alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of se
Matching passage: CVE-2015-3732. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Near-miss passage: CVE-2015-8863. CWE: CWE-119. CVSS: 9.800000190734863. Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.
Query: exploit Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows remote authenticated users to read arbitrary files via crafted parameters to unspecified scr
Matching passage: CVE-2015-6371. CWE: CWE-200. CVSS: 4.0. Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows remote authenticated users to read arbitrary files via crafted parameters to unspecified scripts, aka Bug ID CSCux10621.
Near-miss passage: CVE-2015-7940. CWE: CWE-200. CVSS: 5.0. The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged pro. Logsource: windows / process_creation. Rule: title: Bypass UAC via Fodhelper.exe id: 7f741dcf-fc22-4759-87b4-9ae8376676a2 status: test description: Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes. references: - https://eqllib.readthedocs.io/en/latest/analytics/e491ce22-792f-11e9-8f5c-d46d6d62a49e.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md author: E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community date: 2019-10-24 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \fodhelper.exe condition: selection falsepositives: - Legitimate use of fodhelper.exe utility by legitimate user level: high
Near-miss passage: Sigma rule: Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /. Logsource: linux / process_creation. Rule: title: OMIGOD SCX RunAsProvider ExecuteShellCommand id: 21541900-27a9-4454-9c4c-3f0a4240344a status: test description: 'Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite. ' references: - https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure - https://github.com/Azure/Azure-Sentinel/pull/3059 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC date: 2021-10-15 modified: 2022-10-05 tags: - attack.privilege-escalation - attack.initial-access - attack.execution - attack.t1068 - attack.t1190 - attack.t1203 logsource: product: linux category: process_creation detection: selection: User: root LogonId: 0 CurrentDirectory: /var/opt/microsoft/scx/tmp CommandLine|contains: /bin/sh condition: selection falsepositives: - Legitimate use of SCX RunAsProvider Invoke_ExecuteShellCommand. level: high
Query: weakness Path Equivalence: 'filedir*' (Wildcard)
Matching passage: CWE-56 Path Equivalence: 'filedir*' (Wildcard). The product accepts path input in the form of asterisk wildcard ('filedir*') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Near-miss passage: CWE-772 Missing Release of Resource after Effective Lifetime. The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
Query: alert when Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain
Matching passage: Sigma rule: Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain. Logsource: windows / security. Rule: title: DPAPI Domain Master Key Backup Attempt id: 39a94fd1-8c9a-4ff6-bf22-c058762f8014 status: test description: Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain Controller. references: - https://threathunterplaybook.com/hunts/windows/190620-DomainDPAPIBackupKeyExtraction/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-08-10 modified: 2023-03-15 tags: - attack.credential-access - attack.t1003.004 logsource: product: windows service: security detection: selection: EventID: 4692 condition: selection falsepositives: - If a computer is a member of a domain, DPAPI has a backup mechanism to allow unprotection of the data. Which will trigger this event. level: medium
Near-miss passage: Sigma rule: Detects when a new owner is added to an application. This gives that account privileges to make modifications and config. Logsource: azure / auditlogs. Rule: title: Added Owner To Application id: 74298991-9fc4-460e-a92e-511aa60baec1 status: test description: Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#new-owner author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' date: 2022-06-02 tags: - attack.t1552 - attack.credential-access logsource: product: azure service: auditlogs detection: selection: properties.message: Add owner to application condition: selection falsepositives: - When a new application owner is added by an administrator level: medium
Query: risk of The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be
Matching passage: CVE-2015-9284. CWE: CWE-352. CVSS: 8.800000190734863. The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into the web application as the primary account.
Near-miss passage: CVE-2015-9441. CWE: CWE-352. CVSS: 6.5. The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php.
Query: vulnerability: The CBAutoConfigCommentRepository method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and A
Matching passage: CVE-2015-7618. CWE: CWE-416. CVSS: 6.800000190734863. The CBAutoConfigCommentRepository method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Near-miss passage: CVE-2015-7621. CWE: CWE-416. CVSS: 6.800000190734863. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via a crafted U3D object, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7615, and CVE-2015-7617.
Query: exploit The Operation and Maintenance Unit (OMU) in Huawei VCN500 with software before V100R002C00SPC200 allows remote authenticated users to change the IP address of the media server via 
Matching passage: CVE-2015-8333. CWE: CWE-264. CVSS: 7.099999904632568. The Operation and Maintenance Unit (OMU) in Huawei VCN500 with software before V100R002C00SPC200 allows remote authenticated users to change the IP address of the media server via crafted packets.
