alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Integer overflow in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 o
Matching passage: CVE-2015-3104. CWE: CWE-189. CVSS: 10.0. Integer overflow in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-2470. CWE: CWE-189. CVSS: 9.300000190734863. Integer underflow in Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office for Mac 2011, and Word Viewer allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Integer Underflow Vulnerability."
Query: exploit Directory traversal vulnerability in the API in EMC Secure Remote Services Virtual Edition 3.x before 3.10 allows remote authenticated users to read log files via a crafted paramet
Matching passage: CVE-2015-6852. CWE: CWE-200. CVSS: 4.300000190734863. Directory traversal vulnerability in the API in EMC Secure Remote Services Virtual Edition 3.x before 3.10 allows remote authenticated users to read log files via a crafted parameter.
Near-miss passage: CVE-2015-1147. CWE: CWE-200. CVSS: 5.0. Open Directory Client in Apple OS X before 10.10.3 sends unencrypted password-change requests in certain circumstances involving missing certificates, which allows remote attackers to obtain sensitive information by sniffing the network.
Query: patch priority for CVE-2015-3293
Matching passage: CVE-2015-3293. CWE: CWE-200. CVSS: 4.0. FortiMail 5.0.3 through 5.2.3 allows remote administrators to obtain credentials via the "diag debug application httpd" command.
Near-miss passage: CVE-2015-5382. CWE: CWE-200. CVSS: 6.5. program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard.
Query: detection rule: Detects email exfiltration via powershell cmdlets
Matching passage: Sigma rule: Detects email exfiltration via powershell cmdlets. Logsource: windows / process_creation. Rule: title: Email Exifiltration Via Powershell id: 312d0384-401c-4b8b-abdf-685ffba9a332 status: test description: Detects email exfiltration via powershell cmdlets references: - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/ - https://github.com/Azure/Azure-Sentinel/blob/7e6aa438e254d468feec061618a7877aa528ee9f/Hunting%20Queries/Microsoft%20365%20Defender/Ransomware/DEV-0270/Email%20data%20exfiltration%20via%20PowerShell.yaml author: Nasreddine Bencherchali (Nextron Systems), Azure-Sentinel (idea) date: 2022-09-09 tags: - attack.exfiltration logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains|all: - Add-PSSnapin - Get-Recipient - -ExpandProperty - EmailAddresses - SmtpAddress - -hidetableheaders condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH". Logsource: windows / ps_script. Rule: title: Add Windows Capability Via PowerShell Script id: 155c7fd5-47b4-49b2-bbeb-eb4fab335429 related: - id: b36d01a3-ddaf-4804-be18-18a6247adfcd type: similar status: test description: Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others. references: - https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=powershell - https://www.virustotal.com/gui/file/af1c82237b6e5a3a7cdbad82cc498d298c67845d92971bada450023d1335e267/content author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-22 modified: 2023-05-09 tags: - attack.execution logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmdlet: ScriptBlockText|contains: 'Add-WindowsCapability ' selection_capa: ScriptBlockText|contains: -Name OpenSSH. condition: all of selection_* falsepositives: - Legitimate usage of the capabilities by administrators or users. Add additional filters accordingly. level: medium
Query: risk of The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitr
Matching passage: CVE-2015-4495. CWE: CWE-346. CVSS: 8.800000190734863. The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.
Near-miss passage: CVE-2015-0563. CWE: CWE-20. CVSS: 5.0. epan/dissectors/packet-smtp.c in the SMTP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 uses an incorrect length value for certain string-append operations, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Query: patch priority for CVE-2015-4468
Matching passage: CVE-2015-4468. CWE: CWE-189. CVSS: 4.300000190734863. Multiple integer overflows in the search_chunk function in chmd.c in libmspack before 0.5 allow remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted CHM file.
Near-miss passage: CVE-2015-3240. CWE: CWE-189. CVSS: 4.300000190734863. The pluto IKE daemon in libreswan before 3.15 and Openswan before 2.6.45, when built with NSS, allows remote attackers to cause a denial of service (assertion failure and daemon restart) via a zero DH g^x value in a KE payload in a IKE packet.
Query: CVE similar to CVE-2015-5169
Matching passage: CVE-2015-5169. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.
