alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges by leveraging admin
Matching passage: CVE-2015-4930. CWE: CWE-77. CVSS: 9.0. IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges by leveraging admin access.
Near-miss passage: CVE-2015-8988. CWE: CWE-77. CVSS: 8.800000190734863. Unquoted executable path vulnerability in Client Management and Gateway components in McAfee (now Intel Security) ePO Deep Command (eDC) 2.2 and 2.1 allows authenticated users to execute a command of their choice via dropping a malicious file for the path.
Query: alert when Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existenc
Matching passage: Sigma rule: Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existenc. Logsource: windows / process_creation. Rule: title: Webshell Tool Reconnaissance Activity id: f64e5c19-879c-4bae-b471-6d84c8339677 status: test description: 'Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands ' references: - https://ragged-lab.blogspot.com/2020/07/webshells-automating-reconnaissance.html author: Cian Heasley, Florian Roth (Nextron Systems) date: 2020-07-22 modified: 2023-11-09 tags: - attack.persistence - attack.t1505.003 logsource: category: process_creation product: windows detection: selection_webserver_image: ParentImage|endswith: - \caddy.exe - \httpd.exe - \nginx.exe - \php-cgi.exe - \w3wp.exe - \ws_tomcatservice.exe selection_webserver_characteristics_tomcat1: ParentImage|endswith: - \java.exe - \javaw.exe ParentImage|contains: - -tomcat- - \tomcat selection_webserver_characteristics_tomcat2: ParentImage|endswith: - \java.exe - \javaw.exe CommandLine|contains: - CATALINA_HOME - catalina.jar selection_recon: CommandLine|contains: - perl --help - perl -h - python --help - python -h - python3 --help - python3 -h - wget --help condition: 1 of selection_webserver_* and selection_recon falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detect when System Manager successfully executes commands against an instance.. Logsource: aws / cloudtrail. Rule: title: Potential Malicious Usage of CloudTrail System Manager id: 38e7f511-3f74-41d4-836e-f57dfa18eead status: test description: 'Detect when System Manager successfully executes commands against an instance. ' references: - https://github.com/elastic/detection-rules/blob/v8.6.0/rules/integrations/aws/initial_access_via_system_manager.toml author: jamesc-grafana date: 2024-07-11 modified: 2025-12-08 tags: - attack.privilege-escalation - attack.initial-access - attack.t1566 - attack.t1566.002 logsource: product: aws service: cloudtrail detection: selection_event: eventName: SendCommand eventSource: ssm.amazonaws.com selection_status_success: errorCode: Success selection_status_null: errorCode: null condition: selection_event and 1 of selection_status_* falsepositives: - There are legitimate uses of SSM to send commands to EC2 instances - Legitimate users may have to use SSM to perform actions against machines in the Cloud to update or maintain them level: high
Query: hunt for Clear Linux or Mac System Logs activity
Matching passage: T1685.006 Clear Linux or Mac System Logs. Tactics: defense impairment. Description: Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the `/var/log/` directory. Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs) * `/var/log/messages:`: General and system-related messages * `/var/log/secure or /var/log/auth.log`: Authentication logs * `/var/log/utmp or /var/log/wtmp`: Login records * `/var/log/kern.log`: Kernel logs * `/var/log/cron.log`: Crond logs * `/var/log/maillog`: Mail server logs * `/var/log/httpd/`: Web server access and error logs
Near-miss passage: T1685.002 Disable or Modify Cloud Log. Tactics: defense impairment. Description: An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities. For example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity. They may alternatively tamper with logging functionality, for example, by removing any associated SNS topics, disabling multi-region logging, or disabling settings that validate and/or encrypt log files.(Citation: AWS Cloud Trail)(Citation: Pacu Detection Disruption Module) In Office 365, an adversary may disable logging on mail collection activities for specific users by using the Set-MailboxAuditBypassAssociation cmdlet, by disabling M365 Advanced Auditing for the user, or by downgrading the user’s license from an Enterprise E5 to an Enterprise E3 license.(Citation: Dark Reading)
Query: CVE similar to CVE-2015-10125
Matching passage: CVE-2015-10125. CWE: CWE-352. CVSS: 8.800000190734863. A vulnerability classified as problematic has been found in WP Ultimate CSV Importer Plugin 3.7.2 on WordPress. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.7.3 is able to address this issue. The identifier of the patch is 13c30af721d3f989caac72dd0f56cf0dc40fad7e. It is recommended to upgrade the affected component. The identifier VDB-241317 was assigned to this vulnerability.
Near-miss passage: CVE-2015-2770. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the command line page in Websense TRITON V-Series appliances before 8.0.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Query: patch priority for CVE-2015-4892
Matching passage: CVE-2015-4892. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 allows remote authenticated users to affect integrity via unknown vectors related to Security, a different vulnerability than CVE-2015-4917.
Near-miss passage: CVE-2015-1118. CWE: UNKNOWN. CVSS: 5.0. libnetcore in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to cause a denial of service (memory corruption and application crash) via a crafted configuration profile.
