alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-2638
Matching passage: CVE-2015-2638. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
Near-miss passage: CVE-2015-3086. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-3077 and CVE-2015-3084.
Query: vulnerability: SQL injection vulnerability in list.php in phpRechnung before 1.6.5 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Matching passage: CVE-2015-5648. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in list.php in phpRechnung before 1.6.5 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-1605. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in Dell ScriptLogic Asset Manager (aka Quest Workspace Asset Manager) before 9.5 allow remote attackers to execute arbitrary SQL commands via unspecified vectors to (1) GetClientPackage.aspx or (2) GetProcessedPackage.aspx.
Query: write Sigma for Detects the deletion of registry keys containing the MSTSC connection history
Matching passage: Sigma rule: Detects the deletion of registry keys containing the MSTSC connection history. Logsource: windows / registry_delete. Rule: title: Terminal Server Client Connection History Cleared - Registry id: 07bdd2f5-9c58-4f38-aec8-e101bb79ef8d status: test description: Detects the deletion of registry keys containing the MSTSC connection history references: - https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/remove-entries-from-remote-desktop-connection-computer - http://woshub.com/how-to-clear-rdp-connections-history/ - https://www.trendmicro.com/en_us/research/23/a/vice-society-ransomware-group-targets-manufacturing-companies.html author: Christian Burkard (Nextron Systems) date: 2021-10-19 modified: 2023-02-08 tags: - attack.persistence - attack.stealth - attack.defense-impairment - attack.t1070 - attack.t1112 logsource: category: registry_delete product: windows detection: selection1: EventType: DeleteValue TargetObject|contains: \Microsoft\Terminal Server Client\Default\MRU selection2: EventType: DeleteKey TargetObject|contains: \Microsoft\Terminal Server Client\Servers\ condition: 1 of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities. Logsource: windows / process_creation. Rule: title: Compress Data and Lock With Password for Exfiltration With 7-ZIP id: 9fbf5927-5261-4284-a71d-f681029ea574 status: test description: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md author: frack113 date: 2021-07-27 modified: 2026-06-05 tags: - attack.collection - attack.t1560.001 logsource: category: process_creation product: windows detection: selection_img: - Description|contains: 7-Zip - Image|endswith: - \7z.exe - \7zr.exe - \7za.exe - OriginalFileName: - 7z.exe - 7za.exe - 7zr.exe selection_password: CommandLine|contains: ' -p' selection_action: CommandLine|contains: - ' a ' - ' u ' condition: all of selection_* falsepositives: - Legitimate activity is expected since compressing files with a password is common. level: medium
Query: patch priority for CVE-2015-7765
Matching passage: CVE-2015-7765. CWE: UNKNOWN. CVSS: 9.0. ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access by leveraging knowledge of this password.
Near-miss passage: CVE-2015-0509. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Hyperion BI+ component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote attackers to affect integrity via unknown vectors related to Reporting and Analysis.
Query: patch priority for CVE-2015-2644
Matching passage: CVE-2015-2644. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote attackers to affect confidentiality via unknown vectors related to Security.
Near-miss passage: CVE-2015-7210. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code by triggering attempted use of a data channel that has been closed by a WebRTC function.
Query: indicators of Dynamic Resolution
Matching passage: T1568 Dynamic Resolution. Tactics: command and control. Description: Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control. Adversaries may use dynamic resolution for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)
Near-miss passage: T1568.003 DNS Calculation. Tactics: command and control. Description: Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address. A IP and/or port number calculation can be used to bypass egress filtering on a C2 channel.(Citation: Meyers Numbered Panda) One implementation of [DNS Calculation](https://attack.mitre.org/techniques/T1568/003) is to take the first three octets of an IP address in a DNS response and use those values to calculate the port for command and control traffic.(Citation: Meyers Numbered Panda)(Citation: Moran 2014)(Citation: Rapid7G20Espionage)
Query: Suspicious Exfiltration Over Alternative Protocol execution detected on endpoint
Matching passage: T1048 Exfiltration Over Alternative Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and/or obfuscate these alternate channels. [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048) can be done using various common operating system utilities such as [Net](https://attack.mitre.org/software/S0039)/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016) On macOS and Linux <code>curl</code> may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.(Citation: 20 macOS Common Tools and Techniques) Many IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or [Cloud API](https://attack.mitre.org/techniques/T1059/009).