Near-miss passage: CVE-2015-0551. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop 6.7SP1 before P31, 6.7SP2 before P23, and 6.8 before P01; Documentum Administrator 6.7SP1 before P31, 6.7SP2 before P23, 7.0 before P18, 7.1 before P15, and 7.2 before P01; Documentum Digital Assets Manager 6.5SP6 before P25; Documentum Web Publishers 6.5 SP7 before P25; and Documentum Task Space 6.7SP1 before P31 and 6.7SP2 before P23 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Query: detection rule: Detects a typical pattern of a CobaltStrike BOF which inject into other processes
Matching passage: Sigma rule: Detects a typical pattern of a CobaltStrike BOF which inject into other processes. Logsource: windows / process_access. Rule: title: HackTool - CobaltStrike BOF Injection Pattern id: 09706624-b7f6-455d-9d02-adee024cee1d status: test description: Detects a typical pattern of a CobaltStrike BOF which inject into other processes references: - https://github.com/boku7/injectAmsiBypass - https://github.com/boku7/spawn author: Christian Burkard (Nextron Systems) date: 2021-08-04 modified: 2023-11-28 tags: - attack.execution - attack.defense-impairment - attack.t1106 - attack.t1685 logsource: category: process_access product: windows detection: selection: CallTrace|re: ^C:\\Windows\\SYSTEM32\\ntdll\.dll\+[a-z0-9]{4,6}\|C:\\Windows\\System32\\KERNELBASE\.dll\+[a-z0-9]{4,6}\|UNKNOWN\([A-Z0-9]{16}\)$ GrantedAccess: - '0x1028' - '0x1fffff' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when the file "passwd" or "shadow" is copied from tmp path. Logsource: linux / process_creation. Rule: title: Copy Passwd Or Shadow From TMP Path id: fa4aaed5-4fe0-498d-bbc0-08e3346387ba status: test description: Detects when the file "passwd" or "shadow" is copied from tmp path references: - https://blogs.blackberry.com/ - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144 author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-01-31 tags: - attack.credential-access - attack.t1552.001 logsource: product: linux category: process_creation detection: selection_img: Image|endswith: /cp selection_path: CommandLine|contains: /tmp/ selection_file: CommandLine|contains: - passwd - shadow condition: all of selection_* falsepositives: - Unknown level: high
Query: exploit Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, A
Matching passage: CVE-2015-7652. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via a crafted gridFitType property value, a different vulnerability than CVE-2015-7651, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
Near-miss passage: CVE-2015-2017. CWE: UNKNOWN. CVSS: 4.300000190734863. CRLF injection vulnerability in IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.8 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.
Query: detection rule: Detects the execution of "ldifde.exe" in order to export organizational Active Directory structure.
Matching passage: Sigma rule: Detects the execution of "ldifde.exe" in order to export organizational Active Directory structure.. Logsource: windows / process_creation. Rule: title: Active Directory Structure Export Via Ldifde.EXE id: 4f7a6757-ff79-46db-9687-66501a02d9ec status: test description: Detects the execution of "ldifde.exe" in order to export organizational Active Directory structure. references: - https://businessinsights.bitdefender.com/deep-dive-into-a-backdoordiplomacy-attack-a-study-of-an-attackers-toolkit - https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11) author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-14 tags: - attack.exfiltration logsource: category: process_creation product: windows detection: selection_ldif: - Image|endswith: \ldifde.exe - OriginalFileName: ldifde.exe selection_cmd: CommandLine|contains: -f filter_import: CommandLine|contains: ' -i' condition: all of selection_* and not 1 of filter_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired o. Logsource: linux / auditd. Rule: title: Network Sniffing - Linux id: f4d3748a-65d1-4806-bd23-e25728081d01 status: test description: 'Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1040/T1040.md author: Timur Zinniatullin, oscd.community date: 2019-10-21 modified: 2022-12-18 tags: - attack.credential-access - attack.discovery - attack.t1040 logsource: product: linux service: auditd detection: selection_1: type: execve a0: tcpdump a1: -c a3|contains: -i selection_2: type: execve a0: tshark a1: -c a3: -i condition: 1 of selection_* falsepositives: - Legitimate administrator or user uses network sniffing tool for legitimate reasons. level: low
Query: mitigate Obtain Capabilities
Matching passage: T1588 Obtain Capabilities. Tactics: resource development. Description: Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle. In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals.(Citation: NationsBuying)(Citation: PegasusCitizenLab) In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.(Citation: DiginotarCompromise)
Near-miss passage: T1588.004 Digital Certificates. Tactics: resource development. Description: Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. Adversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) if the certificate is trusted or otherwise added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)). The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities.(Citation: DiginotarCompromise) Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for. Certificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free.(Citation: Let's Encrypt FAQ) After obtaining a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control.
Query: describe CVE-2015-9469
Matching passage: CVE-2015-9469. CWE: CWE-79. CVSS: 4.800000190734863. The content-grabber plugin 1.0 for WordPress has XSS via obj_field_name or obj_field_id.
Near-miss passage: CVE-2015-0156. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.6.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: vulnerability: Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unkn
Matching passage: CVE-2015-0411. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Server : Security : Encryption.
