alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Cross-site scripting (XSS) vulnerability in the Image Title module before 7.x-1.1 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web scri
Matching passage: CVE-2015-4372. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Image Title module before 7.x-1.1 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-6372. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka Bug ID CSCux10614.
Query: alert when Detects service installation with suspicious folder patterns
Matching passage: Sigma rule: Detects service installation with suspicious folder patterns. Logsource: windows / system. Rule: title: Service Installation with Suspicious Folder Pattern id: 1b2ae822-6fe1-43ba-aa7c-d1a3b3d1d5f2 status: test description: Detects service installation with suspicious folder patterns references: - Internal Research author: pH-T (Nextron Systems) date: 2022-03-18 modified: 2022-03-24 tags: - attack.persistence - attack.privilege-escalation - car.2013-09-005 - attack.t1543.003 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7045 selection_img_paths: - ImagePath|re: ^[Cc]:\\[Pp]rogram[Dd]ata\\.{1,9}\.exe - ImagePath|re: ^[Cc]:\\.{1,9}\.exe condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential OGNL Injection exploitation, which may lead to RCE. OGNL is an expression language that is supported i. Logsource: jvm / application. Rule: title: Potential OGNL Injection Exploitation In JVM Based Application id: 4d0af518-828e-4a04-a751-a7d03f3046ad status: test description: 'Detects potential OGNL Injection exploitation, which may lead to RCE. OGNL is an expression language that is supported in many JVM based systems. OGNL Injection is the reason for some high profile RCE''s such as Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134) ' references: - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs author: Moti Harmats date: 2023-02-11 tags: - attack.initial-access - attack.t1190 - cve.2017-5638 - cve.2022-26134 logsource: category: application product: jvm definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)' detection: keywords: - org.apache.commons.ognl.OgnlException - ExpressionSyntaxException condition: keywords falsepositives: - Application bugs level: high
Query: risk of The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg().
Matching passage: CVE-2015-9358. CWE: CWE-79. CVSS: 6.099999904632568. The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg().
Near-miss passage: CVE-2015-9103. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in Synology Note Station 1.1-0212 and earlier allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) note title or (2) file name of attachments.
Query: exploit Cisco WebEx Meeting Center does not properly restrict the content of URLs, which allows remote attackers to obtain sensitive information via vectors related to file: URIs, aka Bug 
Matching passage: CVE-2015-0583. CWE: CWE-200. CVSS: 5.0. Cisco WebEx Meeting Center does not properly restrict the content of URLs, which allows remote attackers to obtain sensitive information via vectors related to file: URIs, aka Bug ID CSCus18281.
Near-miss passage: CVE-2015-1828. CWE: CWE-200. CVSS: 5.900000095367432. The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.
Query: CVE similar to CVE-2015-1694
Matching passage: CVE-2015-1694. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1710.
Near-miss passage: CVE-2015-8072. CWE: CWE-119. CVSS: 10.0. mediaserver in Android 4.4 through 5.x before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23881715, a different vulnerability than CVE-2015-6608 and CVE-2015-8073.
Query: Sigma rule for Detects the execution of netsh to configure a port forwarding of port 3389 (RDP) rule
Matching passage: Sigma rule: Detects the execution of netsh to configure a port forwarding of port 3389 (RDP) rule. Logsource: windows / process_creation. Rule: title: RDP Port Forwarding Rule Added Via Netsh.EXE id: 782d6f3e-4c5d-4b8c-92a3-1d05fed72e63 status: test description: Detects the execution of netsh to configure a port forwarding of port 3389 (RDP) rule references: - https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html author: Florian Roth (Nextron Systems), oscd.community date: 2019-01-29 modified: 2023-02-13 tags: - attack.lateral-movement - attack.command-and-control - attack.t1090 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: CommandLine|contains|all: - ' i' - ' p' - =3389 - ' c' condition: all of selection_* falsepositives: - Legitimate administration activity level: high
Near-miss passage: Sigma rule: Detects disabling Windows Defender Exploit Guard Network Protection. Logsource: windows / registry_set. Rule: title: Disable Exploit Guard Network Protection on Windows Defender id: bf9e1387-b040-4393-9851-1598f8ecfae9 status: test description: Detects disabling Windows Defender Exploit Guard Network Protection references: - https://www.tenforums.com/tutorials/105533-enable-disable-windows-defender-exploit-protection-settings.html author: Austin Songer @austinsonger date: 2021-08-04 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection\DisallowExploitProtectionOverride Details: DWORD (00000001) condition: selection falsepositives: - Unknown level: medium
Query: exploit kextd in kext tools in Apple OS X before 10.10.4 allows attackers to write to arbitrary files via a crafted app that conducts a symlink attack.
Matching passage: CVE-2015-3708. CWE: UNKNOWN. CVSS: 8.800000190734863. kextd in kext tools in Apple OS X before 10.10.4 allows attackers to write to arbitrary files via a crafted app that conducts a symlink attack.