Near-miss passage: T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.(Citation: copy_cmd_cisco) Adversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted (such as HTTP, FTP, or DNS). This may include custom or publicly available encoding/compression algorithms (such as base64) as well as embedding data within protocol headers and fields.
Query: indicators of Disk Structure Wipe
Matching passage: T1561.002 Disk Structure Wipe. Tactics: impact. Description: Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources. Adversaries may attempt to render the system unable to boot by overwriting critical data located in structures such as the master boot record (MBR) or partition table.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) The data contained in disk structures may include the initial executable code for loading an operating system or the location of the file system partitions on disk. If this information is not present, the computer will not be able to load an operating system during the boot process, leaving the computer unavailable. [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) may be performed in isolation, or along with [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) if all sectors of a disk are wiped. On a network devices, adversaries may reformat the file system using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `format`.(Citation: format_cmd_cisco) To maximize impact on the target organization, malware designed for destroying disk structures may have worm-like features to propagate across a network by leveraging other techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)
Near-miss passage: T1561 Disk Wipe. Tactics: impact. Description: Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources. With direct write access to a disk, adversaries may attempt to overwrite portions of disk data. Adversaries may opt to wipe arbitrary portions of disk data and/or wipe disk structures like the master boot record (MBR). A complete wipe of all disk sectors may be attempted. To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disks may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Novetta Blockbuster Destructive Malware) On network devices, adversaries may wipe configuration files and other data from the device using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `erase`.(Citation: erase_cmd_cisco)
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the export of the target Registry key to a file.. Logsource: windows / process_creation. Rule: title: Exports Registry Key To a File id: f0e53e89-8d22-46ea-9db5-9d4796ee2f8a related: - id: 82880171-b475-4201-b811-e9c826cd5eaa type: similar status: test description: Detects the export of the target Registry key to a file. references: - https://lolbas-project.github.io/lolbas/Binaries/Regedit/ - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f author: Oddvar Moe, Sander Wiebing, oscd.community date: 2020-10-07 modified: 2024-03-13 tags: - attack.exfiltration - attack.discovery - attack.t1012 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regedit.exe - OriginalFileName: REGEDIT.EXE selection_cli: CommandLine|contains|windash: ' -E ' filter_1: CommandLine|contains: - hklm - hkey_local_machine filter_2: CommandLine|endswith: - \system - \sam - \security condition: all of selection_* and not all of filter_* falsepositives: - Legitimate export of keys level: low
Near-miss passage: Sigma rule: Detects a Windows command line executable started from MMC. Logsource: windows / process_creation. Rule: title: MMC Spawning Windows Shell id: 05a2ab7e-ce11-4b63-86db-ab32e763e11d status: test description: Detects a Windows command line executable started from MMC references: - https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/ author: Karneades, Swisscom CSIRT date: 2019-08-05 modified: 2022-07-14 tags: - attack.lateral-movement - attack.t1021.003 logsource: category: process_creation product: windows detection: selection1: ParentImage|endswith: \mmc.exe selection2: - Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - \wscript.exe - \cscript.exe - \sh.exe - \bash.exe - \reg.exe - \regsvr32.exe - Image|contains: \BITSADMIN condition: all of selection* level: high
Query: common weakness: Inefficient Algorithmic Complexity
Matching passage: CWE-407 Inefficient Algorithmic Complexity. An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
Near-miss passage: CWE-210 Self-generated Error Message Containing Sensitive Information. The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.
Query: vulnerability: Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.
Matching passage: CVE-2015-8045. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, and CVE-2015-8455.
Near-miss passage: CVE-2015-9126. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, possible buffer overflow when processing 1X circuit service message.
Query: CVE similar to CVE-2015-5149
Matching passage: CVE-2015-5149. CWE: CWE-22. CVSS: 5.5. Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to write to arbitrary files via a .. (dot dot) in the component parameter in the Request component to workorder/Attachment.jsp.
