alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit The CBSharedReviewStatusDialog method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acro
Matching passage: CVE-2015-6722. CWE: UNKNOWN. CVSS: 6.800000190734863. The CBSharedReviewStatusDialog method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Near-miss passage: CVE-2015-0328. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2015-0325 and CVE-2015-0326.
Query: vulnerability: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to cause a denial of service (memo
Matching passage: CVE-2015-4513. CWE: CWE-119. CVSS: 7.5. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Near-miss passage: CVE-2015-6118. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Office 2007 SP3 and Office 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: Sigma YAML for windows / network_connection
Matching passage: Sigma rule: Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing comm. Logsource: windows / network_connection. Rule: title: Suspicious Outbound SMTP Connections id: 9976fa64-2804-423c-8a5b-646ade840773 status: test description: 'Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048.003/T1048.003.md#atomic-test-5---exfiltration-over-alternative-protocol---smtp - https://www.ietf.org/rfc/rfc2821.txt author: frack113 date: 2022-01-07 modified: 2022-09-21 tags: - attack.exfiltration - attack.t1048.003 logsource: category: network_connection product: windows detection: selection: DestinationPort: - 25 - 587 - 465 - 2525 Initiated: 'true' filter_clients: Image|endswith: - \thunderbird.exe - \outlook.exe filter_mailserver: Image|startswith: C:\Program Files\Microsoft\Exchange Server\ filter_outlook: Image|startswith: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_ Image|endswith: \HxTsr.exe condition: selection and not 1 of filter_* falsepositives: - Other SMTP tools level: medium
Near-miss passage: Sigma rule: Detects an issue in apache logs that reports threading related errors. Logsource: apache. Rule: title: Apache Threading Error id: e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c status: test description: Detects an issue in apache logs that reports threading related errors references: - https://github.com/hannob/apache-uaf/blob/da40f2be3684c8095ec6066fa68eb5c07a086233/README.md author: Florian Roth (Nextron Systems) date: 2019-01-22 modified: 2021-11-27 tags: - attack.initial-access - attack.lateral-movement - attack.t1190 - attack.t1210 logsource: service: apache definition: 'Requirements: Must be able to collect the error.log file' detection: keywords: - '__pthread_tpp_change_priority: Assertion `new_prio == -1 || (new_prio >= fifo_min_prio && new_prio <= fifo_max_prio)' condition: keywords falsepositives: - 3rd party apache modules - https://bz.apache.org/bugzilla/show_bug.cgi?id=46185 level: medium
Query: patch priority for CVE-2015-7327
Matching passage: CVE-2015-7327. CWE: CWE-200. CVSS: 4.300000190734863. Mozilla Firefox before 41.0 does not properly restrict the availability of High Resolution Time API times, which allows remote attackers to track last-level cache access, and consequently obtain sensitive information, via crafted JavaScript code that makes performance.now calls.
Near-miss passage: CVE-2015-0080. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly initialize memory for rendering of malformed PNG images, which allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Malformed PNG Parsing Information Disclosure Vulnerability."
Query: describe CVE-2015-0067
Matching passage: CVE-2015-0067. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-6292. CWE: CWE-399. CVSS: 7.800000190734863. The proxy-cache implementation in Cisco AsyncOS 8.0.x before 8.0.7-151, 8.1.x and 8.5.x before 8.5.2-004, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via multiple proxy connections, aka Bug ID CSCus10922.
Query: exploit In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 
Matching passage: CVE-2015-9193. CWE: CWE-20. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, improper input validation could cause a memory overread and cause the app to crash.
Near-miss passage: CVE-2015-8740. CWE: CWE-20. CVSS: 5.300000190734863. The dissect_tds7_colmetadata_token function in epan/dissectors/packet-tds.c in the TDS dissector in Wireshark 2.0.x before 2.0.1 does not validate the number of columns, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet.
Query: exploit The nsTArray_Impl class in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 might allow remote attackers to cause a denial of service (memory co
Matching passage: CVE-2015-4489. CWE: CWE-119. CVSS: 7.5. The nsTArray_Impl class in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging a self assignment.
Near-miss passage: CVE-2015-8683. CWE: CWE-119. CVSS: 5.5. The putcontig8bitCIELab function in tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a packed TIFF image.
Query: patch priority for CVE-2015-2773
Matching passage: CVE-2015-2773. CWE: UNKNOWN. CVSS: 5.0. SVM in Websense TRITON V-Series appliances before 8.0.0 allows attackers to read arbitrary files via unspecified vectors.
Near-miss passage: CVE-2015-1182. CWE: UNKNOWN. CVSS: 7.5. The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ASN.1 sequence in a certificate.
Query: risk of Unrestricted file upload vulnerability in the Job Fair (jobfair) extension before 1.0.1 for TYPO3, when using Apache with mod_mime, allows remote attackers to execute arbitrary cod
Matching passage: CVE-2015-4606. CWE: UNKNOWN. CVSS: 7.5. Unrestricted file upload vulnerability in the Job Fair (jobfair) extension before 1.0.1 for TYPO3, when using Apache with mod_mime, allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the extension upload folder.
Near-miss passage: CVE-2015-1649. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps Server 2010 SP2 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Component Use After Free Vulnerability."
Query: describe CVE-2015-7580
Matching passage: CVE-2015-7580. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.
Near-miss passage: CVE-2015-4385. CWE: CWE-79. CVSS: 2.0999999046325684. Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Imagefield Info module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "Administer image styles" permission to inject arbitrary web script or HTML via unspecified vectors.
Query: patch priority for CVE-2015-1425
Matching passage: CVE-2015-1425. CWE: CWE-20. CVSS: 9.800000190734863. JAKWEB Gecko CMS has Multiple Input Validation Vulnerabilities
Near-miss passage: CVE-2015-8373. CWE: CWE-20. CVSS: 6.800000190734863. The kea-dhcp4 and kea-dhcp6 servers 0.9.2 and 1.0.0-beta in ISC Kea, when certain debugging settings are used, allow remote attackers to cause a denial of service (daemon crash) via a malformed packet.
Query: write Sigma for Detects the execution of WebBrowserPassView.exe. A password recovery tool that reveals the passwords stored by the follo
Matching passage: Sigma rule: Detects the execution of WebBrowserPassView.exe. A password recovery tool that reveals the passwords stored by the follo. Logsource: windows / process_creation. Rule: title: PUA - WebBrowserPassView Execution id: d0dae994-26c6-4d2d-83b5-b3c8b79ae513 status: test description: Detects the execution of WebBrowserPassView.exe. A password recovery tool that reveals the passwords stored by the following Web browsers, Internet Explorer (Version 4.0 - 11.0), Mozilla Firefox (All Versions), Google Chrome, Safari, and Opera references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1555.003/T1555.003.md author: frack113 date: 2022-08-20 modified: 2023-02-14 tags: - attack.credential-access - attack.t1555.003 logsource: category: process_creation product: windows detection: selection: - Description: Web Browser Password Viewer - Image|endswith: \WebBrowserPassView.exe condition: selection falsepositives: - Legitimate use level: medium
Near-miss passage: Sigma rule: Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report. Logsource: windows / system. Rule: title: Moriya Rootkit - System id: 25b9c01c-350d-4b95-bed1-836d04a4f324 status: test description: Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report references: - https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831 author: Bhabesh Raj date: 2021-05-06 modified: 2022-11-29 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ServiceName: ZzNetSvc condition: selection falsepositives: - Unknown level: critical
Query: exploit Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430 allows remote authenticated users to execute arbitrary OS commands via unspecified vectors.
Matching passage: CVE-2015-7901. CWE: CWE-78. CVSS: 6.5. Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430 allows remote authenticated users to execute arbitrary OS commands via unspecified vectors.
Near-miss passage: CVE-2015-5690. CWE: CWE-78. CVSS: 8.5. The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands by leveraging a "redirect."
Query: CVE similar to CVE-2015-0420
Matching passage: CVE-2015-0420. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Forms component in Oracle Fusion Middleware 11.1.1.7 and 11.1.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Forms Services.
Near-miss passage: CVE-2015-5206. CWE: UNKNOWN. CVSS: 9.800000190734863. Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2015-5168.
Query: alert when Detects potential DLL sideloading of "libvlc.dll", a DLL that is legitimately used by "VLC.exe"
Matching passage: Sigma rule: Detects potential DLL sideloading of "libvlc.dll", a DLL that is legitimately used by "VLC.exe". Logsource: windows / image_load. Rule: title: Potential Libvlc.DLL Sideloading id: bf9808c4-d24f-44a2-8398-b65227d406b6 status: test description: Detects potential DLL sideloading of "libvlc.dll", a DLL that is legitimately used by "VLC.exe" references: - https://www.trendmicro.com/en_us/research/23/c/earth-preta-updated-stealthy-strategies.html - https://hijacklibs.net/entries/3rd_party/vlc/libvlc.html author: X__Junior date: 2023-04-17 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \libvlc.dll filter_main_vlc: ImageLoaded|startswith: - C:\Program Files (x86)\VideoLAN\VLC\ - C:\Program Files\VideoLAN\VLC\ condition: selection and not 1 of filter_main_* falsepositives: - False positives are expected if VLC is installed in non-default locations level: medium
Near-miss passage: Sigma rule: Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch. Logsource: windows / process_creation. Rule: title: Suspicious ShellExec_RunDLL Call Via Ordinal id: 8823e85d-31d8-473e-b7f4-92da070f0fc6 related: - id: d87bd452-6da1-456e-8155-7dc988157b7d type: derived status: test description: 'Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch other commands. Adversary might only use the ordinal number in order to bypass existing detection that alert on usage of ShellExec_RunDLL on CommandLine. ' references: - https://redcanary.com/blog/raspberry-robin/ - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - https://github.com/SigmaHQ/sigma/issues/1009 - https://strontic.github.io/xcyclopedia/library/shell32.dll-65DA072F25DE83D9F83653E3FEA3644D.html author: Swachchhanda Shrawan Poudel date: 2024-12-01 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection_parent_img: ParentCommandLine|contains: SHELL32.DLL selection_parent_ordinal: ParentCommandLine|contains: - '#568' - '#570' - '#572' - '#576' selection_susp_cli_parent: - ParentCommandLine|contains: - comspec - iex - Invoke- - msiexec - odbcconf - regsvr32 - ParentCommandLine|contains: - \Desktop\ - \ProgramData\ - \Temp\ - \Users\Public\ selection_susp_child_img: Image|endswith: - \bash.exe - \bitsadmin.exe - \cmd.exe - \cscript.exe - \curl.exe - \mshta.exe - \msiexec.exe - \msxsl.exe - \odbcconf.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \schtasks.exe - \wmic.exe - \wscript.exe condition: all of selection_parent_* and 1 of selection_susp_* falsepositives: - Unknown level: high
Query: vulnerability: Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect confidentiality via unknown vectors related
Matching passage: CVE-2015-4737. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Pluggable Auth.
Near-miss passage: CVE-2015-0404. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote attackers to affect integrity via unknown vectors related to Error Messages.
Query: patch priority for CVE-2015-3132
Matching passage: CVE-2015-3132. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
Near-miss passage: CVE-2015-0482. CWE: UNKNOWN. CVSS: 6.0. Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 12.1.2.0 and 12.1.3.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to WLS-WebServices.
Query: rule covering Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from
Matching passage: Sigma rule: Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from. Logsource: windows / process_access. Rule: title: Lsass Memory Dump via Comsvcs DLL id: a49fa4d5-11db-418c-8473-1e014a8dd462 status: test description: Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass. references: - https://twitter.com/shantanukhande/status/1229348874298388484 - https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/ author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-20 modified: 2023-11-29 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe SourceImage|endswith: \rundll32.exe CallTrace|contains: comsvcs.dll condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry. Logsource: windows / process_creation. Rule: title: Enable LM Hash Storage - ProcCreation id: 98dedfdd-8333-49d4-9f23-d7018cccae53 related: - id: c420410f-c2d8-4010-856b-dffe21866437 type: similar status: test description: 'Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases. ' references: - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a - https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password - https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-12-15 modified: 2023-12-22 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: process_creation detection: selection: CommandLine|contains|all: - \System\CurrentControlSet\Control\Lsa - NoLMHash - ' 0' condition: selection falsepositives: - Unknown level: high
Query: how to detect Backup Software Discovery
Matching passage: T1518.002 Backup Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of backup software or configurations that are installed on a system. Adversaries may use this information to shape follow-on behaviors, such as [Data Destruction](https://attack.mitre.org/techniques/T1485), [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486). Commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), `reg query` with [Reg](https://attack.mitre.org/software/S0075), `dir` with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for, such as Veeam, Acronis, Dropbox, or Paragon.(Citation: Symantec Play Ransomware 2023)
Near-miss passage: T1518 Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from [Software Discovery](https://attack.mitre.org/techniques/T1518) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Such software may be deployed widely across the environment for configuration management or security reasons, such as [Software Deployment Tools](https://attack.mitre.org/techniques/T1072), and may allow adversaries broad access to infect devices or move laterally. Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable to [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).