Near-miss passage: CVE-2015-0369. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to AX/HI Web UI.
Query: incident response steps for EDR alert: possible Masquerade File Type (T1036.008)
Matching passage: Playbook for T1036.008 Masquerade File Type. 1) Validate alert telemetry against T1036.008. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to ident
Near-miss passage: Playbook for T1036 Masquerading. Different response path focused on stealth.
Query: indicators of Boot or Logon Initialization Scripts
Matching passage: T1037 Boot or Logon Initialization Scripts. Tactics: persistence, privilege escalation. Description: Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke March 2019) Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely. Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.
Near-miss passage: T1037.003 Network Logon Script. Tactics: persistence, privilege escalation. Description: Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence. Network logon scripts can be assigned using Active Directory or Group Policy Objects.(Citation: Petri Logon Script AD) These logon scripts run with the privileges of the user they are assigned to. Depending on the systems within the network, initializing one of these scripts could apply to more than one or potentially all systems. Adversaries may use these scripts to maintain persistence on a network. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
Query: patch priority for CVE-2015-1323
Matching passage: CVE-2015-1323. CWE: CWE-200. CVSS: 5.5. The simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 as packaged in Ubuntu 15.04, before 1.1.1+bzr980-0ubuntu1.1 as packaged in Ubuntu 14.10, before 1.1.1-1ubuntu5.2 as packaged in Ubuntu 14.04 LTS, before 0.43+bzr805-0ubuntu10 as packaged in Ubuntu 12.04 LTS allows local users to obtain sensitive information, or access files with root permissions.
Near-miss passage: CVE-2015-8374. CWE: CWE-200. CVSS: 4.0. fs/btrfs/inode.c in the Linux kernel before 4.3.3 mishandles compressed inline extents, which allows local users to obtain sensitive pre-truncation information from a file via a clone action.
Query: detection rule: Detects when a API token is created
Matching passage: Sigma rule: Detects when a API token is created. Logsource: okta / okta. Rule: title: Okta API Token Created id: 19951c21-229d-4ccb-8774-b993c3ff3c5c status: test description: Detects when a API token is created references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-12 modified: 2026-04-27 tags: - attack.persistence logsource: product: okta service: okta detection: selection: eventType: system.api_token.create condition: selection falsepositives: - Legitimate creation of an API token by authorized users level: medium
Near-miss passage: Sigma rule: Detects non-system users performing privileged operation os the SCM database. Logsource: windows / security. Rule: title: SCM Database Privileged Operation id: dae8171c-5ec6-4396-b210-8466585b53e9 status: test description: Detects non-system users performing privileged operation os the SCM database references: - https://threathunterplaybook.com/hunts/windows/190826-RemoteSCMHandle/notebook.html author: Roberto Rodriguez @Cyb3rWard0g, Tim Shelton date: 2019-08-15 modified: 2022-09-18 tags: - attack.privilege-escalation - attack.t1548 logsource: product: windows service: security detection: selection: EventID: 4674 ObjectType: SC_MANAGER OBJECT ObjectName: servicesactive PrivilegeList: SeTakeOwnershipPrivilege filter: SubjectLogonId: '0x3e4' ProcessName|endswith: :\Windows\System32\services.exe condition: selection and not filter falsepositives: - Unknown level: medium
Query: risk of Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Browser ASLR Bypas
Matching passage: CVE-2015-6161. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Browser ASLR Bypass."
Near-miss passage: CVE-2015-8601. CWE: CWE-200. CVSS: 5.0. The Chat Room module 7.x-2.x before 7.x-2.2 for Drupal does not properly check permissions when setting up a websocket for chat messages, which allows remote attackers to bypass intended access restrictions and read messages from arbitrary Chat Rooms via unspecified vectors.
Query: risk of Directory traversal vulnerability in application/templates/amelia/loadjs.php in Free Reprintables ArticleFR 3.0.7 and earlier allows local users to read arbitrary files via the s p
Matching passage: CVE-2015-6591. CWE: CWE-22. CVSS: 5.5. Directory traversal vulnerability in application/templates/amelia/loadjs.php in Free Reprintables ArticleFR 3.0.7 and earlier allows local users to read arbitrary files via the s parameter.
Near-miss passage: CVE-2015-1395. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrary files with the permissions of the target user via a .. (dot dot) in a diff file name.
Query: describe CVE-2015-0652
Matching passage: CVE-2015-0652. CWE: CWE-20. CVSS: 7.800000190734863. The Session Description Protocol (SDP) implementation in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway before X8.2 and Cisco TelePresence Conductor before XC2.4 allows remote attackers to cause a denial of service (mishandled exception and device reload) via a crafted media description, aka Bug IDs CSCus96593 and CSCun73192.
Near-miss passage: CVE-2015-9415. CWE: CWE-20. CVSS: 7.5. The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion.
