alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-1530
Matching passage: CVE-2015-1530. CWE: CWE-190. CVSS: 7.800000190734863. media/libmedia/IAudioPolicyService.cpp in Android before 5.1 allows attackers to execute arbitrary code with media_server privileges or cause a denial of service (integer overflow) via a crafted application that provides an invalid array size.
Near-miss passage: CVE-2015-8983. CWE: CWE-190. CVSS: 8.100000381469727. Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to computing a size in bytes, which triggers a heap-based buffer overflow.
Query: risk of Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST API.
Matching passage: CVE-2015-1844. CWE: CWE-264. CVSS: 4.0. Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST API.
Near-miss passage: CVE-2015-8941. CWE: CWE-264. CVSS: 7.800000190734863. drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c in the Qualcomm components in Android before 2016-08-05 on Nexus 6 and 7 (2013) devices does not properly validate array indexes, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28814502 and Qualcomm internal bug CR792473.
Query: detection rule: Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom VBScript
Matching passage: Sigma rule: Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom VBScript. Logsource: windows / registry_set. Rule: title: New BgInfo.EXE Custom VBScript Registry Configuration id: 992dd79f-dde8-4bb0-9085-6350ba97cfb3 related: - id: cd277474-5c52-4423-a52b-ac2d7969902f type: similar status: test description: Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom VBScript via "BgInfo.exe" references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-16 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Software\Winternals\BGInfo\UserFields\ Details|startswith: '4' condition: selection falsepositives: - Legitimate VBScript level: medium
Near-miss passage: Sigma rule: Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location. Logsource: windows / process_creation. Rule: title: Suspicious Invoke-WebRequest Execution id: 5e3cc4d8-3e68-43db-8656-eaaeefdec9cc related: - id: e218595b-bbe7-4ee5-8a96-f32a24ad3468 type: derived status: test description: Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location references: - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-02 modified: 2025-07-18 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - powershell_ise.EXE - PowerShell.EXE - pwsh.dll selection_commands: CommandLine|contains: - 'curl ' - Invoke-WebRequest - 'iwr ' - 'wget ' selection_flags: CommandLine|contains: - ' -ur' - ' -o' selection_susp_locations: CommandLine|contains: - \AppData\ - \Desktop\ - \Temp\ - \Users\Public\ - '%AppData%' - '%Public%' - '%Temp%' - '%tmp%' - :\Windows\ condition: all of selection_* falsepositives: - Unknown level: high
Query: exploit Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, and PowerPoint 2013 RT SP1 allow remote attackers to execute a
Matching passage: CVE-2015-2424. CWE: CWE-787. CVSS: 8.800000190734863. Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, and PowerPoint 2013 RT SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-8546. CWE: CWE-787. CVSS: 9.800000190734863. An issue was discovered on Samsung mobile devices with software through 2015-11-12, affecting the Galaxy S6/S6 Edge, Galaxy S6 Edge+, and Galaxy Note5 with the Shannon333 chipset. There is a stack-based buffer overflow in the baseband process that is exploitable for remote code execution via a fake base station. The Samsung ID is SVE-2015-5123 (December 2015).
Query: secure coding against Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Matching passage: CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion'). The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
Near-miss passage: CWE-1270 Generation of Incorrect Security Tokens. The product implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens generated in the system are incorrect.
Query: describe CVE-2015-0820
Matching passage: CVE-2015-0820. CWE: CWE-284. CVSS: 2.5999999046325684. Mozilla Firefox before 36.0 does not properly restrict transitions of JavaScript objects from a non-extensible state to an extensible state, which allows remote attackers to bypass a Caja Compiler sandbox protection mechanism or a Secure EcmaScript sandbox protection mechanism via a crafted web site.
Near-miss passage: CVE-2015-9243. CWE: CWE-284. CVSS: 5.900000095367432. When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like origin) would have those restrictions overridden by less restrictive defaults (e.g. origin defaults to all origins `*`).
Query: alert when Detects Obfuscated use of Clip.exe to execute PowerShell
Matching passage: Sigma rule: Detects Obfuscated use of Clip.exe to execute PowerShell. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation CLIP+ Launcher - PowerShell id: 73e67340-0d25-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of Clip.exe to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-13 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|re: cmd.{0,5}(?:/c|/r).+clip(?:\.exe)?.{0,4}&&.+clipboard]::\(\s\\"\{\d\}.+-f.+" condition: selection_4104 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the initial execution of "cmd.exe" which spawns "explorer.exe" with the appropriate command line arguments for o. Logsource: windows / process_creation. Rule: title: File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell id: c3d76afc-93df-461e-8e67-9b2bad3f2ac4 status: test description: 'Detects the initial execution of "cmd.exe" which spawns "explorer.exe" with the appropriate command line arguments for opening the "My Computer" folder. ' author: '@Kostastsale' references: - https://ss64.com/nt/shell.html date: 2022-12-22 modified: 2024-08-23 tags: - attack.discovery - attack.t1135 logsource: product: windows category: process_creation detection: selection: ParentImage|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe Image|endswith: \explorer.exe CommandLine|contains: shell:mycomputerfolder condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_explorer_folder_shortcut_via_shell_binary/info.yml
Query: CVE similar to CVE-2015-4464
Matching passage: CVE-2015-4464. CWE: CWE-287. CVSS: 9.800000190734863. Kguard Digital Video Recorder 104, 108, v2 does not have any authorization or authentication between an ActiveX client and the application server.
