alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit The TCL interpreter in Cisco IOS 15.2 does not properly maintain the vty state, which allows local users to gain privileges by starting a session very soon after a TCL script execu
Matching passage: CVE-2015-4185. CWE: CWE-264. CVSS: 6.900000095367432. The TCL interpreter in Cisco IOS 15.2 does not properly maintain the vty state, which allows local users to gain privileges by starting a session very soon after a TCL script execution, aka Bug ID CSCuq24202.
Near-miss passage: CVE-2015-1155. CWE: CWE-264. CVSS: 4.300000190734863. The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to bypass the Same Origin Policy and read arbitrary files via a crafted web site.
Query: patch priority for CVE-2015-3933
Matching passage: CVE-2015-3933. CWE: CWE-89. CVSS: 9.800000190734863. Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote attackers to execute arbitrary SQL commands via the (1) email parameter or (2) userid parameter to register.php.
Near-miss passage: CVE-2015-2999. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in SysAid Help Desk before 15.2 allow remote administrators to execute arbitrary SQL commands via the (1) groupFilter parameter in an AssetDetails report to /genericreport, customSQL parameter in a (2) TopAdministratorsByAverageTimer report or an (3) ActiveRequests report to /genericreport, (4) dir parameter to HelpDesk.jsp, or (5) grantSQL parameter to RFCGantt.jsp.
Query: detect When configured with suitable command line arguments, w32tm can act as a delay mechanism in logs
Matching passage: Sigma rule: When configured with suitable command line arguments, w32tm can act as a delay mechanism. Logsource: windows / process_creation. Rule: title: Use of W32tm as Timer id: 6da2c9f5-7c53-401b-aacb-92c040ce1215 status: test description: When configured with suitable command line arguments, w32tm can act as a delay mechanism references: - https://github.com/redcanaryco/atomic-red-team/blob/d0dad62dbcae9c60c519368e82c196a3db577055/atomics/T1124/T1124.md - https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains author: frack113 date: 2022-09-25 tags: - attack.discovery - attack.t1124 logsource: category: process_creation product: windows detection: selection_w32tm: - Image|endswith: \w32tm.exe - OriginalFileName: w32time.dll selection_cmd: CommandLine|contains|all: - /stripchart - '/computer:' - '/period:' - /dataonly - '/samples:' condition: all of selection_* falsepositives: - Legitimate use level: high
Near-miss passage: Sigma rule: Detects Obfuscated use of stdin to execute PowerShell. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation STDIN+ Launcher - Powershell id: 779c8c12-0eb1-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of stdin to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|re: cmd.{0,5}(?:/c|/r).+powershell.+(?:\$?\{?input\}?|noexit).+" condition: selection_4104 falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-4533
Matching passage: CVE-2015-4533. CWE: CWE-264. CVSS: 9.0. EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02 does not properly check authorization after creation of an object, which allows remote authenticated users to execute arbitrary code with super-user privileges via a custom script. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2513.
Near-miss passage: CVE-2015-0175. CWE: CWE-264. CVSS: 5.5. IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 does not properly implement authData elements, which allows remote authenticated users to gain privileges via unspecified vectors.
Query: detection rule: Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters
Matching passage: Sigma rule: Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters. Logsource: windows / process_creation. Rule: title: PUA - Seatbelt Execution id: 38646daa-e78f-4ace-9de0-55547b2d30da status: test description: Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters references: - https://github.com/GhostPack/Seatbelt - https://www.bluetangle.dev/2022/08/fastening-seatbelt-on-threat-hunting.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-18 modified: 2023-02-04 tags: - attack.discovery - attack.t1526 - attack.t1087 - attack.t1083 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \Seatbelt.exe - OriginalFileName: Seatbelt.exe - Description: Seatbelt - CommandLine|contains: - ' DpapiMasterKeys' - ' InterestingProcesses' - ' InterestingFiles' - ' CertificateThumbprints' - ' ChromiumBookmarks' - ' ChromiumHistory' - ' ChromiumPresence' - ' CloudCredentials' - ' CredEnum' - ' CredGuard' - ' FirefoxHistory' - ' ProcessCreationEvents' selection_group_list: CommandLine|contains: - ' -group=misc' - ' -group=remote' - ' -group=chromium' - ' -group=slack' - ' -group=system' - ' -group=user' - ' -group=all' selection_group_output: CommandLine|contains: ' -outputfile=' condition: selection_img or all of selection_group_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: The "ScriptRunner.exe" binary can be abused to proxy execution through it and bypass possible whitelisting. Logsource: windows / process_creation. Rule: title: Use of Scriptrunner.exe id: 64760eef-87f7-4ed3-93fd-655668ea9420 status: test description: The "ScriptRunner.exe" binary can be abused to proxy execution through it and bypass possible whitelisting references: - https://lolbas-project.github.io/lolbas/Binaries/Scriptrunner/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-01 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \ScriptRunner.exe - OriginalFileName: ScriptRunner.exe selection_cli: CommandLine|contains: ' -appvscript ' condition: all of selection* falsepositives: - Legitimate use when App-v is deployed level: medium
Query: vulnerability: CoreAnimation in Apple iOS before 9 allows attackers to bypass intended IOSurface restrictions and obtain screen-framebuffer access via a crafted background app.
