alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-9066
Matching passage: CVE-2015-9066. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in an Inter-RAT procedure.
Near-miss passage: CVE-2015-5950. CWE: CWE-119. CVSS: 6.900000095367432. The NVIDIA display driver R352 before 353.82 and R340 before 341.81 on Windows; R304 before 304.128, R340 before 340.93, and R352 before 352.41 on Linux; and R352 before 352.46 on GRID vGPU and vSGA allows local users to write to an arbitrary kernel memory location and consequently gain privileges via a crafted ioctl call.
Query: describe CVE-2015-7278
Matching passage: CVE-2015-7278. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability on Amped Wireless R10000 devices with firmware 2.5.2.11 allows remote attackers to hijack the authentication of arbitrary users.
Near-miss passage: CVE-2015-9428. CWE: CWE-352. CVSS: 6.5. The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address, or lp-niche parameters.
Query: patch priority for CVE-2015-7985
Matching passage: CVE-2015-7985. CWE: CWE-276. CVSS: 7.199999809265137. Valve Steam 2.10.91.91 uses weak permissions (Users: read and write) for the Install folder, which allows local users to gain privileges via a Trojan horse steam.exe file.
Near-miss passage: CVE-2015-7378. CWE: CWE-276. CVSS: 7.800000190734863. Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and installed files, which allows local users to gain SYSTEM privileges by modifying Panda_URL_Filteringb.exe.
Query: write Sigma for Detects changes to the security group entries for RDS databases. This can indicate that a misconfiguration has occurred
Matching passage: Sigma rule: Detects changes to the security group entries for RDS databases. This can indicate that a misconfiguration has occurred. Logsource: aws / cloudtrail. Rule: title: RDS Database Security Group Modification id: 14f3f1c8-02d5-43a2-a191-91ffb52d3015 status: test description: 'Detects changes to the security group entries for RDS databases. This can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users. ' references: - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/ author: jamesc-grafana date: 2024-07-11 tags: - attack.initial-access - attack.t1190 logsource: product: aws service: cloudtrail detection: selection: eventSource: rds.amazonaws.com eventName: - AuthorizeDBSecurityGroupIngress - CreateDBSecurityGroup - DeleteDBSecurityGroup - RevokeDBSecurityGroupIngress condition: selection falsepositives: - Creation of a new Database that needs new security group rules level: medium
Near-miss passage: Sigma rule: Detects the creation of tasks from processes executed from suspicious locations. Logsource: windows / file_event. Rule: title: Suspicious Scheduled Task Write to System32 Tasks id: 80e1f67a-4596-4351-98f5-a9c3efabac95 status: test description: Detects the creation of tasks from processes executed from suspicious locations references: - Internal Research author: Florian Roth (Nextron Systems) date: 2021-11-16 modified: 2022-01-12 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \Windows\System32\Tasks Image|contains: - \AppData\ - C:\PerfLogs - \Windows\System32\config\systemprofile condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-8451
Matching passage: CVE-2015-8451. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, and CVE-2015-8455.
Near-miss passage: CVE-2015-5156. CWE: CWE-119. CVSS: 6.099999904632568. The virtnet_probe function in drivers/net/virtio_net.c in the Linux kernel before 4.2 attempts to support a FRAGLIST feature without proper memory allocation, which allows guest OS users to cause a denial of service (buffer overflow and memory corruption) via a crafted sequence of fragmented packets.
Query: describe CVE-2015-6831
Matching passage: CVE-2015-6831. CWE: CWE-416. CVSS: 7.300000190734863. Multiple use-after-free vulnerabilities in SPL in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allow remote attackers to execute arbitrary code via vectors involving (1) ArrayObject, (2) SplObjectStorage, and (3) SplDoublyLinkedList, which are mishandled during unserialization.
Near-miss passage: CVE-2015-7687. CWE: CWE-416. CVSS: 9.800000190734863. Use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving req_ca_vrfy_smtp and req_ca_vrfy_mta.