Near-miss passage: CVE-2015-8332. CWE: CWE-287. CVSS: 8.800000190734863. Huawei Video Content Management (VCM) before V100R001C10SPC001 does not properly "authenticate online user identities and privileges," which allows remote authenticated users to gain privileges and perform a case operation as another user via a crafted message, aka "Horizontal Privilege Escalation Vulnerability."
Query: exploit JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension.
Matching passage: CVE-2015-7341. CWE: CWE-434. CVSS: 8.800000190734863. JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension.
Near-miss passage: CVE-2015-6000. CWE: CWE-434. CVSS: 8.800000190734863. Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.3.0 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in test/logo/.
Query: incident response steps for Outbound C2 pattern associated with Redundant Access
Matching passage: Playbook for T1108 Redundant Access. 1) Validate alert telemetry against T1108. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth, persistence. 5) Eradicate persistence and recover. Reference detection notes: **This technique has been deprecated. Please use [Create Account](https://attack.mitre.org/techniques/T1136), [Web Shell](https://attack.mitre.org/techniques/T1505/003), and [External Remote Services](https://attack.mitre.org/techniques/T1133) where appropriate.** Adversaries may use more than one remote access tool with varying command and control protocols or credentialed access to remote servic
Near-miss passage: Playbook for T1205.001 Port Knocking. Different response path focused on stealth, persistence, command and control.
Query: detect Detects the load of a revoked kernel driver in logs
Matching passage: Sigma rule: Detects the load of a revoked kernel driver. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Revoked Kernel Driver Loaded id: 320fccbf-5e32-4101-82b8-2679c5f007c6 status: test description: Detects the load of a revoked kernel driver references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-06 tags: - attack.privilege-escalation logsource: product: windows service: codeintegrity-operational detection: selection: EventID: - 3021 - 3022 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the use of the filename DumpStack.log to evade Microsoft Defender. Logsource: windows / process_creation. Rule: title: DumpStack.log Defender Evasion id: 4f647cfa-b598-4e12-ad69-c68dd16caef8 status: test description: Detects the use of the filename DumpStack.log to evade Microsoft Defender references: - https://twitter.com/mrd0x/status/1479094189048713219 author: Florian Roth (Nextron Systems) date: 2022-01-06 modified: 2022-06-17 tags: - attack.defense-impairment logsource: category: process_creation product: windows detection: selection: Image|endswith: \DumpStack.log selection_download: CommandLine|contains: ' -o DumpStack.log' condition: 1 of selection* falsepositives: - Unknown level: critical
Query: CWE for Exposure of Sensitive Information to an Unauthorized Actor
Matching passage: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Near-miss passage: CWE-788 Access of Memory Location After End of Buffer. The product reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer.
Query: vulnerability: Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JRockit R28.3.5, allows remote attackers to affect availability via vectors related to JSSE.
Matching passage: CVE-2015-0488. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JRockit R28.3.5, allows remote attackers to affect availability via vectors related to JSSE.
Near-miss passage: CVE-2015-6012. CWE: UNKNOWN. CVSS: 5.800000190734863. Multiple open redirect vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the referrer parameter.
Query: vulnerability: IOAcceleratorFamily in Apple iOS before 9 allows attackers to obtain sensitive kernel memory-layout information via a crafted app.
Matching passage: CVE-2015-5834. CWE: CWE-200. CVSS: 4.300000190734863. IOAcceleratorFamily in Apple iOS before 9 allows attackers to obtain sensitive kernel memory-layout information via a crafted app.
Near-miss passage: CVE-2015-6706. CWE: CWE-200. CVSS: 5.0. Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2015-5583, CVE-2015-6705, and CVE-2015-7624.
Query: patch priority for CVE-2015-6693
Matching passage: CVE-2015-6693. CWE: CWE-119. CVSS: 6.800000190734863. The signatureSetSeedValue method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted arguments, a different vulnerability than CVE-2015-6685, CVE-2015-6686, CVE-2015-6694, CVE-2015-6695, and CVE-2015-7622.
Near-miss passage: CVE-2015-5368. CWE: CWE-119. CVSS: 7.800000190734863. The HP lt4112 LTE/HSPA+ Gobi 4G module with firmware before 12.500.00.15.1803 on EliteBook, ElitePad, Elite, ProBook, Spectre, ZBook, and mt41 Thin Client devices allows remote attackers to modify data or cause a denial of service, or execute arbitrary code, via unspecified vectors.
