alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-0224
Matching passage: CVE-2015-0224. CWE: CWE-19. CVSS: 7.5. qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service (daemon crash) via a crafted protocol sequence set. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0203.
Near-miss passage: CVE-2015-0615. CWE: CWE-19. CVSS: 7.099999904632568. The call-handling implementation in Cisco Unity Connection 8.5 before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, 9.x before 9.1(2)SU2, and 10.0 before 10.0(1)SU1, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (port consumption) by improperly terminating SIP sessions, aka Bug ID CSCul28089.
Query: common weakness: Public Data Assigned to Private Array-Typed Field
Matching passage: CWE-496 Public Data Assigned to Private Array-Typed Field. Assigning public data to a private array is equivalent to giving public access to the array.
Near-miss passage: CWE-441 Unintended Proxy or Intermediary ('Confused Deputy'). The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
Query: rule covering Detects remote RPC calls to read information about scheduled tasks
Matching passage: Sigma rule: Detects remote RPC calls to read information about scheduled tasks. Logsource: rpc_firewall / application. Rule: title: Remote Schedule Task Recon via ITaskSchedulerService id: 7f7c49eb-2977-4ac8-8ab0-ab1bae14730e status: test description: Detects remote RPC calls to read information about scheduled tasks references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.discovery logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:86d35949-83c9-4044-b424-db363231fd0c"' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 86d35949-83c9-4044-b424-db363231fd0c filter: OpNum: - 1 - 3 - 4 - 10 - 11 - 12 - 13 - 14 - 15 condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential DLL injection and execution using "Tracker.exe". Logsource: windows / process_creation. Rule: title: Potential DLL Injection Or Execution Using Tracker.exe id: 148431ce-4b70-403d-8525-fcc2993f29ea status: test description: Detects potential DLL injection and execution using "Tracker.exe" references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Tracker/ author: Avneet Singh @v3t0_, oscd.community date: 2020-10-18 modified: 2023-01-09 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \tracker.exe - Description: Tracker selection_cli: CommandLine|contains: - ' /d ' - ' /c ' filter_msbuild1: CommandLine|contains: ' /ERRORREPORT:PROMPT ' filter_msbuild2: ParentImage|endswith: - \Msbuild\Current\Bin\MSBuild.exe - \Msbuild\Current\Bin\amd64\MSBuild.exe condition: all of selection_* and not 1 of filter_* falsepositives: - Unknown level: medium
Query: Outbound C2 pattern associated with Compromise Hardware Supply Chain
Matching passage: T1195.003 Compromise Hardware Supply Chain. Tactics: initial access. Description: Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system. Hardware backdoors may be inserted into various devices, such as servers, workstations, network infrastructure, or peripherals.
Near-miss passage: T1195.002 Compromise Software Supply Chain. Tactics: initial access. Description: Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version. Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.(Citation: Avast CCleaner3 2018)(Citation: Command Five SK 2011)
Query: patch priority for CVE-2015-4185
Matching passage: CVE-2015-4185. CWE: CWE-264. CVSS: 6.900000095367432. The TCL interpreter in Cisco IOS 15.2 does not properly maintain the vty state, which allows local users to gain privileges by starting a session very soon after a TCL script execution, aka Bug ID CSCuq24202.
Near-miss passage: CVE-2015-1155. CWE: CWE-264. CVSS: 4.300000190734863. The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to bypass the Same Origin Policy and read arbitrary files via a crafted web site.
Query: vulnerability: Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection.
Matching passage: CVE-2015-9244. CWE: CWE-89. CVSS: 9.800000190734863. Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection.
Near-miss passage: CVE-2015-4633. CWE: CWE-89. CVSS: 9.800000190734863. Multiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow (1) remote attackers to execute arbitrary SQL commands via the number parameter to opac-tags_subject.pl in the OPAC interface or (2) remote authenticated users to execute arbitrary SQL commands via the Filter or (3) Criteria parameter to reports/borrowers_out.pl in the Staff interface.
Query: SOC alert related to Add-ins
Matching passage: T1137.006 Add-ins. Tactics: persistence. Description: Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs. (Citation: Microsoft Office Add-ins) There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins. (Citation: MRWLabs Office Persistence Add-ins)(Citation: FireEye Mail CDS 2018) Add-ins can be used to obtain persistence because they can be set to execute code when an Office application starts.
