alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: The portal client in IBM Tivoli Monitoring (ITM) 6.2.2 through FP9, 6.2.3 through FP5, and 6.3.0 through FP6 allows remote authenticated users to gain privileges via unspecified ve
Matching passage: CVE-2015-7411. CWE: CWE-264. CVSS: 9.899999618530273. The portal client in IBM Tivoli Monitoring (ITM) 6.2.2 through FP9, 6.2.3 through FP5, and 6.3.0 through FP6 allows remote authenticated users to gain privileges via unspecified vectors.
Near-miss passage: CVE-2015-2075. CWE: CWE-264. CVSS: 5.0. SAP BusinessObjects Edge 4.0 allows remote attackers to delete audit events from the auditee queue via a clearData CORBA operation, aka SAP Note 2011396.
Query: rule covering Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as us
Matching passage: Sigma rule: Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as us. Logsource: windows / process_creation. Rule: title: Command Line Execution with Suspicious URL and AppData Strings id: 1ac8666b-046f-4201-8aba-1951aaec03a3 status: test description: Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell) references: - https://www.hybrid-analysis.com/sample/3a1f01206684410dbe8f1900bbeaaa543adfcd07368ba646b499fa5274b9edf6?environmentId=100 - https://www.hybrid-analysis.com/sample/f16c729aad5c74f19784a24257236a8bbe27f7cdc4a89806031ec7f1bebbd475?environmentId=100 author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community date: 2019-01-16 modified: 2021-11-27 tags: - attack.execution - attack.command-and-control - attack.t1059.003 - attack.t1059.001 - attack.t1105 logsource: category: process_creation product: windows detection: selection: Image|endswith: \cmd.exe CommandLine|contains|all: - http - :// - '%AppData%' condition: selection falsepositives: - High level: medium
Near-miss passage: Sigma rule: Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of mali. Logsource: windows / terminalservices-localsessionmanager. Rule: title: Ngrok Usage with Remote Desktop Service id: 64d51a51-32a6-49f0-9f3d-17e34d640272 status: test description: Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of malicious behaviour references: - https://twitter.com/tekdefense/status/1519711183162556416?s=12&t=OTsHCBkQOTNs1k3USz65Zg - https://ngrok.com/ author: Florian Roth (Nextron Systems) date: 2022-04-29 tags: - attack.command-and-control - attack.t1090 logsource: product: windows service: terminalservices-localsessionmanager detection: selection: EventID: 21 Address|contains: '16777216' condition: selection falsepositives: - Unknown level: high
Query: secure coding against Improper Scrubbing of Sensitive Data from Decommissioned Device
Matching passage: CWE-1266 Improper Scrubbing of Sensitive Data from Decommissioned Device. The product does not properly provide a capability for the product administrator to remove sensitive data at the time the product is decommissioned. A scrubbing capability could be missing, insufficient, or incorrect.
Near-miss passage: CWE-1251 Mirrored Regions with Different Values. The product's architecture mirrors regions without ensuring that their contents always stay in sync.
Query: risk of The Newphoria Auction Camera application for iOS and before 1.2 for Android allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified ve
Matching passage: CVE-2015-5633. CWE: CWE-264. CVSS: 6.800000190734863. The Newphoria Auction Camera application for iOS and before 1.2 for Android allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
Near-miss passage: CVE-2015-7861. CWE: CWE-264. CVSS: 10.0. Persistent Accelerite Radia Client Automation (formerly HP Client Automation), possibly before 9.1, allows remote attackers to execute arbitrary code by sending unspecified commands in an environment that lacks relationship-based firewalling.
Query: exploit PACTware 4.1 SP3 allows remote attackers to cause a denial of service (application crash) via a crafted file that triggers an internal error.
Matching passage: CVE-2015-0989. CWE: CWE-19. CVSS: 4.300000190734863. PACTware 4.1 SP3 allows remote attackers to cause a denial of service (application crash) via a crafted file that triggers an internal error.
Near-miss passage: CVE-2015-3225. CWE: CWE-19. CVSS: 5.0. lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.
