alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: what is T1555.006
Matching passage: T1555.006 Cloud Secrets Management Stores. Tactics: credential access. Description: Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault. Secrets managers support the secure centralized management of passwords, API keys, and other credential material. Where secrets managers are in use, cloud services can dynamically acquire credentials via API requests rather than accessing secrets insecurely stored in plain text files or environment variables. If an adversary is able to gain sufficient privileges in a cloud environment – for example, by obtaining the credentials of high-privileged [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004) or compromising a service that has permission to retrieve secrets – they may be able to request secrets from the secrets manager. This can be accomplished via commands such as `get-secret-value` in AWS, `gcloud secrets describe` in GCP, and `az key vault secret show` in Azure.(Citation: Permiso Scattered Spider 2023)(Citation: Sysdig ScarletEel 2.0 2023)(Citation: AWS Secrets Manager)(Citation: Google Cloud Secrets)(Citation: Microsoft Azure Key Vault) **Note:** this technique is distinct from [Cloud Instance Metadata API](https://attack.mitre.org/techniques/T1552/005) in that the credentials are being directly requested from the cloud secrets manager, rather than through the medium of the instance metadata API.
Near-miss passage: T1555.002 Securityd Memory. Tactics: credential access. Description: An adversary with root access may gather credentials by reading `securityd`’s memory. `securityd` is a service/daemon responsible for implementing security protocols such as encryption and authorization.(Citation: Apple Dev SecurityD) A privileged adversary may be able to scan through `securityd`'s memory to find the correct sequence of keys to decrypt the user’s logon keychain. This may provide the adversary with various plaintext passwords, such as those for users, WiFi, mail, browsers, certificates, secure notes, etc.(Citation: OS X Keychain)(Citation: OSX Keydnap malware) In OS X prior to El Capitan, users with root access can read plaintext keychain passwords of logged-in users because Apple’s keychain implementation allows these credentials to be cached so that users are not repeatedly prompted for passwords.(Citation: OS X Keychain)(Citation: External to DA, the OS X Way) Apple’s `securityd` utility takes the user’s logon password, encrypts it with PBKDF2, and stores this master key in memory. Apple also uses a set of keys and algorithms to encrypt the user’s password, but once the master key is found, an adversary need only iterate over the other values to unlock the final password.(Citation: OS X Keychain)
Query: risk of Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Office for Mac 2011, Excel Viewer 2007 SP3, Office Compatibility Pack SP3, Excel Services on SharePoint
Matching passage: CVE-2015-2376. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Office for Mac 2011, Excel Viewer 2007 SP3, Office Compatibility Pack SP3, Excel Services on SharePoint Server 2007 SP3, Excel Services on SharePoint Server 2010 SP2, and Excel Services on SharePoint Server 2013 SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-6609. CWE: CWE-119. CVSS: 10.0. libutils in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22953624.
Query: secure coding against Insufficient Granularity of Address Regions Protected by Register Locks
Matching passage: CWE-1222 Insufficient Granularity of Address Regions Protected by Register Locks. The product defines a large address region protected from modification by the same register lock control bit. This results in a conflict between the functional requirement that some addresses need to be writable by software during operation and the security requirement that the system configuration lock bit must be set during the boot process.
Near-miss passage: CWE-498 Cloneable Class Containing Sensitive Information. The code contains a class with sensitive data, but the class is cloneable. The data can then be accessed by cloning the class.
Query: exploit The SwiftKey language-pack update implementation on Samsung Galaxy S4, S4 Mini, S5, and S6 devices relies on an HTTP connection to the skslm.swiftkey.net server, which allows man-i
Matching passage: CVE-2015-4640. CWE: CWE-254. CVSS: 2.9000000953674316. The SwiftKey language-pack update implementation on Samsung Galaxy S4, S4 Mini, S5, and S6 devices relies on an HTTP connection to the skslm.swiftkey.net server, which allows man-in-the-middle attackers to write to language-pack files by modifying an HTTP response. NOTE: CVE-2015-4640 exploitation can be combined with CVE-2015-4641 exploitation for man-in-the-middle code execution.
Near-miss passage: CVE-2015-6473. CWE: CWE-254. CVSS: 9.800000190734863. WAGO IO 750-849 01.01.27 and WAGO IO 750-881 01.02.05 do not contain privilege separation.