Query: risk of Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '\' or '/' characters for directo
Matching passage: CVE-2015-7851. CWE: CWE-22. CVSS: 6.5. Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '\' or '/' characters for directory separation such as OpenVMS, allows remote authenticated users to overwrite arbitrary files.
Near-miss passage: CVE-2015-1193. CWE: CWE-22. CVSS: 5.0. Multiple directory traversal vulnerabilities in pax 1:20140703 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive.
Query: Sigma rule for Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.
Matching passage: Sigma rule: Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.. Logsource: windows / process_creation. Rule: title: Potential Amazon SSM Agent Hijacking id: d20ee2f4-822c-4827-9e15-41500b1fff10 status: test description: Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report. references: - https://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan - https://www.bleepingcomputer.com/news/security/amazons-aws-ssm-agent-can-be-used-as-post-exploitation-rat-malware/ - https://www.helpnetsecurity.com/2023/08/02/aws-instances-attackers-access/ author: Muhammad Faisal date: 2023-08-02 tags: - attack.command-and-control - attack.persistence - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: Image|endswith: \amazon-ssm-agent.exe CommandLine|contains|all: - '-register ' - '-code ' - '-id ' - '-region ' condition: selection falsepositives: - Legitimate activity of system administrators level: medium
Near-miss passage: Sigma rule: Detects a method to load DLL via LSASS process using an undocumented Registry key. Logsource: windows / registry_event. Rule: title: DLL Load via LSASS id: b3503044-60ce-4bf4-bbcb-e3db98788823 status: test description: Detects a method to load DLL via LSASS process using an undocumented Registry key references: - https://blog.xpnsec.com/exploring-mimikatz-part-1/ - https://twitter.com/SBousseaden/status/1183745981189427200 author: Florian Roth (Nextron Systems) date: 2019-10-16 modified: 2022-04-21 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1547.008 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: - \CurrentControlSet\Services\NTDS\DirectoryServiceExtPt - \CurrentControlSet\Services\NTDS\LsaDbExtPt filter_domain_controller: Image: C:\Windows\system32\lsass.exe Details: - '%%systemroot%%\system32\ntdsa.dll' - '%%systemroot%%\system32\lsadb.dll' condition: selection and not 1 of filter_* falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-0112
Matching passage: CVE-2015-0112. CWE: UNKNOWN. CVSS: 4.0. Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management (CLM) 3.0.1, 4.x before 4.0.7 IF5, and 5.x before 5.0.2 IF4; Rational Quality Manager (RQM) 2.0 through 2.0.1, 3.0 through 3.0.1.6, 4.0 through 4.0.7, and 5.0 through 5.0.2; Rational Team Concert (RTC) 2.0 through 2.0.0.2, 3.x before 3.0.1.6 IF6, 4.x before 4.0.7 IF5, and 5.x before 5.0.2 IF4; Rational Requirements Composer (RRC) 2.0 through 2.0.0.4, 3.x before 3.0.1.6 IF6, and 4.0 through 4.0.7; Rational DOORS Next Generation (RDNG) 4.x before 4.0.7 IF5 and 5.x before 5.0.2 IF4; Rational Engineering Lifecycle Manager (RELM) 1.0 through 1.0.0.1, 4.0.3 through 4.0.7, and 5.0 through 5.0.2; Rational Rhapsody Design Manager (DM) 3.0 through 3.0.1, 4.0 through 4.0.7, and 5.0 through 5.0.2; and Rational Software Architect Design Manager (RSA DM) 3.0 through 3.0.1, 4.0 through 4.0.7, and 5.0 through 5.0.2 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Near-miss passage: CVE-2015-9216. CWE: UNKNOWN. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9625, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 808, and SD 810, improper handling of simultaneous interrupt in USB module during USB RESET and EP COMPLETE.
Query: vulnerability: The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameter.