Query: how to detect Stored Data Manipulation
Matching passage: T1565.001 Stored Data Manipulation. Tactics: impact. Description: Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Near-miss passage: T1565 Data Manipulation. Tactics: impact. Description: Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: Sygnia Elephant Beetle Jan 2022) By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making. The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Query: patch priority for CVE-2015-3283
Matching passage: CVE-2015-3283. CWE: CWE-264. CVSS: 6.800000190734863. OpenAFS before 1.6.13 allows remote attackers to spoof bos commands via unspecified vectors.
Near-miss passage: CVE-2015-4596. CWE: CWE-264. CVSS: 7.800000190734863. Lenovo Mouse Suite before 6.73 allows local users to run arbitrary code with administrator privileges.
Query: risk of Apple iOS before 8.4.1 and OS X before 10.10.5 allow local users to bypass a code-signing protection mechanism by appending code to a crafted executable file.
Matching passage: CVE-2015-3806. CWE: CWE-284. CVSS: 7.199999809265137. Apple iOS before 8.4.1 and OS X before 10.10.5 allow local users to bypass a code-signing protection mechanism by appending code to a crafted executable file.
Near-miss passage: CVE-2015-7887. CWE: CWE-284. CVSS: 8.100000381469727. NetApp SnapCenter Server 1.0 allows remote authenticated users to list and delete backups.
Query: common weakness: Critical Public Variable Without Final Modifier
Matching passage: CWE-493 Critical Public Variable Without Final Modifier. The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values.
Near-miss passage: CWE-366 Race Condition within a Thread. If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.
Query: exploit Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.
Matching passage: CVE-2015-7510. CWE: CWE-119. CVSS: 9.800000190734863. Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.
Near-miss passage: CVE-2015-1257. CWE: CWE-119. CVSS: 7.5. platform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, does not properly handle an insufficient number of values in an feColorMatrix filter, which allows remote attackers to cause a denial of service (container overflow) or possibly have unspecified other impact via a crafted document.
Query: Outbound C2 pattern associated with System Language Discovery
Matching passage: T1614.001 System Language Discovery. Tactics: discovery. Description: Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host. This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions. This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities.(Citation: Malware System Language Check) There are various sources of data an adversary could use to infer system language, such as system defaults and keyboard layouts. Specific checks will vary based on the target and/or adversary, but may involve behaviors such as [Query Registry](https://attack.mitre.org/techniques/T1012) and calls to [Native API](https://attack.mitre.org/techniques/T1106) functions.(Citation: CrowdStrike Ryuk January 2019) For example, on a Windows system adversaries may attempt to infer the language of a system by querying the registry key <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language</code> or parsing the outputs of Windows API functions <code>GetUserDefaultUILanguage</code>, <code>GetSystemDefaultUILanguage</code>, <code>GetKeyboardLayoutList</code> and <code>GetUserDefaultLangID</code>.(Citation: Darkside Ransomware Cybereason)(Citation: Securelist JSWorm)(Citation: SecureList SynAck Doppelgänging May 2018) On a macOS or Linux system, adversaries may query <code>locale</code> to retrieve the value of the <code>$LANG</code> environment variable.
Near-miss passage: T1614 System Location Discovery. Tactics: discovery. Description: Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from [System Location Discovery](https://attack.mitre.org/techniques/T1614) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.(Citation: FBI Ragnar Locker 2020)(Citation: Sophos Geolocation 2016)(Citation: Bleepingcomputer RAT malware 2020) Windows API functions such as <code>GetLocaleInfoW</code> can also be used to determine the locale of the host.(Citation: FBI Ragnar Locker 2020) In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.(Citation: AWS Instance Identity Documents)(Citation: Microsoft Azure Instance Metadata 2021) Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.(Citation: Securelist Trasparent Tribe 2020)(Citation: Sophos Geolocation 2016)
Query: patch priority for CVE-2015-0775
Matching passage: CVE-2015-0775. CWE: CWE-399. CVSS: 5.0. The banner (aka MOTD) implementation in Cisco NX-OS 4.1(2)E1(1f) on Nexus 4000 devices, 5.2(1)SV3(2.1) on Nexus 1000V devices, 6.0(2)N2(2) on Nexus 5000 devices, 6.2(11) on MDS 9000 devices, 6.2(12) on Nexus 7000 devices, 7.0(3) on Nexus 9000 devices, and 7.2(0)ZN(99.67) on Nexus 3000 devices allows remote attackers to cause a denial of service (login process reset) via an unspecified terminal-session request during TELNET session setup, aka Bug IDs CSCuo10554, CSCuu75466, CSCuu75471, CSCuu75484, CSCuu75498, CSCuu77170, and CSCuu77182.