Near-miss passage: T1137.001 Office Template Macros. Tactics: persistence. Description: Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Microsoft Office contains templates that are part of common Office applications and are used to customize styles. The base templates within the application are used each time an application starts. (Citation: Microsoft Change Normal Template) Office Visual Basic for Applications (VBA) macros (Citation: MSDN VBA in Office) can be inserted into the base template and used to execute code when the respective Office application starts in order to obtain persistence. Examples for both Word and Excel have been discovered and published. By default, Word has a Normal.dotm template created that can be modified to include a malicious macro. Excel does not have a template file created by default, but one can be added that will automatically be loaded.(Citation: enigma0x3 normal.dotm)(Citation: Hexacorn Office Template Macros) Shared templates may also be stored and pulled from remote locations.(Citation: GlobalDotName Jun 2019) Word Normal.dotm location:<br> <code>C:\Users\&lt;username&gt;\AppData\Roaming\Microsoft\Templates\Normal.dotm</code> Excel Personal.xlsb location:<br> <code>C:\Users\&lt;username&gt;\AppData\Roaming\Microsoft\Excel\XLSTART\PERSONAL.XLSB</code> Adversaries may also change the location of the base template to point to their own by hijacking the application's search order, e.g. Word 2016 will first look for Normal.dotm under <code>C:\Program Files (x86)\Microsoft Office\root\Office16\</code>, or by modifying the GlobalDotName registry key. By modifying the GlobalDotName registry key an adversary can specify an arbitrary location, file name, and file extension to use for the template that will be loaded on application startup. To abuse GlobalDotName, adversaries may first need to register the template as a trusted document or place it in a trusted location.(Citation: GlobalDotName Jun 2019) An adversary may need to enable macros to execute unrestricted depending
Query: exploit Qolsys IQ Panel (aka QOL) before 1.5.1 does not verify the digital signatures of software updates, which allows man-in-the-middle attackers to bypass intended access restrictions v
Matching passage: CVE-2015-6033. CWE: CWE-310. CVSS: 9.300000190734863. Qolsys IQ Panel (aka QOL) before 1.5.1 does not verify the digital signatures of software updates, which allows man-in-the-middle attackers to bypass intended access restrictions via a modified update.
Near-miss passage: CVE-2015-5655. CWE: CWE-310. CVSS: 5.800000190734863. The Adways Party Track SDK before 1.6.6 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Query: hunt for Credentials from Password Stores activity
Matching passage: T1555 Credentials from Password Stores. Tactics: credential access. Description: Adversaries may search for common password storage locations to obtain user credentials.(Citation: F-Secure The Dukes) Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.
Near-miss passage: T1555.002 Securityd Memory. Tactics: credential access. Description: An adversary with root access may gather credentials by reading `securityd`’s memory. `securityd` is a service/daemon responsible for implementing security protocols such as encryption and authorization.(Citation: Apple Dev SecurityD) A privileged adversary may be able to scan through `securityd`'s memory to find the correct sequence of keys to decrypt the user’s logon keychain. This may provide the adversary with various plaintext passwords, such as those for users, WiFi, mail, browsers, certificates, secure notes, etc.(Citation: OS X Keychain)(Citation: OSX Keydnap malware) In OS X prior to El Capitan, users with root access can read plaintext keychain passwords of logged-in users because Apple’s keychain implementation allows these credentials to be cached so that users are not repeatedly prompted for passwords.(Citation: OS X Keychain)(Citation: External to DA, the OS X Way) Apple’s `securityd` utility takes the user’s logon password, encrypts it with PBKDF2, and stores this master key in memory. Apple also uses a set of keys and algorithms to encrypt the user’s password, but once the master key is found, an adversary need only iterate over the other values to unlock the final password.(Citation: OS X Keychain)
Query: vulnerability: Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to crea
Matching passage: CVE-2015-1830. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.
Near-miss passage: CVE-2015-4666. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in opm/read_sessionlog.php in Xceedium Xsuite 2.4.4.5 and earlier allows remote attackers to read arbitrary files via a ....// (quadruple dot double slash) in the logFile parameter.