Near-miss passage: CVE-2015-8889. CWE: CWE-264. CVSS: 7.800000190734863. The aboot implementation in the Qualcomm components in Android before 2016-07-05 on Nexus 6P devices omits the recovery PIN feature, which has unspecified impact and attack vectors, aka Android internal bug 28822677 and Qualcomm internal bug CR804067.
Query: vulnerability: NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) via an ntpdc relist command, which triggers recursive traversal
Matching passage: CVE-2015-7978. CWE: CWE-400. CVSS: 7.5. NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) via an ntpdc relist command, which triggers recursive traversal of the restriction list.
Near-miss passage: CVE-2015-3248. CWE: CWE-400. CVSS: 4.699999809265137. openhpi/Makefile.am in OpenHPI before 3.6.0 uses world-writable permissions for /var/lib/openhpi directory, which allows local users, when quotas are not properly setup, to fill the filesystem hosting /var/lib and cause a denial of service (disk consumption).
Query: CVE similar to CVE-2015-4234
Matching passage: CVE-2015-4234. CWE: CWE-264. CVSS: 7.199999809265137. Cisco NX-OS 6.0(2) and 6.2(2) on Nexus devices has an improper OS configuration, which allows local users to obtain root access via unspecified input to the Python interpreter, aka Bug IDs CSCun02887, CSCur00115, and CSCur00127.
Near-miss passage: CVE-2015-3222. CWE: CWE-264. CVSS: 7.0. syscheck/seechanges.c in OSSEC 2.7 through 2.8.1 on NIX systems allows local users to execute arbitrary code as root.
Query: vulnerability: SQL injection vulnerability in Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary SQL commands via the id parameter to watchstatus.cgi.
Matching passage: CVE-2015-6911. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary SQL commands via the id parameter to watchstatus.cgi.
Near-miss passage: CVE-2015-1310. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in SAP Adaptive Server Enterprise (Sybase ASE) allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Note 2113333. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Query: write Sigma for Detects instances where an SMB service on an OpenCanary node has had a file open request.
Matching passage: Sigma rule: Detects instances where an SMB service on an OpenCanary node has had a file open request.. Logsource: opencanary / application. Rule: title: OpenCanary - SMB File Open Request id: 22777c9e-873a-4b49-855f-6072ab861a52 status: test description: Detects instances where an SMB service on an OpenCanary node has had a file open request. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.lateral-movement - attack.collection - attack.t1021 - attack.t1005 logsource: category: application product: opencanary detection: selection: logtype: 5000 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content in it.. Logsource: windows / process_creation. Rule: title: Suspicious File Execution From Internet Hosted WebDav Share id: f0507c0f-a3a2-40f5-acc6-7f543c334993 status: test description: Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content in it. As seen being used in malicious LNK files references: - https://twitter.com/ShadowChasing1/status/1552595370961944576 - https://www.virustotal.com/gui/file/a63376ee1dba76361df73338928e528ca5b20171ea74c24581605366dcaa0104/behavior author: pH-T (Nextron Systems) date: 2022-09-01 modified: 2023-02-21 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|contains: \cmd.exe - OriginalFileName: Cmd.EXE selection_base: CommandLine|contains|all: - ' net use http' - '& start /b ' - \DavWWWRoot\ selection_ext: CommandLine|contains: - '.exe ' - '.dll ' - '.bat ' - '.vbs ' - '.ps1 ' condition: all of selection_* falsepositives: - Unknown level: high
Query: vulnerability: Microsoft XML Core Services 3.0 and 5.0 supports SSL 2.0, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and condu
Matching passage: CVE-2015-2434. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft XML Core Services 3.0 and 5.0 supports SSL 2.0, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and conducting a decryption attack, aka "MSXML Information Disclosure Vulnerability," a different vulnerability than CVE-2015-2471.
Near-miss passage: CVE-2015-3108. CWE: CWE-200. CVSS: 5.0. Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors.
Query: threat report mentioning Data from Network Shared Drive
Matching passage: T1039 Data from Network Shared Drive. Tactics: collection. Description: Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.
