alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit CoreAnimation in Apple iOS before 9 allows attackers to bypass intended IOSurface restrictions and obtain screen-framebuffer access via a crafted background app.
Matching passage: CVE-2015-5880. CWE: CWE-200. CVSS: 4.300000190734863. CoreAnimation in Apple iOS before 9 allows attackers to bypass intended IOSurface restrictions and obtain screen-framebuffer access via a crafted background app.
Near-miss passage: CVE-2015-8232. CWE: CWE-200. CVSS: 4.300000190734863. The UC Profile module 6.x-1.x before 6.x-1.3 for Drupal does not properly check access to profiles in certain circumstances, which might allow remote attackers to obtain sensitive information from the anonymous user profile via unspecified vectors.
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in views/add-license-form.php in the Digium Addons module (digiumaddoninstaller) before 2.11.0.7 for FreePBX allow remote attack
Matching passage: CVE-2015-2690. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in views/add-license-form.php in the Digium Addons module (digiumaddoninstaller) before 2.11.0.7 for FreePBX allow remote attackers to inject arbitrary web script or HTML via the (1) add_license_key, (2) add_license_first_name, (3) add_license_last_name, (4) add_license_company, (5) add_license_address1, (6) add_license_address2, (7) add_license_city, (8) add_license_state, (9) add_license_post_code, (10) add_license_country, (11) add_license_phone, or (12) add_license_email parameter in an add-license-form page to admin/config.php.
Near-miss passage: CVE-2015-6753. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in the Quick Edit module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an (1) entity title, related to in-place editing, or a (2) node title.
Query: Sigma rule for Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata
Matching passage: Sigma rule: Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata. Logsource: windows / process_creation. Rule: title: HackTool - UACMe Akagi Execution id: d38d2fa4-98e6-4a24-aff1-410b0c9ad177 status: test description: Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems) date: 2021-08-30 modified: 2024-11-23 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection_pe: - Product: UACMe - Company: - REvol Corp - APT 92 - UG North - Hazardous Environments - CD Project Rekt - Description: - UACMe main module - Pentesting utility - OriginalFileName: - Akagi.exe - Akagi64.exe selection_img: Image|endswith: - \Akagi64.exe - \Akagi.exe selection_hashes_sysmon: Hashes|contains: - IMPHASH=767637C23BB42CD5D7397CF58B0BE688 - IMPHASH=14C4E4C72BA075E9069EE67F39188AD8 - IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC - IMPHASH=7D010C6BB6A3726F327F7E239166D127 - IMPHASH=89159BA4DD04E4CE5559F132A9964EB3 - IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F - IMPHASH=5834ED4291BDEB928270428EBBAF7604 - IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38 - IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894 - IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74 - IMPHASH=3DE09703C8E79ED2CA3F01074719906B condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. Thes. Logsource: windows / process_creation. Rule: title: Msxsl.EXE Execution id: 9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0 status: test description: 'Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. These files are commonly used to describe the processing and rendering of data within XML files. Adversaries can abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/ author: Timur Zinniatullin, oscd.community date: 2019-10-21 modified: 2023-11-09 tags: - attack.stealth - attack.t1220 logsource: category: process_creation product: windows detection: selection: Image|endswith: \msxsl.exe condition: selection falsepositives: - Msxsl is not installed by default and is deprecated, so unlikely on most systems. level: medium
Query: Sigma rule for Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in orde
Matching passage: Sigma rule: Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in orde. Logsource: windows / process_creation. Rule: title: Unmount Share Via Net.EXE id: cb7c4a03-2871-43c0-9bbb-18bbdb079896 status: test description: Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.005/T1070.005.md author: oscd.community, @redcanary, Zach Stanford @svch0st date: 2020-10-08 modified: 2023-02-21 tags: - attack.stealth - attack.t1070.005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: CommandLine|contains|all: - share - /delete condition: all of selection* falsepositives: - Administrators or Power users may remove their shares via cmd line level: low
Near-miss passage: Sigma rule: Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.. Logsource: windows / process_creation. Rule: title: Potential Amazon SSM Agent Hijacking id: d20ee2f4-822c-4827-9e15-41500b1fff10 status: test description: Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report. references: - https://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan - https://www.bleepingcomputer.com/news/security/amazons-aws-ssm-agent-can-be-used-as-post-exploitation-rat-malware/ - https://www.helpnetsecurity.com/2023/08/02/aws-instances-attackers-access/ author: Muhammad Faisal date: 2023-08-02 tags: - attack.command-and-control - attack.persistence - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: Image|endswith: \amazon-ssm-agent.exe CommandLine|contains|all: - '-register ' - '-code ' - '-id ' - '-region ' condition: selection falsepositives: - Legitimate activity of system administrators level: medium
Query: exploit The TripleO Heat templates (tripleo-heat-templates), when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveragi
Matching passage: CVE-2015-5303. CWE: CWE-254. CVSS: 7.5. The TripleO Heat templates (tripleo-heat-templates), when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter.