Near-miss passage: CVE-2015-8858. CWE: CWE-399. CVSS: 7.5. The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, aka a "regular expression denial of service (ReDoS)."
Query: secure coding against Improper Preservation of Consistency Between Independent Representations of Shared State
Matching passage: CWE-1250 Improper Preservation of Consistency Between Independent Representations of Shared State. The product has or supports multiple distributed components or sub-systems that are each required to keep their own local copy of shared data - such as state or cache - but the product does not ensure that all local copies remain consistent with each other.
Near-miss passage: CWE-383 J2EE Bad Practices: Direct Use of Threads. Thread management in a Web application is forbidden in some circumstances and is always highly error prone.
Query: describe CVE-2015-2899
Matching passage: CVE-2015-2899. CWE: CWE-119. CVSS: 6.800000190734863. Heap-based buffer overflow in the QualifierList retrieve_qualifier_list function in Medicomp MEDCIN Engine before 2.22.20153.226 might allow remote attackers to execute arbitrary code via a long list name in a packet on port 8190.
Near-miss passage: CVE-2015-7183. CWE: CWE-119. CVSS: 7.5. Integer overflow in the PL_ARENA_ALLOCATE implementation in Netscape Portable Runtime (NSPR) in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.
Query: write Sigma for Detects suspicious child processes of electron apps (teams, discord, slack, etc.). This could be a potential sign of ".a
Matching passage: Sigma rule: Detects suspicious child processes of electron apps (teams, discord, slack, etc.). This could be a potential sign of ".a. Logsource: windows / process_creation. Rule: title: Suspicious Electron Application Child Processes id: f26eb764-fd89-464b-85e2-dc4a8e6e77b8 related: - id: 378a05d8-963c-46c9-bcce-13c7657eac99 type: similar status: test description: 'Detects suspicious child processes of electron apps (teams, discord, slack, etc.). This could be a potential sign of ".asar" file tampering (See reference section for more information) or binary execution proxy through specific CLI arguments (see related rule) ' references: - https://taggart-tech.com/quasar-electron/ - https://github.com/mttaggart/quasar - https://positive.security/blog/ms-officecmd-rce - https://lolbas-project.github.io/lolbas/Binaries/Msedge/ - https://lolbas-project.github.io/lolbas/Binaries/Teams/ - https://lolbas-project.github.io/lolbas/Binaries/msedgewebview2/ - https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-21 modified: 2024-07-12 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \chrome.exe - \discord.exe - \GitHubDesktop.exe - \keybase.exe - \msedge.exe - \msedgewebview2.exe - \msteams.exe - \slack.exe - \teams.exe selection_child_image: Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \whoami.exe - \wscript.exe selection_child_paths: Image|contains: - :\ProgramData\ - :\Temp\ - \AppData\Local\Temp\ - \Users\Public\ - \Windows\Temp\ filter_optional_discord: ParentImage|endswith: \Discord.exe Image|endswith: \cmd.exe CommandLine|contains: \NVSMI\nvidia-smi.exe condition: selection_parent and 1 of selection_child_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Executes arbitrary PowerShell code using SyncAppvPublishingServer.vbs. Logsource: windows / process_creation. Rule: title: SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code id: 36475a7d-0f6d-4dce-9b01-6aeb473bbaf1 status: test description: Executes arbitrary PowerShell code using SyncAppvPublishingServer.vbs references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1216/T1216.md - https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/ author: frack113 date: 2021-07-16 modified: 2022-06-22 tags: - attack.stealth - attack.t1218 - attack.t1216 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - \SyncAppvPublishingServer.vbs - ; condition: selection falsepositives: - Unknown level: medium
Query: explain CWE-1123
Matching passage: CWE-1123 Excessive Use of Self-Modifying Code. The product uses too much self-modifying code.
