alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: The detect_version function in wiretap/logcat.c in the Android Logcat file parser in Wireshark 1.12.x before 1.12.5 does not check the length of the payload, which allows remote at
Matching passage: CVE-2015-3815. CWE: CWE-119. CVSS: 5.0. The detect_version function in wiretap/logcat.c in the Android Logcat file parser in Wireshark 1.12.x before 1.12.5 does not check the length of the payload, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a packet with a crafted payload, as demonstrated by a length of zero, a different vulnerability than CVE-2015-3906.
Near-miss passage: CVE-2015-3123. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3117, CVE-2015-3130, CVE-2015-3133, CVE-2015-3134, and CVE-2015-4431.
Query: exploit LEMON-S PHP Gazou BBS plus before 2.36 allows remote attackers to upload arbitrary HTML documents via vectors involving a crafted image file.
Matching passage: CVE-2015-2974. CWE: CWE-20. CVSS: 5.0. LEMON-S PHP Gazou BBS plus before 2.36 allows remote attackers to upload arbitrary HTML documents via vectors involving a crafted image file.
Near-miss passage: CVE-2015-0647. CWE: CWE-20. CVSS: 7.800000190734863. Cisco IOS 12.2, 12.4, 15.0, 15.2, and 15.3 allows remote attackers to cause a denial of service (device reload) via malformed Common Industrial Protocol (CIP) UDP packets, aka Bug ID CSCum98371.
Query: Sigma rule for Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques
Matching passage: Sigma rule: Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques. Logsource: windows / system. Rule: title: Tap Driver Installation id: 8e4cf0e5-aa5d-4dc3-beff-dc26917744a9 status: test description: Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques references: - https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers author: Daniil Yugoslavskiy, Ian Davis, oscd.community date: 2019-10-24 modified: 2022-12-25 tags: - attack.exfiltration - attack.t1048 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains: tap0901 condition: selection falsepositives: - Legitimate OpenVPN TAP installation level: medium
Near-miss passage: Sigma rule: Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several. Logsource: windows / ps_script. Rule: title: Dump Credentials from Windows Credential Manager With PowerShell id: 99c49d9c-34ea-45f7-84a7-4751ae6b2cbc status: test description: 'Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555/T1555.md author: frack113 date: 2021-12-20 modified: 2022-12-25 tags: - attack.credential-access - attack.t1555 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_kiddie: ScriptBlockText|contains: - Get-PasswordVaultCredentials - Get-CredManCreds selection_rename_Password: ScriptBlockText|contains|all: - New-Object - Windows.Security.Credentials.PasswordVault selection_rename_credman: ScriptBlockText|contains|all: - New-Object - Microsoft.CSharp.CSharpCodeProvider - '[System.Runtime.InteropServices.RuntimeEnvironment]::GetRuntimeDirectory())' - Collections.ArrayList - System.CodeDom.Compiler.CompilerParameters condition: 1 of selection_* falsepositives: - Unknown level: medium
Query: hunt for Browser Information Discovery activity
Matching passage: T1217 Browser Information Discovery. Tactics: discovery. Description: Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.(Citation: Kaspersky Autofill) Browser information may also highlight additional targets after an adversary has access to valid credentials, especially [Credentials In Files](https://attack.mitre.org/techniques/T1552/001) associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).(Citation: Chrome Roaming Profiles)
Near-miss passage: T1083 File and Directory Discovery. Tactics: discovery. Description: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Many command shell utilities can be used to obtain this information. Examples include <code>dir</code>, <code>tree</code>, <code>ls</code>, <code>find</code>, and <code>locate</code>.(Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the [Native API](https://attack.mitre.org/techniques/T1106). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather file and directory information (e.g. <code>dir</code>, <code>show flash</code>, and/or <code>nvram</code>).(Citation: US-CERT-TA18-106A) Some files and directories may require elevated or specific user permissions to access.
Query: telemetry for T1558.002
Matching passage: T1558.002 Silver Ticket. Tactics: credential access. Description: Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets.(Citation: ADSecurity Silver Tickets) Silver tickets are more limited in scope in than golden tickets in that they only enable adversaries to access a particular resource (e.g. MSSQL) and the system that hosts the resource; however, unlike golden tickets, adversaries with the ability to forge silver tickets are able to create TGS tickets without interacting with the Key Distribution Center (KDC), potentially making detection more difficult.(Citation: ADSecurity Detecting Forged Tickets) Password hashes for target services may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).
