alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 40
Matching passage: CVE-2015-9149. CWE: CWE-476. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, in a DIAG ioctl handler, an untrusted pointer dereference can occur.
Near-miss passage: CVE-2015-8592. CWE: CWE-476. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a pointer is not validated prior to being dereferenced potentially resulting in Guest-OS memory corruption.
Query: risk of The lazy_bdecode function in BitTorrent DHT bootstrap server (bootstrap-dht ) allows remote attackers to execute arbitrary code via a crafted packet, related to "improper indexing.
Matching passage: CVE-2015-5685. CWE: CWE-20. CVSS: 7.5. The lazy_bdecode function in BitTorrent DHT bootstrap server (bootstrap-dht ) allows remote attackers to execute arbitrary code via a crafted packet, related to "improper indexing."
Near-miss passage: CVE-2015-3774. CWE: CWE-20. CVSS: 4.800000190734863. The Dictionary app in Apple OS X before 10.10.5 does not use HTTPS, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof word definitions by modifying the client-server data stream.
Query: detect Detects when an end user consents to an application in logs
Matching passage: Sigma rule: Detects when an end user consents to an application. Logsource: azure / auditlogs. Rule: title: End User Consent id: 9b2cc4c4-2ad4-416d-8e8e-ee6aa6f5035a status: test description: Detects when an end user consents to an application references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#end-user-consent author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow' date: 2022-07-28 tags: - attack.credential-access - attack.t1528 logsource: product: azure service: auditlogs detection: selection: ConsentContext.IsAdminConsent: 'false' condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz.. Logsource: windows / process_access. Rule: title: Credential Dumping Activity By Python Based Tool id: f8be3e82-46a3-4e4e-ada5-8e538ae8b9c9 related: - id: 4b9a8556-99c4-470b-a40c-9c8d02c77ed0 type: obsolete - id: 7186e989-4ed7-4f4e-a656-4674b9e3e48b type: obsolete status: stable description: Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz. references: - https://twitter.com/bh4b3sh/status/1303674603819081728 - https://github.com/skelsec/pypykatz author: Bhabesh Raj, Jonhnathan Ribeiro date: 2023-11-27 modified: 2023-11-29 tags: - attack.credential-access - attack.t1003.001 - attack.s0349 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe CallTrace|contains|all: - _ctypes.pyd+ - :\Windows\System32\KERNELBASE.dll+ - :\Windows\SYSTEM32\ntdll.dll+ CallTrace|contains: - python27.dll+ - python3*.dll+ GrantedAccess: '0x1FFFFF' condition: selection falsepositives: - Unknown level: high
Query: Sigma rule for Detects usage of wmic to start or stop a service
Matching passage: Sigma rule: Detects usage of wmic to start or stop a service. Logsource: windows / process_creation. Rule: title: Service Started/Stopped Via Wmic.EXE id: 0b7163dc-7eee-4960-af17-c0cd517f92da status: test description: Detects usage of wmic to start or stop a service references: - https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-20 modified: 2023-02-14 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: wmic.exe - Image|endswith: \WMIC.exe selection_cli: CommandLine|contains|all: - ' service ' - ' call ' CommandLine|contains: - stopservice - startservice condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_service_manipulation/info.yml
Near-miss passage: Sigma rule: Detects extracting of zip file from image file. Logsource: linux / auditd. Rule: title: Steganography Unzip Hidden Information From Picture File id: edd595d7-7895-4fa7-acb3-85a18a8772ca status: test description: Detects extracting of zip file from image file references: - https://zerotoroot.me/steganography-hiding-a-zip-in-a-jpeg-file/ author: Pawel Mazur date: 2021-09-09 modified: 2022-10-09 tags: - attack.stealth - attack.t1027.003 logsource: product: linux service: auditd detection: commands: type: EXECVE a0: unzip a1: a1|endswith: - .jpg - .png condition: commands and a1 falsepositives: - Unknown level: low
Query: Persistence mechanism resembling OS Exhaustion Flood