Matching passage: CVE-2015-5880. CWE: CWE-200. CVSS: 4.300000190734863. CoreAnimation in Apple iOS before 9 allows attackers to bypass intended IOSurface restrictions and obtain screen-framebuffer access via a crafted background app.
Near-miss passage: CVE-2015-8232. CWE: CWE-200. CVSS: 4.300000190734863. The UC Profile module 6.x-1.x before 6.x-1.3 for Drupal does not properly check access to profiles in certain circumstances, which might allow remote attackers to obtain sensitive information from the anonymous user profile via unspecified vectors.
Query: indicators of One-Way Communication
Matching passage: T1102.003 One-Way Communication. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Near-miss passage: T1102 Web Service. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: Broadcom BirdyClient Microsoft Graph API 2024) Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
Query: detect Add-ins
Matching passage: T1137.006 Add-ins. Tactics: persistence. Description: Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs. (Citation: Microsoft Office Add-ins) There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins. (Citation: MRWLabs Office Persistence Add-ins)(Citation: FireEye Mail CDS 2018) Add-ins can be used to obtain persistence because they can be set to execute code when an Office application starts.
Near-miss passage: T1137.003 Outlook Forms. Tactics: persistence. Description: Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system. Outlook forms are used as templates for presentation and functionality in Outlook messages. Custom Outlook forms can be created that will execute code when a specifically crafted email is sent by an adversary utilizing the same custom Outlook form.(Citation: SensePost Outlook Forms) Once malicious forms have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious forms will execute when an adversary sends a specifically crafted email to the user.(Citation: SensePost Outlook Forms)
Query: CVE similar to CVE-2015-8949
Matching passage: CVE-2015-8949. CWE: CWE-416. CVSS: 9.800000190734863. Use-after-free vulnerability in the my_login function in DBD::mysql before 4.033_01 allows attackers to have unspecified impact by leveraging a call to mysql_errno after a failure of my_login.
Near-miss passage: CVE-2015-5095. CWE: CWE-416. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-4448, CVE-2015-5099, CVE-2015-5101, CVE-2015-5111, CVE-2015-5113, and CVE-2015-5114.
Query: explain CWE-615
Matching passage: CWE-615 Inclusion of Sensitive Information in Source Code Comments. While adding general comments is very useful, some programmers tend to leave important data, such as: filenames related to the web application, old links or links which were not meant to be browsed by users, old code fragments, etc.
Near-miss passage: CWE-1229 Creation of Emergent Resource. The product manages resources or behaves in a way that indirectly creates a new, distinct resource that can be used by attackers in violation of the intended policy.
Query: risk of Multiple integer overflows in the NDEF record parser in hostapd before 2.5 and wpa_supplicant before 2.5 allow remote attackers to cause a denial of service (process crash or infin
Matching passage: CVE-2015-8041. CWE: CWE-189. CVSS: 5.0. Multiple integer overflows in the NDEF record parser in hostapd before 2.5 and wpa_supplicant before 2.5 allow remote attackers to cause a denial of service (process crash or infinite loop) via a large payload length field value in an (1) WPS or (2) P2P NFC NDEF record, which triggers an out-of-bounds read.
Near-miss passage: CVE-2015-4467. CWE: CWE-189. CVSS: 4.300000190734863. The chmd_init_decomp function in chmd.c in libmspack before 0.5 does not properly validate the reset interval, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted CHM file.
Query: write Sigma for Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen
Matching passage: Sigma rule: Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen. Logsource: windows / process_creation. Rule: title: Certificate Exported Via PowerShell id: 9e716b33-63b2-46da-86a4-bd3c3b9b5dfb related: - id: aa7a3fce-bef5-4311-9cc1-5f04bb8c308c type: similar status: test description: Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines. references: - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a - https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps - https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-18 tags: - attack.credential-access - attack.execution - attack.t1552.004 - attack.t1059.001 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - 'Export-PfxCertificate ' - 'Export-Certificate ' condition: selection falsepositives: - Legitimate certificate exports by administrators. Additional filters might be required. level: medium
Near-miss passage: Sigma rule: Detects Obfuscated use of stdin to execute PowerShell. Logsource: windows / security. Rule: title: Invoke-Obfuscation STDIN+ Launcher - Security id: 0c718a5e-4284-4fb9-b4d9-b9a50b3a1974 related: - id: 72862bf2-0eb1-11eb-adc1-0242ac120002 type: derived status: test description: Detects Obfuscated use of stdin to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceFileName|contains|all: - cmd - powershell selection2: ServiceFileName|contains: - ${input} - noexit selection3: ServiceFileName|contains: - ' /c ' - ' /r ' condition: all of selection* falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-10064
Matching passage: CVE-2015-10064. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in VictorFerraresi pokemon-database-php. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The patch is named dd0e1e6cdf648d6a3deff441f515bcb1d7573d68. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218455.
