alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-7491
Matching passage: CVE-2015-7491. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF09 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-5447. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in HP StoreOnce Backup system software before 3.13.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Query: write Sigma for Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Tim
Matching passage: Sigma rule: Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Tim. Logsource: windows / registry_set. Rule: title: New TimeProviders Registered With Uncommon DLL Name id: e88a6ddc-74f7-463b-9b26-f69fc0d2ce85 status: test description: 'Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider. Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.003/T1547.003.md author: frack113 date: 2022-06-19 modified: 2024-03-26 tags: - attack.persistence - attack.privilege-escalation - attack.t1547.003 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Services\W32Time\TimeProviders TargetObject|endswith: \DllName filter_main_w32time: Details: - '%SystemRoot%\System32\vmictimeprovider.dll' - '%systemroot%\system32\w32time.dll' - C:\Windows\SYSTEM32\w32time.DLL condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when an internet hosted webdav share is mounted using the "net.exe" utility. Logsource: windows / process_creation. Rule: title: Windows Internet Hosted WebDav Share Mount Via Net.EXE id: 7e6237fe-3ddb-438f-9381-9bf9de5af8d0 status: test description: Detects when an internet hosted webdav share is mounted using the "net.exe" utility references: - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-21 modified: 2023-07-25 tags: - attack.lateral-movement - attack.t1021.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: CommandLine|contains|all: - ' use ' - ' http' condition: all of selection_* falsepositives: - Unknown level: high
Query: vulnerability: The administrative web interface on Cisco DPC3939 (XB3) devices with firmware 121109aCMCST allows remote authenticated users to execute arbitrary commands via unspecified fields, a
Matching passage: CVE-2015-6361. CWE: CWE-20. CVSS: 6.5. The administrative web interface on Cisco DPC3939 (XB3) devices with firmware 121109aCMCST allows remote authenticated users to execute arbitrary commands via unspecified fields, aka Bug ID CSCuw86170.
Near-miss passage: CVE-2015-8739. CWE: CWE-20. CVSS: 5.5. The ipmi_fmt_udpport function in epan/dissectors/packet-ipmi.c in the IPMI dissector in Wireshark 2.0.x before 2.0.1 improperly attempts to access a packet scope, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted packet.
Query: risk of IBM Capacity Management Analytics 2.1.0.0 allows local users to discover encrypted usernames and passwords by leveraging access to the CMA install machine. IBM X-Force ID: 107863.
Matching passage: CVE-2015-7434. CWE: CWE-200. CVSS: 7.800000190734863. IBM Capacity Management Analytics 2.1.0.0 allows local users to discover encrypted usernames and passwords by leveraging access to the CMA install machine. IBM X-Force ID: 107863.
Near-miss passage: CVE-2015-3277. CWE: CWE-200. CVSS: 7.5. The mod_nss module before 1.0.11 in Fedora allows remote attackers to obtain cipher lists due to incorrect parsing of multi-keyword cipherstring.
Query: risk of Off-by-one error in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code
Matching passage: CVE-2015-3829. CWE: CWE-189. CVSS: 10.0. Off-by-one error in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow and memory corruption) via crafted MPEG-4 covr atoms with a size equal to SIZE_MAX, aka internal bug 20923261.
Near-miss passage: CVE-2015-4468. CWE: CWE-189. CVSS: 4.300000190734863. Multiple integer overflows in the search_chunk function in chmd.c in libmspack before 0.5 allow remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted CHM file.
