alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CWE for Improper Neutralization of Section Delimiters
Matching passage: CWE-145 Improper Neutralization of Section Delimiters. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as section delimiters when they are sent to a downstream component.
Near-miss passage: CWE-342 Predictable Exact Value from Previous Values. An exact value or random number can be precisely predicted by observing previous values.
Query: exploit Microsoft Internet Explorer 10 and 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."
Matching passage: CVE-2015-0069. CWE: CWE-264. CVSS: 4.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."
Near-miss passage: CVE-2015-0006. CWE: CWE-264. CVSS: 6.099999904632568. The Network Location Awareness (NLA) service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not perform mutual authentication to determine a domain connection, which allows remote attackers to trigger an unintended permissive configuration by spoofing DNS and LDAP responses on a local network, aka "NLA Security Feature Bypass Vulnerability."
Query: patch priority for CVE-2015-8981
Matching passage: CVE-2015-8981. CWE: CWE-119. CVSS: 9.800000190734863. Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in base/PdfParser.cpp in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.
Near-miss passage: CVE-2015-6507. CWE: CWE-119. CVSS: 7.199999809265137. The hdbsql client 1.00.091.00 Build 1418659308-1530 in SAP HANA allows local users to cause a denial of service (memory corruption) and possibly have unspecified other impact via unknown vectors, aka SAP Security Note 2140700.
Query: write Sigma for Detects registry modifications that disable Privacy Settings Experience
Matching passage: Sigma rule: Detects registry modifications that disable Privacy Settings Experience. Logsource: windows / registry_set. Rule: title: Disable Privacy Settings Experience in Registry id: 0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b status: test description: Detects registry modifications that disable Privacy Settings Experience references: - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1562.001/T1562.001.md author: frack113 date: 2022-10-02 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \SOFTWARE\Policies\Microsoft\Windows\OOBE\DisablePrivacyExperience Details: DWORD (0x00000000) condition: selection falsepositives: - Legitimate admin script level: medium
Near-miss passage: Sigma rule: Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScr. Logsource: windows / process_creation. Rule: title: HackTool - SharpMove Tool Execution id: 055fb54c-a8f4-4aee-bd44-f74cf30a0d9d status: test description: 'Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options. ' references: - https://github.com/0xthirteen/SharpMove/ - https://pentestlab.blog/tag/sharpmove/ author: Luca Di Bartolomeo (CrimpSec) date: 2024-01-29 tags: - attack.lateral-movement - attack.t1021.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \SharpMove.exe - OriginalFileName: SharpMove.exe selection_cli_computer: CommandLine|contains: computername= selection_cli_actions: CommandLine|contains: - action=create - action=dcom - action=executevbs - action=hijackdcom - action=modschtask - action=modsvc - action=query - action=scm - action=startservice - action=taskscheduler condition: selection_img or all of selection_cli_* falsepositives: - Unknown level: high
Query: exploit The ASN.1 decoder in Apple OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corru
Matching passage: CVE-2015-7059. CWE: CWE-119. CVSS: 6.800000190734863. The ASN.1 decoder in Apple OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate, a different vulnerability than CVE-2015-7060 and CVE-2015-7061.
Near-miss passage: CVE-2015-3703. CWE: CWE-119. CVSS: 6.800000190734863. ImageIO in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted TIFF image.
Query: risk of The Chaos tool suite (ctools) module 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to obtain sensitive node titles via (1) an autocomplete search on custom entities wit
Matching passage: CVE-2015-4375. CWE: CWE-200. CVSS: 4.300000190734863. The Chaos tool suite (ctools) module 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to obtain sensitive node titles via (1) an autocomplete search on custom entities without an access query tag or (2) leveraging knowledge of the ID of an entity.
Near-miss passage: CVE-2015-5860. CWE: CWE-200. CVSS: 5.0. The CFNetwork HTTPProtocol component in Apple iOS before 9 mishandles HSTS state, which allows remote attackers to bypass the Safari private-browsing protection mechanism and track users via a crafted web site.
Query: vulnerability: SQL injection vulnerability in Restaurant Biller allows remote attackers to execute arbitrary SQL commands via the cid parameter in a category action to index.php.
Matching passage: CVE-2015-1450. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Restaurant Biller allows remote attackers to execute arbitrary SQL commands via the cid parameter in a category action to index.php.