Matching passage: T1499.001 OS Exhaustion Flood. Tactics: impact. Description: Adversaries may launch a denial of service (DoS) attack targeting an endpoint's operating system (OS). A system's OS is responsible for managing the finite resources as well as preventing the entire system from being overwhelmed by excessive demands on its capacity. These attacks do not need to exhaust the actual resources on a system; the attacks may simply exhaust the limits and available resources that an OS self-imposes. Different ways to achieve this exist, including TCP state-exhaustion attacks such as SYN floods and ACK floods.(Citation: Arbor AnnualDoSreport Jan 2018) With SYN floods, excessive amounts of SYN packets are sent, but the 3-way TCP handshake is never completed. Because each OS has a maximum number of concurrent TCP connections that it will allow, this can quickly exhaust the ability of the system to receive new requests for TCP connections, thus preventing access to any TCP service provided by the server.(Citation: Cloudflare SynFlood) ACK floods leverage the stateful nature of the TCP protocol. A flood of ACK packets are sent to the target. This forces the OS to search its state table for a related TCP connection that has already been established. Because the ACK packets are for connections that do not exist, the OS will have to search the entire state table to confirm that no match exists. When it is necessary to do this for a large flood of packets, the computational requirements can cause the server to become sluggish and/or unresponsive, due to the work it must do to eliminate the rogue ACK packets. This greatly reduces the resources available for providing the targeted service.(Citation: Corero SYN-ACKflood)
Near-miss passage: T1499.004 Application or System Exploitation. Tactics: impact. Description: Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. (Citation: Sucuri BIND9 August 2015) Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition. Adversaries may exploit known or zero-day vulnerabilities to crash applications and/or systems, which may also lead to dependent applications and/or systems to be in a DoS condition. Crashed or restarted applications or systems may also have other effects such as [Data Destruction](https://attack.mitre.org/techniques/T1485), [Firmware Corruption](https://attack.mitre.org/techniques/T1495), [Service Stop](https://attack.mitre.org/techniques/T1489) etc. which may further cause a DoS condition and deny availability to critical information, applications and/or systems.
Query: vulnerability: Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
Matching passage: CVE-2015-0055. CWE: CWE-264. CVSS: 4.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-5496. CWE: CWE-264. CVSS: 5.0. The pass2pdf module for Drupal does not restrict access to generated PDF files, which allows remote attackers to obtain user passwords via unspecified vectors.
Query: impact using Cloud Service Hijacking
Matching passage: T1496.004 Cloud Service Hijacking. Tactics: impact. Description: Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability. For example, adversaries may leverage email and messaging services, such as AWS Simple Email Service (SES), AWS Simple Notification Service (SNS), SendGrid, and Twilio, in order to send large quantities of spam / [Phishing](https://attack.mitre.org/techniques/T1566) emails and SMS messages.(Citation: Invictus IR DangerDev 2024)(Citation: Permiso SES Abuse 2023)(Citation: SentinelLabs SNS Sender 2024) Alternatively, they may engage in LLMJacking by leveraging reverse proxies to hijack the power of cloud-hosted AI models.(Citation: Sysdig LLMJacking 2024)(Citation: Lacework LLMJacking 2024) In some cases, adversaries may leverage services that the victim is already using. In others, particularly when the service is part of a larger cloud platform, they may first enable the service.(Citation: Sysdig LLMJacking 2024) Leveraging SaaS applications may cause the victim to incur significant financial costs, use up service quotas, and otherwise impact availability.
Near-miss passage: T1496.002 Bandwidth Hijacking. Tactics: impact. Description: Adversaries may leverage the network bandwidth resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Adversaries may also use malware that leverages a system's network bandwidth as part of a botnet in order to facilitate [Network Denial of Service](https://attack.mitre.org/techniques/T1498) campaigns and/or to seed malicious torrents.(Citation: GoBotKR) Alternatively, they may engage in proxyjacking by selling use of the victims' network bandwidth and IP address to proxyware services.(Citation: Sysdig Proxyjacking) Finally, they may engage in internet-wide scanning in order to identify additional targets for compromise.(Citation: Unit 42 Leaked Environment Variables 2024) In addition to incurring potential financial costs or availability disruptions, this technique may cause reputational damage if a victim’s bandwidth is used for illegal activities.(Citation: Sysdig Proxyjacking)
Query: risk of SQL injection vulnerability in the Gateway Provisioning service in EMC Secure Remote Services Virtual Edition (ESRS VE) 3.02 and 3.03 allows remote attackers to execute arbitrary S
Matching passage: CVE-2015-0524. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the Gateway Provisioning service in EMC Secure Remote Services Virtual Edition (ESRS VE) 3.02 and 3.03 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-9330. CWE: CWE-89. CVSS: 9.800000190734863. The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.