Query: detection rule: Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or secur
Matching passage: Sigma rule: Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or secur. Logsource: aws / cloudtrail. Rule: title: AWS SAML Provider Deletion Activity id: ccd6a6c8-bb4e-4a91-9d2a-07e632819374 status: experimental description: 'Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access. An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it. ' references: - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteSAMLProvider.html author: Ivan Saakov date: 2024-12-19 tags: - attack.stealth - attack.t1078.004 - attack.privilege-escalation - attack.initial-access - attack.persistence - attack.t1531 - attack.impact logsource: product: aws service: cloudtrail detection: selection: eventSource: iam.amazonaws.com eventName: DeleteSAMLProvider status: success condition: selection falsepositives: - Automated processes using tools like Terraform may trigger this alert. - Legitimate administrative actions by authorized system administrators could cause this alert. Verify the user identity, user agent, and hostname to ensure they are expected. - Deletions by unfamiliar users should be investigated. If the behavior is known and expected, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects execution of "TroubleshootingPack" cmdlets to leverage CVE-2022-30190 or action similar to "msdt" lolbin (as des. Logsource: windows / ps_script. Rule: title: Troubleshooting Pack Cmdlet Execution id: 03409c93-a7c7-49ba-9a4c-a00badf2a153 status: test description: Detects execution of "TroubleshootingPack" cmdlets to leverage CVE-2022-30190 or action similar to "msdt" lolbin (as described in LOLBAS) references: - https://twitter.com/nas_bench/status/1537919885031772161 - https://lolbas-project.github.io/lolbas/Binaries/Msdt/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-21 tags: - attack.stealth - attack.t1202 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Invoke-TroubleshootingPack - C:\Windows\Diagnostics\System\PCW - -AnswerFile - -Unattended condition: selection falsepositives: - Legitimate usage of "TroubleshootingPack" cmdlet for troubleshooting purposes level: medium
Query: patch priority for CVE-2015-6470
Matching passage: CVE-2015-6470. CWE: UNKNOWN. CVSS: 5.5. Resource Data Management Data Manager before 2.2 allows remote authenticated users to modify arbitrary passwords via unspecified vectors.
Near-miss passage: CVE-2015-0486. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 8u40 allows remote attackers to affect confidentiality via unknown vectors related to Deployment.
Query: rule covering TeamViewer_Desktop.exe is create during install
Matching passage: Sigma rule: TeamViewer_Desktop.exe is create during install. Logsource: windows / file_event. Rule: title: Installation of TeamViewer Desktop id: 9711de76-5d4f-4c50-a94f-21e4e8f8384d status: test description: TeamViewer_Desktop.exe is create during install references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-1---teamviewer-files-detected-test-on-windows author: frack113 date: 2022-01-28 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: \TeamViewer_Desktop.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes. Logsource: windows / process_creation. Rule: title: Potential Process Injection Via Msra.EXE id: 744a188b-0415-4792-896f-11ddb0588dbc status: test description: Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics references: - https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/ - https://www.fortinet.com/content/dam/fortinet/assets/analyst-reports/ar-qakbot.pdf author: Alexander McDonald date: 2022-06-24 modified: 2023-02-03 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \msra.exe ParentCommandLine|endswith: msra.exe Image|endswith: - \arp.exe - \cmd.exe - \net.exe - \netstat.exe - \nslookup.exe - \route.exe - \schtasks.exe - \whoami.exe condition: selection falsepositives: - Legitimate use of Msra.exe level: high
Query: describe CVE-2015-5745
Matching passage: CVE-2015-5745. CWE: CWE-120. CVSS: 6.5. Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows guest users to cause a denial of service (QEMU process crash) via a crafted virtio control message.
Near-miss passage: CVE-2015-10065. CWE: CWE-120. CVSS: 9.800000190734863. A vulnerability classified as critical was found in AenBleidd FiND. This vulnerability affects the function init_result of the file validator/my_validator.cpp. The manipulation leads to buffer overflow. The patch is identified as ee2eef34a83644f286c9adcaf30437f92e9c48f1. It is recommended to apply a patch to fix this issue. VDB-218458 is the identifier assigned to this vulnerability.
Query: describe CVE-2015-8721
Matching passage: CVE-2015-8721. CWE: CWE-20. CVSS: 5.5. Buffer overflow in the tvb_uncompress function in epan/tvbuff_zlib.c in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 allows remote attackers to cause a denial of service (application crash) via a crafted packet with zlib compression.
Near-miss passage: CVE-2015-9049. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in the processing of certain responses from the USIM.