Query: explain CWE-327
Matching passage: CWE-327 Use of a Broken or Risky Cryptographic Algorithm. The product uses a broken or risky cryptographic algorithm or protocol.
Near-miss passage: CWE-770 Allocation of Resources Without Limits or Throttling. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Query: campaign using Delete Cloud Instance
Matching passage: T1578.003 Delete Cloud Instance. Tactics: defense impairment. Description: An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence. Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable. An adversary may also [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and later terminate the instance after achieving their objectives.(Citation: Mandiant M-Trends 2020)
Near-miss passage: T1578.001 Create Snapshot. Tactics: defense impairment. Description: An adversary may create a snapshot or data backup within a cloud account to evade defenses. A snapshot is a point-in-time copy of an existing cloud compute component such as a virtual machine (VM), virtual hard drive, or volume. An adversary may leverage permissions to create a snapshot in order to bypass restrictions that prevent access to existing compute service infrastructure, unlike in [Revert Cloud Instance](https://attack.mitre.org/techniques/T1578/004) where an adversary may revert to a snapshot to evade detection and remove evidence of their presence. An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002), mount one or more created snapshots to that instance, and then apply a policy that allows the adversary access to the created instance, such as a firewall policy that allows them inbound and outbound SSH access.(Citation: Mandiant M-Trends 2020)
Query: CVE similar to CVE-2015-0974
Matching passage: CVE-2015-0974. CWE: CWE-426. CVSS: 7.800000190734863. Untrusted search path vulnerability in ZTE Datacard MF19 0V1.0.0B04 allows local users to gain privilege by modifying the 'Ucell Internet' directory to reference a malicious mms_dll_r.dll or mediaplayerdll.dll.
Near-miss passage: CVE-2015-3887. CWE: CWE-426. CVSS: 7.800000190734863. Untrusted search path vulnerability in ProxyChains-NG before 4.9 allows local users to gain privileges via a Trojan horse libproxychains4.so library in the current working directory, which is referenced in the LD_PRELOAD path.
Query: alert when Detects potentially suspicious file downloads directly from IP addresses using Wget.exe
Matching passage: Sigma rule: Detects potentially suspicious file downloads directly from IP addresses using Wget.exe. Logsource: windows / process_creation. Rule: title: Suspicious File Download From IP Via Wget.EXE id: 17f0c0a8-8bd5-4ee0-8c5f-a342c0199f35 status: test description: Detects potentially suspicious file downloads directly from IP addresses using Wget.exe references: - https://www.gnu.org/software/wget/manual/wget.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-07-27 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wget.exe - OriginalFileName: wget.exe selection_ip: CommandLine|re: ://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3} selection_http: CommandLine|contains: http selection_flag: - CommandLine|re: \s-O\s - CommandLine|contains: --output-document selection_ext: CommandLine|endswith: - .ps1 - .ps1' - .ps1" - .dat - .dat' - .dat" - .msi - .msi' - .msi" - .bat - .bat' - .bat" - .exe - .exe' - .exe" - .vbs - .vbs' - .vbs" - .vbe - .vbe' - .vbe" - .hta - .hta' - .hta" - .dll - .dll' - .dll" - .psm1 - .psm1' - .psm1" condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of clip.exe in order to copy data to the clipboard. Adversaries may collect data stored in the cli. Logsource: windows / process_creation. Rule: title: Data Copied To Clipboard Via Clip.EXE id: ddeff553-5233-4ae9-bbab-d64d2bd634be status: test description: Detects the execution of clip.exe in order to copy data to the clipboard. Adversaries may collect data stored in the clipboard from users copying information within or between applications. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/clip - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1115/T1115.md author: frack113 date: 2021-07-27 modified: 2023-02-21 tags: - attack.collection - attack.t1115 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \clip.exe - OriginalFileName: clip.exe condition: selection falsepositives: - Unknown level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_clip_execution/info.yml simulation: - type: atomic-red-team name: Utilize Clipboard to store or execute commands from technique: T1115 atomic_guid: 0cd14633-58d4-4422-9ede-daa2c9474ae7
Query: describe CVE-2015-4225
Matching passage: CVE-2015-4225. CWE: CWE-264. CVSS: 4.0. Cisco Application Policy Infrastructure Controller (APIC) 1.0(1.110a) and 1.0(1e) on Nexus 9000 devices does not properly implement RBAC health scoring, which allows remote authenticated users to obtain sensitive information via unspecified vectors, aka Bug ID CSCuq77485.
