alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Cross-site scripting (XSS) vulnerability in IBM Emptoris Strategic Supply Management Platform and Emptoris Program Management 10.x before 10.0.1.4_iFix3, 10.0.2.x before 10.0.2.7_i
Matching passage: CVE-2015-4971. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Emptoris Strategic Supply Management Platform and Emptoris Program Management 10.x before 10.0.1.4_iFix3, 10.0.2.x before 10.0.2.7_iFix1, 10.0.3.x before 10.0.3.2, and 10.0.4.x before 10.0.4.0_iFix1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-9370. CWE: CWE-79. CVSS: 6.099999904632568. Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Query: vulnerability: Static code injection vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary PHP code into the language files via a Translati
Matching passage: CVE-2015-4338. CWE: CWE-94. CVSS: 6.5. Static code injection vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary PHP code into the language files via a Translation LM_FRONT_* field for a language, as demonstrated by language/italian.php.
Near-miss passage: CVE-2015-0088. CWE: CWE-94. CVSS: 9.300000190734863. Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0090, CVE-2015-0091, CVE-2015-0092, and CVE-2015-0093.
Query: weakness Logging of Excessive Data
Matching passage: CWE-779 Logging of Excessive Data. The product logs too much information, making log files hard to process and possibly hindering recovery efforts or forensic analysis after an attack.
Near-miss passage: CWE-407 Inefficient Algorithmic Complexity. An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
Query: write Sigma for Detects when Okta identifies new activity in the Admin Console.
Matching passage: Sigma rule: Detects when Okta identifies new activity in the Admin Console.. Logsource: okta / okta. Rule: title: Okta New Admin Console Behaviours id: a0b38b70-3cb5-484b-a4eb-c4d8e7bcc0a9 status: test description: Detects when Okta identifies new activity in the Admin Console. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection author: kelnage date: 2023-09-07 modified: 2026-04-27 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078.004 logsource: product: okta service: okta detection: selection_event: eventType: policy.evaluate_sign_on target.displayName: Okta Admin Console selection_positive: - debugContext.debugData.behaviors|contains: POSITIVE - debugContext.debugData.logOnlySecurityData|contains: POSITIVE condition: all of selection_* falsepositives: - When an admin begins using the Admin Console and one of Okta's heuristics incorrectly identifies the behavior as being unusual. level: high
Near-miss passage: Sigma rule: Detects command that type the content of ntdll.dll to a different file or a pipe in order to evade AV / EDR detection. A. Logsource: windows / process_creation. Rule: title: NtdllPipe Like Activity Execution id: bbc865e4-7fcd-45a6-8ff1-95ced28ec5b2 status: test description: Detects command that type the content of ntdll.dll to a different file or a pipe in order to evade AV / EDR detection. As seen being used in the POC NtdllPipe references: - https://web.archive.org/web/20220306121156/https://www.x86matthew.com/view_post?id=ntdll_pipe author: Florian Roth (Nextron Systems) date: 2022-03-05 modified: 2023-03-07 tags: - attack.defense-impairment logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - type %windir%\system32\ntdll.dll - type %systemroot%\system32\ntdll.dll - type c:\windows\system32\ntdll.dll - \\ntdll.dll > \\\\.\\pipe\\ condition: selection falsepositives: - Unknown level: high
Query: risk of The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to cause a denial of service via a crafted app, a different vulner
Matching passage: CVE-2015-7043. CWE: UNKNOWN. CVSS: 4.300000190734863. The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to cause a denial of service via a crafted app, a different vulnerability than CVE-2015-7040, CVE-2015-7041, and CVE-2015-7042.
Near-miss passage: CVE-2015-4813. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.0.34, 4.1.42, 4.2.34, 4.3.32, and 5.0.8, when using a Windows guest, allows local users to affect availability via unknown vectors related to Core.
Query: vulnerability: Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-369
Matching passage: CVE-2015-3695. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3696, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3700, CVE-2015-3701, and CVE-2015-3702.
Near-miss passage: CVE-2015-8318. CWE: CWE-119. CVSS: 7.800000190734863. Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application, a different vulnerability than CVE-2015-8319.