Query: risk of Unquoted Windows search path vulnerability in the Foxit Cloud Safe Update Service in the Cloud plugin in Foxit Reader 6.1 through 7.0.6.1126 allows local users to gain privileges v
Matching passage: CVE-2015-2789. CWE: UNKNOWN. CVSS: 4.400000095367432. Unquoted Windows search path vulnerability in the Foxit Cloud Safe Update Service in the Cloud plugin in Foxit Reader 6.1 through 7.0.6.1126 allows local users to gain privileges via a Trojan horse program in the %SYSTEMDRIVE% folder.
Near-miss passage: CVE-2015-5431. CWE: UNKNOWN. CVSS: 6.5. HP Matrix Operating Environment before 7.5.0 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.
Query: detection rule: Detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events in an attempt to evade detectio
Matching passage: Sigma rule: Detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events in an attempt to evade detectio. Logsource: kubernetes / application / audit. Rule: title: Kubernetes Events Deleted id: 3132570d-cab2-4561-9ea6-1743644b2290 related: - id: 225d8b09-e714-479c-a0e4-55e6f29adf35 type: derived status: test description: 'Detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events in an attempt to evade detection. ' references: - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Delete%20K8S%20events/ author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.stealth - attack.t1070 logsource: category: application product: kubernetes service: audit detection: selection: verb: delete objectRef.resource: events condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects changes to service startup type to 'disabled' or 'manual' using the WMIC command-line utility.. Logsource: windows / process_creation. Rule: title: Service Startup Type Change Via Wmic.EXE id: c0514f28-fdae-42df-b886-06e2b2bc5b37 status: experimental description: 'Detects changes to service startup type to ''disabled'' or ''manual'' using the WMIC command-line utility. ' references: - https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-04-27 tags: - attack.execution - attack.defense-impairment - attack.t1047 - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WMIC.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains|all: - ' service ' - ChangeStartMode CommandLine|contains: - Manual - Disabled condition: all of selection_* falsepositives: - Legitimate administrative changes to service startup types using WMIC, investigate accordingly. level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_service_startup_change/info.yml
Query: describe CVE-2015-2019
Matching passage: CVE-2015-2019. CWE: CWE-17. CVSS: 2.0999999046325684. IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 does not prevent caching of documents retrieved in SSL sessions, which allows physically proximate attackers to obtain sensitive information by leveraging an unattended workstation.
Near-miss passage: CVE-2015-0275. CWE: CWE-17. CVSS: 4.900000095367432. The ext4_zero_range function in fs/ext4/extents.c in the Linux kernel before 4.1 allows local users to cause a denial of service (BUG) via a crafted fallocate zero-range request.
Query: CVE similar to CVE-2015-5844
Matching passage: CVE-2015-5844. CWE: CWE-119. CVSS: 9.300000190734863. IOKit in the kernel in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-5845 and CVE-2015-5846.
Near-miss passage: CVE-2015-9181. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, and SD 835, in a crypto API function, a buffer over-read can occur.