Near-miss passage: T1558.005 Ccache Files. Tactics: credential access. Description: Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having to re-enter credentials. The <code>/etc/krb5.conf</code> configuration file and the <code>KRB5CCNAME</code> environment variable are used to set the storage location for ccache entries. On Linux, credentials are typically stored in the `/tmp` directory with a naming format of `krb5cc_%UID%` or `krb5.ccache`. On macOS, ccache entries are stored by default in memory with an `API:{uuid}` naming scheme. Typically, users interact with ticket storage using <code>kinit</code>, which obtains a Ticket-Granting-Ticket (TGT) for the principal; <code>klist</code>, which lists obtained tickets currently held in the credentials cache; and other built-in binaries.(Citation: Kerberos GNU/Linux)(Citation: Binary Defense Kerberos Linux) Adversaries can collect tickets from ccache files stored on disk and authenticate as the current user without their password to perform [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003) attacks. Adversaries can also use these tickets to impersonate legitimate users with elevated privileges to perform [Privilege Escalation](https://attack.mitre.org/tactics/TA0004). Tools like Kekeo can also be used by adversaries to convert ccache files to Windows format for further [Lateral Movement](https://attack.mitre.org/tactics/TA0008). On macOS, adversaries may use open-source tools or the Kerberos framework to interact with ccache files and extract TGTs or Service Tickets via lower-level APIs.(Citation: SpectorOps Bifrost Kerberos macOS 2019)(Citation: Linux Kerberos Tickets)(Citation: Brining MimiKatz to Unix)(Citation: Kekeo)
Query: CVE similar to CVE-2015-6322
Matching passage: CVE-2015-6322. CWE: CWE-264. CVSS: 6.599999904632568. The IPC channel in Cisco AnyConnect Secure Mobility Client 2.0.0343 through 4.1(8) allows local users to bypass intended access restrictions and move arbitrary files by leveraging the lack of source-path validation, aka Bug ID CSCuv48563.
Near-miss passage: CVE-2015-8236. CWE: CWE-264. CVSS: 10.0. Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.1 allows remote attackers to execute arbitrary code as root by leveraging management-plane access, aka Bug 138716.
Query: CVE similar to CVE-2015-0860
Matching passage: CVE-2015-0860. CWE: CWE-189. CVSS: 7.5. Off-by-one error in the extracthalf function in dpkg-deb/extract.c in the dpkg-deb component in Debian dpkg 1.16.x before 1.16.17 and 1.17.x before 1.17.26 allows remote attackers to execute arbitrary code via the archive magic version number in an "old-style" Debian binary package, which triggers a stack-based buffer overflow.
Near-miss passage: CVE-2015-2810. CWE: CWE-189. CVSS: 7.5. Integer overflow in the HwpApp::CHncSDS_Manager function in Hancom Office HanWord processor, as used in Hwp 2014 VP before 9.1.0.2342, HanWord Viewer 2007 and Viewer 2010 8.5.6.1158, and HwpViewer 2014 VP 9.1.0.2186, allows remote attackers to cause a denial of service (crash) and possibly "influence the program's execution flow" via a document with a large paragraph size, which triggers heap corruption.