Query: rule covering Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing wh
Matching passage: Sigma rule: Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing wh. Logsource: windows / process_creation. Rule: title: Python Function Execution Security Warning Disabled In Excel id: 023c654f-8f16-44d9-bb2b-00ff36a62af9 related: - id: 17e53739-a1fc-4a62-b1b9-87711c2d5e44 type: similar status: test description: 'Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed. Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet. ' references: - https://support.microsoft.com/en-us/office/data-security-and-python-in-excel-33cc88a4-4a87-485e-9ff9-f35958278327 author: '@Kostastsale' date: 2023-08-22 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - \Microsoft\Office\ - \Excel\Security - PythonFunctionWarnings CommandLine|contains: ' 0' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions all. Logsource: windows / process_creation. Rule: title: Suspicious Rundll32 Setupapi.dll Activity id: 285b85b1-a555-4095-8652-a8a4106af63f status: test description: setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions allowing to create values in the registry, modify files and install drivers. This technique could be used to obtain persistence via modifying one of Run or RunOnce registry keys, run process or use other DLLs chain calls (see references) InstallHinfSection function in setupapi.dll calls runonce.exe executable regardless of actual content of INF file. references: - https://lolbas-project.github.io/lolbas/Libraries/Setupapi/ - https://gist.githubusercontent.com/bohops/0cc6586f205f3691e04a1ebf1806aabd/raw/baf7b29891bb91e76198e30889fbf7d6642e8974/calc_exe.inf - https://raw.githubusercontent.com/huntresslabs/evading-autoruns/master/shady.inf - https://twitter.com/Z3Jpa29z/status/1313742350292746241?s=20 author: Konstantin Grishchenko, oscd.community date: 2020-10-07 modified: 2021-11-27 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection: Image|endswith: \runonce.exe ParentImage|endswith: \rundll32.exe ParentCommandLine|contains|all: - setupapi.dll - InstallHinfSection condition: selection falsepositives: - Scripts and administrative tools that use INF files for driver installation with setupapi.dll level: medium
Query: exploit A vulnerability, which was classified as critical, was found in githuis P2Manage. This affects the function Execute of the file PTwoManage/Database.cs. The manipulation of the argu
Matching passage: CVE-2015-10054. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability, which was classified as critical, was found in githuis P2Manage. This affects the function Execute of the file PTwoManage/Database.cs. The manipulation of the argument sql leads to sql injection. The identifier of the patch is 717380aba80002414f82d93c770035198b7858cc. It is recommended to apply a patch to fix this issue. The identifier VDB-218397 was assigned to this vulnerability.
Near-miss passage: CVE-2015-4454. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php.
Query: CVE similar to CVE-2015-2070
Matching passage: CVE-2015-2070. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote attackers to execute arbitrary SQL commands via the catId parameter to cm/blogrss/feed.
Near-miss passage: CVE-2015-9399. CWE: CWE-89. CVSS: 7.199999809265137. The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection.
Query: rule covering Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service
Matching passage: Sigma rule: Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service. Logsource: windows / process_creation. Rule: title: Suspicious NTLM Authentication on the Printer Spooler Service id: bb76d96b-821c-47cf-944b-7ce377864492 status: test description: Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service references: - https://twitter.com/med0x2e/status/1520402518685200384 - https://github.com/elastic/detection-rules/blob/dd224fb3f81d0b4bf8593c5f02a029d647ba2b2d/rules/windows/credential_access_relay_ntlm_auth_via_http_spoolss.toml author: Elastic (idea), Tobias Michalski (Nextron Systems) date: 2022-05-04 modified: 2023-02-09 tags: - attack.privilege-escalation - attack.credential-access - attack.t1212 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|contains|all: - C:\windows\system32\davclnt.dll,DavSetCookie - http CommandLine|contains: - spoolss - srvsvc - /print/pipe/ condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.. Logsource: juniper / bgp. Rule: title: Juniper BGP Missing MD5 id: a7c0ae48-8df8-42bf-91bd-2ea57e2f9d43 status: test description: Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing. references: - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf author: Tim Brown date: 2023-01-09 modified: 2023-01-23 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.credential-access - attack.collection - attack.stealth - attack.t1078 - attack.t1110 - attack.t1557 logsource: product: juniper service: bgp definition: 'Requirements: juniper bgp logs need to be enabled and ingested' detection: keywords_bgp_juniper: '|all': - :179 - missing MD5 digest condition: keywords_bgp_juniper falsepositives: - Unlikely. Except due to misconfigurations level: low
Query: patch priority for CVE-2015-3150
Matching passage: CVE-2015-3150. CWE: CWE-20. CVSS: 7.099999904632568. abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to delete or change the ownership of arbitrary files via the problem directory argument to the (1) ChownProblemDir, (2) DeleteElement, or (3) DeleteProblem method.