Query: Multiple failed authentications followed by Exfiltration Over Bluetooth
Matching passage: T1011.001 Exfiltration Over Bluetooth. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel. Adversaries may choose to do this if they have sufficient access and proximity. Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Near-miss passage: T1011 Exfiltration Over Other Network Medium. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel. Adversaries may choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Query: rule covering Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping o
Matching passage: Sigma rule: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping o. Logsource: zeek / dce_rpc. Rule: title: MITRE BZAR Indicators for Execution id: b640c0b8-87f8-4daa-aef8-95a24261dd1d status: test description: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE references: - https://github.com/mitre-attack/bzar#indicators-for-attck-execution author: '@neu5ron, SOC Prime' date: 2020-03-19 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1047 - attack.t1053.002 - attack.t1569.002 logsource: product: zeek service: dce_rpc detection: op1: endpoint: JobAdd operation: atsvc op2: endpoint: ITaskSchedulerService operation: SchRpcEnableTask op3: endpoint: ITaskSchedulerService operation: SchRpcRegisterTask op4: endpoint: ITaskSchedulerService operation: SchRpcRun op5: endpoint: IWbemServices operation: ExecMethod op6: endpoint: IWbemServices operation: ExecMethodAsync op7: endpoint: svcctl operation: CreateServiceA op8: endpoint: svcctl operation: CreateServiceW op9: endpoint: svcctl operation: StartServiceA op10: endpoint: svcctl operation: StartServiceW condition: 1 of op* falsepositives: - Windows administrator tasks or troubleshooting - Windows management scripts or software level: medium
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface. Logsource: windows / process_creation. Rule: title: UAC Bypass via ICMLuaUtil id: 49f2f17b-b4c8-4172-a68b-d5bf95d05130 status: test description: Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface references: - https://www.elastic.co/guide/en/security/current/uac-bypass-via-icmluautil-elevated-com-interface.html author: Florian Roth (Nextron Systems), Elastic (idea) date: 2022-09-13 modified: 2022-09-27 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \dllhost.exe ParentCommandLine|contains: - /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} - /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937} filter: - Image|endswith: \WerFault.exe - OriginalFileName: WerFault.exe condition: selection and not filter falsepositives: - Unknown level: high
Query: stealth using System Firmware
Matching passage: T1542.001 System Firmware. Tactics: stealth, persistence. Description: Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer.(Citation: Wikipedia BIOS)(Citation: Wikipedia UEFI)(Citation: About UEFI) System firmware like BIOS and (U)EFI underly the functionality of a computer and may be modified by an adversary to perform or assist in malicious activity. Capabilities exist to overwrite the system firmware, which may give sophisticated adversaries a means to install malicious firmware updates as a means of persistence on a system that may be difficult to detect.
Near-miss passage: T1542.005 TFTP Boot. Tactics: stealth, persistence. Description: Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images. Adversaries may manipulate the configuration on the network device specifying use of a malicious TFTP server, which may be used in conjunction with [Modify System Image](https://attack.mitre.org/techniques/T1601) to load a modified image on device startup or reset. The unauthorized image allows adversaries to modify device configuration, add malicious capabilities to the device, and introduce backdoors to maintain control of the network device while minimizing detection through use of a standard functionality. This technique is similar to [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) and may result in the network device running a modified image. (Citation: Cisco Blog Legacy Device Attacks)
Query: vulnerability: The private-browsing implementation in Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 allows attackers to obtain sensitive browsing-history information via vecto
Matching passage: CVE-2015-1128. CWE: CWE-200. CVSS: 5.0. The private-browsing implementation in Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 allows attackers to obtain sensitive browsing-history information via vectors involving push-notification requests.
Near-miss passage: CVE-2015-3400. CWE: CWE-200. CVSS: 4.300000190734863. sharenfs 0.6.4, when built with commits bcdd594 and 7d08880 from the zfs repository, provides world readable access to the shared zfs file system, which might allow remote authenticated users to obtain sensitive information by reading shared files.
Query: exploit Heap-based buffer overflow in the DNS client library in configd in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows attackers to execute arbitrary code vi
Matching passage: CVE-2015-7015. CWE: CWE-119. CVSS: 6.800000190734863. Heap-based buffer overflow in the DNS client library in configd in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows attackers to execute arbitrary code via a crafted app that sends a spoofed configd response to a client.
Near-miss passage: CVE-2015-5131. CWE: CWE-119. CVSS: 10.0. Buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5132 and CVE-2015-5133.