Near-miss passage: CVE-2015-4703. CWE: CWE-22. CVSS: 5.300000190734863. Absolute path traversal vulnerability in mysqldump_download.php in the WordPress Rename plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the dumpfname parameter.
Query: Suspicious Malware execution detected on endpoint
Matching passage: T1587.001 Malware. Tactics: resource development. Description: Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB) During malware development, adversaries may intentionally include indicators aligned with other known actors in order to mislead attribution by defenders.(Citation: Olympic Destroyer)(Citation: Risky Bulletin Threat actor impersonates FSB APT)(Citation: GamaCopy organization) As with legitimate development efforts, different skill sets may be required for developing malware. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware. Some aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure. For example, malware developed that will communicate with Twitter for C2, may require use of [Web Services](https://attack.mitre.org/techniques/T1583/006).(Citation: FireEye APT29)
Near-miss passage: T1587.003 Digital Certificates. Tactics: resource development. Description: Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA). Adversaries may create self-signed SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) if added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)). After creating a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control.
Query: patch priority for CVE-2015-0543
Matching passage: CVE-2015-0543. CWE: CWE-20. CVSS: 5.800000190734863. EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Near-miss passage: CVE-2015-9051. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached due to an improper bound on a length in a System Information message.
Query: risk of SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly consider integer promotion, which allows remote attackers to execute arbitrary code or cause a de
Matching passage: CVE-2015-6575. CWE: CWE-189. CVSS: 10.0. SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly consider integer promotion, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow and memory corruption) via crafted atoms in MP4 data, aka internal bug 20139950, a different vulnerability than CVE-2015-1538. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7915, CVE-2014-7916, and/or CVE-2014-7917.
Near-miss passage: CVE-2015-3228. CWE: CWE-189. CVSS: 6.800000190734863. Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as demonstrated by using the ps2pdf command, which triggers an out-of-bounds read or write.
Query: alert when Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.
Matching passage: Sigma rule: Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.. Logsource: windows / security. Rule: title: WMI Persistence - Security id: f033f3f3-fd24-4995-97d8-a3bb17550a88 related: - id: 0b7889b4-5577-4521-a60a-3376ee7f9f7b type: derived status: test description: Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs. references: - https://twitter.com/mattifestation/status/899646620148539397 - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ author: Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community date: 2017-08-22 modified: 2022-11-29 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.003 logsource: product: windows service: security detection: selection: EventID: 4662 ObjectType: WMI Namespace ObjectName|contains: subscription condition: selection falsepositives: - Unknown (data set is too small; further testing needed) level: medium
Near-miss passage: Sigma rule: Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation. Logsource: windows / process_creation. Rule: title: Suspicious HWP Sub Processes id: 023394c4-29d5-46ab-92b8-6a534c6f447b status: test description: Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation references: - https://www.securitynewspaper.com/2016/11/23/technical-teardown-exploit-malware-hwp-files/ - https://www.hybrid-analysis.com/search?query=context:74940dcc5b38f9f9b1a0fea760d344735d7d91b610e6d5bd34533dd0153402c5&from_sample=5db135000388385a7644131f&block_redirect=1 - https://twitter.com/cyberwar_15/status/1187287262054076416 - https://blog.alyac.co.kr/1901 - https://en.wikipedia.org/wiki/Hangul_(word_processor) author: Florian Roth (Nextron Systems) date: 2019-10-24 modified: 2021-11-27 tags: - attack.initial-access - attack.t1566.001 - attack.execution - attack.t1203 - attack.t1059.003 - attack.g0032 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \Hwp.exe Image|endswith: \gbb.exe condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-8831
Matching passage: CVE-2015-8831. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in admin/comments.php in Dotclear before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the author name in a comment.
Near-miss passage: CVE-2015-1437. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Asus RT-N10+ D1 router with firmware 2.1.1.1.70 allow remote attackers to inject arbitrary web script or HTML via the flag parameter to (1) result_of_get_changed_status.asp or (2) error_page.htm.