alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corr
Matching passage: CVE-2015-2450. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2451.
Near-miss passage: CVE-2015-7937. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340 PLC BMXNOx and BMXPx devices allows remote attackers to execute arbitrary code via a long password in HTTP Basic Authentication data.
Query: Sigma YAML for windows / process_access
Matching passage: Sigma rule: Detects suspicious access to the "svchost" process such as that used by Invoke-Phantom to kill the thread of the Windows. Logsource: windows / process_access. Rule: title: Suspicious Svchost Process Access id: 166e9c50-8cd9-44af-815d-d1f0c0e90dde status: test description: Detects suspicious access to the "svchost" process such as that used by Invoke-Phantom to kill the thread of the Windows event logging service. references: - https://github.com/hlldz/Invoke-Phant0m - https://twitter.com/timbmsft/status/900724491076214784 author: Tim Burrell date: 2020-01-02 modified: 2023-01-30 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: :\Windows\System32\svchost.exe GrantedAccess: '0x1F3FFF' CallTrace|contains: UNKNOWN filter_main_msbuild: SourceImage|contains: :\Program Files\Microsoft Visual Studio\ SourceImage|endswith: \MSBuild\Current\Bin\MSBuild.exe CallTrace|contains: - Microsoft.Build.ni.dll - System.ni.dll condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the deletion of a process's executable by itself. This is usually not possible without workarounds and may be us. Logsource: windows / file_delete. Rule: title: Process Deletion of Its Own Executable id: f01d1f70-cd41-42ec-9c0b-26dd9c22bf29 status: test description: 'Detects the deletion of a process''s executable by itself. This is usually not possible without workarounds and may be used by malware to hide its traces. ' references: - https://github.com/joaoviictorti/RustRedOps/tree/ce04369a246006d399e8c61d9fe0e6b34f988a49/Self_Deletion author: Max Altgelt (Nextron Systems) date: 2024-09-03 tags: - attack.stealth logsource: product: windows category: file_delete detection: selection: TargetFilename|fieldref: Image condition: selection falsepositives: - Some false positives are to be expected from uninstallers. level: medium
Query: patch priority for CVE-2015-2730
Matching passage: CVE-2015-2730. CWE: CWE-310. CVSS: 4.300000190734863. Mozilla Network Security Services (NSS) before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and other products, does not properly perform Elliptical Curve Cryptography (ECC) multiplications, which makes it easier for remote attackers to spoof ECDSA signatures via unspecified vectors.
Near-miss passage: CVE-2015-1672. CWE: CWE-310. CVSS: 5.0. Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allows remote attackers to cause a denial of service (recursion and performance degradation) via crafted encrypted data in an XML document, aka ".NET XML Decryption Denial of Service Vulnerability."
Query: indicators of RDP Hijacking
Matching passage: T1563.002 RDP Hijacking. Tactics: lateral movement. Description: Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services) Adversaries may perform RDP session hijacking which involves stealing a legitimate user's remote session. Typically, a user is notified when someone else is trying to steal their session. With System permissions and using Terminal Services Console, `c:\windows\system32\tscon.exe [session number to be stolen]`, an adversary can hijack a session without the need for credentials or prompts to the user.(Citation: RDP Hijacking Korznikov) This can be done remotely or locally and with active or disconnected sessions.(Citation: RDP Hijacking Medium) It can also lead to [Remote System Discovery](https://attack.mitre.org/techniques/T1018) and Privilege Escalation by stealing a Domain Admin or higher privileged account session. All of this can be done by using native Windows commands, but it has also been added as a feature in red teaming tools.(Citation: Kali Redsnarf)
Near-miss passage: T1563 Remote Service Session Hijacking. Tactics: lateral movement. Description: Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP. When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service. Adversaries may commandeer these sessions to carry out actions on remote systems. [Remote Service Session Hijacking](https://attack.mitre.org/techniques/T1563) differs from use of [Remote Services](https://attack.mitre.org/techniques/T1021) because it hijacks an existing session rather than creating a new session using [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: RDP Hijacking Medium)(Citation: Breach Post-mortem SSH Hijack)
Query: exploit Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 allows remote authenticated users to affect confidentiality and integrity vi
Matching passage: CVE-2015-4763. CWE: UNKNOWN. CVSS: 3.5999999046325684. Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Security.
Near-miss passage: CVE-2015-4869. CWE: UNKNOWN. CVSS: 4.900000095367432. Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect availability via unknown vectors related to Kernel.
Query: describe CVE-2015-20107
Matching passage: CVE-2015-20107. CWE: CWE-77. CVSS: 7.599999904632568. In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9
Near-miss passage: CVE-2015-5274. CWE: CWE-77. CVSS: 6.5. rubygem-openshift-origin-console in Red Hat OpenShift 2.2 allows remote authenticated users to execute arbitrary commands via a crafted request to the Broker.
Query: exploit The admin pages for power types and key types in Beaker before 20.1 do not have any access controls, which allows remote authenticated users to modify power types and key types via
Matching passage: CVE-2015-3163. CWE: CWE-284. CVSS: 4.300000190734863. The admin pages for power types and key types in Beaker before 20.1 do not have any access controls, which allows remote authenticated users to modify power types and key types via navigating to $BEAKER/powertypes and $BEAKER/keytypes respectively.
Near-miss passage: CVE-2015-3675. CWE: CWE-284. CVSS: 5.0. The default configuration of the Apache HTTP Server on Apple OS X before 10.10.4 does not enable the mod_hfs_apple module, which allows remote attackers to bypass HTTP authentication via a crafted URL.
Query: Sigma rule for Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing wh
Matching passage: Sigma rule: Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing wh. Logsource: windows / process_creation. Rule: title: Python Function Execution Security Warning Disabled In Excel id: 023c654f-8f16-44d9-bb2b-00ff36a62af9 related: - id: 17e53739-a1fc-4a62-b1b9-87711c2d5e44 type: similar status: test description: 'Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed. Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet. ' references: - https://support.microsoft.com/en-us/office/data-security-and-python-in-excel-33cc88a4-4a87-485e-9ff9-f35958278327 author: '@Kostastsale' date: 2023-08-22 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - \Microsoft\Office\ - \Excel\Security - PythonFunctionWarnings CommandLine|contains: ' 0' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting. Logsource: windows / process_creation. Rule: title: Potential Meterpreter/CobaltStrike Activity id: 15619216-e993-4721-b590-4c520615a67d status: test description: Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment - https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/ author: Teymur Kheirkhabarov, Ecco, Florian Roth date: 2019-10-26 modified: 2023-02-05 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.001 - attack.t1134.002 logsource: category: process_creation product: windows detection: selection_img: ParentImage|endswith: \services.exe selection_technique_1: CommandLine|contains|all: - /c - echo - \pipe\ CommandLine|contains: - cmd - '%COMSPEC%' selection_technique_2: CommandLine|contains|all: - rundll32 - .dll,a - '/p:' filter_defender: CommandLine|contains: MpCmdRun condition: selection_img and 1 of selection_technique_* and not 1 of filter_* falsepositives: - Commandlines containing components like cmd accidentally - Jobs and services started with cmd level: high
Query: exploit Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software before V100R003C00SPC60
Matching passage: CVE-2015-7842. CWE: CWE-275. CVSS: 7.099999904632568. Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software before V100R003C00SPC602, RH1288 V3 with software before V100R003C00SPC602, RH2288A V2 with software before V100R002C00SPC701, RH1288A V2 with software before V100R002C00SPC502, RH8100 V3 with software before V100R003C00SPC110, CH222 V3 with software before V100R001C00SPC161, CH220 V3 with software before V100R001C00SPC161, and CH121 V3 with software before V100R001C00SPC161 allow remote authenticated operators to change server information by leveraging failure to verify user permissions.
Near-miss passage: CVE-2015-8300. CWE: CWE-275. CVSS: 7.800000190734863. Polycom BToE Connector before 3.0.0 uses weak permissions (Everyone: Full Control) for "Program Files (x86)\polycom\polycom btoe connector\plcmbtoesrv.exe," which allows local users to gain privileges via a Trojan horse file.
Query: Sigma rule for Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility
Matching passage: Sigma rule: Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility. Logsource: windows / process_creation. Rule: title: HackTool - RedMimicry Winnti Playbook Execution id: 95022b85-ff2a-49fa-939a-d7b8f56eeb9b status: test description: Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility references: - https://redmimicry.com/posts/redmimicry-winnti/ author: Alexander Rausch date: 2020-06-24 modified: 2023-03-01 tags: - attack.execution - attack.stealth - attack.t1106 - attack.t1059.003 - attack.t1218.011 logsource: product: windows category: process_creation detection: selection: Image|endswith: - \rundll32.exe - \cmd.exe CommandLine|contains: - gthread-3.6.dll - \Windows\Temp\tmp.bat - sigcmm-2.4.dll condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse.. Logsource: gcp / google_workspace.login. Rule: title: Google Workspace Out Of Domain Email Forwarding id: 2a0bb2dd-eb5f-4517-8cb9-404f8ba764a5 status: experimental description: Detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse. references: - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#email_forwarding_out_of_domain author: Tom kluter date: 2026-04-28 tags: - attack.t1114.003 - attack.collection logsource: product: gcp service: google_workspace.login detection: selection: protoPayload.serviceName: login.googleapis.com protoPayload.metadata.event.eventName: email_forwarding_out_of_domain condition: selection falsepositives: - Legitimate forwarding level: medium
Query: describe CVE-2015-5509
Matching passage: CVE-2015-5509. CWE: CWE-264. CVSS: 6.0. The Administration Views module 7.x-1.x before 7.x-1.4 for Drupal, when used with other unspecified modules, does not properly grant access to administration pages, which allows remote administrators to bypass intended restrictions via unspecified vectors.
Near-miss passage: CVE-2015-2553. CWE: CWE-264. CVSS: 7.199999809265137. The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 mishandles junctions during mountpoint creation, which makes it easier for local users to gain privileges by leveraging certain sandbox access, aka "Windows Mount Point Elevation of Privilege Vulnerability."
Query: CVE similar to CVE-2015-0549
Matching passage: CVE-2015-0549. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in EMC Documentum D2 before 4.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-8477. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Redmine before 2.6.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving flash message rendering.
Query: patch priority for CVE-2015-8830
Matching passage: CVE-2015-8830. CWE: UNKNOWN. CVSS: 7.800000190734863. Integer overflow in the aio_setup_single_vector function in fs/aio.c in the Linux kernel 4.0 allows local users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec. NOTE: this vulnerability exists because of a CVE-2012-6701 regression.
Near-miss passage: CVE-2015-4737. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Pluggable Auth.
Query: patch priority for CVE-2015-5970
Matching passage: CVE-2015-5970. CWE: CWE-94. CVSS: 5.300000190734863. The ChangePassword RPC method in Novell ZENworks Configuration Management (ZCM) 11.3 and 11.4 allows remote attackers to conduct XPath injection attacks, and read arbitrary text files, via a malformed query involving a system entity reference.
Near-miss passage: CVE-2015-1061. CWE: CWE-94. CVSS: 9.300000190734863. IOSurface in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages "type confusion" during serialized-object handling.
Query: adversary uses Security Support Provider
Matching passage: T1547.005 Security Support Provider. Tactics: persistence, privilege escalation. Description: Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages</code> and <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages</code>. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)
Near-miss passage: T1547.002 Authentication Package. Tactics: persistence, privilege escalation. Description: Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system.(Citation: MSDN Authentication Packages) Adversaries can use the autostart mechanism provided by LSA authentication packages for persistence by placing a reference to a binary in the Windows Registry location <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\</code> with the key value of <code>"Authentication Packages"=&lt;target binary&gt;</code>. The binary will then be executed by the system when the authentication packages are loaded.
Query: SOC runbook when seeing Encoded PowerShell / command-line abuse matching Search Threat Vendor Data
Matching passage: Playbook for T1681 Search Threat Vendor Data. 1) Validate alert telemetry against T1681. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: reconnaissance. 5) Eradicate persistence and recover. Reference detection notes: Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware has
Near-miss passage: Playbook for T1598.003 Spearphishing Link. Different response path focused on reconnaissance.
Query: patch priority for CVE-2015-8312
Matching passage: CVE-2015-8312. CWE: CWE-189. CVSS: 7.800000190734863. Off-by-one error in afs_pioctl.c in OpenAFS before 1.6.16 might allow local users to cause a denial of service (memory overwrite and system crash) via a pioctl with an input buffer size of 4096 bytes.
Near-miss passage: CVE-2015-3814. CWE: CWE-189. CVSS: 5.0. The (1) dissect_tfs_request and (2) dissect_tfs_response functions in epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 interpret a zero value as a length rather than an error condition, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authenticated users with permission to create or edit a stickynote to 
Matching passage: CVE-2015-7879. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authenticated users with permission to create or edit a stickynote to inject arbitrary web script or HTML via note text on the admin listing page.
Near-miss passage: CVE-2015-6037. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in Microsoft Excel Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps 2010 SP2, Excel Web App 2010 SP2, Office Web Apps Server 2013 SP1, and SharePoint Foundation 2013 SP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka "Microsoft Office Web Apps XSS Spoofing Vulnerability."
Query: exploit The RSM (aka RSMWinService) service in SolarWinds N-Able N-Central before 9.5.1.4514 uses the same password decryption key across different customers' installations, which makes it
Matching passage: CVE-2015-5610. CWE: CWE-200. CVSS: 4.0. The RSM (aka RSMWinService) service in SolarWinds N-Able N-Central before 9.5.1.4514 uses the same password decryption key across different customers' installations, which makes it easier for remote authenticated users to obtain the cleartext domain-administrator password by locating the encrypted password within HTML source code and then leveraging knowledge of this key from another installation.
Near-miss passage: CVE-2015-1064. CWE: CWE-200. CVSS: 1.899999976158142. Springboard in Apple iOS before 8.2 allows physically proximate attackers to bypass an intended activation requirement and read the home screen by leveraging an application crash during the activation process.
Query: risk of Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated us
Matching passage: CVE-2015-2618. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect integrity via unknown vectors related to Input validation.
Near-miss passage: CVE-2015-0427. CWE: UNKNOWN. CVSS: 3.200000047683716. Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.3.20 allows local users to affect integrity and availability via vectors related to VMSVGA virtual graphics device, a different vulnerability than CVE-2014-6588, CVE-2014-6589, CVE-2014-6590, and CVE-2014-6595.