Near-miss passage: CVE-2015-5570. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5574, CVE-2015-5581, CVE-2015-5584, and CVE-2015-6682.
Query: patch priority for CVE-2015-8976
Matching passage: CVE-2015-8976. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via vectors related to "old upgrade files."
Near-miss passage: CVE-2015-7879. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authenticated users with permission to create or edit a stickynote to inject arbitrary web script or HTML via note text on the admin listing page.
Query: patch priority for CVE-2015-8265
Matching passage: CVE-2015-8265. CWE: CWE-20. CVSS: 7.5. Huawei Mobile WiFi E5151 routers with software before E5151s-2TCPU-V200R001B146D27SP00C00 and E5186 routers with software before V200R001B310D01SP00C00 allow DNS query packets using the static source port, which makes it easier for remote attackers to spoof responses via unspecified vectors.
Near-miss passage: CVE-2015-9147. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, SD 400, and SD 800, userspace-provided pointer arguments are not validated.
Query: risk of Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HT
Matching passage: CVE-2015-3429. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HTML via a fragment identifier.
Near-miss passage: CVE-2015-2681. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the ASUS RT-G32 routers with firmware 2.0.2.6 and 2.0.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) next_page, (2) group_id, (3) action_script, or (4) flag parameter to start_apply.htm.
Query: patch priority for CVE-2015-9046
Matching passage: CVE-2015-9046. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached due to an improper bound on the size of a frequency list.
Near-miss passage: CVE-2015-8735. CWE: CWE-20. CVSS: 5.5. The get_value function in epan/dissectors/packet-btatt.c in the Bluetooth Attribute (aka BT ATT) dissector in Wireshark 2.0.x before 2.0.1 uses an incorrect integer data type, which allows remote attackers to cause a denial of service (invalid write operation and application crash) via a crafted packet.
Query: exploit The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x be
Matching passage: CVE-2015-1868. CWE: CWE-399. CVSS: 7.800000190734863. The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.
Near-miss passage: CVE-2015-4301. CWE: CWE-399. CVSS: 6.800000190734863. Cisco NX-OS on Nexus 9000 devices 11.1(1c) allows remote authenticated users to cause a denial of service (device hang) via large files that are copied to a device's filesystem, aka Bug ID CSCuu77225.
Query: rule covering Detects a network connection initiated by the certutil.exe utility. Attackers can abuse the utility in order to download
Matching passage: Sigma rule: Detects a network connection initiated by the certutil.exe utility. Attackers can abuse the utility in order to download. Logsource: windows / network_connection. Rule: title: Uncommon Network Connection Initiated By Certutil.EXE id: 0dba975d-a193-4ed1-a067-424df57570d1 status: test description: 'Detects a network connection initiated by the certutil.exe utility. Attackers can abuse the utility in order to download malware or additional payloads. ' references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil author: frack113, Florian Roth (Nextron Systems) date: 2022-09-02 modified: 2024-05-31 tags: - attack.command-and-control - attack.t1105 logsource: category: network_connection product: windows detection: selection: Image|endswith: \certutil.exe Initiated: 'true' DestinationPort: - 80 - 135 - 443 - 445 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of LiveKD with the "-m" flag to potentially dump the kernel memory. Logsource: windows / process_creation. Rule: title: Kernel Memory Dump Via LiveKD id: c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2 status: test description: Detects execution of LiveKD with the "-m" flag to potentially dump the kernel memory references: - https://learn.microsoft.com/en-us/sysinternals/downloads/livekd - https://4sysops.com/archives/creating-a-complete-memory-dump-without-a-blue-screen/ - https://kb.acronis.com/content/60892 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-16 modified: 2024-03-13 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \livekd.exe - \livekd64.exe - OriginalFileName: livekd.exe selection_cli: CommandLine|contains|windash: ' -m' condition: all of selection_* falsepositives: - Unlikely in production environment level: high
Query: patch priority for CVE-2015-9249
Matching passage: CVE-2015-9249. CWE: CWE-89. CVSS: 9.800000190734863. An issue was discovered in Skybox Platform before 7.5.201. SQL Injection exists in /skyboxview/webservice/services/VersionWebService via a soapenv:Body element.
Near-miss passage: CVE-2015-9323. CWE: CWE-89. CVSS: 9.800000190734863. The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.
Query: describe CVE-2015-4879
Matching passage: CVE-2015-4879. CWE: UNKNOWN. CVSS: 4.599999904632568. Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier, and 5.6.25 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to DML.
Near-miss passage: CVE-2015-2346. CWE: UNKNOWN. CVSS: 4.0. XML external entity (XXE) vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote authenticated users to read arbitrary files via the req parameter.