Near-miss passage: T1602.002 Network Device Configuration Dump. Tactics: collection. Description: Adversaries may access network configuration files to collect sensitive data about the device and the network. The network configuration is a file containing parameters that determine the operation of the device. The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset. Adversaries can inspect the configuration files to reveal information about the target network and its layout, the network device and its software, or identifying legitimate accounts and credentials for later use. Adversaries can use common management tools and protocols, such as Simple Network Management Protocol (SNMP) and Smart Install (SMI), to access network configuration files.(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks) These tools may be used to query specific data from a configuration repository or configure the device to export the configuration for later analysis.
Query: CVE similar to CVE-2015-5786
Matching passage: CVE-2015-5786. CWE: CWE-119. CVSS: 6.800000190734863. Apple QuickTime before 7.7.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-5785.
Near-miss passage: CVE-2015-0323. CWE: CWE-119. CVSS: 10.0. Heap-based buffer overflow in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0327.
Query: detect Detects potential DLL sideloading using comctl32.dll to obtain system privileges in logs
Matching passage: Sigma rule: Detects potential DLL sideloading using comctl32.dll to obtain system privileges. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Via comctl32.dll id: 6360757a-d460-456c-8b13-74cf0e60cceb status: test description: Detects potential DLL sideloading using comctl32.dll to obtain system privileges references: - https://github.com/binderlabs/DirCreate2System - https://github.com/sailay1996/awesome_windows_logical_bugs/blob/60cbb23a801f4c3195deac1cc46df27c225c3d07/dir_create2system.txt author: Nasreddine Bencherchali (Nextron Systems), Subhash Popuri (@pbssubhash) date: 2022-12-16 modified: 2022-12-19 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|startswith: - C:\Windows\System32\logonUI.exe.local\ - C:\Windows\System32\werFault.exe.local\ - C:\Windows\System32\consent.exe.local\ - C:\Windows\System32\narrator.exe.local\ - C:\windows\system32\wermgr.exe.local\ ImageLoaded|endswith: \comctl32.dll condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to per. Logsource: m365 / threat_management. Rule: title: Data Exfiltration to Unsanctioned Apps id: 2b669496-d215-47d8-bd9a-f4a45bf07cda status: test description: Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to perform an activity that resembles an attempt to exfiltrate information from your organization. references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: Austin Songer @austinsonger date: 2021-08-23 modified: 2022-10-09 tags: - attack.exfiltration - attack.t1537 logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: Data exfiltration to unsanctioned apps status: success condition: selection falsepositives: - Unknown level: medium
Query: risk of The Siemens SPCanywhere application for iOS allows physically proximate attackers to bypass intended access restrictions by leveraging a filesystem architectural error.
Matching passage: CVE-2015-1599. CWE: CWE-264. CVSS: 2.0999999046325684. The Siemens SPCanywhere application for iOS allows physically proximate attackers to bypass intended access restrictions by leveraging a filesystem architectural error.
Near-miss passage: CVE-2015-1610. CWE: CWE-264. CVSS: 5.300000190734863. hosttracker in OpenDaylight l2switch allows remote attackers to change the host location information by spoofing the MAC address, aka "topology spoofing."
Query: patch priority for CVE-2015-2573
Matching passage: CVE-2015-2573. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.
Near-miss passage: CVE-2015-5557. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.
Query: exploit fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1131, CVE-201
Matching passage: CVE-2015-1133. CWE: CWE-20. CVSS: 7.199999809265137. fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1131, CVE-2015-1132, CVE-2015-1134, and CVE-2015-1135.
Near-miss passage: CVE-2015-5883. CWE: CWE-20. CVSS: 5.0. The bidirectional text-display and text-selection implementations in Terminal in Apple OS X before 10.11 interpret directional override formatting characters differently, which allows remote attackers to spoof the content of a text document via a crafted character sequence.
Query: containment actions for Lateral movement indicators for Application Access Token
Matching passage: Playbook for T1550.001 Application Access Token. 1) Validate alert telemetry against T1550.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: lateral movement. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used to access
Near-miss passage: Playbook for T1550.004 Web Session Cookie. Different response path focused on lateral movement.
Query: exploit racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests.
Matching passage: CVE-2015-4047. CWE: CWE-476. CVSS: 7.800000190734863. racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests.
Near-miss passage: CVE-2015-9043. CWE: CWE-476. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a NULL pointer can be dereferenced upon the expiry of a timer.