Near-miss passage: CWE-467 Use of sizeof() on a Pointer Type. The code calls sizeof() on a pointer type, which can be an incorrect calculation if the programmer intended to determine the size of the data that is being pointed to.
Query: vulnerability: Cisco Wireless LAN Controller (WLC) devices with software 7.0(240.0), 7.3(101.0), and 7.4(1.19) allow remote attackers to cause a denial of service (device outage) by sending malfo
Matching passage: CVE-2015-6311. CWE: CWE-399. CVSS: 6.099999904632568. Cisco Wireless LAN Controller (WLC) devices with software 7.0(240.0), 7.3(101.0), and 7.4(1.19) allow remote attackers to cause a denial of service (device outage) by sending malformed 802.11i management data to a managed access point, aka Bug ID CSCub65236.
Near-miss passage: CVE-2015-0712. CWE: CWE-399. CVSS: 5.0. The session-manager service in Cisco StarOS 12.0, 12.2(300), 14.0, and 14.0(600) on ASR 5000 devices allows remote attackers to cause a denial of service (service reload and packet loss) via malformed HTTP packets, aka Bug ID CSCud14217.
Query: risk of The png_convert_to_rfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before 1.2.54, and 1.4.x before 1.4.17 allows remote attackers to obtain sensitive process memory 
Matching passage: CVE-2015-7981. CWE: CWE-200. CVSS: 5.0. The png_convert_to_rfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before 1.2.54, and 1.4.x before 1.4.17 allows remote attackers to obtain sensitive process memory information via crafted tIME chunk data in an image file, which triggers an out-of-bounds read.
Near-miss passage: CVE-2015-4929. CWE: CWE-200. CVSS: 4.0. IBM License Metric Tool 9 before 9.2.1.0 and Endpoint Manager for Software Use Analysis 9 before 9.2.1.0 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information via a REST API request.
Query: secure coding against Small Seed Space in PRNG
Matching passage: CWE-339 Small Seed Space in PRNG. A Pseudo-Random Number Generator (PRNG) uses a relatively small seed space, which makes it more susceptible to brute force attacks.
Near-miss passage: CWE-301 Reflection Attack in an Authentication Protocol. Simple authentication protocols are subject to reflection attacks if a malicious user can use the target machine to impersonate a trusted user.
Query: exploit Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and installed files, which allows local users to gain SYSTEM privileges
Matching passage: CVE-2015-7378. CWE: CWE-276. CVSS: 7.800000190734863. Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and installed files, which allows local users to gain SYSTEM privileges by modifying Panda_URL_Filteringb.exe.
Near-miss passage: CVE-2015-7985. CWE: CWE-276. CVSS: 7.199999809265137. Valve Steam 2.10.91.91 uses weak permissions (Users: read and write) for the Install folder, which allows local users to gain privileges via a Trojan horse steam.exe file.
Query: campaign using Port Knocking
Matching passage: T1205.001 Port Knocking. Tactics: stealth, persistence, command and control. Description: Adversaries may use port knocking to hide open ports used for persistence or command and control. To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports. After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software. This technique has been observed both for the dynamic opening of a listening port as well as the initiating of a connection to a listening server on a different system. The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.
Near-miss passage: T1205 Traffic Signaling. Tactics: stealth, persistence, command and control. Description: Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control. Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task. This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control. Usually this series of packets consists of attempted connections to a predefined sequence of closed ports (i.e. [Port Knocking](https://attack.mitre.org/techniques/T1205/001)), but can involve unusual flags, specific strings, or other unique characteristics. After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software. Adversaries may also communicate with an already open port, but the service listening on that port will only respond to commands or trigger other malicious functionality if passed the appropriate magic value(s). The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs. On network devices, adversaries may use crafted packets to enable [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004) for standard services offered by the device such as telnet. Such signaling may also be used to open a closed service port such as telnet, or to trigger module modification of malware implants on the device, adding, removing, or changing malicious capabilities. Adversaries may use crafted packets to attempt to connect to one or more (open or closed) ports, but may also