alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relationships exist, allows remote attackers t
Matching passage: CVE-2015-5252. CWE: CWE-264. CVSS: 7.199999809265137. vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relationships exist, allows remote attackers to bypass intended file-access restrictions via a symlink that points outside of a share.
Near-miss passage: CVE-2015-1905. CWE: CWE-264. CVSS: 4.0. The REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to bypass intended access restrictions on task-variable value changes via unspecified vectors.
Query: vulnerability: Huawei Sophia-L10 smartphones with software before P7-L10C900B852 allow attackers to cause a denial of service (system panic) via a crafted application with the system or camera pr
Matching passage: CVE-2015-8305. CWE: CWE-20. CVSS: 5.5. Huawei Sophia-L10 smartphones with software before P7-L10C900B852 allow attackers to cause a denial of service (system panic) via a crafted application with the system or camera privilege.
Near-miss passage: CVE-2015-3830. CWE: CWE-20. CVSS: 6.5. The stock Android browser address bar in all Android operating systems suffers from Address Bar Spoofing, which allows remote attackers to trick a victim by displaying a malicious page for legitimate domain names.
Query: detection rule: Detects suspicious process command line that starts with a shell that executes something and finally gets piped into ano
Matching passage: Sigma rule: Detects suspicious process command line that starts with a shell that executes something and finally gets piped into ano. Logsource: linux / process_creation. Rule: title: Linux Shell Pipe to Shell id: 880973f3-9708-491c-a77b-2a35a1921158 status: test description: Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell references: - Internal Research author: Florian Roth (Nextron Systems) date: 2022-03-14 modified: 2022-07-26 tags: - attack.stealth - attack.t1140 logsource: product: linux category: process_creation detection: selection: CommandLine|startswith: - 'sh -c ' - 'bash -c ' selection_exec: - CommandLine|contains: - '| bash ' - '| sh ' - '|bash ' - '|sh ' - CommandLine|endswith: - '| bash' - '| sh' - '|bash' - ' |sh' condition: all of selection* falsepositives: - Legitimate software that uses these patterns level: medium
Near-miss passage: Sigma rule: Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option. Logsource: macos / process_creation. Rule: title: Hidden User Creation id: b22a5b36-2431-493a-8be1-0bae56c28ef3 status: test description: Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.002/T1564.002.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-10 modified: 2021-11-27 tags: - attack.stealth - attack.t1564.002 logsource: category: process_creation product: macos detection: dscl_create: Image|endswith: /dscl CommandLine|contains: create id_below_500: CommandLine|contains: UniqueID CommandLine|re: ([0-9]|[1-9][0-9]|[1-4][0-9]{2}) ishidden_option_declaration: CommandLine|contains: IsHidden ishidden_option_confirmation: CommandLine|contains: - 'true' - 'yes' - '1' condition: dscl_create and id_below_500 or dscl_create and (ishidden_option_declaration and ishidden_option_confirmation) falsepositives: - Legitimate administration activities level: medium
Query: describe CVE-2015-1058
Matching passage: CVE-2015-1058. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in AdaptCMS 3.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) data[Category][title] parameter to admin/categories/add, (2) data[Field][title] parameter to admin/fields/ajax_fields/, (3) name property in a basicInfo JSON object to admin/tools/create_theme, (4) data[Link][link_title] parameter to admin/links/links/add, or (5) data[ForumTopic][subject] parameter to forums/off-topic/new.
Near-miss passage: CVE-2015-4260. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Cisco Hosted Collaboration Solution 10.6(1) allows remote attackers to inject arbitrary web script or HTML via a crafted value in a URL, aka Bug ID CSCuu14862.