Query: detect Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for in logs
Matching passage: Sigma rule: Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for. Logsource: windows / process_creation. Rule: title: Suspicious Msiexec Execute Arbitrary DLL id: 6f4191bb-912b-48a8-9ce7-682769541e6d status: test description: 'Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi) ' references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md - https://twitter.com/_st0pp3r_/status/1583914515996897281 author: frack113 date: 2022-01-16 modified: 2026-01-09 tags: - attack.stealth - attack.t1218.007 logsource: category: process_creation product: windows detection: selection: Image|endswith: \msiexec.exe CommandLine|contains|windash: ' /Y' filter_main_legit_path: CommandLine|contains: - \MsiExec.exe" /Y "C:\Program Files\ - \MsiExec.exe" /Y "C:\Program Files (x86)\ - \MsiExec.exe" /Y "C:\Windows\System32\ - \MsiExec.exe" /Y "C:\Windows\SysWOW64\ condition: selection and not 1 of filter_main_* falsepositives: - Legitimate script level: medium
Near-miss passage: Sigma rule: Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root,. Logsource: linux / process_creation. Rule: title: Linux Doas Tool Execution id: 067d8238-7127-451c-a9ec-fa78045b618b status: stable description: Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does. references: - https://research.splunk.com/endpoint/linux_doas_tool_execution/ - https://www.makeuseof.com/how-to-install-and-use-doas/ author: Sittikorn S, Teoderick Contreras date: 2022-01-20 tags: - attack.privilege-escalation - attack.t1548 logsource: product: linux category: process_creation detection: selection: Image|endswith: /doas condition: selection falsepositives: - Unlikely level: low
Query: alert when Adversaries may abuse msiexec.exe to proxy the execution of malicious payloads
Matching passage: Sigma rule: Adversaries may abuse msiexec.exe to proxy the execution of malicious payloads. Logsource: windows / process_creation. Rule: title: Suspicious MsiExec Embedding Parent id: 4a2a2c3e-209f-4d01-b513-4155a540b469 status: test description: Adversaries may abuse msiexec.exe to proxy the execution of malicious payloads references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md author: frack113 date: 2022-04-16 modified: 2022-07-14 tags: - attack.stealth - attack.t1218.007 logsource: product: windows category: process_creation detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe - \cmd.exe ParentCommandLine|contains|all: - MsiExec.exe - '-Embedding ' filter_splunk_ufw: Image|endswith: :\Windows\System32\cmd.exe CommandLine|contains: C:\Program Files\SplunkUniversalForwarder\bin\ filter_vs: - CommandLine|contains: \DismFoDInstall.cmd - ParentCommandLine|contains|all: - '\MsiExec.exe -Embedding ' - Global\MSI0000 condition: selection and not 1 of filter* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngro. Logsource: windows / network_connection. Rule: title: Communication To Ngrok Tunneling Service Initiated id: 1d08ac94-400d-4469-a82f-daee9a908849 related: - id: 18249279-932f-45e2-b37a-8925f2597670 type: similar status: test description: 'Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download. ' references: - https://twitter.com/hakluke/status/1587733971814977537/photo/1 - https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent author: Florian Roth (Nextron Systems) date: 2022-11-03 modified: 2024-02-02 tags: - attack.exfiltration - attack.command-and-control - attack.t1567 - attack.t1568.002 - attack.t1572 - attack.t1090 - attack.t1102 - attack.s0508 logsource: category: network_connection product: windows detection: selection: DestinationHostname|contains: - tunnel.us.ngrok.com - tunnel.eu.ngrok.com - tunnel.ap.ngrok.com - tunnel.au.ngrok.com - tunnel.sa.ngrok.com - tunnel.jp.ngrok.com - tunnel.in.ngrok.com condition: selection falsepositives: - Legitimate use of the ngrok service. level: high
Query: ATT&CK technique for File/Path Exclusions
Matching passage: T1564.012 File/Path Exclusions. Tactics: stealth. Description: Adversaries may attempt to hide their file-based artifacts by writing them to specific folders or file names excluded from antivirus (AV) scanning and other defensive capabilities. AV and other file-based scanners often include exclusions to optimize performance as well as ease installation and legitimate use of applications. These exclusions may be contextual (e.g., scans are only initiated in response to specific triggering events/alerts), but are also often hardcoded strings referencing specific folders and/or files assumed to be trusted and legitimate.(Citation: Microsoft File Folder Exclusions) Adversaries may abuse these exclusions to hide their file-based artifacts. For example, rather than tampering with tool settings to add a new exclusion (i.e., [Disable or Modify Tools](https://attack.mitre.org/techniques/T1685)), adversaries may drop their file-based payloads in default or otherwise well-known exclusions. Adversaries may also use [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) and other [Discovery](https://attack.mitre.org/tactics/TA0007)/[Reconnaissance](https://attack.mitre.org/tactics/TA0043) activities to both discover and verify existing exclusions in a victim environment.