Query: describe CVE-2015-8947
Matching passage: CVE-2015-8947. CWE: CWE-119. CVSS: 7.599999904632568. hb-ot-layout-gpos-table.hh in HarfBuzz before 1.0.5 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data, a different vulnerability than CVE-2016-2052.
Near-miss passage: CVE-2015-1521. CWE: CWE-119. CVSS: 7.5. analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not properly handle zero values of a packet length, which allows remote attackers to cause a denial of service (buffer overflow or buffer over-read if NDEBUG; otherwise assertion failure) via a crafted DNP3 packet.
Query: indicators of Compile After Delivery
Matching passage: T1027.004 Compile After Delivery. Tactics: stealth. Description: Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe(Citation: ATTACK IQ), csc.exe, or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018) Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a [Phishing](https://attack.mitre.org/techniques/T1566). Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.(Citation: TrendMicro WindowsAppMac)
Near-miss passage: T1027.001 Binary Padding. Tactics: stealth. Description: Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations. Binary padding effectively changes the checksum of the file and can also be used to avoid hash-based blocklists and static anti-virus signatures.(Citation: ESET OceanLotus) The padding used is commonly generated by a function to create junk data and then appended to the end or applied to sections of malware.(Citation: Securelist Malware Tricks April 2017) Increasing the file size may decrease the effectiveness of certain tools and detection capabilities that are not designed or configured to scan large files. This may also reduce the likelihood of being collected for analysis. Public file scanning services, such as VirusTotal, limits the maximum size of an uploaded file to be analyzed.(Citation: VirusTotal FAQ)
Query: exploit kde-workspace 4.2.0 and plasma-workspace before 5.1.95 allows remote attackers to obtain input events, and consequently obtain passwords, by leveraging access to the X server when 
Matching passage: CVE-2015-1308. CWE: CWE-200. CVSS: 4.300000190734863. kde-workspace 4.2.0 and plasma-workspace before 5.1.95 allows remote attackers to obtain input events, and consequently obtain passwords, by leveraging access to the X server when the screen is locked.
Near-miss passage: CVE-2015-3184. CWE: CWE-200. CVSS: 5.0. mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name.
Query: write Sigma for Detects PowerShell download and execution cradles.
Matching passage: Sigma rule: Detects PowerShell download and execution cradles.. Logsource: windows / process_creation. Rule: title: PowerShell Download and Execution Cradles id: 85b0b087-eddf-4a2b-b033-d771fa2b9775 status: test description: Detects PowerShell download and execution cradles. references: - https://github.com/VirtualAlllocEx/Payload-Download-Cradles/blob/88e8eca34464a547c90d9140d70e9866dcbc6a12/Download-Cradles.cmd - https://labs.withsecure.com/publications/fin7-target-veeam-servers author: Florian Roth (Nextron Systems) date: 2022-03-24 modified: 2025-07-18 tags: - attack.execution - attack.t1059 logsource: product: windows category: process_creation detection: selection_download: CommandLine|contains: - .DownloadString( - .DownloadFile( - 'Invoke-WebRequest ' - 'iwr ' - 'Invoke-RestMethod ' - 'irm ' selection_iex: CommandLine|contains: - ;iex $ - '| IEX' - '|IEX ' - I`E`X - I`EX - IE`X - 'iex ' - IEX ( - IEX( - Invoke-Expression condition: all of selection_* falsepositives: - Some PowerShell installers were seen using similar combinations. Apply filters accordingly level: high
Near-miss passage: Sigma rule: Detects execution of the "finger.exe" utility. Finger.EXE or "TCPIP Finger Command" is an old utility that is still pres. Logsource: windows / process_creation. Rule: title: Finger.EXE Execution id: af491bca-e752-4b44-9c86-df5680533dbc related: - id: c082c2b0-525b-4dbc-9a26-a57dc4692074 type: similar - id: 2fdaf50b-9fd5-449f-ba69-f17248119af6 type: similar status: test description: 'Detects execution of the "finger.exe" utility. Finger.EXE or "TCPIP Finger Command" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon. Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of "finger.exe" can be considered "suspicious" and worth investigating. ' references: - https://twitter.com/bigmacjpg/status/1349727699863011328?s=12 - https://app.any.run/tasks/40115012-a919-4208-bfed-41e82cb3dadf/ - http://hyp3rlinx.altervista.org/advisories/Windows_TCPIP_Finger_Command_C2_Channel_and_Bypassing_Security_Software.txt author: Florian Roth (Nextron Systems), omkar72, oscd.community date: 2021-02-24 modified: 2024-06-27 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: finger.exe - Image|endswith: \finger.exe condition: selection falsepositives: - Admin activity (unclear what they do nowadays with finger.exe) level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_finger_execution/info.yml
Query: write Sigma for Detects wannacry killswitch domain dns queries
Matching passage: Sigma rule: Detects wannacry killswitch domain dns queries. Logsource: dns. Rule: title: Wannacry Killswitch Domain id: 3eaf6218-3bed-4d8a-8707-274096f12a18 status: test description: Detects wannacry killswitch domain dns queries references: - https://www.mandiant.com/resources/blog/wannacry-ransomware-campaign author: Mike Wade date: 2020-09-16 modified: 2022-03-24 tags: - attack.command-and-control - attack.t1071.001 logsource: category: dns detection: selection: query: - ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.testing - ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.test - ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.com - ayylmaotjhsstasdfasdfasdfasdfasdfasdfasdf.com - iuqssfsodp9ifjaposdfjhgosurijfaewrwergwea.com condition: selection falsepositives: - Analyst testing level: high
Near-miss passage: Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: WinSock2 Autorun Keys Modification id: d6c2ce7e-afb5-4337-9ca4-4b5254ed0565 related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: derived status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: winsock_parameters_base: TargetObject|contains: \System\CurrentControlSet\Services\WinSock2\Parameters winsock_parameters: TargetObject|contains: - \Protocol_Catalog9\Catalog_Entries - \NameSpace_Catalog5\Catalog_Entries filter: - Details: (Empty) - Image: C:\Windows\System32\MsiExec.exe - Image: C:\Windows\syswow64\MsiExec.exe condition: winsock_parameters_base and winsock_parameters and not filter falsepositives: - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason - Legitimate administrator sets up autorun keys for legitimate reason level: medium
Query: describe CVE-2015-6464
Matching passage: CVE-2015-6464. CWE: UNKNOWN. CVSS: 8.5. The administrative web interface on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote authenticated users to bypass a read-only protection mechanism by using Firefox with a web-developer plugin.
Near-miss passage: CVE-2015-2629. CWE: UNKNOWN. CVSS: 9.0. Unspecified vulnerability in the Java VM component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0457.
Query: CVE similar to CVE-2015-7504
Matching passage: CVE-2015-7504. CWE: CWE-787. CVSS: 8.800000190734863. Heap-based buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of service (instance crash) or possibly execute arbitrary code via a series of packets in loopback mode.
Near-miss passage: CVE-2015-5628. CWE: CWE-787. CVSS: 9.800000190734863. Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5.04.20 and earlier, CENTUM VP Entry R5.04.20 and earlier, ProSafe-RS R3.02.10 and earlier, Exaopc R3.72.00 and earlier, Exaquantum R2.85.00 and earlier, Exaquantum/Batch R2.50.30 and earlier, Exapilot R3.96.10 and earlier, Exaplog R3.40.00 and earlier, Exasmoc R4.03.20 and earlier, Exarqe R4.03.20 and earlier, Field Wireless Device OPC Server R2.01.02 and earlier, PRM R3.12.00 and earlier, STARDOM VDS R7.30.01 and earlier, STARDOM OPC Server for Windows R3.40 and earlier, FAST/TOOLS R10.01 and earlier, B/M9000CS R5.05.01 and earlier, B/M9000 VP R7.03.04 and earlier, and FieldMate R1.01 or R1.02 allows remote attackers to execute arbitrary code via a crafted packet.
Query: CVE similar to CVE-2015-9418
Matching passage: CVE-2015-9418. CWE: CWE-352. CVSS: 4.300000190734863. The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes.
Near-miss passage: CVE-2015-3367. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Patterns module before 7.x-2.2 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) restore, (2) publish, or (3) unpublish a pattern via unspecified vectors.