Query: Sigma rule for Detects remote RPC calls to get event log information via EVEN or EVEN6
Matching passage: Sigma rule: Detects remote RPC calls to get event log information via EVEN or EVEN6. Logsource: rpc_firewall / application. Rule: title: Remote Event Log Recon id: 2053961f-44c7-4a64-b62d-f6e72800af0d status: test description: Detects remote RPC calls to get event log information via EVEN or EVEN6 references: - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.discovery logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:82273fdc-e32a-18c3-3f78-827929dc23ea and uuid:f6beaff7-1e19-4fbb-9f8f-b89e2018337c"' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: - 82273fdc-e32a-18c3-3f78-827929dc23ea - f6beaff7-1e19-4fbb-9f8f-b89e2018337c condition: selection falsepositives: - Remote administrative tasks on Windows Events level: high
Near-miss passage: Sigma rule: Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script. Logsource: windows / registry_set. Rule: title: PowerShell Logging Disabled Via Registry Key Tampering id: fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7 status: test description: Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script block logging or transcription and script execution logging references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-32---windows-powershell-logging-disabled author: frack113 date: 2022-04-02 modified: 2023-08-17 tags: - attack.stealth - attack.defense-impairment - attack.t1564.001 - attack.t1112 - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Microsoft\Windows\PowerShell\ - \Microsoft\PowerShellCore\ TargetObject|endswith: - \ModuleLogging\EnableModuleLogging - \ScriptBlockLogging\EnableScriptBlockLogging - \ScriptBlockLogging\EnableScriptBlockInvocationLogging - \Transcription\EnableTranscripting - \Transcription\EnableInvocationHeader - \EnableScripts Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_powershell_logging_disabled/info.yml simulation: - type: atomic-red-team name: Disable PowerShell Logging via Registry technique: T1112 atomic_guid: 95b25212-91a7-42ff-9613-124aca6845a8
Query: patch priority for CVE-2015-6733
Matching passage: CVE-2015-6733. CWE: CWE-399. CVSS: 5.0. GeSHi, as used in the SyntaxHighlight_GeSHi extension and MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2, allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors.
Near-miss passage: CVE-2015-3280. CWE: CWE-399. CVSS: 6.800000190734863. OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service (disk consumption) by deleting instances while in the resize state.
Query: CVE similar to CVE-2015-0124
Matching passage: CVE-2015-0124. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix4, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-0128.
Near-miss passage: CVE-2015-0551. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop 6.7SP1 before P31, 6.7SP2 before P23, and 6.8 before P01; Documentum Administrator 6.7SP1 before P31, 6.7SP2 before P23, 7.0 before P18, 7.1 before P15, and 7.2 before P01; Documentum Digital Assets Manager 6.5SP6 before P25; Documentum Web Publishers 6.5 SP7 before P25; and Documentum Task Space 6.7SP1 before P31 and 6.7SP2 before P23 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Query: alert when Detects the usage of particular AttributeLDAPDisplayNames, which are known for data exchange via LDAP by the tool LDAPFr
Matching passage: Sigma rule: Detects the usage of particular AttributeLDAPDisplayNames, which are known for data exchange via LDAP by the tool LDAPFr. Logsource: windows / security. Rule: title: Suspicious LDAP-Attributes Used id: d00a9a72-2c09-4459-ad03-5e0a23351e36 status: test description: Detects the usage of particular AttributeLDAPDisplayNames, which are known for data exchange via LDAP by the tool LDAPFragger and are additionally not commonly used in companies. references: - https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961 - https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/ - https://github.com/fox-it/LDAPFragger author: xknow @xknow_infosec date: 2019-03-24 modified: 2022-10-05 tags: - attack.t1001.003 - attack.command-and-control logsource: product: windows service: security definition: The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule) detection: selection: EventID: 5136 AttributeValue|contains: '*' AttributeLDAPDisplayName: - primaryInternationalISDNNumber - otherFacsimileTelephoneNumber - primaryTelexNumber condition: selection falsepositives: - Companies, who may use these default LDAP-Attributes for personal information level: high
Near-miss passage: Sigma rule: Detects some Empire PowerShell UAC bypass methods. Logsource: windows / process_creation. Rule: title: HackTool - Empire PowerShell UAC Bypass id: 3268b746-88d8-4cd3-bffc-30077d02c787 status: stable description: Detects some Empire PowerShell UAC bypass methods references: - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-EventVwrBypass.ps1#L64 - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-FodHelperBypass.ps1#L64 author: Ecco date: 2019-08-30 modified: 2023-02-21 tags: - attack.privilege-escalation - attack.t1548.002 - car.2019-04-001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - ' -NoP -NonI -w Hidden -c $x=$((gp HKCU:Software\Microsoft\Windows Update).Update)' - ' -NoP -NonI -c $x=$((gp HKCU:Software\Microsoft\Windows Update).Update);' condition: selection falsepositives: - Unknown level: critical
Query: describe CVE-2015-6521
Matching passage: CVE-2015-6521. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in ATutor LMS version 2.2.