Near-miss passage: CVE-2015-4654. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the EQ Event Calendar component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to eqfullevent.
Query: exploit Notes System Diagnostic (NSD) in IBM Domino 8.5.x before 8.5.3 FP6 IF6 and 9.x before 9.0.1 FP3 IF1 allows local users to obtain the System privilege via unspecified vectors, aka S
Matching passage: CVE-2015-0179. CWE: CWE-264. CVSS: 7.199999809265137. Notes System Diagnostic (NSD) in IBM Domino 8.5.x before 8.5.3 FP6 IF6 and 9.x before 9.0.1 FP3 IF1 allows local users to obtain the System privilege via unspecified vectors, aka SPR TCHL9SST8V.
Near-miss passage: CVE-2015-4282. CWE: CWE-264. CVSS: 6.900000095367432. Cisco Mobility Services Engine (MSE) through 8.0.120.7 uses weak permissions for unspecified binary files, which allows local users to obtain root privileges by writing to a file, aka Bug ID CSCuv40504.
Query: risk of Unrestricted file upload vulnerability in Mrs. Shiromuku Perl CGI shiromuku(bu2)BBS before 2.91 allows remote attackers to execute arbitrary code by uploading an executable file.
Matching passage: CVE-2015-0868. CWE: UNKNOWN. CVSS: 7.5. Unrestricted file upload vulnerability in Mrs. Shiromuku Perl CGI shiromuku(bu2)BBS before 2.91 allows remote attackers to execute arbitrary code by uploading an executable file.
Near-miss passage: CVE-2015-4507. CWE: UNKNOWN. CVSS: 5.099999904632568. The SavedStacks class in the JavaScript implementation in Mozilla Firefox before 41.0, when the Debugger API is enabled, allows remote attackers to cause a denial of service (getSlotRef assertion failure and application exit) or possibly execute arbitrary code via a crafted web site.
Query: CVE similar to CVE-2015-5447
Matching passage: CVE-2015-5447. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in HP StoreOnce Backup system software before 3.13.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-9385. CWE: CWE-79. CVSS: 6.099999904632568. The quotes-and-tips plugin before 1.20 for WordPress has XSS.
Query: common weakness: Improper Validation of Specified Quantity in Input
Matching passage: CWE-1284 Improper Validation of Specified Quantity in Input. The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
Near-miss passage: CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data. The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.
Query: patch priority for CVE-2015-9364
Matching passage: CVE-2015-9364. CWE: CWE-79. CVSS: 6.099999904632568. 2Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Near-miss passage: CVE-2015-0156. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.6.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: explain CWE-144
Matching passage: CWE-144 Improper Neutralization of Line Delimiters. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as line delimiters when they are sent to a downstream component.
Near-miss passage: CWE-1106 Insufficient Use of Symbolic Constants. The source code uses literal constants that may need to change or evolve over time, instead of using symbolic constants.
Query: exploit Cross-site scripting (XSS) vulnerability in uddi/search/frames.aspx in the UDDI Services component in Microsoft Windows Server 2008 SP2 and BizTalk Server 2010, 2013 Gold, and 2013
Matching passage: CVE-2015-2475. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in uddi/search/frames.aspx in the UDDI Services component in Microsoft Windows Server 2008 SP2 and BizTalk Server 2010, 2013 Gold, and 2013 R2 allows remote attackers to inject arbitrary web script or HTML via the search parameter, aka "UDDI Services Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-0866. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the (1) fromCustomer, (2) username, or (3) password parameter to HomePage.do.
Query: write Sigma for Uses PowerShell to install/copy a file into a system directory such as "System32" or "SysWOW64"
Matching passage: Sigma rule: Uses PowerShell to install/copy a file into a system directory such as "System32" or "SysWOW64". Logsource: windows / ps_script. Rule: title: Powershell Install a DLL in System Directory id: 63bf8794-9917-45bc-88dd-e1b5abc0ecfd status: test description: Uses PowerShell to install/copy a file into a system directory such as "System32" or "SysWOW64" references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1556.002/T1556.002.md#atomic-test-1---install-and-register-password-filter-dll author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-12-27 modified: 2024-01-22 tags: - attack.persistence - attack.credential-access - attack.defense-impairment - attack.t1556.002 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|re: (Copy-Item|cpi) .{2,128} -Destination .{1,32}\\Windows\\(System32|SysWOW64) condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of a file that has the same name as the default LiveKD kernel memory dump.. Logsource: windows / file_event. Rule: title: LiveKD Kernel Memory Dump File Created id: 814ddeca-3d31-4265-8e07-8cc54fb44903 status: test description: Detects the creation of a file that has the same name as the default LiveKD kernel memory dump. references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-16 tags: - attack.privilege-escalation - attack.stealth logsource: product: windows category: file_event detection: selection: TargetFilename: C:\Windows\livekd.dmp condition: selection falsepositives: - In rare occasions administrators might leverage LiveKD to perform live kernel debugging. This should not be allowed on production systems. Investigate and apply additional filters where necessary. level: high