alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.
Matching passage: CVE-2015-8652. CWE: CWE-787. CVSS: 8.800000190734863. Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via crafted MPEG-4 data, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, CVE-2015-8455, CVE-2015-8654, CVE-2015-8656, CVE-2015-8657, CVE-2015-8658, and CVE-2015-8820.
Near-miss passage: CVE-2015-8656. CWE: CWE-787. CVSS: 8.800000190734863. Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via crafted MPEG-4 data, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, CVE-2015-8455, CVE-2015-8652, CVE-2015-8654, CVE-2015-8657, CVE-2015-8658, and CVE-2015-8820.
Query: vulnerability: SQL injection vulnerability in IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 allows remote authenticated users to execute arbitrary SQL commands via unspecified
Matching passage: CVE-2015-1989. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-4611. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the Smoelenboek (ncgov_smoelenboek) extension before 1.0.9 for TYPO3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Query: patch priority for CVE-2015-3169
Matching passage: CVE-2015-3169. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in askbot 0.7.51-4.el6.noarch.
Near-miss passage: CVE-2015-6010. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allow remote attackers to inject arbitrary web script or HTML via the (1) errorNo or (2) errorMsg parameter to error.php; the (3) viewType parameter to duplicate_manager.php; the (4) queryAction, (5) displayType, (6) citeOrder, (7) sqlQuery, (8) showQuery, (9) showLinks, (10) showRows, or (11) queryID parameter to query_manager.php; the (12) sourceText or (13) sourceIDs parameter to import.php; or the (14) typeName or (15) fileName parameter to modify.php.
Query: describe CVE-2015-6832
Matching passage: CVE-2015-6832. CWE: UNKNOWN. CVSS: 7.300000190734863. Use-after-free vulnerability in the SPL unserialize implementation in ext/spl/spl_array.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to execute arbitrary code via crafted serialized data that triggers misuse of an array field.
Near-miss passage: CVE-2015-2651. CWE: UNKNOWN. CVSS: 3.799999952316284. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect availability via vectors related to Kernel Zones virtualized NIC driver.
Query: explain T1008 Fallback Channels
Matching passage: T1008 Fallback Channels. Tactics: command and control. Description: Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.
Near-miss passage: T1092 Communication Through Removable Media. Tactics: command and control. Description: Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.(Citation: ESET Sednit USBStealer 2014) Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091). Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.
Query: CVE similar to CVE-2015-10030
Matching passage: CVE-2015-10030. CWE: CWE-21. CVSS: 5.300000190734863. A vulnerability has been found in SUKOHI Surpass and classified as critical. This vulnerability affects unknown code of the file src/Sukohi/Surpass/Surpass.php. The manipulation of the argument dir leads to pathname traversal. Upgrading to version 1.0.0 is able to address this issue. The patch is identified as d22337d453a2a14194cdb02bf12cdf9d9f827aa7. It is recommended to upgrade the affected component. VDB-217642 is the identifier assigned to this vulnerability.
Near-miss passage: CVE-2015-9235. CWE: CWE-20. CVSS: 9.800000190734863. In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).
Query: detection rule: Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and
Matching passage: Sigma rule: Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and. Logsource: windows / process_creation. Rule: title: Suspicious Process Masquerading As SvcHost.EXE id: be58d2e2-06c8-4f58-b666-b99f6dc3b6cd related: - id: 01d2e2a1-5f09-44f7-9fc1-24faa7479b6d type: similar - id: e4a6b256-3e47-40fc-89d2-7a477edd6915 type: similar status: test description: 'Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and executing from an uncommon location. Adversaries often disguise their malicious binaries by naming them after legitimate system processes like "svchost.exe" to evade detection. ' references: - https://tria.ge/240731-jh4crsycnb/behavioral2 - https://redcanary.com/blog/threat-detection/process-masquerading/ author: Swachchhanda Shrawan Poudel date: 2024-08-07 tags: - attack.stealth - attack.t1036.005 logsource: category: process_creation product: windows detection: selection: Image|endswith: \svchost.exe filter_main_img_location: Image: - C:\Windows\System32\svchost.exe - C:\Windows\SysWOW64\svchost.exe filter_main_ofn: OriginalFileName: svchost.exe condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_svchost_masqueraded_execution/info.yml
Near-miss passage: Sigma rule: Detects potential arbitrary file download using a Microsoft Office application. Logsource: windows / process_creation. Rule: title: Potential Arbitrary File Download Using Office Application id: 4ae3e30b-b03f-43aa-87e3-b622f4048eed related: - id: 0c79148b-118e-472b-bdb7-9b57b444cc19 type: obsolete status: test description: Detects potential arbitrary file download using a Microsoft Office application references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Winword/ - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Powerpnt/ - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Excel/ - https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191 author: Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community date: 2022-05-17 modified: 2023-06-22 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \EXCEL.EXE - \POWERPNT.EXE - \WINWORD.exe - OriginalFileName: - Excel.exe - POWERPNT.EXE - WinWord.exe selection_http: CommandLine|contains: - http:// - https:// condition: all of selection_* falsepositives: - Unknown level: high
Query: incident response steps for Multiple failed authentications followed by Component Object Model Hijacking
Matching passage: Playbook for T1546.015 Component Object Model Hijacking. 1) Validate alert telemetry against T1546.015. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: privilege escalation, persistence. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system.(Citation: Microsoft Component Object Model) References to various COM objects are stored in the Registry. Adversaries may use the COM system to in
Near-miss passage: Playbook for T1546.006 LC_LOAD_DYLIB Addition. Different response path focused on privilege escalation, persistence.