Near-miss passage: CVE-2015-2177. CWE: CWE-20. CVSS: 7.5. Siemens SIMATIC S7-300 CPU devices allow remote attackers to cause a denial of service (defect-mode transition) via crafted packets on (1) TCP port 102 or (2) Profibus.
Query: alert when Detects Obfuscated Powershell via Stdin in Scripts
Matching passage: Sigma rule: Detects Obfuscated Powershell via Stdin in Scripts. Logsource: windows / process_creation. Rule: title: Invoke-Obfuscation Via Stdin id: 9c14c9fa-1a63-4a64-8e57-d19280559490 status: test description: Detects Obfuscated Powershell via Stdin in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-12 modified: 2026-03-16 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|re: (?i)(?:set).*&&\s?set.*(?:environment|invoke|\$\{?input).*&&.*" condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of netsh with the "trace" flag in order to start a network capture. Logsource: windows / process_creation. Rule: title: New Network Trace Capture Started Via Netsh.EXE id: d3c3861d-c504-4c77-ba55-224ba82d0118 status: test description: Detects the execution of netsh with the "trace" flag in order to start a network capture references: - https://blogs.msdn.microsoft.com/canberrapfe/2012/03/30/capture-a-network-trace-without-installing-anything-capture-a-network-trace-of-a-reboot/ - https://klausjochem.me/2016/02/03/netsh-the-cyber-attackers-tool-of-choice/ author: Kutepov Anton, oscd.community date: 2019-10-24 modified: 2023-02-13 tags: - attack.discovery - attack.credential-access - attack.t1040 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: CommandLine|contains|all: - trace - start condition: all of selection_* falsepositives: - Legitimate administration activity level: medium
Query: telemetry for T1036.009
Matching passage: T1036.009 Break Process Trees. Tactics: stealth. Description: An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID). If endpoint protection software leverages the “parent-child" relationship for detection, breaking this relationship could result in the adversary’s behavior not being associated with previous process tree activity. On Unix-based systems breaking this process tree is common practice for administrators to execute software using scripts and programs.(Citation: 3OHA double-fork 2022) On Linux systems, adversaries may execute a series of [Native API](https://attack.mitre.org/techniques/T1106) calls to alter malware's process tree. For example, adversaries can execute their payload without any arguments, call the `fork()` API call twice, then have the parent process exit. This creates a grandchild process with no parent process that is immediately adopted by the `init` system process (PID 1), which successfully disconnects the execution of the adversary's payload from its previous process tree. Another example is using the “daemon” syscall to detach from the current parent process and run in the background.(Citation: Sandfly BPFDoor 2022)(Citation: Microsoft XorDdos Linux Stealth 2022)
Near-miss passage: T1036.008 Masquerade File Type. Tactics: stealth. Description: Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type. For example, the header of a JPEG file, is <code> 0xFF 0xD8</code> and the file extension is either `.JPE`, `.JPEG` or `.JPG`. Adversaries may edit the header’s hex code and/or the file extension of a malicious payload in order to bypass file validation checks and/or input sanitization. This behavior is commonly used when payload files are transferred (e.g., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and stored (e.g., [Upload Malware](https://attack.mitre.org/techniques/T1608/001)) so that adversaries may move their malware without triggering detections. Common non-executable file types and extensions, such as text files (`.txt`) and image files (`.jpg`, `.gif`, etc.) may be typically treated as benign. Based on this, adversaries may use a file extension to disguise malware, such as naming a PHP backdoor code with a file name of <code>test.gif</code>. A user may not know that a file is malicious due to the benign appearance and file extension. Polyglot files, which are files that have multiple different file types and that function differently based on the application that will execute them, may also be used to disguise malicious malware and capabilities.(Citation: polygot_icedID)
Query: explain CWE-1109
Matching passage: CWE-1109 Use of Same Variable for Multiple Purposes. The code contains a callable, block, or other code element in which the same variable is used to control more than one unique task or store more than one instance of data.
Near-miss passage: CWE-106 Struts: Plug-in Framework not in Use. When an application does not use an input validation framework such as the Struts Validator, there is a greater risk of introducing weaknesses related to insufficient input validation.