Query: CVE similar to CVE-2015-3133
Matching passage: CVE-2015-3133. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3117, CVE-2015-3123, CVE-2015-3130, CVE-2015-3134, and CVE-2015-4431.
Near-miss passage: CVE-2015-6080. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6068, CVE-2015-6072, CVE-2015-6073, CVE-2015-6075, CVE-2015-6077, CVE-2015-6079, and CVE-2015-6082.
Query: explain T1552.008 Chat Messages
Matching passage: T1552.008 Chat Messages. Tactics: credential access. Description: Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels. Rather than accessing the stored chat logs (i.e., [Credentials In Files](https://attack.mitre.org/techniques/T1552/001)), adversaries may directly access credentials within these services on the user endpoint, through servers hosting the services, or through administrator portals for cloud hosted services. Adversaries may also compromise integration tools like Slack Workflows to automatically search through messages to extract user credentials. These credentials may then be abused to perform follow-on activities such as lateral movement or privilege escalation (Citation: Slack Security Risks).
Near-miss passage: T1552.006 Group Policy Preferences. Tactics: credential access. Description: Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts.(Citation: Microsoft GPP 2016) These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public).(Citation: Microsoft GPP Key) The following tools and scripts can be used to gather and decrypt the password file from Group Policy Preference XML files: * Metasploit’s post exploitation module: <code>post/windows/gather/credentials/gpp</code> * Get-GPPPassword(Citation: Obscuresecurity Get-GPPPassword) * gpprefdecrypt.py On the SYSVOL share, adversaries may use the following command to enumerate potential GPP XML files: <code>dir /s * .xml</code>
Query: exploit Buffer overflow in Saitoh Kikaku Maruo Editor 8.51 and earlier allows remote attackers to execute arbitrary code via a crafted .hmbook file.
Matching passage: CVE-2015-0903. CWE: CWE-119. CVSS: 7.5. Buffer overflow in Saitoh Kikaku Maruo Editor 8.51 and earlier allows remote attackers to execute arbitrary code via a crafted .hmbook file.
Near-miss passage: CVE-2015-9177. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, in a crypto API function, a buffer over-read can occur.
Query: describe CVE-2015-7085
Matching passage: CVE-2015-7085. CWE: CWE-119. CVSS: 6.599999904632568. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
Near-miss passage: CVE-2015-5590. CWE: CWE-119. CVSS: 7.300000190734863. Stack-based buffer overflow in the phar_fix_filepath function in ext/phar/phar.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large length value, as demonstrated by mishandling of an e-mail attachment by the imap PHP extension.
Query: exploit Larry Wall's patch; patch in FreeBSD 10.2-RC1 before 10.2-RC1-p1, 10.2 before 10.2-BETA2-p2, and 10.1 before 10.1-RELEASE-p16; Bitrig; GNU patch before 2.2.5; and possibly other pa
Matching passage: CVE-2015-1416. CWE: CWE-264. CVSS: 7.800000190734863. Larry Wall's patch; patch in FreeBSD 10.2-RC1 before 10.2-RC1-p1, 10.2 before 10.2-BETA2-p2, and 10.1 before 10.1-RELEASE-p16; Bitrig; GNU patch before 2.2.5; and possibly other patch variants allow remote attackers to execute arbitrary shell commands via a crafted patch file.
Near-miss passage: CVE-2015-1481. CWE: CWE-264. CVSS: 6.5. Ansible Tower (aka Ansible UI) before 2.0.5 allows remote organization administrators to gain privileges by creating a superuser account.
Query: SIEM correlation: persistence activity consistent with Network Logon Script
Matching passage: T1037.003 Network Logon Script. Tactics: persistence, privilege escalation. Description: Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence. Network logon scripts can be assigned using Active Directory or Group Policy Objects.(Citation: Petri Logon Script AD) These logon scripts run with the privileges of the user they are assigned to. Depending on the systems within the network, initializing one of these scripts could apply to more than one or potentially all systems. Adversaries may use these scripts to maintain persistence on a network. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
Near-miss passage: T1037.001 Logon Script (Windows). Tactics: persistence, privilege escalation. Description: Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.(Citation: TechNet Logon Scripts) This is done via adding a path to a script to the <code>HKCU\Environment\UserInitMprLogonScript</code> Registry key.(Citation: Hexacorn Logon Scripts) Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
Query: describe CVE-2015-8072
Matching passage: CVE-2015-8072. CWE: CWE-119. CVSS: 10.0. mediaserver in Android 4.4 through 5.x before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23881715, a different vulnerability than CVE-2015-6608 and CVE-2015-8073.
Near-miss passage: CVE-2015-8392. CWE: CWE-119. CVSS: 7.5. PCRE before 8.38 mishandles certain instances of the (?| substring, which allows remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8395.