Query: describe CVE-2015-5156
Matching passage: CVE-2015-5156. CWE: CWE-119. CVSS: 6.099999904632568. The virtnet_probe function in drivers/net/virtio_net.c in the Linux kernel before 4.2 attempts to support a FRAGLIST feature without proper memory allocation, which allows guest OS users to cause a denial of service (buffer overflow and memory corruption) via a crafted sequence of fragmented packets.
Near-miss passage: CVE-2015-9171. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, if OEMCrypto_Dash_InstallEncapKeybox() is called with keyBoxLength set to a value higher than TZ_WV_MAX_DATA_LEN (20k), a buffer over-read occurs.
Query: CVE similar to CVE-2015-7892
Matching passage: CVE-2015-7892. CWE: CWE-787. CVSS: 7.800000190734863. Stack-based buffer overflow in the m2m1shot_compat_ioctl32 function in the Samsung m2m1shot driver framework, as used in Samsung S6 Edge, allows local users to have unspecified impact via a large data.buf_out.num_planes value in an ioctl call.
Near-miss passage: CVE-2015-3113. CWE: CWE-787. CVSS: 9.800000190734863. Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.
Query: write Sigma for Detects execution of a renamed autohotkey.exe binary based on PE metadata fields
Matching passage: Sigma rule: Detects execution of a renamed autohotkey.exe binary based on PE metadata fields. Logsource: windows / process_creation. Rule: title: Renamed AutoHotkey.EXE Execution id: 0f16d9cf-0616-45c8-8fad-becc11b5a41c status: test description: Detects execution of a renamed autohotkey.exe binary based on PE metadata fields references: - https://www.autohotkey.com/download/ - https://thedfirreport.com/2023/02/06/collect-exfiltrate-sleep-repeat/ author: Nasreddine Bencherchali date: 2023-02-07 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: - Product|contains: AutoHotkey - Description|contains: AutoHotkey - OriginalFileName: - AutoHotkey.exe - AutoHotkey.rc filter: - Image|endswith: - \AutoHotkey.exe - \AutoHotkey32.exe - \AutoHotkey32_UIA.exe - \AutoHotkey64.exe - \AutoHotkey64_UIA.exe - \AutoHotkeyA32.exe - \AutoHotkeyA32_UIA.exe - \AutoHotkeyU32.exe - \AutoHotkeyU32_UIA.exe - \AutoHotkeyU64.exe - \AutoHotkeyU64_UIA.exe - Image|contains: \AutoHotkey condition: selection and not filter falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of "curl.exe" with the "-c" flag in order to save cookie data.. Logsource: windows / process_creation. Rule: title: Potential Cookies Session Hijacking id: 5a6e1e16-07de-48d8-8aae-faa766c05e88 status: test description: Detects execution of "curl.exe" with the "-c" flag in order to save cookie data. references: - https://curl.se/docs/manpage.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-07-27 tags: - attack.execution logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \curl.exe - OriginalFileName: curl.exe selection_cli: - CommandLine|re: \s-c\s - CommandLine|contains: --cookie-jar condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_cookie_hijacking/info.yml
Query: threat report mentioning Time Based Checks
Matching passage: T1497.003 Time Based Checks. Tactics: stealth, discovery. Description: Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. This may include enumerating time-based properties, such as uptime or the system clock. Adversaries may use calls like `GetTickCount` and `GetSystemTimeAsFileTime` to discover if they are operating within a virtual machine or sandbox, or may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.(Citation: ISACA Malware Tricks)
Near-miss passage: T1497.002 User Activity Based Checks. Tactics: stealth, discovery. Description: Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness) Adversaries may search for user activity on the host based on variables such as the speed/frequency of mouse movements and clicks (Citation: Sans Virtual Jan 2016) , browser history, cache, bookmarks, or number of files in common directories such as home or the desktop. Other methods may rely on specific user interaction with the system before the malicious code is activated, such as waiting for a document to close before activating a macro (Citation: Unit 42 Sofacy Nov 2018) or waiting for a user to double click on an embedded image to activate.(Citation: FireEye FIN7 April 2017)
Query: weakness Excessive Number of Inefficient Server-Side Data Accesses
Matching passage: CWE-1060 Excessive Number of Inefficient Server-Side Data Accesses. The product performs too many data queries without using efficient data processing functionality such as stored procedures.
Near-miss passage: CWE-153 Improper Neutralization of Substitution Characters. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as substitution characters when they are sent to a downstream component.