Query: detection engineering for Abuse Elevation Control Mechanism
Matching passage: T1548 Abuse Elevation Control Mechanism. Tactics: privilege escalation. Description: Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.(Citation: TechNet How UAC Works)(Citation: sudo man page 2018) An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.(Citation: OSX Keydnap malware)(Citation: Fortinet Fareit)
Near-miss passage: T1548.003 Sudo and Sudo Caching. Tactics: privilege escalation. Description: Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges. Within Linux and MacOS systems, sudo (sometimes referred to as "superuser do") allows users to perform commands from terminals with elevated privileges and to control who can perform these commands on the system. The <code>sudo</code> command "allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments."(Citation: sudo man page 2018) Since sudo was made for the system administrator, it has some useful configuration features such as a <code>timestamp_timeout</code>, which is the amount of time in minutes between instances of <code>sudo</code> before it will re-prompt for a password. This is because <code>sudo</code> has the ability to cache credentials for a period of time. Sudo creates (or touches) a file at <code>/var/db/sudo</code> with a timestamp of when sudo was last run to determine this timeout. Additionally, there is a <code>tty_tickets</code> variable that treats each new tty (terminal session) in isolation. This means that, for example, the sudo timeout of one tty will not affect another tty (you will have to type the password again). The sudoers file, <code>/etc/sudoers</code>, describes which users can run which commands and from which terminals. This also describes which commands users can run as other users or groups. This provides the principle of least privilege such that users are running in their lowest possible permissions for most of the time and only elevate to other users or permissions as needed, typically by prompting for a password. However, the sudoers file can also specify when to not prompt users for passwords with a line like <code>user1 ALL=(ALL) NOPASSWD: ALL</code>.(Citation: OSX.Dok
Query: vulnerability: IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (CPU consumption) via a crafted byte sequence in authentication data.
Matching passage: CVE-2015-1955. CWE: CWE-399. CVSS: 7.800000190734863. IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (CPU consumption) via a crafted byte sequence in authentication data.
Near-miss passage: CVE-2015-1626. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0056 and CVE-2015-1623.
Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects the use of the "nice" utility to execute a shell. Such behavior may be associated with privilege escalation, una. Logsource: linux / process_creation. Rule: title: Shell Execution via Nice - Linux id: 093d68c7-762a-42f4-9f46-95e79142571a status: test description: 'Detects the use of the "nice" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. ' references: - https://gtfobins.github.io/gtfobins/nice/#shell - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-09-02 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: linux detection: selection: Image|endswith: /nice CommandLine|endswith: - /bin/bash - /bin/dash - /bin/fish - /bin/sh - /bin/zsh condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExe. Logsource: windows / process_creation. Rule: title: HackTool - Impersonate Execution id: cf0c254b-22f1-4b2b-8221-e137b3c0af94 status: test description: Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively references: - https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/ - https://github.com/sensepost/impersonate author: Sai Prashanth Pulisetti @pulisettis date: 2022-12-21 modified: 2024-11-23 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.001 - attack.t1134.003 logsource: product: windows category: process_creation detection: selection_commandline_exe: CommandLine|contains: impersonate.exe selection_commandline_opt: CommandLine|contains: - ' list ' - ' exec ' - ' adduser ' selection_hash: Hashes|contains: - MD5=9520714AB576B0ED01D1513691377D01 - SHA256=E81CC96E2118DC4FBFE5BAD1604E0AC7681960143E2101E1A024D52264BB0A8A - IMPHASH=0A358FFC1697B7A07D0E817AC740DF62 condition: all of selection_commandline_* or selection_hash falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-5684
Matching passage: CVE-2015-5684. CWE: CWE-120. CVSS: 9.800000190734863. MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A buffer overflow vulnerability was reported, (fixed and publicly disclosed in 2015) in the Lenovo Service Engine (LSE), affecting various versions of BIOS for Lenovo Notebooks, that could allow a remote user to execute arbitrary code on the system.
Near-miss passage: CVE-2015-10123. CWE: CWE-120. CVSS: 8.800000190734863. An unautheticated remote attacker could send specifically crafted packets to a affected device. If an authenticated user then views that data in a specific page of the web-based management a buffer overflow will be triggered to gain full access of the device.
Query: vulnerability: The aiptek_probe function in drivers/input/tablet/aiptek.c in the Linux kernel before 4.4 allows physically proximate attackers to cause a denial of service (NULL pointer dereferen
Matching passage: CVE-2015-7515. CWE: CWE-476. CVSS: 4.599999904632568. The aiptek_probe function in drivers/input/tablet/aiptek.c in the Linux kernel before 4.4 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted USB device that lacks endpoints.
Near-miss passage: CVE-2015-5180. CWE: CWE-476. CVSS: 7.5. res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash).
Query: CWE for Path Equivalence: 'filename.' (Trailing Dot)
Matching passage: CWE-42 Path Equivalence: 'filename.' (Trailing Dot). The product accepts path input in the form of trailing dot ('filedir.') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Near-miss passage: CWE-1304 Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation. The product performs a power save/restore operation, but it does not ensure that the integrity of the configuration state is maintained and/or verified between the beginning and ending of the operation.
Query: alert when Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.