Query: detect Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer s in logs
Matching passage: Sigma rule: Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer s. Logsource: windows / ps_script. Rule: title: Powershell Suspicious Win32_PnPEntity id: b26647de-4feb-4283-af6b-6117661283c5 status: test description: Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1120/T1120.md author: frack113 date: 2021-08-23 modified: 2022-12-25 tags: - attack.discovery - attack.t1120 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: Win32_PnPEntity condition: selection falsepositives: - Admin script level: low
Near-miss passage: Sigma rule: Detects a renamed "dctask64.exe" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. T. Logsource: windows / process_creation. Rule: title: Renamed ZOHO Dctask64 Execution id: 340a090b-c4e9-412e-bb36-b4b16fe96f9b status: test description: 'Detects a renamed "dctask64.exe" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution. ' references: - https://twitter.com/gN3mes1s/status/1222088214581825540 - https://twitter.com/gN3mes1s/status/1222095963789111296 - https://twitter.com/gN3mes1s/status/1222095371175911424 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2020-01-28 modified: 2025-01-22 tags: - attack.privilege-escalation - attack.stealth - attack.t1036 - attack.t1055.001 - attack.t1202 - attack.t1218 logsource: category: process_creation product: windows detection: selection: Hashes|contains: - IMPHASH=6834B1B94E49701D77CCB3C0895E1AFD - IMPHASH=1BB6F93B129F398C7C4A76BB97450BBA - IMPHASH=FAA2AC19875FADE461C8D89DCF2710A3 - IMPHASH=F1039CED4B91572AB7847D26032E6BBF filter_main_legit_name: Image|endswith: \dctask64.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: exploit Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.8.0 and 11.1.1.9.0, and the Oracle Applications Framework component in Oracle 
Matching passage: CVE-2015-1926. CWE: UNKNOWN. CVSS: 5.5. Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.8.0 and 11.1.1.9.0, and the Oracle Applications Framework component in Oracle E-Business Suite 12.2.3 and 12.2.4, allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Portal.
Near-miss passage: CVE-2015-0253. CWE: UNKNOWN. CVSS: 5.0. The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) by sending a request that lacks a method to an installation that enables the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI.
Query: weakness CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations
Matching passage: CWE-1252 CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations. The CPU is not configured to provide hardware support for exclusivity of write and execute operations on memory. This allows an attacker to execute data from all of memory.
Near-miss passage: CWE-1286 Improper Validation of Syntactic Correctness of Input. The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.
Query: Sigma rule for Detects SQL error messages that indicate probing for an injection attack
Matching passage: Sigma rule: Detects SQL error messages that indicate probing for an injection attack. Logsource: sql / application. Rule: title: Suspicious SQL Error Messages id: 8a670c6d-7189-4b1c-8017-a417ca84a086 status: test description: Detects SQL error messages that indicate probing for an injection attack references: - http://www.sqlinjection.net/errors author: Bjoern Kimminich date: 2017-11-27 modified: 2023-02-12 tags: - attack.initial-access - attack.t1190 logsource: category: application product: sql definition: 'Requirements: application error logs must be collected (with LOG_LEVEL ERROR and above)' detection: keywords: - quoted string not properly terminated - You have an error in your SQL syntax - Unclosed quotation mark - 'near "*": syntax error' - SELECTs to the left and right of UNION do not have the same number of result columns condition: keywords falsepositives: - A syntax error in MySQL also occurs in non-dynamic (safe) queries if there is an empty in() clause, that may often be the case. level: high
Near-miss passage: Sigma rule: Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and es. Logsource: aws / cloudtrail. Rule: title: AWS STS GetSessionToken Misuse id: b45ab1d2-712f-4f01-a751-df3826969807 status: test description: Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges. references: - https://github.com/elastic/detection-rules/pull/1213 - https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html author: Austin Songer @austinsonger date: 2021-07-24 modified: 2022-10-09 tags: - attack.lateral-movement - attack.privilege-escalation - attack.t1548 - attack.t1550 - attack.t1550.001 logsource: product: aws service: cloudtrail detection: selection: eventSource: sts.amazonaws.com eventName: GetSessionToken userIdentity.type: IAMUser condition: selection falsepositives: - GetSessionToken may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. GetSessionToken from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Query: vulnerability: Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before
Matching passage: CVE-2015-3079. CWE: CWE-264. CVSS: 5.0. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-0662. CWE: CWE-264. CVSS: 7.199999809265137. Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to gain privileges via crafted IPC messages that trigger use of root privileges for a software-package installation, aka Bug ID CSCus79385.
Query: CVE similar to CVE-2015-6170
Matching passage: CVE-2015-6170. CWE: CWE-264. CVSS: 6.800000190734863. Microsoft Edge allows remote attackers to gain privileges via a crafted web site, aka "Microsoft Browser Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-5301. CWE: CWE-264. CVSS: 5.5. providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).
Query: describe CVE-2015-9120
Matching passage: CVE-2015-9120. CWE: CWE-388. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, and SD 835, detection of Error Condition Without Action in Core.
Near-miss passage: CVE-2015-9218. CWE: CWE-388. CVSS: 5.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SDM630, SDM636, SDM660, and Snapdragon_High_Med_2016, when processing bad HEVC clips, the DPB fills, and with no error handling for DPB being full, a hang occurs.