Query: patch priority for CVE-2015-7565
Matching passage: CVE-2015-7565. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12, 2.0.x before 2.0.3, 2.1.x before 2.1.2, and 2.2.x before 2.2.1 allows remote attackers to inject arbitrary web script or HTML.
Near-miss passage: CVE-2015-3390. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Facebook Album Fetcher module for Drupal allows remote authenticated users with the "access administration pages" permission to inject arbitrary web script or HTML via unspecified vectors.
Query: patch priority for CVE-2015-2925
Matching passage: CVE-2015-2925. CWE: UNKNOWN. CVSS: 6.900000095367432. The prepend_path function in fs/dcache.c in the Linux kernel before 4.2.4 does not properly handle rename actions inside a bind mount, which allows local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack."
Near-miss passage: CVE-2015-4834. CWE: UNKNOWN. CVSS: 3.700000047683716. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Utility/Zones.
Query: patch priority for CVE-2015-0667
Matching passage: CVE-2015-0667. CWE: CWE-284. CVSS: 5.0. The Management Interface on Cisco Content Services Switch (CSS) 11500 devices 8.20.4.02 and earlier allows remote attackers to bypass intended restrictions on local-network device access via crafted SSH packets, aka Bug ID CSCut14855.
Near-miss passage: CVE-2015-7899. CWE: CWE-284. CVSS: 5.0. The com_content component in Joomla! 3.x before 3.4.5 does not properly check ACLs, which allows remote attackers to obtain sensitive information via unspecified vectors.
Query: CVE similar to CVE-2015-0925
Matching passage: CVE-2015-0925. CWE: CWE-94. CVSS: 9.0. The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a subprocess reached through a named pipe, as demonstrated by a UNC share pathname.
Near-miss passage: CVE-2015-0898. CWE: CWE-94. CVSS: 7.5. futomi CGI Cafe MP Form Mail CGI eCommerce before 2.0.12 on Windows allows remote attackers to execute arbitrary Perl code via unspecified vectors.
Query: CVE similar to CVE-2015-1722
Matching passage: CVE-2015-1722. CWE: CWE-416. CVSS: 7.199999809265137. Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Microsoft Windows Kernel Bitmap Handling Use After Free Vulnerability."
Near-miss passage: CVE-2015-3890. CWE: CWE-416. CVSS: 7.5. Use-after-free vulnerability in Open Litespeed before 1.3.10.
Query: CWE for Cleartext Storage in the Registry
Matching passage: CWE-314 Cleartext Storage in the Registry. The product stores sensitive information in cleartext in the registry.
Near-miss passage: CWE-1290 Incorrect Decoding of Security Identifiers. The product implements a decoding mechanism to decode certain bus-transaction signals to security identifiers. If the decoding is implemented incorrectly, then untrusted agents can now gain unauthorized access to the asset.
Query: explain CWE-240
Matching passage: CWE-240 Improper Handling of Inconsistent Structural Elements. The product does not handle or incorrectly handles when two or more structural elements should be consistent, but are not.
Near-miss passage: CWE-664 Improper Control of a Resource Through its Lifetime. The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.
Query: SOC alert related to Graphical User Interface
Matching passage: T1061 Graphical User Interface. Tactics: execution. Description: **This technique has been deprecated. Please use [Remote Services](https://attack.mitre.org/techniques/T1021) where appropriate.** The Graphical User Interfaces (GUI) is a common way to interact with an operating system. Adversaries may use a system's GUI during an operation, commonly through a remote interactive session such as [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1076), instead of through a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), to search for information and execute files via mouse double-click events, the Windows Run command (Citation: Wikipedia Run Command), or other potentially difficult to monitor interactions.
Near-miss passage: T1175 Component Object Model and Distributed COM. Tactics: lateral movement, execution. Description: **This technique has been deprecated. Please use [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) and [Component Object Model](https://attack.mitre.org/techniques/T1559/001).** Adversaries may use the Windows Component Object Model (COM) and Distributed Component Object Model (DCOM) for local code execution or to execute on remote systems as part of lateral movement. COM is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) DCOM is transparent middleware that extends the functionality of Component Object Model (COM) (Citation: Microsoft COM) beyond a local computer using remote procedure call (RPC) technology.(Citation: Fireeye Hunting COM June 2019) Permissions to interact with local and remote server COM objects are specified by access control lists (ACL) in the Registry. (Citation: Microsoft COM ACL)(Citation: Microsoft Process Wide Com Keys)(Citation: Microsoft System Wide Com Keys) By default, only Administrators may remotely activate and launch COM objects through DCOM. Adversaries may abuse COM for local command and/or payload execution. Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and VBScript.(Citation: Microsoft COM) Specific COM objects also exists to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors such as Privilege Escalation and Persistence.(Citation: Fireeye Hunting COM June 2019)(Citation: ProjectZero File Write EoP Apr 2018) Adversaries may use DC
Query: describe CVE-2015-5612
Matching passage: CVE-2015-5612. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via the caption tag of a profile image.
Near-miss passage: CVE-2015-6942. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Coremail XT3.0 allows remote attackers to inject arbitrary web script or HTML via a hyperlink in a document attachment.