Query: Sigma rule for Detects the use of the "git" utility to execute a shell. Such behavior may be associated with privilege escalation, unau
Matching passage: Sigma rule: Detects the use of the "git" utility to execute a shell. Such behavior may be associated with privilege escalation, unau. Logsource: linux / process_creation. Rule: title: Shell Execution via Git - Linux id: 47b3bbd4-1bf7-48cc-84ab-995362aaa75a status: test description: 'Detects the use of the "git" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. ' references: - https://gtfobins.github.io/gtfobins/git/#shell author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-09-02 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection: ParentImage|endswith: /git ParentCommandLine|contains|all: - ' -p ' - help CommandLine|contains: - bash 0<&1 - dash 0<&1 - sh 0<&1 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. It was seen used by BlackCat. Logsource: windows / process_creation. Rule: title: DirLister Execution id: b4dc61f5-6cce-468e-a608-b48b469feaa2 status: test description: Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. It was seen used by BlackCat ransomware to create a list of accessible directories and files. references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1083/T1083.md - https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/ author: frack113 date: 2022-08-20 modified: 2023-02-04 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: DirLister.exe - Image|endswith: \DirLister.exe condition: selection falsepositives: - Legitimate use by users level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_dirlister_execution/info.yml simulation: - type: atomic-red-team name: Launch DirLister Executable technique: T1083 atomic_guid: c5bec457-43c9-4a18-9a24-fe151d8971b7
Query: Outbound C2 pattern associated with Terminal Services DLL
Matching passage: T1505.005 Terminal Services DLL. Tactics: persistence. Description: Adversaries may abuse components of Terminal Services to enable persistent access to systems. Microsoft Terminal Services, renamed to Remote Desktop Services in some Windows Server OSs as of 2022, enable remote terminal connections to hosts. Terminal Services allows servers to transmit a full, interactive, graphical user interface to clients via RDP.(Citation: Microsoft Remote Desktop Services) [Windows Service](https://attack.mitre.org/techniques/T1543/003)s that are run as a "generic" process (ex: <code>svchost.exe</code>) load the service's DLL file, the location of which is stored in a Registry entry named <code>ServiceDll</code>.(Citation: Microsoft System Services Fundamentals) The <code>termsrv.dll</code> file, typically stored in `%SystemRoot%\System32\`, is the default <code>ServiceDll</code> value for Terminal Services in `HKLM\System\CurrentControlSet\services\TermService\Parameters\`. Adversaries may modify and/or replace the Terminal Services DLL to enable persistent access to victimized hosts.(Citation: James TermServ DLL) Modifications to this DLL could be done to execute arbitrary payloads (while also potentially preserving normal <code>termsrv.dll</code> functionality) as well as to simply enable abusable features of Terminal Services. For example, an adversary may enable features such as concurrent [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) sessions by either patching the <code>termsrv.dll</code> file or modifying the <code>ServiceDll</code> value to point to a DLL that provides increased RDP functionality.(Citation: Windows OS Hub RDP)(Citation: RDPWrap Github) On a non-server Windows OS this increased functionality may also enable an adversary to avoid Terminal Services prompts that warn/log out users of a system when a new RDP session is created.
Near-miss passage: T1505.003 Web Shell. Tactics: persistence. Description: Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.(Citation: volexity_0day_sophos_FW) In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. [China Chopper](https://attack.mitre.org/software/S0020) Web shell client).(Citation: Lee 2013)
Query: Sigma YAML for okta / okta
Matching passage: Sigma rule: Detects when an Okta user session starts where the user is behind an anonymising proxy service.. Logsource: okta / okta. Rule: title: Okta User Session Start Via An Anonymising Proxy Service id: bde30855-5c53-4c18-ae90-1ff79ebc9578 status: test description: Detects when an Okta user session starts where the user is behind an anonymising proxy service. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection author: kelnage date: 2023-09-07 modified: 2026-04-27 tags: - attack.defense-impairment - attack.t1685 logsource: product: okta service: okta detection: selection: eventType: user.session.start securityContext.isProxy: 'true' condition: selection falsepositives: - If a user requires an anonymising proxy due to valid justifications. level: high
Near-miss passage: Sigma rule: Identifies when ClusterRoles/Roles are being modified or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes Sensitive Role Access id: 818fee0c-e0ec-4e45-824e-83e4817b0887 status: test description: Identifies when ClusterRoles/Roles are being modified or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1 author: Austin Songer @austinsonger date: 2021-08-07 modified: 2022-08-23 tags: - attack.impact - attack.t1485 - attack.t1496 - attack.t1489 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLES/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLES/DELETE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLES/BIND/ACTION - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLES/ESCALATE/ACTION - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLES/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLES/DELETE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLES/BIND/ACTION - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLES/ESCALATE/ACTION condition: selection falsepositives: - ClusterRoles/Roles being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - ClusterRoles/Roles modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium