alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-5024
Matching passage: CVE-2015-5024. CWE: CWE-200. CVSS: 4.0. IBM Emptoris Sourcing 10.0.2.0 before iFix6, 10.0.2.2 before iFix11, 10.0.2.3, 10.0.2.5 before iFix4, 10.0.2.6 before iFix8, 10.0.2.7 before iFix1, and 10.0.4.x before iFix2 allows remote authenticated users to obtain sensitive supplier-bid information via unspecified vectors.
Near-miss passage: CVE-2015-3923. CWE: CWE-200. CVSS: 5.0. Coppermine Photo Gallery before 1.5.36 allows remote attackers to enumerate directories via a full path in the folder parameter to minibrowser.php.
Query: detect Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools in logs
Matching passage: Sigma rule: Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools. Logsource: windows / process_creation. Rule: title: Suspicious Program Names id: efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6 status: test description: Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md author: Florian Roth (Nextron Systems) date: 2022-02-11 modified: 2023-03-22 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_image: - Image|contains: - \CVE-202 - \CVE202 - Image|endswith: - \poc.exe - \artifact.exe - \artifact64.exe - \artifact_protected.exe - \artifact32.exe - \artifact32big.exe - obfuscated.exe - obfusc.exe - \meterpreter selection_commandline: CommandLine|contains: - inject.ps1 - Invoke-CVE - pupy.ps1 - payload.ps1 - beacon.ps1 - PowerView.ps1 - bypass.ps1 - obfuscated.ps1 - obfusc.ps1 - obfus.ps1 - obfs.ps1 - evil.ps1 - MiniDogz.ps1 - _enc.ps1 - \shell.ps1 - \rshell.ps1 - revshell.ps1 - \av.ps1 - \av_test.ps1 - adrecon.ps1 - mimikatz.ps1 - \PowerUp_ - powerup.ps1 - \Temp\a.ps1 - \Temp\p.ps1 - \Temp\1.ps1 - Hound.ps1 - encode.ps1 - powercat.ps1 condition: 1 of selection* falsepositives: - Legitimate tools that accidentally match on the searched patterns level: high
Near-miss passage: Sigma rule: Detects a suspicious process pattern which could be a sign of an exploited Serv-U service. Logsource: windows / process_creation. Rule: title: Suspicious Serv-U Process Pattern id: 58f4ea09-0fc2-4520-ba18-b85c540b0eaf status: test description: Detects a suspicious process pattern which could be a sign of an exploited Serv-U service references: - https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/ author: Florian Roth (Nextron Systems) date: 2021-07-14 modified: 2022-07-14 tags: - attack.credential-access - attack.t1555 - cve.2021-35211 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \Serv-U.exe Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - \wscript.exe - \cscript.exe - \sh.exe - \bash.exe - \schtasks.exe - \regsvr32.exe - \wmic.exe - \mshta.exe - \rundll32.exe - \msiexec.exe - \forfiles.exe - \scriptrunner.exe condition: selection falsepositives: - Legitimate uses in which users or programs use the SSH service of Serv-U for remote command execution level: high
Query: exploit In all Qualcomm products with Android releases from CAF using the Linux kernel, a potential compiler optimization of memset() is addressed.
Matching passage: CVE-2015-9067. CWE: UNKNOWN. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a potential compiler optimization of memset() is addressed.
Near-miss passage: CVE-2015-4752. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to Server : I_S.
Query: risk of Absolute path traversal vulnerability in the Image Export plugin 1.1 for WordPress allows remote attackers to read and delete arbitrary files via a full pathname in the file parame
Matching passage: CVE-2015-5609. CWE: CWE-22. CVSS: 9.100000381469727. Absolute path traversal vulnerability in the Image Export plugin 1.1 for WordPress allows remote attackers to read and delete arbitrary files via a full pathname in the file parameter to download.php.
Near-miss passage: CVE-2015-0016. CWE: CWE-22. CVSS: 7.800000190734863. Directory traversal vulnerability in the TS WebProxy (aka TSWbPrxy) component in Microsoft Windows Vista SP2, Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to gain privileges via a crafted pathname in an executable file, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Directory Traversal Elevation of Privilege Vulnerability."
Query: vulnerability: IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to conduct clickjacking attacks via unspec
Matching passage: CVE-2015-1980. CWE: CWE-20. CVSS: 3.5. IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors.
Near-miss passage: CVE-2015-3254. CWE: CWE-20. CVSS: 6.5. The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function.
Query: risk of The USB driver in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows physically proximate attackers to cause a denial of service via a crafted 
Matching passage: CVE-2015-6369. CWE: CWE-20. CVSS: 4.900000095367432. The USB driver in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows physically proximate attackers to cause a denial of service via a crafted USB device that triggers invalid USB commands, aka Bug ID CSCux10531.
Near-miss passage: CVE-2015-1787. CWE: CWE-20. CVSS: 2.5999999046325684. The ssl3_get_client_key_exchange function in s3_srvr.c in OpenSSL 1.0.2 before 1.0.2a, when client authentication and an ephemeral Diffie-Hellman ciphersuite are enabled, allows remote attackers to cause a denial of service (daemon crash) via a ClientKeyExchange message with a length of zero.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with th. Logsource: windows / process_creation. Rule: title: AgentExecutor PowerShell Execution id: 7efd2c8d-8b18-45b7-947d-adfe9ed04f61 related: - id: c0b40568-b1e9-4b03-8d6c-b096da6da9ab type: similar status: test description: Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument author: Nasreddine Bencherchali (Nextron Systems), memory-shards references: - https://twitter.com/lefterispan/status/1286259016436514816 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Agentexecutor/ - https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension - https://twitter.com/jseerden/status/1247985304667066373/photo/1 date: 2022-12-24 modified: 2024-08-07 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image: \AgentExecutor.exe - OriginalFileName: AgentExecutor.exe selection_cli: CommandLine|contains: - ' -powershell' - ' -remediationScript' filter_main_intune: ParentImage|endswith: \Microsoft.Management.Services.IntuneWindowsAgent.exe condition: all of selection_* and not 1 of filter_main_* falsepositives: - Legitimate use via Intune management. You exclude script paths and names to reduce FP rate level: medium
Near-miss passage: Sigma rule: Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens). Logsource: windows / process_creation. Rule: title: Renamed BrowserCore.EXE Execution id: 8a4519e8-e64a-40b6-ae85-ba8ad2177559 status: test description: Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens) references: - https://twitter.com/mariuszbit/status/1531631015139102720 author: Max Altgelt (Nextron Systems) date: 2022-06-02 modified: 2023-02-03 tags: - attack.credential-access - attack.stealth - attack.t1528 - attack.t1036.003 logsource: category: process_creation product: windows detection: selection: OriginalFileName: BrowserCore.exe filter_realbrowsercore: Image|endswith: \BrowserCore.exe condition: selection and not 1 of filter_* falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-4544
Matching passage: CVE-2015-4544. CWE: CWE-264. CVSS: 9.0. EMC Documentum Content Server before 7.1P20 and 7.2.x before 7.2P04 does not properly verify authorization for dm_job object access, which allows remote authenticated users to obtain superuser privileges via crafted object operations. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4626.
Near-miss passage: CVE-2015-1496. CWE: CWE-264. CVSS: 7.199999809265137. Motorola Scanner SDK uses weak permissions for (1) CoreScanner.exe, (2) rsmdriverproviderservice.exe, and (3) ScannerService.exe, which allows local users to gain privileges via unspecified vectors.
Query: risk of The process-initialization implementation in win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, an
Matching passage: CVE-2015-2527. CWE: CWE-264. CVSS: 7.199999809265137. The process-initialization implementation in win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 does not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-2794. CWE: CWE-264. CVSS: 9.800000190734863. The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.
Query: describe CVE-2015-5606
Matching passage: CVE-2015-5606. CWE: CWE-20. CVSS: 7.5. Vordel XML Gateway (acquired by Axway) version 7.2.2 could allow remote attackers to cause a denial of service via a specially crafted request.
Near-miss passage: CVE-2015-3411. CWE: CWE-20. CVSS: 6.5. PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument load method, (2) the xmlwriter_open_uri function, (3) the finfo_file function, or (4) the hash_hmac_file function, as demonstrated by a filename\0.xml attack that bypasses an intended configuration in which client users may read only .xml files.
Query: describe CVE-2015-0848
Matching passage: CVE-2015-0848. CWE: CWE-119. CVSS: 6.800000190734863. Heap-based buffer overflow in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image.
Near-miss passage: CVE-2015-3828. CWE: CWE-119. CVSS: 10.0. The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM), which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted 3GPP metadata, aka internal bug 20923261, a related issue to CVE-2015-3826.
Query: exploit The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and 
Matching passage: CVE-2015-6113. CWE: CWE-254. CVSS: 2.0999999046325684. The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 allows local users to bypass intended filesystem permissions by leveraging Low Integrity access, aka "Windows Kernel Security Feature Bypass Vulnerability."
Near-miss passage: CVE-2015-6592. CWE: CWE-254. CVSS: 6.800000190734863. Huawei UAP2105 before V300R012C00SPC160(BootRom) does not require authentication to the serial port or the VxWorks shell.
Query: exploit Bluetooth in Android 4.4 and 5.x before 5.1.1 LMY48Z allows user-assisted remote attackers to execute arbitrary code by leveraging access to the local physical environment, aka int
Matching passage: CVE-2015-6618. CWE: CWE-254. CVSS: 4.300000190734863. Bluetooth in Android 4.4 and 5.x before 5.1.1 LMY48Z allows user-assisted remote attackers to execute arbitrary code by leveraging access to the local physical environment, aka internal bug 24595992.
Near-miss passage: CVE-2015-7188. CWE: CWE-254. CVSS: 7.5. Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to bypass the Same Origin Policy for an IP address origin, and conduct cross-site scripting (XSS) attacks, by appending whitespace characters to an IP address string.
Query: CWE for Exposure of Private Personal Information to an Unauthorized Actor
Matching passage: CWE-359 Exposure of Private Personal Information to an Unauthorized Actor. The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
Near-miss passage: CWE-536 Servlet Runtime Error Message Containing Sensitive Information. A servlet error message indicates that there exists an unhandled exception in the web application code and may provide useful information to an attacker.
Query: alert when Detects suspicious encoded payloads in WMI Event Consumers
Matching passage: Sigma rule: Detects suspicious encoded payloads in WMI Event Consumers. Logsource: windows / wmi_event. Rule: title: Suspicious Encoded Scripts in a WMI Consumer id: 83844185-1c5b-45bc-bcf3-b5bf3084ca5b status: test description: Detects suspicious encoded payloads in WMI Event Consumers references: - https://github.com/RiccardoAncarani/LiquidSnake author: Florian Roth (Nextron Systems) date: 2021-09-01 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.execution - attack.t1047 - attack.persistence - attack.t1546.003 logsource: product: windows category: wmi_event detection: selection_destination: Destination|base64offset|contains: - WriteProcessMemory - This program cannot be run in DOS mode - This program must be run under Win32 condition: selection_destination falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via COMPRESS OBFUSCATION. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module id: 7034cbbb-cc55-4dc2-8dad-36c0b942e8f1 related: - id: 20e5497e-331c-4cd5-8d36-935f6e2a9a07 type: derived status: test description: Detects Obfuscated Powershell via COMPRESS OBFUSCATION references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|contains|all: - new-object - text.encoding]::ascii Payload|contains: - system.io.compression.deflatestream - system.io.streamreader Payload|endswith: readtoend condition: selection_4103 falsepositives: - Unknown level: medium
Query: detection rule: Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy"
Matching passage: Sigma rule: Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy". Logsource: windows / ps_script. Rule: title: Change PowerShell Policies to an Insecure Level - PowerShell id: 61d0475c-173f-4844-86f7-f3eebae1c66b related: - id: cf2e938e-9a3e-4fe8-a347-411642b28a9f type: similar - id: 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180 type: similar - id: fad91067-08c5-4d1a-8d8c-d96a21b37814 type: similar status: test description: Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy" cmdlet. references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4 - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4 - https://adsecurity.org/?p=2604 author: frack113 date: 2021-10-20 modified: 2023-12-14 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmdlet: ScriptBlockText|contains: Set-ExecutionPolicy selection_option: ScriptBlockText|contains: - Unrestricted - bypass filter_optional_chocolatey: ScriptBlockText|contains: - (New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1') - (New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1') condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Administrator script level: medium
Near-miss passage: Sigma rule: Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load mali. Logsource: windows / process_creation. Rule: title: Suspicious FromBase64String Usage On Gzip Archive - Process Creation id: d75d6b6b-adb9-48f7-824b-ac2e786efe1f related: - id: df69cb1d-b891-4cd9-90c7-d617d90100ce type: similar status: test description: Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load malicious content into memory afterward. references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=43 author: frack113 date: 2022-12-23 tags: - attack.command-and-control - attack.t1132.001 logsource: product: windows category: process_creation detection: selection: CommandLine|contains|all: - FromBase64String - MemoryStream - H4sI condition: selection falsepositives: - Legitimate administrative script level: medium
Query: describe CVE-2015-5914
Matching passage: CVE-2015-5914. CWE: CWE-17. CVSS: 4.699999809265137. The EFI component in Apple OS X before 10.11 allows physically proximate attackers to modify firmware during the EFI update process by inserting an Apple Ethernet Thunderbolt adapter with crafted code in an Option ROM, aka a "Thunderstrike" issue. NOTE: this issue exists because of an incomplete fix for CVE-2014-4498.