Near-miss passage: CVE-2015-5759. CWE: CWE-254. CVSS: 5.0. WebKit in Apple iOS before 8.4.1 allows remote attackers to spoof clicks via a crafted web site that leverages tap events.
Query: describe CVE-2015-8020
Matching passage: CVE-2015-8020. CWE: CWE-200. CVSS: 3.700000047683716. Clustered Data ONTAP versions 8.0, 8.3.1, and 8.3.2 contain a default privileged account which under certain conditions can be used for unauthorized information disclosure.
Near-miss passage: CVE-2015-1933. CWE: CWE-200. CVSS: 2.0999999046325684. IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX001, and 7.6.0 before 7.6.0.1 IFIX001; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX001 and 7.6.0 before 7.6.0.1 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products do not have an off autocomplete attribute for the password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
Query: Sigma rule for Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence
Matching passage: Sigma rule: Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence. Logsource: windows / process_creation. Rule: title: Potential Persistence Via Logon Scripts - CommandLine id: 21d856f9-9281-4ded-9377-51a1a6e2a432 related: - id: 0a98a10c-685d-4ab0-bddc-b6bdd1d48458 type: derived status: test description: Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence references: - https://cocomelonc.github.io/persistence/2022/12/09/malware-pers-20.html author: Tom Ueltschi (@c_APT_ure) date: 2019-01-12 modified: 2023-06-09 tags: - attack.privilege-escalation - attack.persistence - attack.t1037.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: UserInitMprLogonScript condition: selection falsepositives: - Legitimate addition of Logon Scripts via the command line by administrators or third party tools level: high
Near-miss passage: Sigma rule: Detects potential persistence activity via the registering of a new custom protocole handlers. While legitimate applicat. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Custom Protocol Handler id: fdbf0b9d-0182-4c43-893b-a1eaab92d085 status: test description: Detects potential persistence activity via the registering of a new custom protocole handlers. While legitimate applications register protocole handlers often times during installation. And attacker can abuse this by setting a custom handler to be used as a persistence mechanism. references: - https://ladydebug.com/blog/2019/06/21/custom-protocol-handler-cph/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-05-30 modified: 2023-05-12 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|startswith: HKCR\ Details|startswith: 'URL:' filter_main_ms_trusted: Details|startswith: URL:ms- filter_main_generic_locations: Image|startswith: - C:\Program Files (x86) - C:\Program Files\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ condition: selection and not 1 of filter_main_* falsepositives: - Many legitimate applications can register a new custom protocol handler. Additional filters needs to applied according to your environment. level: medium
Query: risk of iBooks in Apple iOS before 9.2 and OS X before 10.11.2 allows remote attackers to read arbitrary files via an iBooks file containing an XML external entity declaration in conjuncti
Matching passage: CVE-2015-7081. CWE: UNKNOWN. CVSS: 5.0. iBooks in Apple iOS before 9.2 and OS X before 10.11.2 allows remote attackers to read arbitrary files via an iBooks file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Near-miss passage: CVE-2015-2610. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect integrity via unknown vectors related to Popup windows.
Query: describe CVE-2015-7238
Matching passage: CVE-2015-7238. CWE: CWE-264. CVSS: 2.0999999046325684. The Secondary server in Threat Intelligence Exchange (TIE) before 1.2.0 uses weak permissions for unspecified (1) configuration files and (2) installation logs, which allows local users to obtain sensitive information by reading the files.
Near-miss passage: CVE-2015-5342. CWE: CWE-264. CVSS: 4.300000190734863. The choice module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote authenticated users to bypass intended access restrictions by visiting a URL to add or delete responses in the closed state.
Query: CVE similar to CVE-2015-3738
Matching passage: CVE-2015-3738. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Near-miss passage: CVE-2015-2549. CWE: CWE-119. CVSS: 7.199999809265137. The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Corruption Vulnerability."
Query: vulnerability: Cisco WebEx Meeting Center allows remote attackers to activate disabled meeting attributes, and consequently obtain sensitive information, by providing crafted parameters during a 
Matching passage: CVE-2015-0590. CWE: CWE-200. CVSS: 5.0. Cisco WebEx Meeting Center allows remote attackers to activate disabled meeting attributes, and consequently obtain sensitive information, by providing crafted parameters during a meeting-join action, aka Bug ID CSCuo34165.
Near-miss passage: CVE-2015-1323. CWE: CWE-200. CVSS: 5.5. The simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 as packaged in Ubuntu 15.04, before 1.1.1+bzr980-0ubuntu1.1 as packaged in Ubuntu 14.10, before 1.1.1-1ubuntu5.2 as packaged in Ubuntu 14.04 LTS, before 0.43+bzr805-0ubuntu10 as packaged in Ubuntu 12.04 LTS allows local users to obtain sensitive information, or access files with root permissions.
Query: weakness Unexpected Status Code or Return Value
Matching passage: CWE-394 Unexpected Status Code or Return Value. The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.