Matching passage: CVE-2015-9316. CWE: CWE-89. CVSS: 9.800000190734863. The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameter.
Near-miss passage: CVE-2015-2035. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote administrators to execute arbitrary SQL commands via the user parameter in the history page to admin.php.
Query: exploit The booking-system plugin before 2.1 for WordPress has DOPBSPBackEndTranslation::display SQL injection via the language parameter.
Matching passage: CVE-2015-9460. CWE: CWE-89. CVSS: 8.800000190734863. The booking-system plugin before 2.1 for WordPress has DOPBSPBackEndTranslation::display SQL injection via the language parameter.
Near-miss passage: CVE-2015-1397. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set.
Query: detection rule: Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string
Matching passage: Sigma rule: Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string. Logsource: proxy. Rule: title: Rclone Activity via Proxy id: 2c03648b-e081-41a5-b9fb-7d854a915091 status: test description: Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string references: - https://rclone.org/ - https://www.kroll.com/en/insights/publications/cyber/new-m365-business-email-compromise-attacks-with-rclone author: Janantha Marasinghe date: 2022-10-18 tags: - attack.exfiltration - attack.t1567.002 logsource: category: proxy detection: selection: c-useragent|startswith: rclone/v condition: selection falsepositives: - Valid requests with this exact user agent to that is used by legitimate scripts or sysadmin operations level: medium
Near-miss passage: Sigma rule: Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more. Logsource: windows / security. Rule: title: Password Protected ZIP File Opened (Suspicious Filenames) id: 54f0434b-726f-48a1-b2aa-067df14516e4 status: test description: Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened. references: - https://twitter.com/sbousseaden/status/1523383197513379841 author: Florian Roth (Nextron Systems) date: 2022-05-09 tags: - attack.command-and-control - attack.stealth - attack.t1027 - attack.t1105 - attack.t1036 logsource: product: windows service: security detection: selection: EventID: 5379 TargetName|contains: Microsoft_Windows_Shell_ZipFolder:filename selection_filename: TargetName|contains: - invoice - new order - rechnung - factura - delivery - purchase - order - payment condition: selection and selection_filename falsepositives: - Legitimate used of encrypted ZIP files level: high
Query: describe CVE-2015-8402
Matching passage: CVE-2015-8402. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-0370. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote authenticated users to affect integrity via unknown vectors, a different vulnerability than CVE-2013-5858.
Query: rule covering Detects potential DLL sideloading of an unsigned dbghelp.dll by the Sysinternals VMMap.
Matching passage: Sigma rule: Detects potential DLL sideloading of an unsigned dbghelp.dll by the Sysinternals VMMap.. Logsource: windows / image_load. Rule: title: VMMap Unsigned Dbghelp.DLL Potential Sideloading id: 273a8dd8-3742-4302-bcc7-7df5a80fe425 related: - id: 98ffaed4-aec2-4e04-9b07-31492fe68b3d type: similar status: test description: Detects potential DLL sideloading of an unsigned dbghelp.dll by the Sysinternals VMMap. references: - https://techcommunity.microsoft.com/t5/sysinternals-blog/zoomit-v7-1-procdump-2-0-for-linux-process-explorer-v17-05/ba-p/3884766 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-07-28 modified: 2023-09-05 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|contains: C:\Debuggers\dbghelp.dll Image|endswith: - \vmmap.exe - \vmmap64.exe filter_main_signed: Signed: 'true' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive. Logsource: aws / cloudtrail. Rule: title: PUA - AWS TruffleHog Execution id: a840e606-7c8c-4684-9bc1-eb6b6155127f status: experimental description: 'Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment. It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious. ' references: - https://github.com/trufflesecurity/trufflehog - https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-10-21 tags: - attack.credential-access - attack.t1555 - attack.t1003 logsource: product: aws service: cloudtrail detection: selection: userAgent: TruffleHog condition: selection falsepositives: - Legitimate use of TruffleHog by security teams for credential scanning. level: medium
