWE: CWE-119. CVSS: 7.5. The convolution implementation in Skia, as used in Google Chrome before 47.0.2526.73, does not properly constrain row lengths, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted graphics data.
Near-miss passage: CVE-2015-1897. CWE: CWE-119. CVSS: 7.199999809265137. Stack-based buffer overflow in the FastBackMount process in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.11.1 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1898.
Query: describe CVE-2015-4481
Matching passage: CVE-2015-4481. CWE: CWE-362. CVSS: 3.299999952316284. Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file during an update.
Near-miss passage: CVE-2015-7817. CWE: CWE-362. CVSS: 7.099999904632568. Race condition in the administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows remote attackers to obtain privileged-account access, and consequently provide FileReader.jsp input containing directory traversal sequences to read arbitrary text files, via a request to port 40080 or 40443.
Query: describe CVE-2015-6609
Matching passage: CVE-2015-6609. CWE: CWE-119. CVSS: 10.0. libutils in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22953624.
Near-miss passage: CVE-2015-3744. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter 
Matching passage: CVE-2015-2034. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter to admin.php.
Near-miss passage: CVE-2015-20019. CWE: CWE-79. CVSS: 5.400000095367432. The Content text slider on post WordPress plugin before 6.9 does not sanitise and escape the Title and Message/Content settings, which could lead to Cross-Site Scripting issues
Query: risk of Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API
Matching passage: CVE-2015-5323. CWE: CWE-264. CVSS: 6.5. Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API token of another user.
Near-miss passage: CVE-2015-3767. CWE: CWE-264. CVSS: 7.199999809265137. udf in Apple OS X before 10.10.5 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via a malformed DMG image.
Query: risk of Cisco VPN Client 5.x through 5.0.07.0440 uses weak permissions for vpnclient.ini, which allows local users to gain privileges by entering an arbitrary program name in the Command f
Matching passage: CVE-2015-7600. CWE: CWE-264. CVSS: 7.199999809265137. Cisco VPN Client 5.x through 5.0.07.0440 uses weak permissions for vpnclient.ini, which allows local users to gain privileges by entering an arbitrary program name in the Command field of the ApplicationLauncher section.
Near-miss passage: CVE-2015-4683. CWE: CWE-264. CVSS: 9.800000190734863. Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows attackers to obtain sensitive information and potentially gain privileges by leveraging use of session identifiers as parameters with HTTP GET requests.
Query: CVE similar to CVE-2015-7451
Matching passage: CVE-2015-7451. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5 before 7.5.0.9 IF2 and 7.6 before 7.6.0.3 FP3 and Maximo Asset Management 7.5 before 7.5.0.9 IF2, 7.5.1, and 7.6 before 7.6.0.3 FP3 for SmartCloud Control Desk allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-10013. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in WebDevStudios taxonomy-switcher Plugin up to 1.0.3 on WordPress. It has been classified as problematic. Affected is the function taxonomy_switcher_init of the file taxonomy-switcher.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.4 is able to address this issue. It is recommended to upgrade the affected component. VDB-217446 is the identifier assigned to this vulnerability.
Query: vulnerability: LOYTEC LIP-3ECTB 6.0.1, LINX-100, LVIS-3E100, and LIP-ME201 devices allow remote attackers to read a password-hash backup file via unspecified vectors.
Matching passage: CVE-2015-7906. CWE: CWE-255. CVSS: 10.0. LOYTEC LIP-3ECTB 6.0.1, LINX-100, LVIS-3E100, and LIP-ME201 devices allow remote attackers to read a password-hash backup file via unspecified vectors.
Near-miss passage: CVE-2015-7287. CWE: CWE-255. CVSS: 7.5. CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 use the same 001984 default PIN across different customers' installations, which allows remote attackers to execute commands by leveraging knowledge of this PIN and including it in an SMS message.
Query: exploit Cross-site scripting (XSS) vulnerability in IBM Security QRadar Incident Forensics before 7.2.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Matching passage: CVE-2015-1919. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in IBM Security QRadar Incident Forensics before 7.2.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-2289. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in templates/2k11/admin/entries.tpl in Serendipity before 2.0.1 allows remote authenticated editors to inject arbitrary web script or HTML via the serendipity[cat][name] parameter to serendipity_admin.php, when creating a new category.
Query: CVE similar to CVE-2015-4407
Matching passage: CVE-2015-4407. CWE: CWE-119. CVSS: 6.5. Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service (service interruption) via a crafted HTTP request, aka the PSIA issue.
Near-miss passage: CVE-2015-2441. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 through 11 and Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2452.
Query: telemetry for T1565.001
Matching passage: T1565.001 Stored Data Manipulation. Tactics: impact. Description: Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Near-miss passage: T1565.002 Transmitted Data Manipulation. Tactics: impact. Description: Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Manipulation may be possible over a network connection or between system processes where there is an opportunity deploy a tool that will intercept and change information. The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Query: adversary uses Delete Cloud Instance
Matching passage: T1578.003 Delete Cloud Instance. Tactics: defense impairment. Description: An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence. Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable. An adversary may also [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and later terminate the instance after achieving their objectives.(Citation: Mandiant M-Trends 2020)
Near-miss passage: T1578.002 Create Cloud Instance. Tactics: defense impairment. Description: An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses. Creating a new instance may allow an adversary to bypass firewall rules and permissions that exist on instances currently residing within an account. An adversary may [Create Snapshot](https://attack.mitre.org/techniques/T1578/001) of one or more volumes in an account, create a new instance, mount the snapshots, and then apply a less restrictive security policy to collect [Data from Local System](https://attack.mitre.org/techniques/T1005) or for [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002).(Citation: Mandiant M-Trends 2020) Creating a new instance may also allow an adversary to carry out malicious activity within an environment without affecting the execution of current running instances.
Query: risk of The force printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
Matching passage: CVE-2015-2155. CWE: UNKNOWN. CVSS: 7.5. The force printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-2613. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 7u80 and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JCE.
Query: risk of Multiple SQL injection vulnerabilities in the Web-based Development Workbench in SAP HANA DB 1.00.091.00.1418659308 allow remote authenticated users to execute arbitrary SQL comman
Matching passage: CVE-2015-7725. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in the Web-based Development Workbench in SAP HANA DB 1.00.091.00.1418659308 allow remote authenticated users to execute arbitrary SQL commands via the (1) remoteSourceName in the dropCredentials function or unspecified vectors in the (2) setTraceLevelsForXsApps, (3) _modifyUser, or (4) _newUser function, aka SAP Security Notes 2153898 and 2153765.
Near-miss passage: CVE-2015-7903. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.