Matching passage: Sigma rule: Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.. Logsource: azure / activitylogs. Rule: title: Azure Suppression Rule Created id: 92cc3e5d-eb57-419d-8c16-5c63f325a401 status: test description: Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer date: 2021-08-16 modified: 2022-08-23 tags: - attack.impact logsource: product: azure service: activitylogs detection: selection: operationName: MICROSOFT.SECURITY/ALERTSSUPPRESSIONRULES/WRITE condition: selection falsepositives: - Suppression Rule being created may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Suppression Rule created from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been re. Logsource: windows / process_creation. Rule: title: HackTool - CrackMapExec Execution id: 42a993dd-bb3e-48c8-b372-4d6684c4106c status: test description: This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced. references: - https://mpgn.gitbook.io/crackmapexec/smb-protocol/authentication/checking-credentials-local - https://www.mandiant.com/resources/telegram-malware-iranian-espionage - https://www.infosecmatter.com/crackmapexec-module-library/?cmem=mssql-mimikatz - https://www.infosecmatter.com/crackmapexec-module-library/?cmem=smb-pe_inject author: Florian Roth (Nextron Systems) date: 2022-02-25 modified: 2023-03-08 tags: - attack.execution - attack.persistence - attack.privilege-escalation - attack.credential-access - attack.discovery - attack.t1047 - attack.t1053 - attack.t1059.003 - attack.t1059.001 - attack.t1110 - attack.t1201 logsource: category: process_creation product: windows detection: selection_binary: Image|endswith: \crackmapexec.exe selection_special: CommandLine|contains: ' -M pe_inject ' selection_execute: CommandLine|contains|all: - ' --local-auth' - ' -u ' - ' -x ' selection_hash: CommandLine|contains|all: - ' --local-auth' - ' -u ' - ' -p ' - ' -H ''NTHASH''' selection_module_mssql: CommandLine|contains|all: - ' mssql ' - ' -u ' - ' -p ' - ' -M ' - ' -d ' selection_module_smb1: CommandLine|contains|all: - ' smb ' - ' -u ' - ' -H ' - ' -M ' - ' -o ' selection_module_smb2: CommandLine|contains|all: - ' smb ' - ' -u ' - ' -p ' - ' --local-auth' part_localauth_1: CommandLine|contains|all: - ' --local-auth' - ' -u ' - ' -p ' part_localauth_2: CommandLine|contains|all: - ' 10.' - ' 192.168.' - '/24 ' condition: 1 of selection_* or all of part_localauth* falsepositives: - Unknown level: high
Query: describe CVE-2015-2798
Matching passage: CVE-2015-2798. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in Joomla! Component Contact Form Maker 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Near-miss passage: CVE-2015-10016. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability, which was classified as critical, has been found in jeff-kelley opensim-utils. Affected by this issue is the function DatabaseForRegion of the file regionscrits.php. The manipulation of the argument region leads to sql injection. The patch is identified as c29e5c729a833a29dbf5b1e505a0553fe154575e. It is recommended to apply a patch to fix this issue. VDB-217550 is the identifier assigned to this vulnerability.
Query: patch priority for CVE-2015-4494
Matching passage: CVE-2015-4494. CWE: CWE-200. CVSS: 4.300000190734863. Mozilla Firefox OS before 2.2 does not require the wifi-manage privilege for reading a Wi-Fi system message, which allows attackers to obtain potentially sensitive information via a crafted app.
Near-miss passage: CVE-2015-0834. CWE: CWE-200. CVSS: 4.300000190734863. The WebRTC subsystem in Mozilla Firefox before 36.0 recognizes turns: and stuns: URIs but accesses the TURN or STUN server without using TLS, which makes it easier for man-in-the-middle attackers to discover credentials by spoofing a server and completing a brute-force attack within a short time window.
Query: Outbound C2 pattern associated with Defacement
Matching passage: T1491 Defacement. Tactics: impact. Description: Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for [Defacement](https://attack.mitre.org/techniques/T1491) include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of [Defacement](https://attack.mitre.org/techniques/T1491) in order to cause user discomfort, or to pressure compliance with accompanying messages.
Near-miss passage: T1491.001 Internal Defacement. Tactics: impact. Description: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites or server login messages, or directly to user systems with the replacement of the desktop wallpaper.(Citation: Novetta Blockbuster)(Citation: Varonis) Disturbing or offensive images may be used as a part of [Internal Defacement](https://attack.mitre.org/techniques/T1491/001) in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.(Citation: Novetta Blockbuster Destructive Malware)
Query: alert when Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)
Matching passage: Sigma rule: Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32). Logsource: windows / process_creation. Rule: title: UAC Bypass Using Windows Media Player - Process id: 0058b9e5-bcd7-40d4-9205-95ca5a16d7b2 status: test description: Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-23 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection_img_1: Image: C:\Program Files\Windows Media Player\osk.exe selection_img_2: Image: C:\Windows\System32\cmd.exe ParentCommandLine: '"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc" /s' selection_integrity: IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 condition: 1 of selection_img_* and selection_integrity falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh. Logsource: linux / process_creation. Rule: title: Execution Of Script Located In Potentially Suspicious Directory id: 30bcce26-51c5-49f2-99c8-7b59e3af36c7 status: test description: Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh", etc. references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.execution logsource: product: linux category: process_creation detection: selection_img: Image|endswith: - /bash - /csh - /dash - /fish - /ksh - /sh - /zsh selection_flag: CommandLine|contains: ' -c ' selection_paths: CommandLine|contains: /tmp/ condition: all of selection_* falsepositives: - Unknown level: medium