Near-miss passage: CVE-2015-3274. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to inject arbitrary web script or HTML by leveraging absence of an external_format_text call in a web service.
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects creation of files with the ".one"/".onepkg" extension in suspicious or uncommon locations. This could be a sign. Logsource: windows / file_event. Rule: title: OneNote Attachment File Dropped In Suspicious Location id: 7fd164ba-126a-4d9c-9392-0d4f7c243df0 status: test description: Detects creation of files with the ".one"/".onepkg" extension in suspicious or uncommon locations. This could be a sign of attackers abusing OneNote attachments references: - https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/ - https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-22 modified: 2023-09-19 tags: - attack.stealth logsource: category: file_event product: windows detection: selection: TargetFilename|contains: - \AppData\Local\Temp\ - \Users\Public\ - \Windows\Temp\ - :\Temp\ TargetFilename|endswith: - .one - .onepkg filter_main_onenote: Image|contains: :\Program Files\Microsoft Office\ Image|endswith: \ONENOTE.EXE condition: selection and not 1 of filter_main_* falsepositives: - Legitimate usage of ".one" or ".onepkg" files from those locations level: medium
Near-miss passage: Sigma rule: Detects installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by. Logsource: windows / process_creation. Rule: title: Potential Shim Database Persistence via Sdbinst.EXE id: 517490a7-115a-48c6-8862-1a481504d5a8 related: - id: 18ee686c-38a3-4f65-9f44-48a077141f42 type: similar status: test description: 'Detects installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims ' references: - https://www.mandiant.com/resources/blog/fin7-shim-databases-persistence author: Markus Neis date: 2019-01-16 modified: 2023-12-06 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.011 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \sdbinst.exe - OriginalFileName: sdbinst.exe selection_cli: CommandLine|contains: .sdb filter_optional_iis: ParentImage|endswith: \msiexec.exe CommandLine|contains: - :\Program Files (x86)\IIS Express\iisexpressshim.sdb - :\Program Files\IIS Express\iisexpressshim.sdb condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Query: risk of Cross-site request forgery (CSRF) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticat
Matching passage: CVE-2015-0145. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Near-miss passage: CVE-2015-4353. CWE: CWE-352. CVSS: 5.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Custom Sitemap module for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete sitemaps via unspecified vectors.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union). Logsource: windows / process_creation. Rule: title: Disable Windows IIS HTTP Logging id: e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e status: test description: Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union) references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.002/T1562.002.md#atomic-test-1---disable-windows-iis-http-logging author: frack113 date: 2022-01-09 modified: 2023-01-22 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \appcmd.exe - OriginalFileName: appcmd.exe selection_cli: CommandLine|contains|all: - set - config - section:httplogging - dontLog:true condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a creation of systemd services which could be used by adversaries to execute malicious code.. Logsource: linux / auditd. Rule: title: Systemd Service Creation id: 1bac86ba-41aa-4f62-9d6b-405eac99b485 status: test description: Detects a creation of systemd services which could be used by adversaries to execute malicious code. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.002/T1543.002.md author: Pawel Mazur date: 2022-02-03 modified: 2022-02-06 tags: - attack.privilege-escalation - attack.persistence - attack.t1543.002 logsource: product: linux service: auditd detection: path: type: PATH nametype: CREATE name_1: name|startswith: - /usr/lib/systemd/system/ - /etc/systemd/system/ name_2: name|contains: /.config/systemd/user/ condition: path and 1 of name_* falsepositives: - Admin work like legit service installs. level: medium
Query: describe CVE-2015-5407
Matching passage: CVE-2015-5407. CWE: UNKNOWN. CVSS: 6.0. HP CentralView Fraud Risk Management 11.1, 11.2, and 11.3; CentralView Revenue Leakage Control 4.1, 4.2, and 4.3; CentralView Dealer Performance Audit 2.0 and 2.1; CentralView Credit Risk Control 2.1, 2.2, and 2.3; CentralView Roaming Fraud Control 2.1, 2.2, and 2.3; and CentralView Subscription Fraud Prevention 2.0 and 2.1 allow remote attackers to obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2015-5406 and CVE-2015-5408.