Near-miss passage: CVE-2015-2126. CWE: CWE-264. CVSS: 7.199999809265137. Unspecified vulnerability in pppoec in HP HP-UX 11iv2 and 11iv3 allows local users to gain privileges by leveraging setuid permissions.
Query: SOC runbook when seeing Outbound C2 pattern associated with Dylib Hijacking
Matching passage: Playbook for T1574.004 Dylib Hijacking. 1) Validate alert telemetry against T1574.004. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth, execution. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may execute their own payloads by placing a malicious dynamic library (dylib) with an expected name in a path a victim application searches at runtime. The dynamic loader will try to find the dylibs based on the sequential order of the search paths. Paths to dylibs may be prefixed with <code>@rpath</code>, which allows developers to use relative paths to specify an array of search path
Near-miss passage: Playbook for T1574.011 Services Registry Permissions Weakness. Different response path focused on stealth, execution.
Query: patch priority for CVE-2015-6734
Matching passage: CVE-2015-6734. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in contrib/cssgen.php in the GeSHi, as used in the SyntaxHighlight_GeSHi extension and MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-3219. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.
Query: describe CVE-2015-4334
Matching passage: CVE-2015-4334. CWE: CWE-200. CVSS: 5.0. The default configuration of SGOS in Blue Coat ProxySG before 6.2.16.5, 6.5 before 6.5.7.1, and 6.6 before 6.6.2.1 forwards authentication challenges from upstream origin content servers (OCS) when used in an explicit proxy deployment, which makes it easier for remote attackers to obtain sensitive information via a 407 (aka Proxy Authentication Required) HTTP status code, as demonstrated when using NTLM authentication.
Near-miss passage: CVE-2015-6052. CWE: CWE-200. CVSS: 4.300000190734863. The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "VBScript and JScript ASLR Bypass."
Query: CVE similar to CVE-2015-9064
Matching passage: CVE-2015-9064. CWE: CWE-284. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, the UE can send IMEI or IMEISV to the network on a network request before NAS security has been activated.
Near-miss passage: CVE-2015-7473. CWE: CWE-284. CVSS: 2.5. runmqsc in IBM WebSphere MQ 8.x before 8.0.0.5 allows local users to bypass intended queue-manager command access restrictions by leveraging authority for +connect and +dsp.
Query: describe CVE-2015-2816
Matching passage: CVE-2015-2816. CWE: CWE-284. CVSS: 7.5. The XcListener in SAP Afaria 7.0.6001.5 does not properly restrict access, which allows remote attackers to have unspecified impact via a crafted request, aka SAP Security Note 2134905.
Near-miss passage: CVE-2015-4624. CWE: CWE-284. CVSS: 7.5. Hak5 WiFi Pineapple 2.0 through 2.3 uses predictable CSRF tokens.
Query: risk of ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by subm
Matching passage: CVE-2015-0222. CWE: CWE-17. CVSS: 5.0. ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries.
Near-miss passage: CVE-2015-6822. CWE: CWE-17. CVSS: 7.5. The destroy_buffers function in libavcodec/sanm.c in FFmpeg before 2.7.2 does not properly maintain height and width values in the video context, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via crafted LucasArts Smush video data.
Query: secure coding against Improper Filtering of Special Elements
Matching passage: CWE-790 Improper Filtering of Special Elements. The product receives data from an upstream component, but does not filter or incorrectly filters special elements before sending it to a downstream component.
Near-miss passage: CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute. The Secure attribute for sensitive cookies in HTTPS sessions is not set.
Query: risk of WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corrupt
Matching passage: CVE-2015-1071. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Near-miss passage: CVE-2015-8087. CWE: CWE-399. CVSS: 5.0. Huawei NE20E-S, NE40E-M, and NE40E-M2 routers with software before V800R007C10SPC100 and NE40E and NE80E routers with software before V800R007C00SPC100 allows remote attackers to send packets to other VPNs and conduct flooding attacks via a crafted MPLS forwarding packet, aka a "VPN routing and forwarding (VRF) hopping vulnerability."