Query: vulnerability: The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDo
Matching passage: CVE-2015-8315. CWE: CWE-1333. CVSS: 7.5. The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."
Near-miss passage: CVE-2015-10005. CWE: CWE-1333. CVSS: 7.5. A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/html_re.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 3.0.0 is able to address this issue. The name of the patch is 89c8620157d6e38f9872811620d25138fc9d1b0d. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216852.
Query: detection rule: Detects the execution of clip.exe in order to copy data to the clipboard. Adversaries may collect data stored in the cli
Matching passage: Sigma rule: Detects the execution of clip.exe in order to copy data to the clipboard. Adversaries may collect data stored in the cli. Logsource: windows / process_creation. Rule: title: Data Copied To Clipboard Via Clip.EXE id: ddeff553-5233-4ae9-bbab-d64d2bd634be status: test description: Detects the execution of clip.exe in order to copy data to the clipboard. Adversaries may collect data stored in the clipboard from users copying information within or between applications. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/clip - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1115/T1115.md author: frack113 date: 2021-07-27 modified: 2023-02-21 tags: - attack.collection - attack.t1115 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \clip.exe - OriginalFileName: clip.exe condition: selection falsepositives: - Unknown level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_clip_execution/info.yml simulation: - type: atomic-red-team name: Utilize Clipboard to store or execute commands from technique: T1115 atomic_guid: 0cd14633-58d4-4422-9ede-daa2c9474ae7
Near-miss passage: Sigma rule: Detects logs clearing attempts on Linux systems via utilities such as 'rm', 'rmdir', 'shred', and 'unlink' targeting log. Logsource: linux / process_creation. Rule: title: Linux Logs Clearing Attempts id: 80915f59-9b56-4616-9de0-fd0dea6c12fe status: stable description: 'Detects logs clearing attempts on Linux systems via utilities such as ''rm'', ''rmdir'', ''shred'', and ''unlink'' targeting log files and directories. Adversaries often try to clear logs to cover their tracks after performing malicious activities. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md author: Ömer Günal, oscd.community date: 2020-10-07 modified: 2026-03-18 tags: - attack.defense-impairment - attack.t1685.006 logsource: product: linux category: process_creation detection: selection: Image|endswith: - /rm - /rmdir - /shred - /unlink CommandLine|contains: - /var/log - /var/spool/mail filter_main_legit_systat: Image|endswith: /rm CommandLine|startswith: rm -f /var/log/sysstat/ filter_main_dmseg: Image|endswith: /rm CommandLine|startswith: rm -f -- /var/log//dmesg condition: selection and not 1 of filter_main_* falsepositives: - Legitimate administration activities level: medium
Query: how to detect Create Process with Token
Matching passage: T1134.002 Create Process with Token. Tactics: stealth, privilege escalation. Description: Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as <code>CreateProcessWithTokenW</code> and <code>runas</code>.(Citation: Microsoft RunAs) Creating processes with a token not associated with the current user may require the credentials of the target user, specific privileges to impersonate that user, or access to the token to be used. For example, the token could be duplicated via [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) or created via [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) before being used to create a process. While this technique is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001), the techniques can be used in conjunction where a token is duplicated and then used to create a new process.
Near-miss passage: T1134.005 SID-History Injection. Tactics: stealth, privilege escalation. Description: Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. (Citation: Microsoft SID) An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens). With Domain Administrator (or equivalent) rights, harvested or well-known SID values (Citation: Microsoft Well Known SIDs Jun 2017) may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators. This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as [Remote Services](https://attack.mitre.org/techniques/T1021), [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002), or [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006).
Query: SIEM correlation: execution activity consistent with Malicious Library
Matching passage: T1204.005 Malicious Library. Tactics: execution. Description: Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may [Upload Malware](https://attack.mitre.org/techniques/T1608/001) to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that establishes persistence, steals data, or mines cryptocurrency.(Citation: Datadog Security Labs Malicious PyPi Packages 2024)(Citation: Fortinet Malicious NPM Packages 2023) In some cases, threat actors may compromise and backdoor existing popular libraries (i.e., [Compromise Software Dependencies and Development Tools](https://attack.mitre.org/techniques/T1195/001)). Alternatively, they may create entirely new packages and leverage behaviors such as typosquatting to encourage users to install them.
Near-miss passage: T1204.002 Malicious File. Tactics: execution. Description: An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001). Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.(Citation: Mandiant Trojanized Windows 10) Adversaries may employ various forms of [Masquerading](https://attack.mitre.org/techniques/T1036) and [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it.(Citation: Password Protected Word Docs) While [Malicious File](https://attack.mitre.org/techniques/T1204/002) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534).
Query: risk of The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approa
Matching passage: CVE-2015-8877. CWE: CWE-399. CVSS: 7.5. The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function.
Near-miss passage: CVE-2015-1747. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1732, CVE-2015-1742, CVE-2015-1750, and CVE-2015-1753.