Near-miss passage: CVE-2015-4474. CWE: UNKNOWN. CVSS: 10.0. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 40.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Query: CVE similar to CVE-2015-5186
Matching passage: CVE-2015-5186. CWE: CWE-20. CVSS: 5.300000190734863. Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.
Near-miss passage: CVE-2015-6546. CWE: CWE-20. CVSS: 6.099999904632568. The vCMP host in F5 BIG-IP Analytics, APM, ASM, GTM, Link Controller, and LTM 11.0.0 before 11.6.0, BIG-IP AAM 11.4.0 before 11.6.0, BIG-IP AFM and PEM 11.3.0 before 11.6.0, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.0.0 through 11.3.0, BIG-IP PSM 11.0.0 through 11.4.1 allows remote attackers to cause a denial of service via "malicious traffic."
Query: vulnerability: Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view_hosts permissions, which allows (1) remote authenticated users with the view_reports permission to read repor
Matching passage: CVE-2015-5233. CWE: CWE-264. CVSS: 4.199999809265137. Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view_hosts permissions, which allows (1) remote authenticated users with the view_reports permission to read reports from arbitrary hosts or (2) remote authenticated users with the destroy_reports permission to delete reports from arbitrary hosts via direct access to the (a) individual report show/delete pages or (b) APIs.
Near-miss passage: CVE-2015-0227. CWE: CWE-264. CVSS: 5.0. Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."
Query: describe CVE-2015-7889
Matching passage: CVE-2015-7889. CWE: CWE-275. CVSS: 5.5. The SecEmailComposer/EmailComposer application in the Samsung S6 Edge before the October 2015 MR uses weak permissions for the com.samsung.android.email.intent.action.QUICK_REPLY_BACKGROUND service action, which might allow remote attackers with knowledge of the local email address to obtain sensitive information via a crafted application that sends a crafted intent.
Near-miss passage: CVE-2015-5153. CWE: CWE-275. CVSS: 8.800000190734863. Pulp does not remove permissions for named objects upon deletion, which allows authenticated users to gain the privileges of a deleted object via creating an object with the same name.
Query: exploit Tails before 1.7 includes the wget program but does not prevent automatic fallback from passive FTP to active FTP, which allows remote FTP servers to discover the Tor client IP add
Matching passage: CVE-2015-7665. CWE: CWE-200. CVSS: 5.300000190734863. Tails before 1.7 includes the wget program but does not prevent automatic fallback from passive FTP to active FTP, which allows remote FTP servers to discover the Tor client IP address by reading a (1) PORT or (2) EPRT command. NOTE: within wget itself, the automatic fallback is not considered a vulnerability by CVE.
Near-miss passage: CVE-2015-7846. CWE: CWE-200. CVSS: 4.599999904632568. Huawei S7700, S9700, S9300 before V200R07C00SPC500, and AR200, AR1200, AR2200, AR3200 before V200R005C20SPC200 allows attackers with physical access to the CF card to obtain sensitive information.
Query: vulnerability: In TrustZone an information exposure vulnerability can potentially occur in all Android releases from CAF using the Linux kernel.
Matching passage: CVE-2015-9001. CWE: CWE-200. CVSS: 5.5. In TrustZone an information exposure vulnerability can potentially occur in all Android releases from CAF using the Linux kernel.
Near-miss passage: CVE-2015-7434. CWE: CWE-200. CVSS: 7.800000190734863. IBM Capacity Management Analytics 2.1.0.0 allows local users to discover encrypted usernames and passwords by leveraging access to the CMA install machine. IBM X-Force ID: 107863.