Query: risk of McPvDrv.sys 4.6.111.0 in McAfee File Lock 5.x in McAfee Total Protection allows local users to obtain sensitive information from kernel memory or cause a denial of service (system 
Matching passage: CVE-2015-8772. CWE: CWE-19. CVSS: 9.100000381469727. McPvDrv.sys 4.6.111.0 in McAfee File Lock 5.x in McAfee Total Protection allows local users to obtain sensitive information from kernel memory or cause a denial of service (system crash) via a large VERIFY_INFORMATION.Length value in an IOCTL_DISK_VERIFY ioctl call.
Near-miss passage: CVE-2015-5348. CWE: CWE-19. CVSS: 8.100000381469727. Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
Query: patch priority for CVE-2015-7179
Matching passage: CVE-2015-7179. CWE: CWE-119. CVSS: 7.5. The VertexBufferInterface::reserveVertexSpace function in libGLES in ANGLE, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows, incorrectly allocates memory for shader attribute arrays, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via crafted (1) OpenGL or (2) WebGL content.
Near-miss passage: CVE-2015-5791. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Query: Sigma rule for Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (a
Matching passage: Sigma rule: Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (a. Logsource: windows / process_creation. Rule: title: Suspicious UltraVNC Execution id: 871b9555-69ca-4993-99d3-35a59f9f3599 status: test description: Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (as seen being used by Gamaredon threat group) references: - https://web.archive.org/web/20220224045756/https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine - https://unit42.paloaltonetworks.com/unit-42-title-gamaredon-group-toolset-evolution - https://uvnc.com/docs/uvnc-viewer/52-ultravnc-viewer-commandline-parameters.html author: Bhabesh Raj date: 2022-03-04 modified: 2022-03-09 tags: - attack.lateral-movement - attack.g0047 - attack.t1021.005 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - '-autoreconnect ' - '-connect ' - '-id:' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects strings used in command execution in DNS TXT Answer. Logsource: dns. Rule: title: DNS TXT Answer with Possible Execution Strings id: 8ae51330-899c-4641-8125-e39f2e07da72 status: test description: Detects strings used in command execution in DNS TXT Answer references: - https://twitter.com/stvemillertime/status/1024707932447854592 - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Backdoors/DNS_TXT_Pwnage.ps1 author: Markus Neis date: 2018-08-08 modified: 2021-11-27 tags: - attack.command-and-control - attack.t1071.004 logsource: category: dns detection: selection: record_type: TXT answer|contains: - IEX - Invoke-Expression - cmd.exe condition: selection falsepositives: - Unknown level: high
Query: risk of EMC RSA Web Threat Detection before 5.1 SP1 allows local users to obtain root privileges by leveraging access to a service account and writing commands to a service configuration f
Matching passage: CVE-2015-4548. CWE: CWE-264. CVSS: 7.199999809265137. EMC RSA Web Threat Detection before 5.1 SP1 allows local users to obtain root privileges by leveraging access to a service account and writing commands to a service configuration file.
Near-miss passage: CVE-2015-5301. CWE: CWE-264. CVSS: 5.5. providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).
Query: vulnerability: The XML parser in IBM Rational DOORS Next Generation 4.x before 4.0.7 iFix3 and 5.x before 5.0.2 and Rational Requirements Composer 2.x and 3.x before 3.0.1.6 iFix5 and 4.x before 
Matching passage: CVE-2015-0132. CWE: CWE-399. CVSS: 7.800000190734863. The XML parser in IBM Rational DOORS Next Generation 4.x before 4.0.7 iFix3 and 5.x before 5.0.2 and Rational Requirements Composer 2.x and 3.x before 3.0.1.6 iFix5 and 4.x before 4.0.7 iFix3 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
Near-miss passage: CVE-2015-2927. CWE: CWE-399. CVSS: 6.5. node 0.3.2 and URONode before 1.0.5r3 allows remote attackers to cause a denial of service (bandwidth consumption).
Query: risk of Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, 
Matching passage: CVE-2015-5569. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 improperly implement the Flash broker API, which has unspecified impact and attack vectors.
Near-miss passage: CVE-2015-4821. CWE: UNKNOWN. CVSS: 9.300000190734863. Unspecified vulnerability in the Integrated Lights Out Manager (ILOM) component in Oracle Sun Systems Products Suite 3.0, 3.1, and 3.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Web.