Query: detection rule: Detects Processes accessing the camera and microphone from suspicious folder
Matching passage: Sigma rule: Detects Processes accessing the camera and microphone from suspicious folder. Logsource: windows / registry_event. Rule: title: Suspicious Camera and Microphone Access id: 62120148-6b7a-42be-8b91-271c04e281a3 status: test description: Detects Processes accessing the camera and microphone from suspicious folder references: - https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072 author: Den Iuzvyk date: 2020-06-07 modified: 2022-10-09 tags: - attack.collection - attack.t1125 - attack.t1123 logsource: category: registry_event product: windows detection: selection_1: TargetObject|contains|all: - \Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\ - \NonPackaged selection_2: TargetObject|contains: - microphone - webcam selection_3: TargetObject|contains: - :#Windows#Temp# - :#$Recycle.bin# - :#Temp# - :#Users#Public# - :#Users#Default# - :#Users#Desktop# condition: all of selection_* falsepositives: - Unlikely, there could be conferencing software running from a Temp folder accessing the devices level: high
Near-miss passage: Sigma rule: Detects extracting of zip file from image file. Logsource: linux / auditd. Rule: title: Steganography Unzip Hidden Information From Picture File id: edd595d7-7895-4fa7-acb3-85a18a8772ca status: test description: Detects extracting of zip file from image file references: - https://zerotoroot.me/steganography-hiding-a-zip-in-a-jpeg-file/ author: Pawel Mazur date: 2021-09-09 modified: 2022-10-09 tags: - attack.stealth - attack.t1027.003 logsource: product: linux service: auditd detection: commands: type: EXECVE a0: unzip a1: a1|endswith: - .jpg - .png condition: commands and a1 falsepositives: - Unknown level: low
Query: telemetry for T1578.004
Matching passage: T1578.004 Revert Cloud Instance. Tactics: defense impairment. Description: An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence. In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine (VM) or data storage snapshots through the cloud management dashboard or cloud APIs. Another variation of this technique is to utilize temporary storage attached to the compute instance. Most cloud providers provide various types of storage including persistent, local, and/or ephemeral, with the ephemeral types often reset upon stop/restart of the VM.(Citation: Tech Republic - Restore AWS Snapshots)(Citation: Google - Restore Cloud Snapshot)
Near-miss passage: T1578.005 Modify Cloud Compute Configurations. Tactics: defense impairment. Description: Adversaries may modify settings that directly affect the size, locations, and resources available to cloud compute infrastructure in order to evade defenses. These settings may include service quotas, subscription associations, tenant-wide policies, or other configurations that impact available compute. Such modifications may allow adversaries to abuse the victim’s compute resources to achieve their goals, potentially without affecting the execution of running instances and/or revealing their activities to the victim. For example, cloud providers often limit customer usage of compute resources via quotas. Customers may request adjustments to these quotas to support increased computing needs, though these adjustments may require approval from the cloud provider. Adversaries who compromise a cloud environment may similarly request quota adjustments in order to support their activities, such as enabling additional [Resource Hijacking](https://attack.mitre.org/techniques/T1496) without raising suspicion by using up a victim’s entire quota.(Citation: Microsoft Cryptojacking 2023) Adversaries may also increase allowed resource usage by modifying any tenant-wide policies that limit the sizes of deployed virtual machines.(Citation: Microsoft Azure Policy) Adversaries may also modify settings that affect where cloud resources can be deployed, such as enabling [Unused/Unsupported Cloud Regions](https://attack.mitre.org/techniques/T1535).
Query: incident response steps for Multiple failed authentications followed by Symmetric Cryptography
Matching passage: Playbook for T1573.001 Symmetric Cryptography. 1) Validate alert telemetry against T1573.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: command and control. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.
Near-miss passage: Playbook for T1573 Encrypted Channel. Different response path focused on command and control.