Near-miss passage: CVE-2015-6758. CWE: CWE-17. CVSS: 6.800000190734863. The CPDF_Document::GetPage function in fpdfapi/fpdf_parser/fpdf_parser_document.cpp in PDFium, as used in Google Chrome before 46.0.2490.71, does not properly perform a cast of a dictionary object, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.
Query: Outbound C2 pattern associated with Encrypted/Encoded File
Matching passage: T1027.013 Encrypted/Encoded File. Tactics: stealth. Description: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file content aims to conceal malicious artifacts within a file used in an intrusion. Many other techniques, such as [Software Packing](https://attack.mitre.org/techniques/T1027/002), [Steganography](https://attack.mitre.org/techniques/T1027/003), and [Embedded Payloads](https://attack.mitre.org/techniques/T1027/009), share this same broad objective. Encrypting and/or encoding files could lead to a lapse in detection of static signatures, only for this malicious content to be revealed (i.e., [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140)) at the time of execution/use. This type of file obfuscation can be applied to many file artifacts present on victim hosts, such as malware log/configuration and payload files.(Citation: File obfuscation) Files can be encrypted with a hardcoded or user-supplied key, as well as otherwise obfuscated using standard encoding schemes such as Base64. The entire content of a file may be obfuscated, or just specific functions or values (such as C2 addresses). Encryption and encoding may also be applied in redundant layers for additional protection. For example, adversaries may abuse password-protected Word documents or self-extracting (SFX) archives as a method of encrypting/encoding a file such as a [Phishing](https://attack.mitre.org/techniques/T1566) payload. These files typically function by attaching the intended archived content to a decompressor stub that is executed when the file is invoked (e.g., [User Execution](https://attack.mitre.org/techniques/T1204)).(Citation: SFX - Encrypted/Encoded File) Adversaries may also abuse file-specific as well as custom encoding schemes. For example, Byte Order Mark (BOM) headers in text files may be abused to manipulate and obfuscate file content until [Command and Scripting Interpreter](https://attack.mitre.org/techn
Near-miss passage: T1027.002 Software Packing. Tactics: stealth. Description: Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018) Utilities used to perform software packing are called packers. Example packers are MPRESS and UPX. A more comprehensive list of known packers is available, but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses.(Citation: Awesome Executable Packing)
Query: describe CVE-2015-4370
Matching passage: CVE-2015-4370. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Site Documentation module before 6.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms.
Near-miss passage: CVE-2015-1640. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Microsoft Project Server 2010 SP2 and 2013 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."
Query: describe CVE-2015-7252
Matching passage: CVE-2015-7252. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allows remote attackers to inject arbitrary web script or HTML via the errorpage parameter.
Near-miss passage: CVE-2015-7451. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5 before 7.5.0.9 IF2 and 7.6 before 7.6.0.3 FP3 and Maximo Asset Management 7.5 before 7.5.0.9 IF2, 7.5.1, and 7.6 before 7.6.0.3 FP3 for SmartCloud Control Desk allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.