Near-miss passage: CVE-2015-2564. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to users-edit.php.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file.. Logsource: windows / process_creation. Rule: title: Suspicious ZipExec Execution id: 90dcf730-1b71-4ae7-9ffc-6fcf62bd0132 status: test description: ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file. references: - https://twitter.com/SBousseaden/status/1451237393017839616 - https://github.com/Tylous/ZipExec author: frack113 date: 2021-11-07 modified: 2022-12-25 tags: - attack.execution - attack.stealth - attack.t1218 - attack.t1202 logsource: category: process_creation product: windows detection: run: CommandLine|contains|all: - /generic:Microsoft_Windows_Shell_ZipFolder:filename= - .zip - '/pass:' - '/user:' delete: CommandLine|contains|all: - /delete - Microsoft_Windows_Shell_ZipFolder:filename= - .zip condition: run or delete falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option. Logsource: macos / process_creation. Rule: title: Hidden User Creation id: b22a5b36-2431-493a-8be1-0bae56c28ef3 status: test description: Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.002/T1564.002.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-10 modified: 2021-11-27 tags: - attack.stealth - attack.t1564.002 logsource: category: process_creation product: macos detection: dscl_create: Image|endswith: /dscl CommandLine|contains: create id_below_500: CommandLine|contains: UniqueID CommandLine|re: ([0-9]|[1-9][0-9]|[1-4][0-9]{2}) ishidden_option_declaration: CommandLine|contains: IsHidden ishidden_option_confirmation: CommandLine|contains: - 'true' - 'yes' - '1' condition: dscl_create and id_below_500 or dscl_create and (ishidden_option_declaration and ishidden_option_confirmation) falsepositives: - Legitimate administration activities level: medium
Query: CVE similar to CVE-2015-2724
Matching passage: CVE-2015-2724. CWE: CWE-119. CVSS: 10.0. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Near-miss passage: CVE-2015-1000. CWE: CWE-119. CVSS: 6.800000190734863. Stack-based buffer overflow in the OpenForIPCamTest method in the RTSPVIDEO.rtspvideoCtrl.1 (aka SStreamVideo) ActiveX control in Moxa SoftCMS before 1.3 allows remote attackers to execute arbitrary code via the StrRtspPath parameter.
Query: campaign using Domain Account
Matching passage: T1136.002 Domain Account. Tactics: persistence. Description: Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the <code>net user /add /domain</code> command can be used to create a domain account.(Citation: Savill 1999) Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Near-miss passage: T1136.001 Local Account. Tactics: persistence. Description: Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. For example, with a sufficient level of access, the Windows <code>net user /add</code> command can be used to create a local account. In Linux, the `useradd` command can be used, while on macOS systems, the <code>dscl -create</code> command can be used. Local accounts may also be added to network devices, often via common [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as <code>username</code>, to ESXi servers via `esxcli system account add`, or to Kubernetes clusters using the `kubectl` utility.(Citation: cisco_username_cmd)(Citation: Kubernetes Service Accounts Security) Adversaries may also create new local accounts on network firewall management consoles – for example, by exploiting a vulnerable firewall management system, threat actors may be able to establish super-admin accounts that could be used to modify firewall rules and gain further access to the network.(Citation: Cyber Security News) Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Query: what is T1686.002
Matching passage: T1686.002 Network Device Firewall. Tactics: defense impairment. Description: Adversaries may disable network device-based firewall mechanisms entirely or add, delete, or modify particular rules in order to bypass controls limiting network usage. Adversaries may obtain access to devices such as routers, switches, or other perimeter/network devices and change access control lists (ACLs), security zones, or policy rules to permit otherwise blocked traffic. For example, adversaries may add new network firewall rules to allow access to all internal network subnets without restrictions. Allowing access to internal network subsets may enable unrestricted inbound/outbound connectivity or open paths for command and control and lateral movement. Adversaries may obtain access to network device management interfaces via [Valid Accounts](https://attack.mitre.org/techniques/T1078) or by exploiting vulnerabilities. In some cases, threat actors may target firewalls and other network infrastructure that are exposed to the internet by leveraging weaknesses in public-facing applications ([Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).(Citation: CVE-2024-55591 Detail) Adversaries may also modify host networking configurations that indirectly manipulate system firewalls, such as adjusting interface bandwidth or network connection request thresholds.
Near-miss passage: T1686.001 Cloud Firewall. Tactics: defense impairment. Description: Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols. An adversary with appropriate permissions may introduce new firewall rules or policies to allow access into a victim cloud environment and/or move laterally from the cloud control plane to the data plane. For example, an adversary may use a script or utility that creates new ingress rules in existing security groups (or creates new security groups entirely) to allow any TCP/IP connectivity to a cloud-hosted instance. They may also remove networking limitations to support traffic associated with malicious activity (such as cryptomining).(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022)(Citation: Expel AWS)
Query: describe CVE-2015-5402
Matching passage: CVE-2015-5402. CWE: CWE-264. CVSS: 7.199999809265137. HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows local users to gain privileges, and consequently obtain sensitive information, modify data, or cause a denial of service, via unspecified vectors.
Near-miss passage: CVE-2015-7709. CWE: CWE-264. CVSS: 10.0. The arkeiad daemon in the Arkeia Backup Agent in Western Digital Arkeia 11.0.12 and earlier allows remote attackers to bypass authentication and execute arbitrary commands via a series of crafted requests involving the ARKFS_EXEC_CMD operation.
Query: detect Bidirectional Communication
Matching passage: T1102.002 Bidirectional Communication. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Near-miss passage: T1102.001 Dead Drop Resolver. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
Query: vulnerability: Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a diffe
Matching passage: CVE-2015-4931. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a different vulnerability than CVE-2015-4932, CVE-2015-4933, CVE-2015-4934, and CVE-2015-4935.
Near-miss passage: CVE-2015-8382. CWE: CWE-119. CVSS: 6.400000095367432. The match function in pcre_exec.c in PCRE before 8.37 mishandles the /(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi)abc)|((*ACCEPT)))/ pattern and related patterns involving (*ACCEPT), which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (partially initialized memory and application crash) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-2547.
Query: patch priority for CVE-2015-4351
Matching passage: CVE-2015-4351. CWE: CWE-264. CVSS: 4.900000095367432. The Spider Video Player module for Drupal allows remote authenticated users with the "access Spider Video Player administration" permission to delete arbitrary files via a crafted URL.
Near-miss passage: CVE-2015-6423. CWE: CWE-264. CVSS: 4.300000190734863. The DCERPC Inspection implementation in Cisco Adaptive Security Appliance (ASA) Software 9.4.1 through 9.5.1 allows remote authenticated users to bypass an intended DCERPC-only ACL by sending arbitrary network traffic, aka Bug ID CSCuu67782.
Query: alert when Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)
Matching passage: Sigma rule: Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64). Logsource: windows / file_event. Rule: title: UAC Bypass Using IEInstal - File id: bdd8157d-8e85-4397-bb82-f06cc9c71dbb status: test description: Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: file_event product: windows detection: selection: Image: C:\Program Files\Internet Explorer\IEInstal.exe TargetFilename|startswith: C:\Users\ TargetFilename|contains: \AppData\Local\Temp\ TargetFilename|endswith: consent.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of rundll32 where the DLL being called is stored in an Alternate Data Stream (ADS).. Logsource: windows / process_creation. Rule: title: Potential Rundll32 Execution With DLL Stored In ADS id: 9248c7e1-2bf3-4661-a22c-600a8040b446 status: test description: Detects execution of rundll32 where the DLL being called is stored in an Alternate Data Stream (ADS). references: - https://lolbas-project.github.io/lolbas/Binaries/Rundll32 author: Harjot Singh, '@cyb3rjy0t' date: 2023-01-21 modified: 2026-03-16 tags: - attack.stealth - attack.t1564.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|re: '[Rr][Uu][Nn][Dd][Ll][Ll]32(?:\.[Ee][Xx][Ee])? \S+?\w:\S+?:' condition: all of selection_* falsepositives: - Unknown level: high
Query: Multiple failed authentications followed by Create Snapshot
Matching passage: T1578.001 Create Snapshot. Tactics: defense impairment. Description: An adversary may create a snapshot or data backup within a cloud account to evade defenses. A snapshot is a point-in-time copy of an existing cloud compute component such as a virtual machine (VM), virtual hard drive, or volume. An adversary may leverage permissions to create a snapshot in order to bypass restrictions that prevent access to existing compute service infrastructure, unlike in [Revert Cloud Instance](https://attack.mitre.org/techniques/T1578/004) where an adversary may revert to a snapshot to evade detection and remove evidence of their presence. An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002), mount one or more created snapshots to that instance, and then apply a policy that allows the adversary access to the created instance, such as a firewall policy that allows them inbound and outbound SSH access.(Citation: Mandiant M-Trends 2020)
Near-miss passage: T1578.005 Modify Cloud Compute Configurations. Tactics: defense impairment. Description: Adversaries may modify settings that directly affect the size, locations, and resources available to cloud compute infrastructure in order to evade defenses. These settings may include service quotas, subscription associations, tenant-wide policies, or other configurations that impact available compute. Such modifications may allow adversaries to abuse the victim’s compute resources to achieve their goals, potentially without affecting the execution of running instances and/or revealing their activities to the victim. For example, cloud providers often limit customer usage of compute resources via quotas. Customers may request adjustments to these quotas to support increased computing needs, though these adjustments may require approval from the cloud provider. Adversaries who compromise a cloud environment may similarly request quota adjustments in order to support their activities, such as enabling additional [Resource Hijacking](https://attack.mitre.org/techniques/T1496) without raising suspicion by using up a victim’s entire quota.(Citation: Microsoft Cryptojacking 2023) Adversaries may also increase allowed resource usage by modifying any tenant-wide policies that limit the sizes of deployed virtual machines.(Citation: Microsoft Azure Policy) Adversaries may also modify settings that affect where cloud resources can be deployed, such as enabling [Unused/Unsupported Cloud Regions](https://attack.mitre.org/techniques/T1535).