Near-miss passage: CWE-126 Buffer Over-read. The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
Query: alert when Detects usage of bitsadmin downloading a file
Matching passage: Sigma rule: Detects usage of bitsadmin downloading a file. Logsource: windows / process_creation. Rule: title: File Download Via Bitsadmin id: d059842b-6b9d-4ed1-b5c3-5b89143c6ede status: test description: Detects usage of bitsadmin downloading a file references: - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin - https://isc.sans.edu/diary/22264 - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ author: Michael Haag, FPT.EagleEye date: 2017-03-09 modified: 2023-02-15 tags: - attack.persistence - attack.execution - attack.stealth - attack.t1197 - attack.s0190 - attack.t1036.003 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \bitsadmin.exe - OriginalFileName: bitsadmin.exe selection_cmd: CommandLine|contains: ' /transfer ' selection_cli_1: CommandLine|contains: - ' /create ' - ' /addfile ' selection_cli_2: CommandLine|contains: http condition: selection_img and (selection_cmd or all of selection_cli_*) falsepositives: - Some legitimate apps use this, but limited. level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download/info.yml simulation: - type: atomic-red-team name: Windows - BITSAdmin BITS Download technique: T1105 atomic_guid: a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b
Near-miss passage: Sigma rule: Detects an installation of a device that is forbidden by the system policy. Logsource: windows / security. Rule: title: Device Installation Blocked id: c9eb55c3-b468-40ab-9089-db2862e42137 status: test description: Detects an installation of a device that is forbidden by the system policy references: - https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6423 author: frack113 date: 2022-10-14 tags: - attack.initial-access - attack.t1200 logsource: service: security product: windows detection: selection: EventID: 6423 condition: selection falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-6687
Matching passage: CVE-2015-6687. CWE: CWE-416. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7615, CVE-2015-7617, and CVE-2015-7621.
Near-miss passage: CVE-2015-7615. CWE: CWE-416. CVSS: 6.800000190734863. Use-after-free vulnerability in a SaveAs feature in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7617, and CVE-2015-7621.
Query: rule covering Identifies when a service account is modified or deleted.
Matching passage: Sigma rule: Identifies when a service account is modified or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes Service Account Modified or Deleted id: 12d027c3-b48c-4d9d-8bb6-a732200034b2 status: test description: Identifies when a service account is modified or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1 author: Austin Songer @austinsonger date: 2021-08-07 modified: 2022-08-23 tags: - attack.impact - attack.t1531 - attack.t1485 - attack.t1496 - attack.t1489 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SERVICEACCOUNTS/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SERVICEACCOUNTS/DELETE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SERVICEACCOUNTS/IMPERSONATE/ACTION condition: selection falsepositives: - Service account being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Service account modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Triggers on any Sysmon "FileBlockShredding" event, which indicates a violation of the configured shredding policy.. Logsource: windows / sysmon. Rule: title: Sysmon Blocked File Shredding id: c3e5c1b1-45e9-4632-b242-27939c170239 status: test description: Triggers on any Sysmon "FileBlockShredding" event, which indicates a violation of the configured shredding policy. references: - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon author: frack113 date: 2023-07-20 tags: - attack.defense-impairment logsource: product: windows service: sysmon detection: selection: EventID: 28 condition: selection falsepositives: - Unlikely level: high
Query: vulnerability: iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS queries. A new (default) feature was added to iTerm2 version 3.0.0 (and unreleased 2.9.x versio
Matching passage: CVE-2015-9231. CWE: CWE-200. CVSS: 7.5. iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS queries. A new (default) feature was added to iTerm2 version 3.0.0 (and unreleased 2.9.x versions such as 2.9.20150717) that resulted in a potential information disclosure. In an attempt to see whether the text under the cursor (or selected text) was a URL, the text would be sent as an unencrypted DNS query. This has the potential to result in passwords and other sensitive information being sent in cleartext without the user being aware.
Near-miss passage: CVE-2015-1977. CWE: CWE-200. CVSS: 7.5. Directory traversal vulnerability in the Web Administration tool in IBM Tivoli Directory Server (ITDS) before 6.1.0.74-ISS-ISDS-IF0074, 6.2.x before 6.2.0.50-ISS-ISDS-IF0050, and 6.3.x before 6.3.0.43-ISS-ISDS-IF0043 and IBM Security Directory Server (ISDS) before 6.3.1.18-ISS-ISDS-IF0018 and 6.4.x before 6.4.0.9-ISS-ISDS-IF0009 allows remote attackers to read arbitrary files via a .. (dot dot) in a URL.
Query: patch priority for CVE-2015-8263
Matching passage: CVE-2015-8263. CWE: UNKNOWN. CVSS: 8.600000381469727. NETGEAR WNR1000v3 devices with firmware 1.0.2.68 use the same source port number for every DNS query, which makes it easier for remote attackers to spoof responses by selecting that number for the destination port.
Near-miss passage: CVE-2015-4798. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to DB Listener, a different vulnerability than CVE-2015-4839.