Near-miss passage: T1564.007 VBA Stomping. Tactics: stealth. Description: Adversaries may hide malicious Visual Basic for Applications (VBA) payloads embedded within MS Office documents by replacing the VBA source code with benign data.(Citation: FireEye VBA stomp Feb 2020) MS Office documents with embedded VBA content store source code inside of module streams. Each module stream has a <code>PerformanceCache</code> that stores a separate compiled version of the VBA source code known as p-code. The p-code is executed when the MS Office version specified in the <code>_VBA_PROJECT</code> stream (which contains the version-dependent description of the VBA project) matches the version of the host MS Office application.(Citation: Evil Clippy May 2019)(Citation: Microsoft _VBA_PROJECT Stream) An adversary may hide malicious VBA code by overwriting the VBA source code location with zero’s, benign code, or random bytes while leaving the previously compiled malicious p-code. Tools that scan for malicious VBA source code may be bypassed as the unwanted code is hidden in the compiled p-code. If the VBA source code is removed, some tools might even think that there are no macros present. If there is a version match between the <code>_VBA_PROJECT</code> stream and host MS Office application, the p-code will be executed, otherwise the benign VBA source code will be decompressed and recompiled to p-code, thus removing malicious p-code and potentially bypassing dynamic analysis.(Citation: Walmart Roberts Oct 2018)(Citation: FireEye VBA stomp Feb 2020)(Citation: pcodedmp Bontchev)
Query: risk of Directory traversal vulnerability in widgets/logs.php in BlackCat CMS before 1.1.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the dl parameter.
Matching passage: CVE-2015-5079. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in widgets/logs.php in BlackCat CMS before 1.1.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the dl parameter.
Near-miss passage: CVE-2015-2966. CWE: CWE-22. CVSS: 6.400000095367432. Directory traversal vulnerability in the Droidware UK Explorer+ File Manager application before 2.3.3 for Android allows remote attackers to write to arbitrary files via unspecified vectors.
Query: vulnerability: Buffer overflow in the XComms process in SAP Afaria 7.00.6620.2 SP5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted re
Matching passage: CVE-2015-4092. CWE: CWE-119. CVSS: 7.5. Buffer overflow in the XComms process in SAP Afaria 7.00.6620.2 SP5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request, aka SAP Security Note 2153690.
Near-miss passage: CVE-2015-3815. CWE: CWE-119. CVSS: 5.0. The detect_version function in wiretap/logcat.c in the Android Logcat file parser in Wireshark 1.12.x before 1.12.5 does not check the length of the payload, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a packet with a crafted payload, as demonstrated by a length of zero, a different vulnerability than CVE-2015-3906.
Query: patch priority for CVE-2015-2643
Matching passage: CVE-2015-2643. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer.
Near-miss passage: CVE-2015-2903. CWE: UNKNOWN. CVSS: 6.900000095367432. The CWSAPI SOAP service in HP ArcSight SmartConnectors before 7.1.6 has a hardcoded password, which makes it easier for remote attackers to obtain administrative access by leveraging knowledge of this password.
Query: describe CVE-2015-3123
Matching passage: CVE-2015-3123. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3117, CVE-2015-3130, CVE-2015-3133, CVE-2015-3134, and CVE-2015-4431.
Near-miss passage: CVE-2015-3734. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Query: CVE similar to CVE-2015-4547
Matching passage: CVE-2015-4547. CWE: CWE-200. CVSS: 4.0. EMC RSA Web Threat Detection before 5.1 SP1 stores a cleartext AnnoDB password in a configuration file, which allows remote authenticated users to obtain sensitive information by reading this file.
Near-miss passage: CVE-2015-7996. CWE: CWE-200. CVSS: 5.0. The Nitro API in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 133.9, 10.5 before Build 58.11, and 10.5.e before Build 56.1505.e on NetScaler Service Delivery Appliance Service VM (SVM) devices allow attackers to obtain credentials via the browser cache.
Query: exploit Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.1 allows remote attackers to execute arbitrary code as root 
Matching passage: CVE-2015-8236. CWE: CWE-264. CVSS: 10.0. Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.1 allows remote attackers to execute arbitrary code as root by leveraging management-plane access, aka Bug 138716.
Near-miss passage: CVE-2015-9012. CWE: CWE-264. CVSS: 9.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384691.
Query: CVE similar to CVE-2015-3723
Matching passage: CVE-2015-3723. CWE: CWE-119. CVSS: 6.800000190734863. CoreGraphics in Apple iOS before 8.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted ICC profile in a PDF document, a different vulnerability than CVE-2015-3724.
Near-miss passage: CVE-2015-2869. CWE: CWE-119. CVSS: 5.0. The FileInfo plugin before 2.22 for Ghisler Total Commander allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via (1) a large Size value in the Archive Member Header of a COFF Archive Library file, (2) a large Number Of Symbols value in the 1st Linker Member of a COFF Archive Library file, (3) a large Resource Table Count value in the LE Header of a Linear Executable file, or (4) a large value in a certain Object field in a Resource Table Entry in a Linear Executable file.